Risk Analysis & Management

Phases Initial Risk Assessment Risk Analysis Risk Management and Mitigation

Risk Assessment for Initial Business Case Looking at Uncertainty

Why the Initial Risk Assessment is needed To decide whether it is worth proceeding with the project As an input into the Value Management study As an input into the Scenario Analysis As an input into Risk Management As a factor in deciding Project Strategy (inc. Purchasing)

Definitions of Project Risk Narrow Definition Risk is the possibility that project objectives may not be achieved OR Wider Definition Risk is a recognition of the uncertain outcome of any project

Initial Risk Assessment Clarify the project objectives Identify all the possible risks For each risk assess: the probability of occurrence the potential impact on the project if the risk occurs the overall ‘seriousness’ Identify potential ‘show-stoppers’

Project Objectives Risk cannot be assessed unless the project objectives are clear Most projects have a range of objectives The project ‘Sponsor’ needs to identify the main ‘business drivers’ But, each ‘Stakeholder’ will have his/her own priorities for the project A hierarchy of objectives should be agreed

Objectives Hierarchy Business Objectives must be part of the objectives hierarchy Key Objective Prime Objective or Reason Sub- Objective

Identification of Risk Internal Risks Project resources are inadequate External Risks A key supplier goes bankrupt Market collapses Uncertainties Future exchange rates Record risks in a Risk Log

Probability of Occurrence No risk has 100% probability of a particular outcome - if it does it becomes a certainty Suggested range of probabilities: - “Likely” - a probability of 50% or more is high “May happen” - a probability of 25% to 45% is medium “Unlikely” - a probability of 20% or less is low

Impact of Risks The cost of implementing the project will be higher than expected The time taken to implement the project will be longer than expected The required technical or commercial performance (or quality) of the deliverable will not be achieved Impact ratings of ‘High’, ‘Medium’ or ‘Low’ should take account of any planned risk management actions

Seriousness Rating

Check-list: Initial Risk Assessment Have the project objectives been clarified? What are the risks of failing to meet these objectives? What other uncertainties exist? Does the assessment of risk identify any potential ‘show-stoppers’? If so, can anything be done to reduce the risk? Are you convinced that there is an acceptable balance between risk and reward?

Risk and Scenario Analysis Considering Different Project Outcomes

The Risk Management Process Risk Analysis What are the uncertainties, probabilities and impacts? Value Management What are the options? Define preferred option Scenario Analysis What is the range of probable outcomes? Risk Containment How do we control the outcome?

Full Risk Analysis Verify Risk Log Estimate percentage probabilities Score potential impacts Rank seriousness of risks Explore options which will mitigate risks (using Value Management study) Prepare ‘scenarios’ to demonstrate range of possible outcomes for the preferred option

Quantification of Risk Estimate percentage probabilities Score potential impact on scale = lowest impact - perhaps because it will be easy to manage the risk if it occurs 10 = sufficient impact to halt project - and no effective risk management countermeasures are envisaged Multiply percentage times score to give a seriousness rating A seriousness rating above 2.5 could represent an ‘unacceptable’ risk - establish threshold for project

Seriousness Rating = IMPACT PROBABILITY

Full Risk Analysis: Summary The Risk Log should list those events which might affect the outcome of your project The seriousness of each risk is defined as the percentage probability times the impact A numerical threshold of acceptability can then be defined - but a high potential reward would justify a higher threshold The next steps are Scenario Analysis and Risk Management

Scenario Analysis Trying to define the range of possible project outcomes: ‘Pessimistic’ ‘Most Likely’ ‘Optimistic’ This is an alternative the more traditional Sensitivity Analysis

Probability Distribution - Graph 1 Probability Outcome Most Likely Pessimistic Optimistic

Using Scenario Analysis For each area of uncertainty (in the Risk Log), define the ‘pessimistic’, ‘most likely’ and ‘optimistic’ outcomes Record these using a Scenario Template Use these assumptions to prepare three financial scenarios in the Financial Appraisal - ‘pessimistic’, ‘most likely’ and ‘optimistic’ The pessimistic and optimistic scenarios should represent the extreme outcomes which have realistic probability of happening

Risk Management “No project is risk free. Risk can be managed, minimised, shared, transferred or accepted. It must not be ignored.” (Sir Michael Latham, 1994)

Risk Management Review the risk log Prepare contingency or pro-active actions Try to benefit from uncertainties Consider risk transfer mechanisms Allocate responsibility for risk management Monitor progress against the risk log Take decisive action when risks occur

Risk Management Identify Risk Determine appropriate action(s) Contingency: - only invoked when necessary Pro-active: - taken before risk occurs REDUCE OR ELIMINATE ADVERSE IMPACT MAY IMPROVE EXPECTED OUTCOME Accept Risk -no action identified

Risk Transfer Mechanisms One pro-active strategy is to transfer risk to another party - e.g. a supplier or insurance This does not eliminate the risk - it merely shifts the responsibility for that risk “Risk should be borne by the party which is best able to manage it”

Allocate Responsibilities Allocate responsibilities to those best able to handle the risks For example, the Purchasing Manager should handle risks associated with external suppliers Ask managers to look for upside potential as well as avoiding downside risk

Monitor Progress and Take Action A Risk Management Log should identify responsibilities, proposed actions and dates This log should be reviewed regularly as the project progresses If unforeseen problems arise, then immediate action may be needed

Issue Log An optional “action list” based on the Risk Management log Defines who is responsible for any actions not already pre-planned as part of the WBS Links Risk Management Log to the Change Management Log

Risk Management: Summary Try to anticipate all possible risks Plan how do deal with these risks Allocate responsibilities or transfer risk Monitor progress and be prepared for the unexpected Act promptly when risks occur