Risk Management

I think, it is the most arduous topic in PM training is risk management.

While managing a six sigma project in a matrix structured organization, imagine that you are not allowed to utilize some production processes operations at the scheduled time, due to sales department's urgent product request to for a key customer. therefore, you did not achieve to complete the production trial which would give you the best optimum conditions in a DOE. Eventually, you are allowed to realize this DOE after 2 weeks and schedule shifted 2 weeks as it is on the critical path, project end date also need to delayed for 2 weeks. But you prevented this delay with hard work and motivate team to fast track some activities. In the end, you accomplished to deliver the project on time.

In the course of a six sigma project at a bank, one of your best resources is assigned to another project, or promoted as project manager. He was the only responsible regarding insurance data analysis. Therefore, project will be delayed or need to search for a new guy who can replace your best analyst. In 2 weeks you found a replace for him, and convinced top management to assign for the position available on your project, you realized that he is even better analyst than you lost.

Do you think, are you a good PM, in these occasions?

If you do know and practice risk maangement, I am sorry, you are not.

As a project manager you are in charge of thinking of possible risks that project requires, document and prevent them. Moreover, you will have list of possible responses for unavoidable risks. In the end, you will know how much risk you accept and how much you prevented.

As risk management is a very comprehensive topic, I do not go very profound topics, but only give a risk management concept that all project managers should know at least a baseline to their project. Short brief how to manage your risks efficiently. On the other hand, I encourage you to learn more regarding risk management if you are managing big projects.

Opportunities are also Risk

Not only threats but opportunities also classified as risks in the project. Therefore, you need to calculate overall risks substracting threats' impact from opportunities' impact.

Make the Risk List & classify OR

Classify & make the list

Start managing risks listing the risky activities or work packages. Your best tool will be Work Breakdown Structure in this process. Start from there.

Then classify or categorize risks as internal, external, unpredictable.

Keeping this categorization in one column, classify regarding root cause like customer 1, supplier 2, raw material, lack of know-how in the organization, communication problems, remote management, etc.

Then, classify the impact, this risk will impact Cost, schedule, team motivation, scope, which areas will impact it?

Classify if it is insurable? insurable, not insurable.

Classify as opportunity and threat. might prefer just to put a minus sign or plus sign as well as texting opportunity.

In the end you are going to have a risk list pointing out its types and classes regarding different point of views. This is not an easy task. You will need to use some tools like brainstorming, root-cause analisis, interviews, expert judgement, SWOT, QFD etc. Prepare the list with team buy-in and try to convert these meetings and tools to a funny team building activity. Because, it will be difficult to open people and say their opinions and trigger them to use their imagination.

Risk Priority

In order to calculate the risk priority in PMI methodology only impact and probability matrix is used to evaluate the essence of a risk.

IN six sigma, it is a bit different, there is additionally detection rate of possible risk. Because, if you are not able to detect any any prospective risk already occuring, corresponds to additional risk.

I would recommend to create a probaility impact matrix using organizational tools already exist. Most probably, it exists in health and safety departments and they use a scale. If you do not want to lose time dealing with HSE department and telling what you want, just create yours using most common way, using 5 or 10 scale for both probability and impact. If detection also important use the same scale for that as well. In the end you priority order will be calculated using this formula.

Risk priority = P . I OR Risk priority = P . I . D

Where

P is probability of risk occuring

I is impact if risk occurs

D is detection possibility when it occurs

In the end, add 4 more columns to your risk list stating these numbers, P, I, D and Risk priority number.

You can not deal with all risks

that is why, make a shortlist of the risks using risk priority number. The biggest number your most important risk in the project. determine the effort you want to put on risk management and set out a level for risk priority number.

Your shortlist already created and you need to track closely these risks on each team meeting and assign responsible for each risk.

The rest are your wachlist, which you need to watch and be informed but not lose time tracking closely.

Risk priority only shows importance not urgency

You need another assessment for urgency. Because, RPN does not show urgency, but only a scale for importance and priority.

go and add another column to your list. Name it as urgency and take action for urgent list as soon as possible.

Heretofore, you did well, if you really establish this table. Now, if you want to go deeper and calculate expected value effect you may use these tools. If you do want to control risks with this table and not to complicate much, then skip this part and go on reading from risk responses and mitigations.

Risk Value Calculation

To calculate risks you may use many tools. I will tell some of them here.

Expected monetary Value (EMV) Or Decision trees

Is the most common and basic tool to expect risk quantitatively.

It is similar to risk priority number but this time using real values:

EMV = P . I

where P is probability in percentage and I is impact in $, £, €, ₺ or whatever.

For instance, 20% probable riskfor supplier transportation fails which lead us to lose € 100,000 expected monetary value of risk is - € 20,000.

Do not forget sign because, the EMV of opportunities will be signed with + and in the end you need to sum all risks using minus for threats and + for opportunities.

For decision trees same calculation is made writing down possible outcome of decisions.

Monte-Carlo Analysis Or other simulations

If you know the risk probability its impact and standard deviation for the risk, you might use Monte-Carlo analysis or other simulation tecniques.

Of course you need a computer for simulation. fundamentally simulations make conclusions depending on random data created by the simulation owner. As an outcome you can have the probabnility of finishing on time, in budget etc.

Risk Responses

You have your shortlist risk list, categories, classes and risk priority. If you perform EMV or monte-carlo you also have possible impact values of the corresponding risk. Now, it is time to mitigate or remove threats and assure or promote opportunities.

Threat Responses

Avoid

cut off the work package or activity that causes risk.

Mitigate

reduce the probability or impact of risk

Transfer

give the responsibility of risk to another party, outsource work package activity or insurance aggreements.

Opportunity Responses

Exploit (X Avoid)

add new work package or activity to the scope to ensure opportunity

Enhance (X mitigate )

increase possibility of occuring an opportunity

All Risks

If non of the above responses are available or appropriate then you might need to accept it.

"what can I do sometimes? " is the brief for acceptance of risks. If you accept risk, it is better to communicate it and all stakeholders are aware of taking this risk. Create a seperate table for accepted risk and inform everybody. For this kind of risk better directly prepare contingency plans if the RPN is big enough.

Efforts put in risk management must be rentable. Do not track risks that probability and impact thus RPN is very low.

Good risk management and tracking will lead 90% prevention from risks. However, for the rest you need contingency plans. Do not say, "if it occurs we will think of and find a solution. ". Remember the example when I start this page on the top of the page, why they re not good PM's because, they do not have not only risk management plan but also contingency plans.

Prepare contingency plan for each risk at your shortlist. Start from top RPN. This is not the funniest part of project management, therefore you need team and fate of union in the team, you will be bored together. Use old project documents and contingency plans if exists in organization or google a bit.

In the end, you are prepared to follow risks. From now in project execution, put risk table on the table at each team meeting, and learn if there is any change in probability or impact. Be aware what is happening in the project, perform audits and make roadshows to track and watch risks and risk triggers.

Reserves

Use reserves for risks in your projects, essentially time and cost reserves are key. Because, if one of the risks occurs it will probably effect project constraints and reserves will help you to minimize the effect. Contingency reserves are assigned for each activity by PM and business reserves are assigned for the project by top management.

Reserves are part of project budget and do not require to ask for extra cost.

Communications Management

Stakeholders Management