Risk

Risk

1. Definitions

   • Risk Management
     • Looking into the future trying to assess the possible outcome of the project
   • Deviation from the forecast, with a negative or positive impact on the project
   • Risk & Uncertainty
     • Risk is quantifiable
     • Uncertainty is not quantifiable
   • Branches
     • Safety - related to risk assessment of hazards
     • Insurance - assessment of risk based on the context of the policy
     • Financial - uncertainty of making a return

2. RIsk Management Process

   • 1.Identify all possible events, estimate their effects and determine their probability of occurance
     • Types of Risk
       • Internal & External
         • Internal are associated with the project itself (completion of activities in a certain way) while the external with third parties, economy or world event.
       • Contractual
         • Identifying contractual risks will require an examination of the contract terms
         • Particular
           • Definitive allocation of risk.
         • Fundamental
           • Natural events which are outside of the control of any party (flood, war).These risks can again be identified through the contract.
         • Speculative
           • The risk of losses accruing from events should also be established within the contract Disruption to the works because of exceptional weather conditions would be one example of a speculative event.
       • Controllable & Uncontrollabe
         • Under own control
           • activities that are directly under the control of the project parties determining the risks associated with each action, a list of risk events can be determined
         • Control of others
           • individuals and organisations outside of the direct project organisation statutory authorities who may be controlling the supply of services to the project
         • Control of government
           • legislative authorities can produce risks that influence the project alter the tax rate
         • Outside of control
           • outside of human control Natural disasters and environmental effects
       • Dependent and independent
         • Dependent risks risks associated with specific decisions independent risks risks which arise regardless of the decisions made.
       • From who is involved
         • Key parties
           • main participants in the project ·         The skills experience and track record of each party can be analysed to identify any potential risk they may bring with them into the project.
         • Regulatory bodies
           • authorities involved with granting approvals
         • Competitors
           • rival firms An analysis of rivals, with an assessment of their possible response
         • Contracts
           • Key risks should be identified within the contracts, and a risk assessment will ensure that all risks are included within the contract documentation
       • Nature of Technologies used (old or new)
       • Method of working on the project
         • Availability and reliability of resources, and subsequent analysis of the risk associated with them.
       • Time-frame
         • MACRO level we can consider the overall start and finish dates for the project and the feasibility of completing the work within the timeframe. MICRO level we can examine the timing of individual activities, and their relationship to other work within the project.
     • Brainstorming
       • large number of potential ideas in a short space of time trying to generate a significant quantity of potential risks. Critical to the success of brainstorming is that we complete the process in a free and open atmosphere, where people are encouraged to share as many ideas as possible without criticism or comment. where team members are not contributing to the brainstorming process and alternative method of generating ideas is to use the process of brain writing. In brain writing each team member is given a sheet of paper and encouraged to write one idea at the top of the page
       • Location
         • take the project team away from the normal office environment
       • Interruption
         • prevent the process from being interrupted
       • Size
         • when a project team is too large the contribution from all team members may be reduced it can be useful to divide a large team into several smaller groups who will work simultaneously on the same problem of generating risks, and then pool the results of each group at the end of the process
       • Event
         • to make the brainstorming session an event which everyone feels compelled to attend and contribute to ensure that all team members are present
     • Delphi Technique
       • The Delphi technique is a systematic method to gain judgement from a range of experts who have no direct role on the project, but who have considerable experience that they can contribute
       • benefits The panel is independent of the project, and will have no preconceptions or bias towards particular aspects of the project which can arise from using an internal team comprised of experts structured list of risks which can be used by the project team to plan their risk management strategy on the project.
       • weaknesses time and cost process viable for only the largest of projects The final output of the process can be variable, depending on the composition of the team and the dynamics of their operation. the team have no direct interest in the project, and therefore their motivation to generate a conclusive list of items will not be as high
       • Select panel
         • independent experts can act in an independent manner in the identification and assessment of risks
       • Brief on problem
         • This information will be provided in advance of any meetin
       • Round one
         • to identify the risks on the project
       • Round two
         • once the risks are identified, these will be collated and formed into an unstructured list of items rank in an order of importance ·         the results collated into a final list.
       • Round three
         • to assess the ranked list, and consider any further risks The aim of this second meeting is to finalise the list of risks into a structured order which can be given to the project team.
     • Root cause identification
       • understand past problems, to understand their cause and to highlight actions which may prevent their re-occurrence. Root cause identification is a tool to assess past problems, and to identify means of managing them in the future.
       • In completing a root cause identification of a major failure on a project, there can be resistance from the individuals involved on the project because of a fear of being identified with failure the team involved in the assessment focus on the process involved rather than trying to apportion blame to individuals. the evaluation is to improve the management of future projects. the team completing the review are independent of the project, The success of the process depends on the ability to get to the root of the problem
       • Establish facts
         • the individual auditing completing the process need to determine the timeline of events which led up to the risk occurring. purely fact-finding mission
       • Understand failure
         • the cause of the risk event needs to be determined. Often a risk will have occurred because there was a deviation from an established plan, ·         The aim is to identify where the actual events deviated from the planned process.
       • Find root cause
         • once the deviation is identified, the cause for the change needs to be established. ·        decision-making, leadership, management, environment and actions which brought about the deviation and the subsequent failure.
       • Risk reduction cause
         • a plan can be prepared to prevent future repetition of the event. ·         to ensure that a similar set of Root conditions cannot occur.
       • Evaluate effectiveness
         • regular reviews should be completed ·        to make sure that the plan is operating correctly and that there are no potential problems or weaknesses in the implementation.
     • Checklists
       • simply a list of items Alternatively the checklist can ask broad questions A generic list of risks can be prepared by a group of experts focus attention on to specific issues, rather than generating random and board list of items which are unrelated. It can also help to ensure that we have covered all possible areas for risks
       • The problem with a checklist is that it can be very broad and provide no indication of the importance of particular risks to a specific project. All risks will be of equal importance in the checklist It is also possible that some risks may not be identified on a checklist, either because they are too specific or the checklist is not sufficiently comprehensive One issue to consider in the use of checklists is the length of the list itself. If the list is too long and detailed then the process of using the list to evaluate a project can be to time-consuming, and not provide the best cost benefit to the project. Alternatively if a list is too short then it may be possible to miss critical risks on a project if the team rely solely on the list itself for identifying risks
     • Risk Register
       • risks have been identified it is useful to start to enter them into a central document which will act as a reference point for all the team members is a record of the risks associated with a project, and well identify appropriate response strategies and the role of all team members
       • Identified risks
         • the risks identified in the first stage of the risk management process should be listed within the register to record that they were considered at some stage within the project.
       • Probability of occurence
         • the chances of the risk occurring should be recorded against a scale which will range from certainty when the risk is anticipated to occur on the majority of projects, through to unlikely when the risk occurs only on a very small proportion of projects.
       • Impact
         • potential effect of the risk should it take place on the project
       • Response
         • a strategy to manage the risk potential effect of the risk should it take place on the project
       • Status
         • the current position with regard to the risk, and how it has been managed if it has been encountered on the project.
       • Responsibility
         • ·         the individual or organisation who has responsibility for dealing with the risk should it occur.
   • 3.Response to each event from 2. based on the RISK STRATEGY of the project
   • Data
     • 2. Use of formal techniques to determine possible outcomes
       • Qualitative techniques
         • Once we are satisfied with the quality of data and have resolved any issues associated with assumptions that have been made in the development of the risks, we are ready to start to analyse each risk to determine appropriate responses from the project team
         • All of these techniques are qualitative because they do not involve the use of numeric data to complete.  The techniques rely on the judgement of the project team to assess the nature of the risks, and their possible impact on the project.
         • Stakeholder Analysis
           • A stakeholder could be considered to be anyone who has an interest in the project. The two main types of stakeholders are primary and secondary stakeholders. Primary stakeholders are those having a direct influence on the project, or are affected by the project outcomes Secondary stakeholders are those who will have less of an influence or may be indirectly affected by the outcomes of a project.
           • The results of a stakeholder analysis can be summarised in a table for each of the parties involved in the project. The table will allow us to summarise the decision-making in our risk assessment, and determine appropriate strategies for dealing with risks when associated with particular stakeholders
           • 1. Identify stakeholder
             • ·        to establish all the parties who will have an interest in the project, whether primary or secondary.
           • 2. Area of interest
             • establish where their interest in the project might be ·         the client will have a specific interest in the successful delivery of the project. Other stakeholders will have very specific elements that are of interest to them, for example the glazing systems subcontractor will be interested in the cladding and windows and doors on the project only.
           • 3.Risk impact
             • how the stakeholder will be affected by particular risks.
           • 4. Risk influences
             • to determine the extent to which each stakeholder can have an influence over the risks and sources of risks within the project. setting constraints
           • 5. Risk attitude
             • the attitude of each stakeholder to the risks that may arise within the project
             • Risk averse
               • want to avoid risks, or where risks exist they will expect some incentive or financial compensation to be provided to encourage them to take the risk
             • Neutral
               • willing to tolerate some risk, but will evaluate the risk: return ratio to establish the benefits of taking a risk compared to the financial benefits of the project
             • Risk taker
               • an individual who will accept a higher exposure to risk, and in some situations may even seek risk because they are willing to be exposed to the potential for failure in return for a higher profit.
           • 6. Risk response
             • to determine the appropriate response for risks associated with this stakeholder
             • This will be a balance between the impact of potential risks and the risk attitude of the individual
             • ·         Where the risk impact could have significant effects on the stakeholder viability, and the attitude of the individual is to be risk averse, then the risk response may be to pass on risk to other individuals rather than retain it with the stakeholder. In contrast where the risk impact is on less significant items to the stakeholder, and their risk attitude is to take risks, then the risk response may be to accept the risk and retain it for themselves. The risk response will be a judgement taken by the project team as a result of an analysis of each of the stakeholders.
           • 7. Risk management
             • the strategy to be adopted within the project to manage risks which will affect each of the stakeholders. The management policy will depend on the risk response we have just identified. design a contract which will allocate a risk to the parties most able to manage and are willing to accept the risk
         • Risk Urgency Assessment
           • focuses on when a risk is likely to take place, and considers the urgency of a response allowing us to prioritise a risk strategy It would make sense for us to allocate our resources and management to urgent risks that are likely to occur in the near future aspects of the timing how soon is it likely to occur The second aspect of timing is the need for a strategy to deal with the risk. Some risks although occurring further into the future may need strategies in place earlier In contrast some risks that are much earlier may not need such complex planning to resolve and we can delay the development of strategies until nearer the time. The risk management will therefore need to have a means of identifying the warning signs of when a risk is likely to occur, so that strategies can be devised and developed before a serious problem arises
           • Risk symptoms
             • likely signs within the project or its environment
           • Risk rating
             • how serious is the possible risk outcome to the project
           • Risk ranking
             • within the management team we need a means of deciding where to prioritise management effort, to ensure that this is directed to the risks that are most urgent ·        As the project progresses this focus will change as new risks arise, and other risks are successfully dealt with it.
         • Defence in Depth
           • is derived from a military strategy The basic concept of the technique is to delay an attack on vulnerable positions by creating a buffer which would allow the military to yield some space to a risk, but which in effect buys time for defences to the enhanced and allow important elements to be better protected
           • Vulnerability
             • potential weaknesses within the project
             • Venn diagram
               • shows the interrelationship between these three aspects of our risks
               • Vulnerable systems
                 • parts of our project which may be weak no critical parts may accept that there are weaknesses within these areas
               • Critical project elements
                 • aspects of the project which are critical to the overall success of the project itself. ·         to respond quickly to prevent a serious problem arising, and we will need to monitor these elements to check for potential risks as the project progresses.
               • Possible threats
                 • at present they do not either affect a weakness within the project or a critical system. ·         , and we can decide to monitor them to ensure they do not escalate or become a threat in the future. We may not need at this stage to develop strategies to respond any further than this.
               • Vulnerable elements
                 • critical elements of the project which have some known weaknesses, but which at present have no known threat which could compromise their position need closer management, and ideally we should be trying to remove the weakness so that the risk is not threatened at any later stage in the project
               • Critical elements that are vulnerable and threatened
                 • these are the most important elements within the project for risk management and control.
                 • Active risk management policies will need to be adopted for risks that exist within this category
               • Threats that could exploit vulnerable elements
                 • where there are known weaknesses within the project, with threats that could directly affect these items, then we will need to exercise some management control over these risks.
               • Elements that are threatened
                 • ·         risks may be known which will affect critical aspects of the project. At this stage these critical systems within the project do not possess known weaknesses which the threat can exploit, but we need to monitor closely these risks to ensure that no weaknesses do become exposed.
               • Response Mechanism
                 • Criticality (Preventive)
                   • to define that critical elements that are at risk in the project, and determine how much protection they may need we can build a buffer into schedules ·         The criticality needs to establish the exact extent of buffer that is required in the system, and this will vary from one project to the next.
                 • System (Preventive)
                   • way of working that builds a trust in the system of identifying and managing risks we will have greater confidence in the system and will have less need of larger buffers. We can also use trusted partners who have worked on projects before
                 • Protect (Preventive)
                   • barriers that protect the parties when things do happen on the project.  The contract which details the responsibilities on the project, clarifies who should manage risks, and the payments on consequences .  Good backup plans
                 • Detect (Detection)
                   • ·         and seek to detect them early before they become a problem on the project.  A detection system will look for deviations in plans at an early stage, which might reflect a larger issue later in the project.
                 • React (Corrective)
                   • clear means of responding when events occur.  This will identify who is responsible for certain risks, and provide an outline of the actions they are expected to take
           • Threat
             • particular risks that might affect
           • Criticality
             • the important project elements that are vital to the project. If these elements are affected by the risk they could have a crucial effect on our ability to complete the project successfully.
         • Risk Factor Analysis
           • to view risks under broad classifications and for specific activities The four risks are all inter-related, with knock-on effects from one to another, so a technical risk could result in delays to the timing of the project, and affect the budget
           • The questions and issues raised in the risk factors are difficult to judge and evaluate for the project as a whole, so the analysis is completed on individual risk items to determine their relationship to each factor.  The risks are scored on a simple scale of 1 to 3 for each factor,
           • Technical
             • the ability to complete the task ·        What are the technical limitations or problems associated with the activity?
           • Schedule
             • complete the work in the time available?
           • Cost
             • is the budget sufficient to complete the work?  What items are not fully costed, but may just be provisional sums and could change in the future? 
           • Finance
             • ·         how is the project to be funded?  How much flexibility exists in the funding to allow the budgets to change?  What are risks of funding not materialising, or being withdrawn?  How could changes in timing or budget affect the financing of the project?
       • Quantitative techniques
         • Before we consider the two techniques it is important to remember that quantitative risk assessment tools rely on a different level of information to complete the analysis when compared to the qualitative tools discussed in the last unit quantitative techniques rely on the input of precise data concerning the nature, probability, and impact of risks. The techniques we will consider within this section have been derived from manufacturing industries, where processes and activities are repeated on a regular basis
         • Sensitivity analysis
           • This technique considers the relationship between a change in one variable on the project and the final project outcome. The aim is to assess the robustness of the project to change, and to determine the point where changes in specific items cause a critical impact on the project outcome
           • The benefits of using a sensitivity analysis is that it allows us to compare the risk associated with different options, and much our strategy for risk to the profile of risks on the project The sensitivity analysis also allows us to concentrate management efforts towards the items which have the greatest potential impact, and we can reduce our efforts to control less important items.
           • two major weaknesses as a technique fails to consider the chances of an event occurring, with each risk being shown on the diagram as having an equal probability of taking place . One way of overcoming this weakness is to include an envelope of probability onto our diagram
           • The second weakness with this technique is that it only considers events in isolation. In practice some risks could have a knock on effect
           • Determine project outcome
             • ·        we can plan the outcome of the project under normal conditions to provide us with a benchmark to compare alternative outcomes with. A variety of different project outcomes can be considered, the most common being budget, schedule and return. We may also consider the life-cycle of the project or the market conditions.
           • Establish key variables
             • we can determine the primary variables that may alter during the life of the project and have an impact on this outcome. The variables will depend on the outcome, with some variables only having an impact on one aspect of the project outcome. For example some changes in the project such as inflation or wage increases will have a significant cost impact, but would be unlikely to impact on the schedule.
           • Determine range of variability
             • ·         for each of the key variables we need to consider the scope for change within this particular item. The change can be both positive and negative, and our analysis will need to consider both outcomes. For example, the cost on a project may rise due to inflation, but the price of items may fall, and as a result the project may save money.
           • Calculate effects of change
             • ·        range of changes in the value of each variable we need to quantify the total impact on the final project. If the cost of wages is to rise by 2%, how much of an impact would this have on the final budget for the project? For each of the variables a series of incremental changes will be considered, with the impact on the final outcome measured, until we reached the limit of possible change within the variable.
           • Plot changes
             • the results of the change in each variable can be plotted in a graph, which is commonly known as a spider diagram
           • Assess results
             • determine the sensitivity of the project, and determine an appropriate response. The sensitivity of the project can be determined from the steepness of each individual curl.
         • Decision Tree
           • This technique considers the consequences of different decisions on a project, and assesses the exposure to risk associated with alternative choices. It is a useful technique when considering significant project decisions, because it allows us to evaluate the risks associated with alternatives and produce a calculated choice. Once each of the possible outcomes are identified we need to quantify the impact associated with each choice, and determine the probability of a particular outcome taking place. To complete the above diagram requires good historic data on the performance of alternative lifting solutions, to determine the range of productivity that can be achieved with each alternative and the financial benefits arising from each choice. Once we have determined the probabilities and values of each outcome we can determine the tree values, to determine the value to the project of each decision.
           • The analysis allows us to compare the risk associated with each choice The benefit of using this approach is to provide a logical analysis which considers all possible options in a choice, It allows the project team to see and evaluate alternatives, understanding the risks associated with each choice. The process is relatively easy to understand
           • difficult to gather such comprehensive data in the context of projects. Therefore this method needs to be approached with a degree of caution. appropriate to use this technique in situations where there are specific risks which need to be evaluated and which could have a significant effect on the project outcome
     • Understanding data/Data sources
       • Risk management plan
         • the plan will determine the general project risk strategy It will not identify all risks associated within the project, but will set out the general objectives to be achieved in risk management the key risks provide guidelines for decision-making in the project it will establish the risk response
       • Risk Register
         • central document a record of all risk decision-making on the project. As a source of data it identifies the risk that has to the assessed in the risk management process
       • Work breakdown structure
         • identifies the activities on the project, and should determine the relationship between tasks that have to be completed. important in establishing relationships and the possible implications of a risk on future tasks within the project to establish activities and how they are managed
       • Assumptions list
         • Each assumption that we make on the project will expose us to an element of risk A well-managed project should retain a list of assumptions evaluated at regular intervals assumptions list is valuable in identifying potential risks and quantifying their impact
       • Best practice guidelines
         • professional organisations, statutory authorities and industry bodies all reduce guidelines on good practice
     • Data testing
       • test the reliability of our data before using our risk analysis techniques. Two common methods of data testing are assumption analysis and data precision ranking.
       • Assumptions analysis
         • study the assumptions made on the project to determine the risk associated with them, and to decide on appropriate strategies to manage the data that is used by the assumptions
         • Stability of choice
           • ·         measured on a scale of 1 to 9 to reflect the stability of the data generated within the assumption. A score of 1 would indicate that the assumption is not stable and very likely to change, whereas a score of 9 suggests the data is reliable and unlikely to vary.
         • Consequences of choices
           • ·        the possible impact of the data being incorrect, to identify the situations where an outcome may be critical.
         • Revise assumptions
           • where the consequences of using incorrect data are significant it may be necessary to revise the assumptions
       • Data Precision Ranking
         • One way of trying to score the precision of the data is to rank each of the four questions on a scale of 1 to 10 The data generated during our risk identification phase will be used in the various risk assessment tools. The reliability of this data will determine the quality of the outcome of our assessment, and it is important to understand any bias or errors in the data which may compromise our results
         • How well is the risk understood
           • probability of the risk occurring and its possible impact. When a risk is poorly understood then it is more difficult to make precise judgements
         • What information exists on the risk?
           • past data on similar risks we may be able to extrapolate probabilities and impacts
         • Reliability of the source data?
           • ·         a reliable source that we have used and proved to be correct in the past, or is it an unknown source where we have no knowledge of how the data was collected and recorded.
         • Quality of the data?
           • ·        accurately measured over a period of time the quality of data will be high, but if this is only sporadic data gathered at irregular intervals then the data quality will be much poorer, and will affect the validity of our assessment tools.