Project Management - 10

Project Risk Management
PMP Prep Course – PMBOK 5th Edition – Version 5.0
Risk Management
©2013 Long Island Chapter of the Project Management Institute ALL RIGHTS RESERVED
Project Risk Management Definition
A subset of project management that

includes the processes of conducting risk
management planning, identification, analysis,
response planning and controlling risk on a project.
PMBoK® Guide, 5th Edition, p. 309
©2013 Long Island Chapter of the Project Management Institute ALL RIGHTS RESERVED 2
Additional Definitions
RISK - an occurrence that may affect the project for good or bad.
UNCERTAINTY - the absence of any information related to a desired outcome.
RISK APPETITE - the degree of uncertainty an entity is willing to accept in anticipation of a

reward
RISK TOLERANCES - the degree, amount, or volume of risk that an organization or

individual will withstand
RISK THRESHOLD - a measure of uncertainty or impact at which a stakeholder may have

an interest
CONTINGENCY RESERVES - time or money added to the plan to handle “known

unknowns”
MANAGEMENT RESERVES - time or money added to the plan to handle “unknown

unknowns”
Project Risk Management Objectives
Increase the probability & impact of opportunities
Decrease the probability & impact of threats
Simple & Clear-cut goals!
Why is Risk Management Necessary?
Projects are:
New, Unique
Under Time Pressures
Uncertain
Under Budget Constraints
Six Step Approach to Handling Project Risk
1. Make a plan that address’ steps 2-6 in detail

2. Identify – Create a comprehensive list of risks
3. Screen or Qualify risks for further analysis or watching, use low cost/effort tools
4. Analyze only the screened risks and the overall project, use heavier duty
numerical (a.k.a. Quantitative)
Quantitative tools
5. Plan individual responses (and contingencies) as most needed based on step
number 4.
6. Monitor the risks that have response plans and execute the responses. Use
workarounds as needed. Watch for new (unplanned) risks.
To hold it all together, form a risk register in step 1, update in 2 thru 6

Repeat as needed especially at phase gates or decision points.
Six Step Approach - Concepts
Completely analyzing and planning responses to all risks is

expensive & time consuming – not a practical approach
Steps 3, 4, 5 progressively reduce the number of risk items that
will have more costly resources devoted to analyzing them
The risk register (formatted in step 1) is updated with new
information at all other steps
These steps should be repeated as appropriate, especially at
project phase gates or decisions points
Each step is a process
Project Risk Management Processes
11.1 Plan Risk Management
11.2 Identify Risks
11.3 Perform Qualitative Risk Analysis
11.4 Perform Quantitative Risk Analysis
11.5 Plan Risk Responses
11.6 Control Risks
Plan Risk Management Process
Project Management Process Groups

Knowledge Area
Initiating Planning Executing Controlling Closing
11.2 Identify Risks

11. Project Risk 11.6 Control Risks
Management 11.3 Perform Qualitative Risk Analysis

Definition: “The process of defining how to conduct risk
management activities for a project.”

11.1.1 Plan Risk Management Inputs

Project
Provides baseline or current state of risk-affected areas including
11.1.1.1 Management
scope, schedule, and cost.
Plan
Provides various inputs such as high-level risks, high-level project

11.1.1.2 Project Charter
descriptions, and high-level requirements.
Stakeholder Lists all details related to a project’s internal and external

11.1.1.3
Register stakeholders including an overview of their roles.
Enterprise Includes, but is not limited to, risk attitudes, thresholds, and
11.1.1.4 Environmental tolerances that describe the degree of risk an organization, as well
Factors as individual stakeholders, will withstand.
Includes, but is not limited to, risk categories, definitions of concepts
Organizational and terms, risk statement formats, standard templates, roles and
11.1.1.5
Process Assets responsibilities, authority levels for decision making and lessons
learned.
11.1.2 Plan Risk Management Tools and

Techniques
A variety of techniques used to understand and define the overall risk
Analytical
11.1.2.1 management context of the project. Examples include a stakeholder risk
Techniques profile and risk scoring sheets.
Expertise from groups or individuals with specialized training or knowledge
in the subject area such as:
• Senior Management,
• Project Stakeholders,
11.1.2.2 Expert Judgment •Project Managers who have worked on similar projects either via
lessons learned or directly,
• Subject Matter Experts,
• Industry groups and consultants as well as,
• Professional and technical associations.
Attendees may include project team members and stakeholders and people
with organizational responsibility for Risk Management.
11.1.2.3 Meetings Plans for including the cost and schedule for Risk Management activities in
the overall Project Plan should be developed. Assign responsibilities for Risk
Management, Review of organizational templates for risk categories and
management, et al.
11.1.3 Plan Risk Management Outputs

Methodology
Approaches, tools, data sources used to manage risk.
Roles and Responsibilities
Define leads, team members and supporting roles; clarify
responsibilities for each role.
Budgeting
Risk Assign resources and estimate costs for Risk Management to

11.1.3.1 Management include in project cost baseline.
Plan Timing
When, how often to perform risk management activities.
Risk categories
Structure to ensure the comprehensive identification of risks
through a systematic process.
Can be further decomposed into a Risk Breakdown Structure
(RBS).
Can be based on previous projects.
11.1.3 Plan Risk Management Outputs (cont’d)

Risk probability and impact scales defined
These form a matrix
Probability and impact matrix
Tabular plot of total qualitative risk scores based on
probability (vertical) and impact (horizontal)
Revised stakeholders’ tolerances
Risk
11.1.3.1 Management Because tolerances may be project specific
Plan (cont’d) Reporting formats
Define content and format of Risk register and other reports.
How will the outcomes of risk management be documented,
analyzed and communicated?
Tracking
How risk activities are recorded and audited
Should benefit current project, future needs and record
lessons learned
Example Set of Risk Categories

Technical/Quality/Performance
Unproven or complex technology
Expected changes (standards, technology)
Project Management
Poor allocation of time and resources
Inadequate project plan quality
Organizational
Inconsistent objectives (scope, cost, time)
Lack of prioritization
Inadequacy/Interruption of funding
Resource conflicts
External
Shifting legal, regulatory, environmental requirements
Labor issues
Force Majeure (natural disasters, war, LOTTO)
11.1 Plan Risk Management Facts
The Risk Management Plan does not address responses to

Fact:
individual risks – that is done in the Risk Response Plan.
Organizational assets are improved by lessons learned

Fact:
updates.
Fact: Good Risk Management depends on good communications.
Identify Risks Process

Knowledge Area
11.2 Identify Risks

11.2 Identify Risks

Definition: “Determine which risks might affect the project and
document their characteristics.”

Risk Types
Normal risk of doing business. Includes threats and

Business
opportunities.
Threat Risk that presents a possible loss.
Opportunity Risk that presents a possible gain.
Pure (Insurable) Risk Risk that presents a possible loss & no possible gain!
Risks that were identified. Can be handled in a variety of

Known Risk
ways, including contingency reserve
Risks that were not identified

These can not be handled proactively
Unknown Risk
It is prudent to allocate management reserves for these
risks
11.2.1 Identify Risks Inputs
Risk Include roles & responsibility assignments, provision of risk

11.2.1.1 Management management activities in the budget and schedule, and categories
Plan of risk.
Cost
Provides processes and controls that can be used to help identify
11.2.1.2 Management
risks across the project.
Plan
Schedule
Provides insight to protect time/schedule objectives and
11.2.1.3 Management
expectations which may be impacted by known (or unknown) risks.
Plan
Quality
Provides a baseline of quality measures and metrics for use in
11.2.1.4 Management
identifying risks.
Plan
Human
Provides guidance on defining, staffing, managing and releasing
Resource
11.2.1.5 human resources. Also contains roles and responsibilities, project
Management
organization charts and the staffing management plan.
Plan
11.2.1 Identify Risks Inputs (cont’d)
Contains project assumptions which should be evaluated as risk.

11.2.1.6 Scope Baseline The WBS can also be included to indentify risk at both the micro and
macro level.
Provides a quantitative assessment of the likely cost to complete
11.2.1.7
Activity Cost scheduled activities and ideally expressed as a range, allowing a
Estimates degree of cost risk to be assigned. Projections may indicate
estimates are insufficient to complete an activity and pose a risk.
Useful in identifying risk related to time allowances for either the
Activity Duration
11.2.1.8 project or activities, again using a range to assign degree of risk is
Estimates
useful.
Stakeholder Ensures that key stakeholders, sponsor and customer are

11.2.1.9
Register interviewed or otherwise participate.
Project Should include, at a minimum, Project Charter, Project Schedule,

11.2.1.10
Documents Schedule Network Diagrams, Issue Log, and Quality Checklist.
11.2.1 Identify Risks Inputs (cont’d)
If the project requires the procurement of external resources,

Procurement procurement documents could become a key input. The level of
11.2.1.11
Documents detail and complexity should correspond to the value of the
procurement.
Enterprise May include, but are not limited to: Published information and
11.2.1.12 Environmental commercial databases, academic studies, published checklists,
Factors benchmarking, industry studies and risk attitudes.
May include, but are not limited to: Project files, including actual
Organizational
11.2.1.13 data, organizational and project process controls, risk statement
Process Assets
formats or templates, and lessons learned.
11.2.2 Identify Risks Tools and Techniques
A review of project documentation, e.g. plans, assumptions,

Documentation
11.2.2.1 previous project files and agreements, to identify risks. The quality
Reviews
of this documentation may be an indicator of risk.
Information
May include: Brainstorming, Delphi Technique, Interviewing, Root
11.2.2.2 Gathering
Cause Analysis
Techniques
Checklist Create checklists to assist with risk identification, based on past

11.2.2.3
Analysis experiences and other project work
Assumptions Uncertainty in project assumptions indicate potential areas of risk,

11.2.2.4
Analysis and the validity of assumptions should be explored.
11.2.2 Identify Risks Tools and Techniques (cont.)
Use risk diagramming techniques, including:

Diagramming Cause & effect diagrams
11.2.2.5
Techniques Influence diagrams
System or Process Flow charts
Identify risks using strengths, weaknesses, opportunities, threats
11.2.2.6 SWOT Analysis (SWOT) . Examine where opportunities and organizational strengths
offset threats and weaknesses.
Utilize expert judgment to identify risks, considering any bias that

11.2.2.7 Expert Judgment
may be present.
11.2.3 Identify Risks Outputs
Identified Risks
Potential Responses
11.2.3.1 Risk Register Root Causes
Updated Risk Categories
The Risk Register is a LIVING project artifact!
Initiate Risk Register
Identify Risks Perform Risk Analysis Plan Risk Responses Control Risks
Potential Defined Qualtve Risk

# Category Risk Date Impact Prob Score Notes Owner Status Date Notes
Result By Impact Strat
Unable to
IT
meet 15-
1 Tech Resource Brian
project Jun
Availability
schedule
Inability to
Project
complete 22-
2 Contracts contract Wendy
project Jun
negotiate
goals
Project
Scope 30-
3 Cost Budget Jeff
Creep Jun
Overrun
Note: Register Updates in Amber
Perform Qualitative Risk Analysis Process

Knowledge Area
11.2 Identify Risks


Definition: “The process of prioritizing risks for further analysis or
action by assessing and combining their probability of
occurrence and impact.”


Definitions
EVENT – Something that happens, an occurrence, an outcome.
PROBABILITY – How likely the event is to occur?
IMPACT – The event’s impact on objectives should it occur.
“POP QUIZ”
Project Risk is greatest in the _____ phase of the project & why?
Amount at stake is greater in the _____ phase of the project & why?

Commentary
QUALITATIVE approach expresses probability and/or impact using an

ordinal rating system to denote order.
Adjectives: high, medium, low
Colors: red, yellow,
yellow green
Ranking 1-10
Qualitative Approach: The Good, The Bad & The Ugly

Good – it’s fast and easy to administer & understand
Bad – it’s subjective, “invites” bias
Ugly – it requires definitions, rules, standards, and process
Example of Ordinal Scale
Rank Probability Impact

If risk occurs, a significant impact to
Risk event is very likely to occur,
High high probability
cost, schedule, quality, or customer
satisfaction will occur
If risk event occurs, a moderate

Risk event is likely to occur,
Medium medium probability
impact to cost, schedule, quality or
customer satisfaction will occur
If risk event occurs, a small impact to

Risk event is unlikely to occur,
Low low probability
cost, schedule, quality, or customer
satisfaction will occur
11.3.1 Perform Qualitative Risk Analysis Inputs
An output from Plan Risk Management it provides:

Roles and responsibilities of the Risk Management personnel
Budgets
Risk Schedule of activities for Risk Management
11.3.1.1 Management
Plan Risk categories
Definitions of probability and impact
Probability and impact matrix
Revised stakeholder risk tolerances
An input for Plan Risk Management.
11.3.1.2 Scope Baseline Simple or complex project; Recurrent or First-of-its-kind or State-
of-the-Art... (as defined in scope statement) – which would have
more risks?
11.3.1.3 Risk Register This output from Identify Risks is used to access and prioritize risks.
11.3.1 Perform Qualitative Risk Analysis Inputs

(cont.)
Enterprise • Data or Industry Studies from similar projects previously

11.3.1.4 Environmental completed
Factors • Risk databases from industry or proprietary sources
Organization
11.3.1.5 • Information on prior, similar completed projects.
Process Assets
11.3.2 Perform Qualitative Risk Analysis Tools

and Techniques
The likelihood that each specific risk will occur.
Risk Probability
The potential positive and negative impacts of the risk are also projected.
11.3.2.1 and Impact
Assessment Risks not likely to occur & with minimal impact (if they do) may be maintained
on a watch-list for future monitoring.
Probability and Provides a visual display of probability and impact products, grouped by order
11.3.2.2
Impact Matrix of priority: Low, Medium or High.
An analysis of the quality of the data used to assess the risk. Examines the
Risk Data Quality
11.3.2.3 degree to which risk is understood; the accuracy, quality, reliability and
Assessment
integrity of data used to analyze risk.
Risk Risks can be categorized to illustrate most vulnerable areas of the project;
11.3.2.4
Categorization categories may include risk source (RBS), or area of project affected (WBS).
Risk Urgency A means to determine which risks need to be addressed first, not just due to
11.3.2.5
Assessment high priority but possibly also due to high impact implications.
Leveraging an expert’s opinion to assess the probability and impact of each

risk.
11.3.3 Perform Qualitative Risk Analysis Outputs
Updates to the Project Risk Register include

assessments of probability and impacts
risk ranking or scores
Project risk urgency information
11.3.3.1 Document
risk categorization
Updates
watch lists for low probability risk or those require further
analysis
Updates tot he Assumptions Log. These may be incorporated into
the Project Scope Statement or in a separate Assumptions Log.
Update Risk Register

Unable to
IT Mod
meet 15-
1 Tech Resource Brian impact to
project Jun
Availability sched
schedule
Inability to
Project Mod
complete 22-
2 Contracts contract Wendy impact to
project Jun
negotiate goals
goals
Project Signif
Scope 30-
3 Cost Budget Jeff impact to
Creep Jun
Overrun cost
Perform Quantitative Risk Analysis

Knowledge Area
11.2 Identify Risks


Definition: “The process of numerically analyzing the effect of
identified risks on overall project objectives.”

QUANTITATIVE risk analysis is a numerical analysis of the

probability and/or impact of the highest risks. e.g.:
 80% probability of occurrence
 $10,000 impact or three week delay
Helps to determine the most critical risks

Less subjective than qualitative
More time consuming; requires estimation
Substantially more valuable in developing risk response
strategies and reserves
11.4.1 Perform Quantitative Risk Analysis Inputs
Risk
Provides guidelines, methods, and tools to be used in quantitative
11.4.1.1 Management
risk analysis.
Plan
Cost
11.4.1.2 Management Provides guidelines and establishing and managing risk reserves.
Plan
Schedule
11.4.1.3 Management Provides guidelines on establishing and managing risk reserves.
Plan
11.4.1 Perform Quantitative Risk Analysis Inputs

(cont.)
11.4.1.4 Risk Register Used as a references point for performing quantitative risk analysis.
Enterprise Providing insight and context to the risk analysis, these may include:
11.4.1.5 Environmental Industry studies of similar projects by risk specialists
Factors Risk Databases from industry or proprietary sources.
Organization
11.4.1.6 This may include information from prior, similar completed projects.
Process Assets
11.4.1 Perform Quantitative Risk Analysis Tools

and Techniques
Interviewing
Data Gathering Utilize experience & historical data to quantify probability and
and impact of project risks.
11.4.1.1
Representation Probability Distributions
Techniques Often used in simulations to represent uncertainty in values, e.g.
uniform distribution (“bell curve”) is commonly seen.
Sensitivity Analysis
Expected Monetary Value (EMV) Analysis
Statistical concept that calculates the average outcome
Quantitative EMV of opportunities/threats is either positive or negative
Risk Analysis EMV (project) = (Outcome 1 x Probability 1) + ...
11.4.1.2
& Modeling ... + (Outcome n x Probability n)
Techniques Common use is in a Decision Tree analysis
Modeling and Simulation
Often using the Monte Carlo technique
Expert
11.4.1.3 A technique used in the two prior risk processes
Judgment
Sensitivity Analysis
Shows which risks have the most impact.
Task B
Task A Task E
Start Task C
Finish
Task D
The probability of Task E starting on time decreases as the

number of parallel predecessors increases.
Expected Monetary Value (EMV) Analysis
EMV = Probability x Impact
Risk Probability of X Impact = Expected

Value
Event Occurrence
1 10% $500,000 overrun $50,000
10 week delay 1 week delay
2 50% $100,000 overrun $50,000
16 week delay 8 week delay
3 75% $10,000 overrun $7,500

2 week delay 1.5 week delay
Decision Tree Analysis
A diagram that graphically describes the implications

of choosing one or more alternatives
Incorporates probabilities of risks as well as costs or
rewards of each logical path
Solving a “decision tree” determines which decision
has the greatest yield or expected value
Decision Tree Example

Probability x Outcome
= EMV
x
Aggressive Uncertain P = .20 +100,000 = + $20,000
Schedule Outcome
(EMV = $4,000)
Decision
X P = .80 x - $20,000 = - $16,000
Uncertain P = .30 x - $20,000 = - $6,000

Outcome
Conservative
Schedule
(EMV = $1,000)
P = .70 x + $10,000 = + $7,000
Rules for Dealing with Probabilities
For mutually exclusive, independent events:

Addition Rule: The probability of one outcome or another outcome
occurring is equal to the sum of the probabilities of the outcomes
occurring individually.
P(A or B) = P(A) + P(B)
Multiplication Rule: The probability of one outcome and another

outcome occurring is equal to the product of the probabilities of the
outcomes occurring individually.
P(A and B) = P(A) x P(B)
11.4.3 Perform Quantitative Risk Analysis

Outputs
Probabilistic analysis of the project

Project Probability of achieving cost and time objectives
11.4.3.1 Document
Updates Prioritized list of quantified risks
Trends in quantitative risk analysis results

Unable to
IT Mod
meet 15-
1 Tech Resource Brian 0.4 0.6 0.24 impact to
project Jun
Availability sched
schedule
Inability to
Project Mod
complete 22-
2 Contracts contract Wendy 0.3 0.9 0.27 impact to
project Jun
negotiate goals
goals
Project Signif
Scope 30-
3 Cost Budget Jeff 0.8 0.7 0.56 impact to
Creep Jun
Overrun cost
Plan Risk Responses Process

Knowledge Area
11.2 Identify Risks


Definition: “The process of developing options and actions to
enhance opportunities and reduce threats to project
objectives.”

11.5.1 Plan Risk Responses Inputs
Risk An input to multiple risk processes.

11.5.1.1 Management Important components include roles and responsibilities,
Plan definitions, timing for reviews, and risk thresholds.
Risk Register now contains

a list of risks,
root causes,
potential responses,
risk owners,
11.5.1.2 Risk Register symptoms and warning signs,
relative risk rating,
urgent risks,
risks requiring further analysis,
trends in qualitative analysis results and
a watch list (list of low-priority risks within the Risk Register)
11.5.2 Plan Risk Responses Tools & Techniques

Avoid
Change the plan to eliminate the threat.
Examples: Extend schedule, change strategy, reduce scope
Transfer
Shift impact to a third party (note: does not eliminate threat).
Strategies for Examples: Buy insurance, issue a contract (Cost Plus)
11.5.2.1 Negative Risks
(Threats) Mitigate
Lessen impact or probability of occurrence.
Examples: Utilize redundancy for critical systems, NASA
Accept
Do nothing and address when/if it occurs.
Example: Active acceptance – use contingency reserve
Secondary and Residual Risks
Secondary Risks
Risks that arise as a direct result of implementing a risk response.
Example: Request new project resources to replace poor performers –
what can happen?
Residual Risks
Risks that remain after risk responses have been implemented.
Example: You execute a risk response strategy for a project during
hurricane season but a hurricane may still occur.
Strategies for Negative Risks (Threats)
Situation: Company’s data center is in a hurricane zone.

Risk: Loss of data center after major storm.
Options: What are they?
Avoidance:
Transference:
Mitigation:
Acceptance:
Strategies for Negative Risks (Threats)

Situation: Company’s data center is in a hurricane zone.
Risk: Loss of data center after major storm.
Options:
Avoidance:
Avoidance
Move data center
Secondary Risk: longer response times
Transference:
Transference
Insurance is only monetary it wont keep the data center up
Outsource the data center & hold the contractor responsible
Residual Risk: Outsourcer’s disaster recovery plan does not work
Mitigation:
Mitigation
Create disaster recovery plans (e.g.: spare hardware for the most critical elements of
the data center, or backup data center located elsewhere)
Acceptance:
Acceptance
Passive: Do nothing now. Develop a workaround on the fly if it happens.
Active: Do nothing now but have a contingency plan and the funding to implement it

(cont’d)
Exploit
Ensure an opportunity is realized, eliminate uncertainty.
Example: Assign “A Team” to project
Share
Strategies for Allocate partial opportunity ownership to get “an edge”.
11.5.2.2 Positive Risks or
Opportunities Examples: Risk sharing partnership, joint venture
Enhance
Increase the probability or impacts of an opportunity.
Example: Add resources to finish a task early
Accept
Take advantage of an opportunity if it occurs, don’t pursue.
Strategies for Positive Risks or Opportunities

Homework / Self Study
Situation: Define a situation

Risk: Define Positive Risks (Opportunities)
Options: Think about it - what are they?
Exploit:
Share:
Enhance:
Accept:

(cont’d)
Special Responses to be employed if triggered by events

Contingent
11.5.2.3 Response Sufficient warning is required to be effective.
Strategies
Example: Trigger - Missing intermediate milestone
Input from any group or person relating to any actions to be

taken on a specific identified risk.
Specialized education, knowledge, skill, experience or training in
risk responses.
11.5.3 Plan Risk Responses Outputs
Schedule Management Plan

Cost Management Plan
Quality Management Plan
Project Procurement Management Plan
11.5.3.1 Management
Plan Updates Human Resource Management Plan
Scope Baseline
Schedule Baseline
Cost Baseline
Risk Register Updates

Project Assumptions Log Updates
11.5.3.2 Document
Updates Technical Documentation Updates
Change Requests

With
Unable to Apprvd
IT Mod Avoid,
meet 15- Sponsor PM
1 Tech Resource Brian 0.4 0.6 0.24 impact to extend
project Jun Chg Jeff
Availability sched sched
schedule Rqst

Fixed
Inability to Transf Price
Project Mod
complete 22- er risk Cont PM
project Jun with Limits Jeff
negotiate goals
goals contrct Addtl
Risk
With
Accept
Project Signf Apprvd
Scope 30- use PM
3 Cost Budget Jeff 0.8 0.7 0.56 impact to Sponsor
Creep Jun Cont Jeff
Overrun cost Chg
Resrv
Rqst
Control Risks Process

Knowledge Area
11.2 Identify Risks

11.6 Control Risks

Definition: “The process of implementing risk response plans,
tracking identified risks, monitoring residual risks,
identifying new risks and evaluating risk process
effectiveness throughout the project.”

11.6.1 Control Risks Inputs
Project
Contains the Risk Management Plan, which provides guidance for
11.6.1.1 Management
risk monitoring and control.
Plan
Contains key inputs such as
identified risks and owners,
agreed upon risk responses,
controls to assess the effectiveness of response plans,
11.6.1.2 Risk Register specific implementation actions,
symptoms and warning signs of risk,
residual and secondary risks,
watch list of low-priority risks,
time and cost contingency reserves.
11.6.1 Control Risks Inputs (cont.)
Performance data includes, but is not limited to,

Work deliverable status,
11.6.1.3 Performance
Data schedule progress and
costs incurred.
Project work performance information (over time) that includes:
Work Variance analysis,
Reports Earned value data and
Forecasting data
11.6.2 Control Risks Tools & Techniques
Risk A risk review to determine if risks are still valid, need to be

11.6.2.1
Reassessment updated or closed, as well as the addition of new risks.
Execution of audits is usually specified in the Risk Management

11.6.2.2 Risk Audits Plan for the purpose of evaluating the effectiveness of risk
responses as applied to identified risks
Control processes that measure and compare planned results vs.

Variance and actual results. (i.e. Earned Value Analysis)
11.6.2.3
Trend Analysis Variances in expected results may indicate the impact of threats
or opportunities.
Compares technical accomplishments to the schedule of technical
achievement.
Technical
Requires objective quantifiable measures of technical
performance. i.e. transaction times; delivered defects, etc.
Measurement
Deviations of these may identify the technical risk encountered in
the project.
11.6.2 Control Risks Tools & Techniques
Measures the positive or negative impacts of project risks on

Reserve
11.6.2.5 budget or schedule contingency reserves, as well as the amount
Analysis
of remaining reserves to support remaining risks.
11.6.2.6 Meetings Should provide a regular forum for Risk discussion with the team
11.6.3 Control Risks Outputs
Work Work Performance Information , as an output of Control Risks,

11.6.3.1 Performance provides a mechanism to communicate and support decision
information making within the project.
Recommended corrective actions may be required to support

Change contingency plans/workarounds for known/unknown risks, a.k.a..
11.6.3.2
Requests Recommended preventive actions are taken to reduce the
probability of negative consequences of project risks.
Project Should be updated if any change requests impacted the risk

11.6.3.3 Management management processes.
Plan Updates
11.6.3 Control Risks Outputs (cont.)
The Risk Register, as well as other project document updates may

be required as a result for controlling risks. Risk Register updates
Project may include:
11.6.3.4 Document Outcomes of risk assessments, risk audits and periodic risk
Updates reviews
Actual outcomes of the project’s risks and of the risk
responses.
The Risk Management process produces information that may be

useful in future projects.
Other Organization Process Assets may include, but are not limited
Organization to:
11.6.3.5 Process Assets • Templates for the risk management plan
Updates • Templates for the Probability and Impact Matrix
• Templates for the Risk Register
• Risk Breakdown Structure and
• Lessons Learned from the project’s risk management
activities.

With
Projct
Unable to Apprvd
IT Mod Avoid, on Tech
meet 15- Sponsor PM 31 -
1 Tech Resource Brian 0.4 0.6 0.24 impact to extend sched Tasks
project Jun Chg Jeff Oct
Availability sched sched Risk Cmplt
schedule Rqst
Closed

Fixed
Inability to Transf Price Cont
Project Mod
complete 22- er risk Cont PM Cmplt 16 - Cont
project Jun with Limits Jeff Risk Aug Cmplt
negotiate goals
goals contrct Addtl Closed
Risk
With
Accept Proj
Project Signf Apprvd
Scope 30- use PM No 25 - within
3 Cost Budget Jeff 0.8 0.7 0.56 impact to Sponsor
Creep Jun Cont Jeff Chg Nov revised
Overrun cost Chg
Resrv budget
Rqst
Risk Fact Review

Risk The most important item to cover at team meetings.
Risk auditors examine and document the effectiveness of the risk response in
Project Risk
avoiding, transferring, or mitigating risk occurrence as well as the effectiveness of
Response Audits the risk owner. Done throughout project life cycle.
Earned Value Used for monitoring overall project performance against a baseline plan.
Analysis Deviations from the project baseline may be risk triggers.
Time and money for known unknowns.

Contingency
Added on top of the estimate.
Reserves
Made part of the cost baseline.
Time and money for unknown unknowns.

Management Added on top of the estimate.
Reserves Made part of the project budget, not the baseline.
Some organizations have policies on management reserves.
Fallback Plans A plan of action if contingency plans are not effective. “Plan C”
Unplanned responses to emerging project risks that were previously accepted

Workarounds (passively) or unidentified. Must be documented and incorporated into the project
plan and risk response plan.
Risk Question Review
When should risk management first take place?
When is corrective action most costly?
When is “scope” risk highest?
When is “cost” risk highest?
Are product defects a project risk?
Who is responsible for risk?
Who is accountable for risk?
Sample Risk Documents
Cause & Effect Diagram
Risk Breakdown Structure (RBS) - Sample
IT Project
Project
Business Technical Organizational
Management
Executive
Competitors Hardware Estimates
support
Suppliers Software User support Communication
Cash flow Network Team support Resources
Probability Impact Matrix - Sample
Expected Monetary Value (EMV) - Example
Risk Register Sample
Good Luck!!
©2013 Long Island Chapter of the Project Management Institute ALL RIGHTS RESERVED

Project Management - 10

Uploaded by

Copyright:

Available Formats

You might also like

Project Management - 10

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Project Management - 10

Uploaded by

Copyright:

Available Formats

Project Risk Management

PMP Prep Course – PMBOK 5th Edition – Version 5.0

Project Risk Management Definition

A subset of project management that

UNCERTAINTY - the absence of any information related to a desired outcome.

RISK APPETITE - the degree of uncertainty an entity is willing to accept in anticipation of a

RISK TOLERANCES - the degree, amount, or volume of risk that an organization or

RISK THRESHOLD - a measure of uncertainty or impact at which a stakeholder may have

CONTINGENCY RESERVES - time or money added to the plan to handle “known

MANAGEMENT RESERVES - time or money added to the plan to handle “unknown

Project Risk Management Objectives

Increase the probability & impact of opportunities

Decrease the probability & impact of threats

Simple & Clear-cut goals!

Why is Risk Management Necessary?

Six Step Approach to Handling Project Risk

1. Make a plan that address’ steps 2-6 in detail

To hold it all together, form a risk register in step 1, update in 2 thru 6

Six Step Approach - Concepts

Completely analyzing and planning responses to all risks is

Project Risk Management Processes

11.1 Plan Risk Management

11.2 Identify Risks

11.3 Perform Qualitative Risk Analysis

11.4 Perform Quantitative Risk Analysis

11.5 Plan Risk Responses

11.6 Control Risks

Plan Risk Management Process

Project Management Process Groups

11.1 Plan Risk Management

11.2 Identify Risks

11.4 Perform Quantitative Risk Analysis

11.5 Plan Risk Responses

11.1 Plan Risk Management

PMBoK® Guide, 5th Edition, p. 313

11.1.1 Plan Risk Management Inputs

Provides various inputs such as high-level risks, high-level project

Stakeholder Lists all details related to a project’s internal and external

11.1.2 Plan Risk Management Tools and

11.1.3 Plan Risk Management Outputs

Risk Assign resources and estimate costs for Risk Management to

11.1.3 Plan Risk Management Outputs (cont’d)

Example Set of Risk Categories

11.1 Plan Risk Management Facts

The Risk Management Plan does not address responses to

Organizational assets are improved by lessons learned

Fact: Good Risk Management depends on good communications.

Identify Risks Process

Project Management Process Groups

11.1 Plan Risk Management

11.2 Identify Risks

11.4 Perform Quantitative Risk Analysis

11.5 Plan Risk Responses

11.2 Identify Risks

PMBoK® Guide, 5th Edition, p. 319

Normal risk of doing business. Includes threats and

Threat Risk that presents a possible loss.

Opportunity Risk that presents a possible gain.