© Risk Decisions, 2009 Getting a Return On Investment from Risk Management Val Jonas CEO, Risk Decisions Group

© Risk Decisions, 2009 Agenda  Understanding uncertainty and risk  Impact on ROI  A recent example & conclusion

© Risk Decisions, 2009 Part 1 Understanding uncertainty and risk

© Risk Decisions, 2009 Uncertainty & Risk Risk analysis & Tornado results { 3 point estimates (Max, Min, Most likely) Identified risks (probability & Impact)

© Risk Decisions, 2009 Budget Uncertainty Analysis Cost (£k) Likelihood 0 20% 49% 60% 80% 100% £45,000£50,000 £55,000£60,000£65,000£70,000£75,000 £80,000 £85,000£90,000 50% confidence (Excluding Risk Events)

© Risk Decisions, 2009 Cost (£k) Baseline (incl. Estimating Error) Exposure Budget Uncertainty Analysis Risk Appetite (Excluding Risk Events) ‘Long’ right hand tail may indicate risk events (which should be managed in risk register) Target Maximum Aggressive target Non-Aggressive target Minimum Likely

© Risk Decisions, 2009 Provision for known risks Provision for Known Risks Exposure Budget Risk Appetite Maximum Minimum Pay attention to ‘Long’ right hand tail (must identify mitigation actions)

© Risk Decisions, 2009 Managing uncertainty and risk  Manage cost and schedule over-runs Estimating accuracy Resource management Project & change control  Manage known threats Proactive risk mitigation actions Treat, transfer, tolerate, terminate Budget and authority in place  Exploit opportunities

© Risk Decisions, 2009 Focus on ‘Left Shift’ Baseline Target Reserve Contracted Exposure

© Risk Decisions, 2009 How to convince senior management?  Limited ability to interpret risk analysis results  Confusion over meaning of Risk Appetite  Consider risk budget spent as ‘wasted’  Focussed on business objectives (and the bottom line) … We need to find new ways of getting information across to managers

© Risk Decisions, 2009 Part 2 Impact on Return on Investment

© Risk Decisions, 2009 Achieving return  Contracting routes  Fixed price (vs. cost plus)  Fixed base + performance payments  Bonuses & penalties for on-time or late delivery  Pain / gain-share  Business case  Need to understand sensitivity to uncertainty and risk

© Risk Decisions, 2009 Modelling performance Outcomes Inputs

© Risk Decisions, 2009 What-if scenarios on schedule  Analyse the schedule  Impacts of schedule uncertainty on:  1a. Performance payments  1b. Penalty and bonus payments  1c. Costs of the ‘Marching Army’  Contain the impact of schedule slippage

© Risk Decisions, 2009 Analysing the schedule BaselineSchedule Reserve Exposure Maximum Minimum Target Risk Appetite Contracted Aggressive target Non-Aggressive target

© Risk Decisions, a. Impact on performance payments Expected Reduction of 15% ROI Zero performance payment for late milestones

© Risk Decisions, b. Added impact of penalties/bonuses Negative expected ROI (down 21%) Daily penalties / bonuses for late / early delivery

© Risk Decisions, c. Added impact of the ‘marching army’ No chance of positive ROI (down 23%) Assumes no opportunity for savings if finished early

© Risk Decisions, 2009 Focus on ‘Left Shift’ Contain schedule slip

© Risk Decisions, 2009 Managing the uncertainty What-if’s based on containing the schedule slip: (Do we really want this contract?)

© Risk Decisions, 2009 What-if scenarios on risk  2a. The cost of risks materialising  2b. The post mitigation position  2b. Pain/Gain-share contracting

© Risk Decisions, 2009 Back to base case model Outcomes Inputs

© Risk Decisions, a. Impact of risks materialising Risks impact (down 12%) Assumes no risk mitigation

© Risk Decisions, 2009 Focus on ‘Left Shift’ Manage the risks

© Risk Decisions, b. Impact of risks (post mitigation) Mitigaton saves 2% ROI

© Risk Decisions, 2009 Risk sharing scenario 15% confidence 65% confidence

© Risk Decisions, c. Pain/Gainshare contracting Back to 15% ROI Customer share of the risk payment

© Risk Decisions, 2009 More what-ifs …

© Risk Decisions, 2009 Part 3 Conclusion

© Risk Decisions, 2009 but… …can we afford not to manage risk? Not so much a question of… what is the value of risk management?

© Risk Decisions, 2009 ‘Getting a Return on Investment from Risk Management’ White paper: Val Jonas, CEO Risk Decisions Group