Defence Project Management 2007 Learning to love project risk management Dr Andrew Tyler DG Ships, DE&S

Defence projects – more risky than most Military superiority –Complexity risk –Technology maturity risk Complex procurement strategies (multi-party, multi- national etc.) Complex market context Politics

Defence project risk management Project management & risk management are synonymous –The risk - to what….? –Risk, issues, and uncertainty –Risk perception –Expressing risks –Risk management actions –Quantifying risks –Linking risks and project forecasting

The risk to what……? The risk to what? –Business objectives, safety, financial targets etc. etc. Express risk impact in the right currency –£££s, time delay, lost time accidents etc. etc.

Risk, issues, and uncertainty “….as we know, there are known unknowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don’t know we don’t know.” Donald Rumsfeld

Identifying a risk A risk is an event or situation with a realistic likelihood of occurring and an unfavourable consequence should it occur – the known unknowns If you don’t know what it is, it’s an uncertainty – the unknown unknowns If it has occurred already, it is an issue – known knowns Risks can be specifically identified and quantified in the appropriate currency

Risk perception Dogs risk management in many fields - especially public perception of risk Less so in project risk management but; High impact, low probability risks (usually dramatic and eye-catching) usually over- stated subjectively and understated quantitatively

Expressing risks Specificity is key; “There is a risk we could lose key staff” Cause-effect-consequence “There is a risk that the hot market for software engineers may result in loss of senior software designers leading to delay in completing our system design review on time”

Risk management actions Specificity is key –Assigned to a single responsible individual –Specific action(s) achievable within a realistic period (6-12months) “HR manager to implement golden handcuffs scheme within 3 months” Can sometimes be a good way of testing risk expression

Quantifying risks A very tricky area – but essential Computer models can be very misleading; –Statistical approaches often suppress high impact, low probability risks –Risk envelope often too tight at outset – risky projects with only 5-10% difference between 10% and 90% probabilities of out-turn –Risk inter-dependencies often not well handled –Risks to schedule are almost always risks to cost – easy to count twice –‘Black box’ nature often leads to mistakes –Ability to run models regularly is essential

Managing the project risks The project team is there for one reason only – to manage risks If it weren’t for the risks, the project team would consist of a contracts officer…..and that’s all What matters is how the risks are identified, quantified and managed The movement in the risk profile is the heartbeat of the project – no movement, no life

Linking risk to project forecasting Project Performance Metric e.g. time, cost Time MOST PROBABLE OPTIMISTIC PESSIMISTIC Project milestone deliveries Early stage risk identification Risk mitigation planning Late emerging risk and mitigation Zero risk Project End Initial Risk Envelope

Evidence of active risk management?

Project re- approval – risks reassessed New risk(s) identified Risk mitigation in place Note risk asymmetry Risk ‘funnel’ reducing

Opportunity management An opportunity; –A situation or circumstance with a realistic likelihood of occurring, and which provides a potential benefit Mature risk management embraces risks and opportunities equally

CVF risk and opportunity management Early introduction of Earned Value Management Discipline of work breakdown structure and single point responsibility established (Cost Account Manager) Every CAM owns quantified risk and opportunity against base cost/time Held in central model - rolled up monthly to provide holistic project performance forecast

Defence project risk touchstones Centralised risk systems with hundreds of risks are unmanageable unless highly federated with single-point-of-accountability Specificity in risk expression and actions Quantification of risk is a minefield – beware! Project forecasts should be moving constantly against the changing risk/opportunity profile Risk and opportunity should be treated as equals In a Department of State, political risks are rarely treated honestly