1. Risk Management Introduction Generic approach Type of project
The length of the project
Experience of the risk manager
The attitude of senior management
Project versus Risk management
See also The Complete Project Management Package in this series
Client versus contractor
Risk management culture
Limitations
© March Ltd 2004
In general, the principals should apply whether we are building a house extension or a major airport.
The techniques and comments and advice in this training package will try and cover a generic project situation.
Generic approach
In real life the exact approach used will need to be tailored and modified based upon many issues.
If the project is new and innovative the approach is likely to be more rigorous compared to a project which has been repeated many times.
All projects will have risks but the steps taken for their identification, clarification of responses and how they are managed may well vary according to the nature of the project.
The type of project
Even in the latter case Legal and regulatory issues may change.
There will be differences between the rigorous approach of a project lasting only 6 months to one of 5 to 10 years. We will look at this later in terms of planning horizons.
The length of the project
This may allow suitable short cuts once the methodology is understood and many projects have been undertaken.
The experience of the Risk Manager
The former may promote a smoother introduction of the risk management process than the latter.
Are the use of risk management procedures being encouraged by senior managers or will they need persuading of the merits of the RISK MANAGEMENT PROCESS (RMP)?
The attitude of senior management
They have often heard of risk management and may only experience it through reactive crisis management as ‘unforeseen events’ occur.
When people begin project management there first thought is generally the management of a set of activities with the help of a Project Plan, often represented by a Gantt chart.
Project versus risk management
Some of these events may just be considered as unlucky.
Certain aspects of ‘project management’ are covered in more detail in another training package in this series called ‘The Complete Project Management Package’ which also includes
We hope that once you have completed this training package you will come to agree that risk management is an integral part of the overall process of Project Management.
Others may see risk management as an extra or ‘add on’ to the ‘normal’ project management process.
examples and templates.
Again, we will look at this in more detail later.
As the client trying to manage the project on behalf of a customer you will perceive the risk within the project differently to the contractor carrying out specific parts of the work.
Client versus contractor
Risk management culture
What I have tried to do is introduce some of the basics of the Risk Management Process with comments and advice from the perspective of a Project Manager.
I am not a statistician.
The aim of this training package is to give a good grounding and basic idea of the Risk Management Process (RMP).
You should still read many more detailed and specialised books on this subject to improve and hone the
Hopefully, this will give you a very good understanding.
Where certain principles require a clear understanding of the underlying statistical calculations I have tried to provide this.
Risk Management Process even further.
We hope this package will help you to tailor those training needs and convince all stakeholders within the company (and externally) of the merits of a Risk Management Process.
In addition, the Risk Management Process will only work if all those who have a vested interest in it are convinced of its benefits.
Limitations
The aim of this package is to give the user a ‘basic’ understanding of risk management.
It is not a definitive guide into the statistical approaches used.
There is much, much more to the statistical side of risk management than can be incorporated in this package.
In addition, any software referred to is for illustration purposes and does not imply preference or recommendation.
No detail will be entered into in the use of individual software.
As such, this package may form a basis for further understanding when consulting other information discussing the statistical background
and methods in greater depth or referring to risk management in specific areas.
Exactly how the information is applied to a particular project will be very much down to the individual.
It will be no substitute for the presence of a suitable ‘risk analyst’ skilled in statistics and the risk management process.
Information in this package is provided for general guidance and advice only and March Ltd can not be held responsible for the specific actions of individuals.
Note:
Only the purchaser may modify and use this package. The owner of this training package can use it for personal training or to train others within his own organisation and project team.
This training package can be used by itself. It does not, in itself, provide examples from a specific project but does give guidance where applicable.
The key aim of this training package is to provide a broad useful approach to Project Risk Management.
The primary aim of this package is to offer generic Project Risk Management skills.
There will be as many projects as there are stars in the sky and to try to tailor a training package such as this would be impossible.
Many books exist that specialise in Project Risk Management in particular industry sectors.
The Project Manager must comply with all local (and relevant international) legal, regulatory and statutory requirements as well as adhering to codes of practice and good working practices.
If you work in a specific industry you should also try to read Project Risk Management books specific to your area where specific examples will be of help.
Many workers and managers are experts in their own area and may wish to have a general guidance that they are able to adapt.
In some cases, individuals may wish to train others using this package. Hopefully, this package more than meets this aim.

2. Risk Management What is risk? Uncertainty Risk versus issue
Tight objectives
Plan
All projects involve RISK
RISK versus REWARD (benefits)
Margins and contingency
Will a project succeed?
Is the end date feasible?
Milestones deliverable
Individual tasks correct
6 basic questions requiring an answer
opportunities
© March Ltd 2004
Uncertainty
RISK represents UNCERTAINTY. The more uncertainty there is in an activity the greater the difficult in managing towards a successful completion.
It is fair to say that anything that can AFFECT the PERFORMANCE of the product would constitute a RISK.
However, this event would need to be UNCERTAIN and have a SIGNIFICANT impact.
Naturally, if the affect was insignificant the risk could be largely ignored and if certain the event would
constitute part of the main plan and not a contingency (see later for proactive planning and reactive planning with contingency plans)
When something goes wrong and there is no ‘plan’ in place to tackle it you are into CRISIS management. It’s possible that you may get away with
this on occasion but regular crisis management will cause a lot of problems… as well as draining morale. If effective risk management fails it is likely that crisis
management will come to the fore.
Risk versus issue
There is often confusion between ‘risk’ and ‘issue’.
Risk: A potential event that may have a detrimental affect on time, cost, quality and deliverables.
Issue: This is an unpredicted event that requires a decision otherwise a negative affect on the project may result.
Tight objectives
If the project sets COST and TIME targets are very tight there will naturally be more risk in achieving them.
Conversely, if they are set too loosely this encourages additional risk in terms of potentially poor control.
Clearly, there needs to be mechanisms for setting the various targets with an appropriate level of risk.
This training package will explore ways that may help.
This really indicates that the management of risk is closely linked to target setting and the project’s objectives.
Plan
Risk can affect many aspects of the plan. It is usually a matter of detail as to what becomes routine project management (low risk) and what could be classed as risk management (high risk).
ALL PROJECTS INVOLVE RISK.
Risk is a natural part of any project plan.
There is a natural balance of RISK versus REWARD (benefits). Naturally, the more risk a company takes the higher the reward expected.
However, this is not a licence to carry as much risk as possible in order to gain a high profit or other benefit.
The company that understands the risks will be able to manage them better.
This will mean they will be able to run with a plan containing less contingency and tighter margins. This will be very important in bid situations
when putting together a quote to carry out a project. We will cover these issues in greater detail later.
A large part of risk management within a project is common sense but many other risks exist that require clear systems and methods to identify and manage them.
It really depends on the potential impact of the risk.
There are a lot of day to day activities which are managed within this ‘common sense’ approach.
Will a project succeed?
People wish to know whether the project will succeed.
Are the completion dates realistic?
Are individual milestones deliverable?
Are the individual tasks that make up the project plan correct in terms of their duration and costs?
In general, people are concerned about the overall costs, completion dates and trying to predict what might happen in the future.
Anyway, why should you get the contract to manage a particular project? Are you the cheapest? Do you have the right expertise to do the job?
Basically, there will be many other potential contractors who could get the job.
You will get the contract because you put in the lowest tender, right? Perhaps, but if you go too low then you may end up doing the project at a loss.
What if you say you can finish 2 months earlier than another contractor? If you are unable to deliver you will have to pay penalties.
There is a risk involved in putting in a bid and it would be useful to know how best to assess it.
Also, your project will not be carried out in isolation. The company that you work for will have other projects to manage. There will be managers that have to predict, for the next financial year, what resource they will use and hence put forward budgets for approval.
The better you can understand the elements leading to the construction of the project plan then the more accurate budgets will be.
Everyone wants something cheap, of extremely high quality and they want it yesterday.
This pressure tends to mean project plans are put together quickly.
Clearly, this will depend upon the size of the project. It is not possible to wait an excessive time until the ‘project plan’ is perfect because it will never happen.
The experience of the project team will determine how long it takes to put together the plan.
The project plan won’t be perfect but at least the project will get underway.
Once the project starts issues will materialise.
Hopefully, the project plan (schedule) that you put together will have benefited from good project risk assessment.
One thing you can be sure of is:
ALL RISK WILL NOT HAVE BEEN ELIMINATED.
6 basic questions requiring an answer
Who?
Why?
What?
How?
Resource?
When?
We will look at these a little more in the next slide.
Opportunities
Risk analysis may show an area where the project could benefit.
For example:
If your project relies on weather windows these are notoriously unpredictable, even if years of data exists on which to base opinion.
In a negative view on what may happen the plan may allow for certain events to occur in, say, November. If there is a really good weather
Window in October, such that the project can be brought forward, the project manager may be caught out if he is unable to bring key activities
forward to take advantage of this OPPORTUNITY.
In terms of Project Team motivation a Risk Management Process that just concentrates on negatives can lead to poor team performance.
It is therefore important to actively search for risk opportunities.
The aim of the Risk Management Process is to ‘improve the performance of the project by suitable identification, assessment and management of risk’.

3. 6 questions to define the project
Risk Management
6 questions to define the project
Who?
Why?
What?
How?
Resource?
When?
© March Ltd 2004
Within this training package we will refer to the Project Life Cycle (PLC), the Project Management plan and its phases.
These phases will define the ‘backbone’ of the project.
Within each of these we will need to consider the 6 questions to varying degrees.
Who?
Persons who are involved in the project or who may be affected by it will be the STAKEHOLDERS.
Initially, these will be those persons starting up the project.
They will include the project team and other internal personnel.
There will be external personnel e.g. contractors, regulatory bodies, consultants,
legal advisors add others.
Why?
It addresses the point of the project.
These could be many and varied.
One reason will obviously be:
Profit
Others may include:
To offset a competitor’s position
To comply with a regulatory need
In broader terms these are often referred to as the MOTIVES for the project.
What?
This could be anything from a building or service to a report.
How?
Depending on how weapproach the project will influence the ‘resource’, and ‘when’ in terms of the plan.
Resource?
Resource could be both internal and external.
When?
Usually seen as a Gantt chart representing the tasks and will indicate the completion date.
When considering these 6 questions in the various phases of the project we may need to revisit some earlier assumptions.
For example, HOW we decide to carry out a project may well influence a revisit to the WHAT in terms of design.
RISK will be evident in all of these considerations.
Identification and management of RISK will be covered in more detail later.

4. Risk Management The key areas of concern. COST SCHEDULE REVENUE
© March Ltd 2004
All risks within a project will impact on one of cost, schedule timing or revenue.
The problem with any project is the status quo. The project team may tend to consider the plan rather simplistically in that they will know where the risks exist and approach allocation of resource on this basis.
Another problem is the detail of the project plans that will be generated. These will start from the top down. How far do we go down and to what level of detail do we go? The key aspect here is what can we manage? Also, consider horizon planning later.
If you can’t manage it don’t do it. Also, to generate this amount of detail costs TIME.
By utilising simple risk assessment techniques we will gain a better idea of where the main risk areas are and hence where to put the resource.

5. Why carry out Risk Assessment?
Risk Management
Why carry out Risk Assessment?
Is the project too risky?
Threat intensity?
Improve decision making
Clarification of terms
Targets
Expected values
Commitments
Documentation
RISK
COST
© March Ltd 2004
Is the project too risky?
This is a basic question that will not only be asked by the project manager but by many other stakeholders.
How will we be able to gauge the risk in a project without some form of ‘formal’ assessment.
Banks and others (e.g. environmental bodies) may insist on a RISK MANAGEMENT PROCESS before releasing funds or giving the green light to a project.
However, while this is an important aspect there will be many other benefits to carrying out a RISK MANAGEMENT PROCESS.
The style and depth of the RISK MANAGEMENT PROCESS will vary depending upon the project.
To fully explore the benefits of a RISK MANAGEMENT PROCESS it should be considered as an integral part of the project management process and not
just as an ‘add on’ or some sort of afterthought.
Threat intensity
The biggest worry for any project is over runs and the ensuing costs.
RISK and COST are inextricably linked.
For any given project that has a given level of risk, to reduce the risk further we will have to increase the cost.
On the other hand, for a project with a given level of cost which we wish to reduce we will have to increase the risk.
In summary:
RISK down, COST up
COST down, RISK up.
In terms of trying to reduce risk and cost we have to consider a systematic approach.
The aim is to spend money at the front end in identifying risks properly.
These risks can then either be managed well within the plan or suitable contingency plans can be put in place.
This will save future more excessive costs should the risk materialise unexpectedly later in the project.
Identifying these ‘opportunities’ is one of the key points of a formal RISK MANAGEMENT PROCESS.
It is quite likely that without a formal process many of these RISK opportunities will remain masked.
Obviously, there will be times when identified RISK does not come to pass and in hindsight the money invested in this risk will seem ‘wasted’.
It will be difficult to persuade people that this money was not ‘wasted’ but indeed well spent. Sometimes identified risks only fail to occur due
to good fortune and not due to good management. This often applies to projects where the weather is a key factor.
In addition, looking at this from the perspective of the Project Manager, what would have happened had the RISK not been identified?
Well, senior managers may well have considered that the good fortune seen in the project was ‘very lucky’ and that the Project Manager had handled the project badly.
This would tend to ignore the rest of the project which has been managed well.
There is a balance in the amount of money spent in looking for and managing risk.
To increase costs in order to seek the Holy Grail of identifying and managing all risks is not practical.
There is a trade off.
How RISK is perceived will depend on the number and size of the projects within the organisation.
If there are a lot of small projects then one which is HIGH RISK but lower cost may be looked upon much more favourably than a company with only one or two major projects.
Improve decision making
The RISK MANAGEMENT PROCESS allows a better grasp of the risks involved and a basis on which to make decisions that may lead to projects accepting a higher risk.
If the risks in a particular area are too high for one company to bear then joint ventures may well result.
However, the taking of high risks (gambles) without the appropriate data to support them may well prove very foolhardy.
The encouragement of the organisation to look for risk opportunities is a good thing and helps to reduce a fear of risk.
A good RISK MANAGEMENT PROCESS will not eliminate the need for REACTIVE management during the project but it will reduce it to an acceptable level.
Clarification of terms
Understanding the significance of these terms and how they are derived is central to the RISK MANAGEMENT PROCESS.
Targets
The expected cost of a project may be £200,000. However, the project manager may set a ‘target’ of £180,000 and retain £20,000 for ‘contingency’.
Expected values
The ‘expected cost’ is precisely that. It is the cost of the project if all goes to plan. This will include all identified risks which we expect to occur and thus have been
allowed for within the management of the plan.
Commitments
The sum of the ‘expected cost’ and the ‘contingency’ is a measure of the ‘commitment’ of senior managers to the project.
These are discussed in more detail on a later slide.
Documentation
Documenting the RISK MANAGEMENT PROCESS will help to clarify any uncertainties and remove ambiguities.
This is very useful between organisation departments and for communicating with external resource such as contractors.
Helps to make all of the information gathered in the RISK MANAGEMENT PROCESS visible to all parties.
Documentation can be a very valuable training tool when there is staff turn over and they need to get up to speed in a project.
Supports the rationale for the decision making process. This is a valuable tool for when things go awry to see what decisions were made.
As well as a training tool it can be a source of very valuable information for future projects. This can be a positive commercial advantage for companies. Especially those carrying out projects where similar experience already exists.
The RISK MANAGEMENT PROCESS helps organisations appreciate the type and quality of data to collect now and for the good of future projects.

6. Risk Management What should risk analysis provide?
Time - must leave time for corrective action
Priorities - limited resource will dictate
Aggregation - allows overall summary of individual risks
Decision making - better informed
Realistic attitude to the project - objective
© March Ltd 2004
Time
There must be time for corrective action. This will only happen if risks are identified along with responses.
These can be either proactive (actions form part of the plan) or reactive (actions form part of the contingency plans which have a trigger).
These are discussed in more detail later.
Priorities
Once risks have been identified we will need to categorise them in terms of impact and likelihood.
The management of the risks may be limited by the available resource.
Aggregation
One we have assessed the impact on an individual risk (or group of risks) we will need to combine or aggregate their affects.
This will need to be done on an interim and summary basis to see the affect on the overall project.
Decision making
Understanding the risks involved in a project will improve the decision making process.
Realism
Identifying the risks and defining responses accordingly will aid in the setting of the project objectives.

7. Risk Management 3 Ways to view risk management PM RM
Risk management supports Project Management
Risk Management is the reason for Project Management
Risk Management permeates all of Project Management.
© March Ltd 2004
Risk in project management can be viewed in several ways.
First
Risk management is the reason for project management. In any project there will be activities.
Those activities will finish at a specific time (we hope). However, we know that most (more than we wish) activities don’t finish on time.
After the event we know the delay. The aim is to try and assess the risk prior to the activity and hence better manage any potential delays in the project.
In this system risk takes a much higher profile. The project management is risk driven.
Second
This is more realistic. Risk assessment, in some form, is needed throughout the project management. In practice, the project team may not have the necessary experience and external expertise is often needed. Here risk management is better integrated.
Third
Risk can be seen as a section of the overall project management activity. Here the risk management supports the project management.
This can result in the risk management becoming distant and fragmented.
On the one hand the Risk Management Process may be carried out by one of the Project Team. Depending on the size of the project and the expertise of the
Individual. This may or may not be appropriate.
The Risk Management Process may be organised by a separate team.
It will be important that the Risk Management Process is not seen as an addition to the Project Management process which then becomes isolated.

8. General comments on risk assessment
Risk Management
General comments on risk assessment
Broad range of risks - by impact and likelihood
Could be a simple matter of assigning resource
May require formal risk assessment:
Classify as high, medium and low
Use of mathematical models
How much effort do we use?
Minimum needed to give a meaningful result
© March Ltd 2004
Assess the risks
This will be covered in more detail later but some of the
Remember that risks can be assessed at differing levels:
How a risk is assessed (e.g. high, medium or low) may indicate who will need to be consulted in terms of any decision making. Remember, HIGH risk does not necessarily equate with HIGH impact upon the project. Conversely, a LOW risk activity may be extremely unlikely to happen but if it does it could be devastating for the project and hence have a HIGH impact.
The range of risk impact will reflect the way resource is allocated. What is considered a fairly trivial risk (low impact) will be handled by the project team.
A major risk may need a more formal approach in assessing the impact requiring mathematical techniques. This will employ a more formal basis.
At some point resource will need to be appointed to minimising the risk. The contingency plan will be instigated when the trigger is activated. The trick is trying to balance the resource allocated so that the project provides the minimum required.

9. Risk Management Accountability
Accountability of risks cannot be shared
Who will be accountable?
One of the key aspects of project management is that ACCOUNTABILITY can not be delegated, whereas, RESPONSIBILITY can be delegated.
© March Ltd 2004
It is very important to make sure that when the plan to manage risk for a particular task is agreed that someone is assigned to make it happen.
That person will be ACCOUNTABLE for making it happen. No one else will be responsible for this. If the responsibility for such a task were passed on it could lead to passing the buck when things are getting tough.
The next question is where should this accountability lie.
The project team?
The steering committee?
The board?
The contractor?
The customer (actual user)?
For most projects the latter is unlikely. If the project team are accountable for all the identified risk areas this may lead to certain disadvantages.
The cost is very likely to be higher as extra resource will be required.
For certain risks the client or the contractor may well be in a better position to manage it and thus should be accountable.
Like all aspects of control all areas of ACCOUNTABILITY must be agreed up front. This does not necessarily mean that person joins the project team just that they will need to have their progress reported at regular meetings.
These aspects are treated in much more detail later.

10. Risk Management Stakeholders Identify those whose views matter
Consider both customer and supplier views
Think about the priorities of the users
© March Ltd 2004
Identify the stakeholders involved
How the risk is managed will depend upon the potential affect on the project. Who will make the final decision? A risk may need to be presented to the appropriate stakeholder. The project team will have to be sure who that is. Is it the steering committee, the board or will it be the direct customer?
Other stakeholders whose opinion may need to be considered are legal departments, health and safety, regulatory and environmental bodies etc
Typically the steering committee will be focussed on the budget and any deviation from it.
The over riding concern for the customer will be:
When do I get it?
How well does it work?
How well made is it and will it last?
The customer could either be direct (client) or indirect (actual customer that uses the product).
In other words… time, performance and quality.
We have to remember the difference between ‘risk’ and ‘issue’ identified earlier:
Risk: A potential event that may have a detrimental affect on time, cost, quality and deliverables.
Issue: This is an unpredicted event that requires a decision otherwise a negative affect on the project may result.
In effect, risks are identified in advance and should thus be taken into account in the project plan, whilst issues may arise unexpectedly.
Identifying risk areas can present some problems. For instance, if the system is over zealous too many minor risks (in terms of potential impact) could be raised. This would become an irritation to a steering committee. A system generating too many minor risk areas could end up masking more significant ones owing to a lack of focus and poor technique.