Introduction to Risk Management

MGMT 4019
Intro to PM & Risk Management
Class 8
Learning Objectives

1. Discuss the value of managing project risk

2. Recall the six steps of the risk management process

3. Discriminate between types of project risks:

i. known versus unknown
ii. positive versus negative
iii. internal versus external
iv. Inherent versus residual
4. Recall the functions of a project manager in identifying project risks during the
initiation and planning phases of a project

5. Distinguish between inherent and residual risks

6. Recall key risk factor categories as well as key risks associated with each

7. Complete an in-class assignment to identify 4 risks for a sample project

What is a project risk?

▪ How would you describe project risk?

 What is a Project Risk?

“Project Risk is an uncertain event or condition that, if it

occurs, has a positive or negative effect on one or more
project objectives”.
PMBOK 6th Edition

• Risks can either be negative (threats) or positive (opportunities)

• Although a project manager will continually look for opportunities to

facilitate the implementation of project deliverables, most risk
management focuses on identifying and responding to threats that have
the potential to negatively impact the project

• The major focus of this course will be on negative risks (threats)

 Project Risk Management

Project risk management includes the processes of

conducting risk management planning,
identification, analysis, response planning, and
controlling risk on a project.
PMBOK 6th Edition
 Risk Management

Initiating Planning Executing Monitoring &

Controlling Closing
• Develop Project •Plan Risk
Charter Management • Implement Risk
•Identify Risks
Responses • Monitor risks
•Perform Qualitative
Risk Analysis
•Perform Quantitative
Risk Analysis
•Plan Risk Responses
 Why Is Risk Management Important?

▪ Provides vital information to decrease the likelihood and impact of

negative events, and increase the likelihood and impact of positive
events.
▪ Provides the project with a budget and schedule reserve (money set
aside to respond to risks if they occur)
▪ The project manager is able to prepare a response plan for each
individual risk and act accordingly if a risk occurs.
 Risk Management Processes (PMBOK)

The following six Risk Management processes are defined in PMBOK:

1. Plan Risk Management: The process of defining how to conduct risk

management activities for a project (not part of this course).
2. Identify Risks: The process of determining which risks may affect the project
and documenting their characteristics.
3. Perform Qualitative Risk Analysis: The process of prioritizing risks for further
analysis or action by assessing and combining their probability of occurrence or
impact.
4. Perform Quantitative Risk Analysis: The process of numerically analyzing the
effect of identified risks on overall project objectives.
5. Plan Risk Responses: The process of developing options and actions to enhance
opportunities and to reduce threats to project objectives.
6. Control Risks: The process of implementing risk response plans, tracking
identified risks, monitoring residual risks, identifying new risks, and evaluating
the process effectiveness throughout the project.
 Identifying Risks

Today’s class will focus on identifying risks

Let’s start by examining the various types of project
risks…
 Introduction to Risk Management Video

Video: Risk Management for Projects

Examples of effective and ineffective risk management for

large scale projects

https://www.youtube.com/watch?v=lvARcsgZOKg

This video demonstrates the very different outcomes when risk

management is performed correctly vs incorrectly.
 Types of Project Risks

Risks are events that may or may not occur at some point during
implementation. If you have sufficient evidence to know that a risk will
occur when you are in the planning phase, this is an assumption, not a
risk.
For example, if you know that the current office environment does not have room to
accommodate the project team and/or provide sufficient meeting spaces, this is an
assumption.

A risk might be that the space that has been allocated for your project team may be
taken over by another project based on information you have received from your project
sponsor.
 Types of Project Risks

1. Known vs. Unknown risks

Known risks: Risks that have been identified and analyzed, making it possible to
plan a response for them, although you have no control over them.
– If the weather forecast calls for a chance of rain, bring an umbrella.

– You do not know if you are going to get a flat tire, but you carry a spare tire in case it
happens.
 Types of Project Risks

1. Known vs. Unknown risks

Unknown risks: Risks that arrive unexpectedly. These risks are beyond your
ability to foresee
– Brexit

– COVID-19
 Types of Project Risks

2. Positive vs. Negative risks

A positive risk (also known as “opportunity”) is a situation or event that have a
potential to create a favorable impact on the project outcome.
– When remodeling your kitchen, you find that you can sell your old appliances to a
friend which reduces the overall cost of the project.
 Types of Project Risks

2. Positive vs. Negative risks

▪ A negative risk (also known as “threat”) is an event that can potentially harm
the project.
– One of your key team members has a car accident and will not be able to return to
work for three months. Her absence will potentially delay the project.

▪ Note: there are times when a risk can be both positive and negative:

– you need to reschedule your destination wedding because there is a hurricane in the weather
forecast. However, some of your relatives who couldn’t attend on the original date can come
on the rescheduled date.
 Types of Project Risks

3. Internal vs. External risk

An internal risk is a risk that is identified within the project boundaries.
– The scope of the project changes

– The stakeholders do not approve the final product

 Types of Project Risks

3. Internal vs. External risk

An external risk is a risk that is identified outside the project boundaries.
– A flood delays a construction project beyond the initially scheduled completion date

– A new labour law is approved which impacts the number of hours that team
members can work on the project each day
 Types of Project Risks

Internal External
▪ Executive management ▪ Social environment
▪ Stakeholders ▪ Market
▪ Scope changes ▪ Weather
▪ Resources and team ▪ Politics
▪ Communication issues ▪ Natural disasters
▪ Timing of approvals ▪ Actions taken by competitors
▪ Change management issues
 Group Activity – Discriminate between types of project risk

For each of the following situations on the next slide, determine whether the risk is:
▪ known or unknown
▪ positive or negative – consider this from the project rather than company
perspective
▪ Internal or external to the project
 Group Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may collapse before the
extraction is over
2. During the construction of a subway line in Mexico City, the remains of an
Aztec temple are discovered
3. A hurricane is approaching the construction site of a high rise building, if it
doesn’t change its course, workers won’t be able to work for an entire month.
Schedule will be delayed, but the company will be able to claim insurance
4. Confidential information about a new app is leaked causing the software
company stocks to increase by 12%

For each of these scenarios, write down whether the risk is known vs unknown, positive vs
negative and internal vs external.
 Discriminate between types of project risk

1. A mining company identified that one of their mines may

collapse before the extraction is over
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may

collapse before the extraction is over (known, negative,
internal)
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may

collapse before the extraction is over (known, negative,
internal)
2. During the construction of a subway line in Mexico City, the
remains of an Aztec temple are discovered
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may

collapse before the extraction is over (known, negative,
internal)
2. During the construction of a subway line in Mexico City, the
remains of an Aztec temple are discovered (unknown,
negative*, external)
*although the discovery of the temple may have a positive archeological
benefit, it is an additional cost to the project and, therefore, negative
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may collapse before
the extraction is over (known, negative, internal)
2. During the construction of a subway line in Mexico City, the remains of an
Aztec temple are discovered (unknown, negative, external)
3. A hurricane is approaching the construction site of a high rise building, if it
doesn’t change its course, workers won’t be able to work for an entire
month. Schedule will be delayed, but the company will be able to claim
insurance
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may collapse before
the extraction is over (known, negative, internal)
2. During the construction of a subway line in Mexico City, the remains of
an Aztec temple are discovered (unknown, negative (could be positive as
well), external)
3. A hurricane is approaching the construction site of a high rise building, if
it doesn’t change its course, workers won’t be able to work for an entire
month. Schedule will be delayed, but the company will be able to claim
insurance (known, negative, external)
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may collapse before the
extraction is over (known, negative, internal)
2. During the construction of a subway line in Mexico City, the remains of an Aztec
temple are discovered (unknown, negative (could be positive as well), external)
3. A hurricane is approaching the construction site of a high rise building, if it
doesn’t change its course, workers won’t be able to work for an entire month.
Schedule will be delayed, but the company will be able to claim insurance
(known, negative, external)
4. Confidential information about a new app is leaked causing the software
company stocks to increase by 12%
 In-class Activity – Discriminate between types of project risk

1. A mining company identified that one of their mines may collapse before the
extraction is over (known, negative, internal)
2. During the construction of a subway line in Mexico City, the remains of an Aztec
temple are discovered (unknown, negative (could be positive as well), external)
3. A hurricane is approaching the construction site of a high rise building, if it
doesn’t change its course, workers won’t be able to work for an entire month.
Schedule will be delayed, but the company will be able to claim insurance
(known, negative, external)
4. Confidential information about a new app is leaked causing the software
company stocks to increase by 12% (known/unknown, negative*, internal)
* While the increase in share value may be a benefit to the company as a whole, it does not
provide a discernable positive benefit to the actual project
 Functions of a Project Manager

Project
Initiation

Feedback, Changes, Corrective Action

Key Functions:
•Define Requirements; Purpose, Goals, Constraints
•Stakeholders; Identify roles, Secure Buy-In
•Document; “What” is Required not “How”, Detail
the “Rules of Engagement”
•Key Documents: Project Charter (which defines
initial risks), Statement of Work, Stakeholder
Register, Responsibility Matrix, Communications
Plan
 Risk Identification Continues in the Project Planning Phase

▪ A significant component of developing a project plan involves the

identification of project risks

▪ Identifying project risks continues throughout project implementation.

New risks can occur at any time!

▪ Risks are documented and updated in a risk register – also called a

risk log (which we will study later in this course)
 Functions of a Project Manager

Project
Project
Definition
Planning

Feedback, Changes, Corrective Action

Project Planning
•“How” to meet the Requirements
•Develop WBS
•Develop project schedule
•Develop project budget
•Assess and plan for risks
•Key Documents: Project Management Plan, Work Breakdown Structure
(WBS), Project Schedule (Timeline), Budget, Risk Register
 Inherent Risk vs Residual Risk

1. Inherent risk is the level of risk before any attempts are made to put
actions or plans in place to reduce or eliminate the risk from occurring.

– There is an inherent risk that you may get a flat tire at any time you are driving
which will impact the time you can reach your destination which may cause you
to miss a meeting/appointment

2. Residual risk is the level of risk after all plans and actions to control or
eliminate the risk are put into place.

– By having a tire repair kit or spare tire in the car, you have reduced an inherent
risk to a residual risk. You may still get a flat tire, but after repairing the tire, you
will still be able to reach your destination, and make your appointment, with a
short amount of delay.
 Risk Identification Process

Identifying project risks is a two step process:

1. Identify the risk factors associated with your project. Risk

factors are categories of risks that tend to occur in similar types
of projects.

2. Identify specific risks within each risk factor area that specifically
relate to your project
 Risk Identification Process

▪ Risks can be grouped into categories (risk factors).

▪ There are ‘generic’ risk factors that are potentially common to any
project. These include:
1. Project Team Risk
2. Executive Support Risk
3. Stakeholder Risk
4. Scope Risk
5. Cost Risk
6. Schedule Risk

Let’s look at some of the key risks within these risk factor categories…
 Project Team Risk

Risks associated with the project team’s ability to deliver the project include:
▪ Resources are inexperienced- When your project team need to acquire new skills
for the project there's a risk that productivity will be low. Training is often a poor
substitute for professional experience. Projects shouldn't assume that resources will
be fully productive in a new skill.
▪ Team members with negative attitudes towards the project - Resources who are
negative towards the project may actively or passively sabotage project efforts.
▪ Resource turnover - Resource turnover can lead to delays and cost overruns.
▪ Lack of commitment from functional managers – your project team members
may report to functional managers. If these functional managers do not support the
project or require your project team members to perform other work, there is a risk
that the project will not be delivered on schedule.

Source: http://www.cs.odu.edu/~cs410/risk.html
 Project Team Risk

Note:
▪ Risks arising from inexperience or other project team deficiencies are legitimate
risks
▪ However, risks that arise from poor performance are not legitimate risks
Example 1: You are a new project manager working on a project budget. Because you are not
experienced, it is legitimate to cite, this as a risk. The response to this risk may be to ensure that
at least one more experienced project manager reviews your work.
Example 2: You are an experienced project manager working on a project budget. You identify
project team risk for a budget you are preparing in case you make mistakes on the budget. This
is not a legitimate risk as the ‘so-called’ risk would be the result of poor performance given that
the project manager should have the skills and knowledge to perform the work.
 Executive Support

Typical risks associated with insufficient executive support for the project include:
▪ Executives fail to support project - The project team may lack the authority to achieve
project objectives. In such cases, executive management support is fundamental to
project success. When this doesn't materialize the project often fails.
▪ Executives become disengaged with project - Executive management do not focus
enough on the project. Perhaps, organizational priorities have changed and the
Executive group no longer has as much interest in the project.
▪ Conflict between executive stakeholders disrupts project- Members of executive
management are combative to the project or there is a disagreement over project issues
at the executive level.
▪ Executive turnover disrupts project - A key executive leaves the company, the
resulting disruption becomes a project issue.

Source: http://management.simplicable.com/management/new/130-project-risks
 Stakeholder Risk

Typical risks associated with stakeholder support for the project include:

▪ Stakeholders have inaccurate expectations - Stakeholders develop inaccurate

expectations (believe that the project will achieve something not in the requirements,
plan, etc).

▪ Stakeholders become disengaged – e.g. stakeholders ignore project

communications, don’t attend meetings, etc.
▪ Stakeholder turnover - Stakeholder turnover can lead to project disruptions.
▪ Stakeholders fail to support project - When stakeholders have a negative attitude
towards the project and wish to see it fail.
▪ Stakeholder conflict - Disagreement between stakeholders over project issues.

Source: http://management.simplicable.com/management/new/130-project-risks
 Scope Risk

Common scope risk factors include:

▪ Improper scope or requirements definition–Key stakeholder requirements have not
been properly defined or are incomplete. Key stakeholders not involved in the
requirements definition process.
▪ Scope creep– Changes and/or additions to the project scope are not properly managed.
▪ Gold plating - The project team add their own product features that are not in
requirements or change requests.

Source: http://management.simplicable.com/management/new/130-project-risks
 Cost Risk

Risks that impact the ability to deliver the project on budget include:

▪ Austere (bare bones) budget

▪ Additional and unforeseen expenses

▪ Inflation

▪ Contract penalties - late on delivery

▪ Reduction of funding

▪ etc.

Source: http://www.cs.odu.edu/~cs410/risk.html
 Schedule Risk

Risks that impact the ability to deliver the project on schedule include:

▪ Unrealistic project delivery schedule imposed by client/management

▪ Permission delays – e.g. licenses and permits

But RISK cannot be a result of poor planning, for example:

▪ Dependencies are improperly defined – Improperly defined dependencies (i.e. which

tasks are dependent on others first being completed) can dramatically impact the project
schedule and costs.

▪ Insufficient resources assigned to deliverables (people, equipment, materials,

space, etc.)

Source: http://www.cs.odu.edu/~cs410/risk.html
 Other Risk Factors

▪ Depending on your project, there are other risk factors that may apply, including:
• Technology risks – the technology was improperly specified or does not work as
expected
• Procurements risks – limited or low quality responses to Requests for Proposals; inability
to negotiate a contract; vendors do not deliver according to the contract, etc.
• Legal risks – changes to legislation or regulations impact project; the products or services
created by the project incur legal liability
• Business Risk – changes in the organization’s business strategy impact the underlying
need for the project
• Commercial Risk – users do not accept the product/service created by the project;
product negatively impacts the business’s brand or reputation
• etc.
 Sources of Risk Information

Assume you are a project manager who has recently graduated and become employed in the
field. You are developing a project plan for your first project. You have limited knowledge of the
risk factors associated with your project.
What sources of information can you use to identify risks for your project?

Write down at least 3 sources of information you can use to identify project risks before
proceeding to the next slide.
 Sources of Risk Information

Assume you are a project manager who has recently graduated and become employed in the
field. You are developing a project plan for your first project. You have limited knowledge of the
risk factors associated with your project.
What sources of information can you use to identify risks for your project?

▪ Information obtained from stakeholders

▪ Project managers with experience on similar projects

▪ Project management team (expertise and knowledge)
▪ Project documentation for past projects (created as part of the Project Close phase)
▪ Research on similar types of projects (online and offline)
▪ Networking with other project management professionals (e.g. through PMI)
▪ Input from subject matter experts
▪ Other sources of information (e.g. internet, conferences, books and periodicals)
 Risk Identification: Rules of Thumb

Project managers who are new to the field or have limited experience with the type (i.e.
content) of the project they are about to manage can benefit from the following rules of thumb:

1. Attempt to learn as much as possible about the risk factors associated with your project
using the resources identified on the previous slide.

2. Carefully analyze the internal and external environment in which your project will be
delivered. Identify risks that are specific to your project.

3. Take the time and effort required to prepare your project plan, schedule and budget.
Proper planning will eliminate numerous potential risks and, conversely, improper planning
will generate risks that could have been avoided and will be attributed to you!

Continued…
 Risk Identification: Rules of Thumb

Project managers who are new to the field or have limited experience with the type (i.e.
content) of the project they are about to manage can benefit from the following rules of thumb:

4. Be realistic in deciding which risks to track and manage. Only include those risks that have
a reasonable probability of occurring and, if they do, will have significant impacts on your
ability to deliver the project.

5. Continually scan for new risks to your project during the Project Implementation phase.
There are some risks that only come to light once the project work has begun.
 Individual In-class Assignment

You are a project manager who has just been hired to plan and implement a project to convert a 100 room
downtown Toronto hotel into a GBC student residence. This project will involve removing all furniture from the
current hotel rooms and replacing it with a single bed, a desk and a chest of drawers. GBC wants to begin moving
students into the new residence in September 2023. In discussions with stakeholders you have learned the
following:
▪ The college has purchased the hotel
▪ A supplier of beds, chests of drawers and desks has not yet been identified
▪ The college has put aside funds that it believes will be sufficient to pay for all aspects of this project
▪ The colleges Board of Governors voted 8-7 to approve the project
▪ The Director of Construction for the college is due to retire in June 2023
Identify 4 risks associated with this project and the risk category associated with each risk
 Individual In-Class Assignment

Possible Risks:
1. The beds, chests of drawers and desks may not be delivered on time or at a cost
that is reflected in the project budget (cost risk)
2. The college has not yet arrived at a final vetted budget (only has a budget that they
believe will be sufficient). The actual costs of the project may well exceed this
unvetted budget. (cost risk)
3. Given how close the Board of Governor’s vote is, if any one governor is replaced or
changes his/her mind the project could be placed at risk (stakeholder risk)
4. It will take time to on-board a new Director of Construction. This may delay the
completion of the project by September 2023 (schedule risk)
 Individual Bonus In-class Assignment

You’ve all experienced risks in your day-to-day lives!

– Write a brief description of a risk that you have encountered
sometime in your life
– Was the risk known or unknown?
– Was the impact of the risk positive or negative?
– How did you respond to the risk?
– Work individually for 10 minutes to think about a significant risk
you have experienced in the past year
 When does risk identification begin?

▪ Defining project risks and responses starts during project initiation

▪ Initial risks are identified in the Project Charter

▪ There are risks associated with the development of the project

scope, schedule and budget. These need to be identified as early as
possible
Next Class

Next class: Qualitative Risk Analysis