6/20/2018

RISK.2932
Utilizing a QRA Maturity Model for
Continuous Improvement
James Arrow DRMP FRICS

PLEASE USE
MICROPHONE FOR
ALL QUESTIONS
AND COMMENTS!

1
 6/20/2018

Speaker Bio
James Arrow, MoRP DRMP FRICS
Project Risk SME & Lead Associate at Booz Allen Hamilton
Project Management professional and Chartered Quantity
Surveyor with more than 20 years of experience
Broad range of Industrial / Commercial Engineering,
Procurement, and Construction (EPC) experience working
with Fortune 500 contractors and Owner organizations
– Market sectors include oil and gas, aerospace,
mining, power generation, government operations,
pharma and IT Program Management
Currently providing executive advisory support in the
deployment of Enterprise Risk Management solutions for
clients headquartered in Houston
Recent experiences include the development of Risk
Management capability improvement plans, the
deployment of state-of-the-art risk analysis solutions
including the development of network-enabled asset
tracking platforms designed to enhance construction
productivity planning and control on large capital projects
Something you don’t know about me: My interest in
diving (sky & scuba – not at the same time) helped kick-
Image courtesy of Booz Allen Hamilton start my interest in Risk Management.
3

Agenda
Risk-based Kaizen
A Roadmap for Optimizing QRA
Managing the Broader Perspective
Summary

Image courtesy Booz Allen Hamilton

2
 6/20/2018

Risk-based Kaizen
Continuous Learning; The Pursuit of Excellence

A Japanese business philosophy

of continuous improvement
Kai concerning working practices
and personal efficiency.

Zen
Change

Kaizen
Continual
"The wise know their weakness too well to
assume infallibility; and he who knows
Improvement
most, knows best how little he knows."
– Thomas Jefferson

5 Graphic attributed to author

So What?
The improvement goal; A risk-based competitive advantage
Cost Key
$ = Residual Risk Impact
(Indicative /
Not to Scale) = Cost of Risk Management
= Total Cost of Risk

Pushing capability past the

point of decreasing returns may
be warranted in such cases
where risks must be avoided at
all costs.

Capability
1 2 3 4 5
Reactive Basic Standard Mature Optimizing

6 Graphic attributed to author

3
 6/20/2018

QRA Maturity Model

Waves of Change; The Spectrum of QRA Process Capability Characteristics

Ad Hoc Reporting Statistical Analyses

Predictive Prescriptive Key
Analytics Analytics
= Residual Risk
Impact
Cost
= Cost of Risk
(Indicative / Management
Not to Scale)
= Risk Tolerance

= Risk Appetite

Risk Risk
Tolerance Appetite

Capability
1 2 3 4 5
Reactive Ad-hoc Centralized Dynamic Adaptive

7 Graphic attributed to author

QRA Process Level 1 – Reactive

Intuition-based decision-making; The naïve organization

Level 1 Cost
Reactive
(Indicative / Not to Scale)

 No capability exists;
intuition-based
decision-making
 No defined roles
 No automation or
systems (highly
manual)
 Reactive fire-fighting
culture (worship the Risk Risk
hero)
Tolerance Appetite

Key
= Residual Risk
Impact
= Cost of Risk
Management
1 2 3 4 5
= Risk Tolerance Reactive Ad-hoc Centralized Dynamic Adaptive
= Risk Appetite
Capability

8 Graphic attributed to author

4
 6/20/2018

QRA Process Level 2 – Ad-hoc

Experimental QRA roll-out; Diagnostic Analytics

Level 2 Cost
Ad-hoc

(Indicative / Not to Scale)

 Ad hoc / informal
processes; infrequent
and limited analytical
insight
 Basic technology, still
highly manual process
 Reliance on external
experts
 Little integration Risk Risk
between Cost &
Tolerance Appetite
Schedule Data

Key
= Residual Risk
Impact
= Cost of Risk
Management
1 2 3 4 5
= Risk Tolerance Reactive Ad-hoc Centralized Dynamic Adaptive
= Risk Appetite
Capability

QRA Process Level 3 – Centralized

Evidence-based Decision-making; Descriptive Analytics
Level 3
Centralized
Cost
 Formal processes;
(Indicative / Not to Scale)

some evidence-based
decision-making
 Defined roles &
responsibilities
 Some centralized
repositories
 Inconsistent adoption
of systems across
projects
Risk Risk
 Some inter-
Tolerance Appetite
department co-
operation between
Risk, Estimating / Cost
and Planning &
Scheduling
 Frequent use of
analytics; MCS, MLR or
other

Key = Residual Risk

Impact
= Cost of Risk 1 2 3 4 5
Management Reactive Ad-hoc Centralized Dynamic Adaptive
= Risk Tolerance

= Risk Appetite
Capability

10 Graphic attributed to author

5
 6/20/2018

QRA Process Level 4 – Dynamic

Fact-based Decision-making; Predictive Analytics
Level 4
Dynamic
Cost
 Formal and dynamic

(Indicative / Not to Scale)

processes; fact-based
decision-making
 Specialization of roles
and skills; in-house
expertise
 Consistent adoption /
integration of systems
 Some automation;
some Big Data analytics
Risk Risk
 Close collaboration /
Tolerance Appetite
alignment between
Project Controls
departments, BUs &
Enterprise
 Organizational
awareness of current
Risk Ecosystem

Key = Residual Risk

Impact
= Cost of Risk 1 2 3 4 5
Management Reactive Ad-hoc Centralized Dynamic Adaptive
= Risk Tolerance

= Risk Appetite
Capability

11 Graphic attributed to author

QRA Process Level 5 – Adaptive

Risk Intelligent Networks; Prescriptive Analytics
Level 5
Optimized
Cost
 Highly adaptive
(Indicative / Not to Scale)

processes; fact-based
decision-making
 Advanced skill sets;
market-leading
capabilities
 Highly integrated
systems across the
organization
 High automation;
Risk Risk
advanced analytics
Tolerance Appetite
using Big & Fast Data
 Risk intelligent network
with awareness of
current and near-term
Risk Ecosystems
 Risk Intelligent
Meritocracy

Key = Residual Risk

Impact
= Cost of Risk 1 2 3 4 5
Management Reactive Ad-hoc Centralized Dynamic Adaptive
= Risk Tolerance

= Risk Appetite
Capability

12 Graphic attributed to author

6
 6/20/2018

The Broader Perspective

Risk Management Capability Attributes

An effective QRA capability QRA capability will be a function

cannot exist in a vacuum of an organization’s overall risk
management capability
CULTURE Attribute - Both demonstrable and
visible top-down commitment. Level of policy
acceptance throughout the organization.
PROCESS Attribute - The nature in which the
Risk Management process is applied in all
projects (and departments).
EXPERIENCE Attribute - Level of understanding
&/or training. Learning from experience
(Lessons Learned).
APPLICATION Attribute - Consistency of
application, availability of dedicated resources,
state or capability of available risk tools /
software.
13 Graphic attributed to author

Conclusion

14

7
 6/20/2018

Summary
Level 1 Level 2 Level 3 Level 4 Level 5
Reactive Ad-hoc Centralized Dynamic Optimized
 No capability exists;  Ad hoc / informal  Formal processes;  Formal and dynamic  Highly adaptive
intuition-based processes; infrequent some evidence-based processes; fact-based processes; fact-based
decision-making and limited analytical decision-making decision-making decision-making
 No defined roles insight  Defined roles &  Specialization of roles  Advanced skill sets;
 No automation or  Basic technology, still responsibilities and skills; in-house market-leading
systems (highly highly manual process  Some centralized expertise capabilities
manual)  Reliance on external repositories  Consistent adoption /  Highly integrated
 Reactive fire-fighting experts  Inconsistent adoption integration of systems systems across the
culture (worship the  Little integration of systems across  Some automation; organization
hero) between Cost & projects some Big Data analytics  High automation;
Schedule Data  Some inter-  Close collaboration / advanced analytics
department co- alignment between using Big & Fast Data
operation between Project Controls  Risk intelligent network
Risk, Estimating / Cost departments, BUs & with awareness of
and Planning & Enterprise current and near-term
Scheduling  Organizational Risk Ecosystems
 Frequent use of awareness of current  Risk Intelligent
analytics; MCS, MLR or Risk Ecosystem Meritocracy
other

There is no single approach for QRA.

The method (or combination of analytical approaches) employed for QRA will reflect:
Organizational risk management maturity or capability
The nature of the problem under review
A continuous campaign to improve QRA capability can secure a risk-based competitive
advantage
15 Graphic attributed to author

QUESTIONS/COMMENTS?

(PLEASE USE MICROPHONE)

16

8
 6/20/2018

RISK.2932
Utilizing a QRA Maturity Model for Continuous Improvement
James E Arrow DRMP FRICS
arrow_james@BAH.com

17

18