Risk Identification

A more disciplined process involves using checklists of potential risks and evaluating the likelihood that those events might happen on the project. Some companies and industries developed risk checklists based on experience from past projects. The Construction Industry InstituteConstruction Industry Institute Cost/Schedule Task Force, Management of Project Risks and Uncertainties (Austin, TX: Construction Industry Institute, 1989). developed a detailed checklist of potential risks based on the experience of several large construction companies executing major construction projects. These checklists can be helpful to the project manager and project team in identifying both specific risks on the checklist and expanding the thinking of the team. The past experience of the project team, project experience within the company, and experts in the industry can be valuable sources for identifying potential risk on a project.

Identifying the sources of risk by category is another method for exploring potential risk on a project. Some examples of categories for potential risks include the following:

• Technical
• Cost
• Schedule
• Client
• Contractual
• Weather
• Financial
• Political
• Environmental
• People

The people category can be subdivided into risks associated with the people. Examples of people risks include the risk of not finding the skills needed to execute the project or the sudden unavailability of key people on the project. David HillsonDavid Hillson, “Using a Risk Breakdown Structure in Project Management,” Journal of Facilities Management 2, no. 1 (2003): 85–97. uses the same framework as the work breakdown structure (WBS) for developing a risk breakdown structure (RBS)Organization of risks associated with each activity in the work breakdown structure using a similar graphic approach.. A risk breakdown structure organizes the risks that have been identified into categories using a table with increasing levels of detail to the right.

Risks in John’s Move

In John’s move, John makes a list of things that might go wrong with his project and uses his work breakdown structure as a guide. A partial list for the planning portion of the RBS is shown below.

Figure 11.1 Risk Breakdown Structure (RBS)

The result is a more obvious understanding of where risks are most concentrated. Hillson’s approach helps the project team identify known risks but can be restrictive and less creative in identifying unknown risks and risks not easily found inside the work breakdown structure.

Risk Evaluation

After the potential risks have been identified, the project team then evaluates the risk based on the probability that the risk event will occur and the potential loss associated with the event. Not all risks are equal. Some risk events are more likely to happen than others, and the cost of a risk event can vary greatly. Evaluating the risk for probability of occurrence and the severity or the potential loss to the project is the next step in the risk management process.

The Construction Industry Institute conducted a study of large construction project risk evaluation and categorized risk according to the potential impact of project costs. High-impact risk consisted of risks that could increase the project costs by 5 percent of the conceptual budget or 2 percent of the detailed budget. Only thirty potential risk events met these criteria. These were the critical few potential risk events that the project management team focused on when developing a project risk mitigation or management plan. Risk evaluation is about developing an understanding of which potential risks have the greatest possibility of occurring and can have the greatest negative impact on the project. These become the critical few.

Figure 11.2 Risk and Impact

There is a positive correlationTwo variables that respond in the same way to change in their environment.—both increase or decrease together—between project risk and project complexity. A project with new and emerging technology will have a high-complexity rating and a correspondingly high risk. The project management team will assign the appropriate resources to the technology managers to assure the accomplishment of project goals. The more complex the technology, the more resources the technology manager typically needs to meet project goals, and each of those resources could face unexpected problems.

Risk evaluation often occurs in a workshop setting. Building on the identification of the risks, each risk event is analyzed to determine the likelihood of occurring and the potential cost if it did occur. The likelihood and impact are both rated as high, medium, or low. A risk mitigation plan addresses the items that have high ratings on both factors—likelihood and impact.

Not all project mangers conduct a formal risk assessment on the project. There are barriers to identifying risks. David Parker and Alison MobeyDavid Parker and Alison Mobey, “Action Research to Explore Perceptions of Risk in Project Management,” International Journal of Productivity and Performance Management 53, no. 1 (2004): 18–32. found in a phenomenological study of project managers that there was a low understanding of the tools and benefits of a structured analysis of project risks. The lack of formal risk management tools was seen as a barrier to implementing a risk management program. The level of investment in formal risk management was also associated with managerial psychological dimensions.

Some project managers are more proactiveMaking decisions and taking action to anticipate an expected difficulty. and will develop elaborate risk management programs for their projects. Other managers are reactiveMaking decisions and taking action in response to events. and are more confident in their ability to handle unexpected events without prior planning, while some managers are risk averseA project manager or decision maker who avoids taking risks. and prefer to be optimistic and not consider risks or to avoid taking risks whenever possible.

On projects with a low complexity profile, the project manager may informally track items that may be considered risk items. On more complex projects, the project management team may develop a list of items perceived to be higher risk and track them during project reviews. On projects with greater complexity, the process for evaluating risk is more formal with a risk assessment meeting or series of meetings during the life of the project to assess risks at different phases of the project. On highly complex projects, an outside expert may be included in the risk assessment process, and the risk assessment plan may take a more prominent place in the project execution plan.

On complex projects, statistical models are sometimes used to evaluate risk because there are too many different possible combinations of risks to calculate them one at a time. One example of the statistical model used on projects is the Monte Carlo simulationA simulation that uses statistical processes to evaluate risk., which simulates a possible range of outcomes by trying many different combinations of risks based on their likelihood. The output from a Monte Carlo simulation provides the project team with the probability of an event occurring within a range and for combinations of events. For example, the typical output from a Monte Carol simulation may reflect that there is a 10 percent chance that one of the three important pieces of equipment will be late and that the weather will also be unusually bad after the equipment arrives.

Risk Mitigation

After the risk has been identified and evaluated, the project team develops a risk mitigation plan, which is a plan to reduce the impact of an unexpected event. The project team mitigates risks in the following ways:

• Risk avoidance
• Risk sharing
• Risk reduction
• Risk transfer

Figure 11.3 Risk Mitigation

© 2010 Jupiterimages Corporation

Each of these mitigation techniques can be an effective tool in reducing individual risks and the risk profile of the project. The risk mitigation plan captures the risk mitigation approach for each identified risk event and the actions the project management team will take to reduce or eliminate the risk.

Risk Transfer

Figure 11.4 Risk Transfer

© 2010 Jupiterimages Corporation

Risk transferRisk transfer is the risk mitigation process of shifting the possible negative impact of an event to a party outside the project. is a risk reduction method that shifts the risk from the project to another party. The purchase of insurance on certain items is a risk transfer method. The risk is transferred from the project to the insurance company. A construction project in the Caribbean may purchase hurricane insurance that would cover the cost of a hurricane damaging the construction site. The purchase of insurance is usually in areas outside the control of the project team. Weather, political unrest, and labor strikes are examples of events that can significantly impact the project and that are outside the control of the project team.

Contingency Plan

The project risk plan balances the investment of the mitigation against the benefit for the project. The project team often develops an alternative method for accomplishing a project goal when a risk event has been identified that may frustrate the accomplishment of that goal. These plans are called contingency plans. The risk of a truck drivers strike may be mitigated with a contingency plan that uses a train to transport the needed equipment for the project. If a critical piece of equipment is late, the impact on the schedule can be mitigated by making changes to the schedule to accommodate a late equipment delivery.

Contingency funds are funds set aside by the project team to address unforeseen events that cause the project costs to increase. Projects with a high-risk profile will typically have a large contingency budget. Although the amount of contingency allocated in the project budget is a function of the risks identified in the risk analysis process, contingency is typically managed as one line item in the project budget.

Some project managers allocate the contingency budget to the items in the budget that have high risk rather than developing one line item in the budget for contingencies. This approach allows the project team to track the use of contingency against the risk plan. This approach also allocates the responsibility to manage the risk budget to the managers responsible for those line items. The availability of contingency funds in the line item budget may also increase the use of contingency funds to solve problems rather than finding alternative, less costly solutions. Most project managers, especially on more complex projects, will manage contingency funds at the project level, with approval of the project manager required before contingency funds can be used.