Friday, March 2, 2012

Beginners Guide To Project Management
Part 14, The Risk Management Plan

Projects have a lot of uncertainty mainly due to the unique nature of its results. Some of this uncertainty is impossible to manage: you'll never know when an economic crisis will hit or some law changes or an earthquake hits. But there are other risks that you can protect your project from, and some opportunities you can turn into actual benefits and this part of the Beginners Guide to Project Management is about them - planning for risks and opportunities.


Previously on the “Beginners Guide to Project Management”

Introduction

Initiating

Planning


So what is a risk?
A common definition for risk in the context of Project Management is a likely future event that impacts your project if it occurs. While this is fine as a definition, I have some trouble with it. Suppose the following scenario. You have to buy a lot of stuff for your project for a huge organization that this particular supplier is eager to have as a client. So there's a chance that you'll get the stuff you need for you project for a cost way below the market price. This, as the previous definition of risk goes, is a risk. But just try saying to someone: there's a risk our project can save 500.000 USD if we get this supplier working for us. Does that sound right? Not to most people.

Risks and opportunities
So I like these two better: a risk is a likely future event that will damage your project if it occurs; and an opportunity is a likely future event that will benefit your project if it occurs. Although everything I'll talk about risk is also applicable to opportunities, the semantics are much better this way and everyone will intuitively understand what you, as a project manager, are talking about.

What is a likely event?
Well, I have to give you the consultant answer to this one: it depends. Suppose you're doing a project in a region with high seismic activity, say San Francisco. If your project is to make an outdoor ad, you'll probably don't want to consider an earthquake as a risk. But if you're project is lengthy and will suffer a lot in the case an earthquake does hit, you'll probably want to consider it a risk. This would be the case of any major construction project (where in fact the deliverables would most likely have to comply to several quality requirements related to earthquakes). But this is me. People and organizations have different risk tolerances and so any other person could perceive the "likely event" of an earthquake (or any other for this matter) differently.

Assumptions
Any assumption you make will generate either a risk or an opportunity, the reason being that if you're assuming that (i) it isn't certain and (ii) it will somehow impact you project if it doesn't occur. What I do with assumptions is to use the most likely scenario for the assumption and the least likely scenario as a risk or opportunity. Suppose you're planning a wedding in London. I would assume that it would be a rainy day and consider the opportunity of sunshine. But if I was to plan a wedding in a sunny place like Portugal, I'd assume it would be on a sunny day and consider the risk of rain.

On to the planning
So how can you deal with the unexpected and how do you plan for it? If you check the Project Management Book of Knowledge, Risk Management is the area that has changed the most between editions. So there is no one way to deal with it but in compensation there is a lot you can do that goes beyond the purpose of this beginners guide. But however you deal with it, there are 2 outputs of planning that are essential and should be present in every project:
  • The Risk Management Plan and
  • the Risk Register

Risk Management Plan
This plan should be clear about how you will deal with risks and opportunities and should always include:
  • Risk threshold, that is, how much risk is acceptable in your project
  • Responsibilities, that is, who will be responsibility for what related to risk
  • Methodology, how will you deal with risks (for instance, which type of risks will generate a contingency plan)
There's a lot more you can include, and actually should in some projects, but this is the very minimum that you should always consider about risks and opportunities in any project.

Risk Register
The risk register is the one place to put all your risks and opportunities. My ideal format for this is a table with the following columns:
  • Identified on
  • Closed on
  • Responsible
  • Cause
  • Risk/opportunity
  • Impact
The text entered under Cause, Risk/opportunity and Impact should allow you to read each line in the risk register as follows:
Because of Cause it can be that Risk/opportunity which would Impact

This is great because if forces you to identify each risk's (and opportunity) cause and it's impact in a very clear form.

Focus on the most important
But what can you do with this list of risks? The first thing to do is to rank them somehow. What I always do is to associate to each risk and opportunity values for probability and impact in case they occur. These are both in the same scale (you'll often see a scale from 1 to 5 where 1 is for low probability/impact and 5 is for high probability/impact) and to rank your risks you do it by probability x impact like shown bellow.



The higher the rank the more significant is the risk or opportunity to you, so start working on those first.

Act accordingly
There several different ways you can act upon risks and opportunities and it's up to you to decide or recommend the way to deal with each one of them. The following are the type of things you can do about risks:
  • Avoidance: this is what you do when you eliminate the probability of the risk happening. In the case of the risk on earthquakes, that could be relocate the project to a low seismic activity region.
  • Transference: when you transfer part of the impact to a third party such as the case of insurance or contractual penalties. In the case of the supplier delivering late, it could mean contractual penalties for each day the supplier is late - it doesn't make the risk go away but it diminishes its impact
  • Mitigation: when the probability and/or impact is lowered. In the case of the late delivery risk this could mean partial deliveries or tracking, monitoring and control of the product manufacturing.
  • Acceptance: when you do nothing about it. This is a reasonable when you can't do nothing about it or it isn't worth it. You could just accept the fact the an earthquake can occur because you can't relocate or get insurance or whatever.
As for opportunities, there are also some strategies available (basically the opposite of the ones available to risks).
  • Exploitation: when you eliminate the uncertainty of the opportunity assuring that it will occur. You can negotiate with a supplier in order to get the discount you aimed for.
  • Sharing: increasing the opportunity by sharing the benefit such as in a joint venture.
  • Enhancing: increasing the probability of the opportunity.
  • Acceptance: just like with risks, it could be that you just accept there's a change to get some benefit but do nothing about, either because you can't or it just isn't worth the effort.
Acting in this sense is not to take action but to plan it: you can plan to accept one risk, share an opportunity and accept another.
And finally...
...you add this information about the risks and opportunities into the risk register, nominate someone responsible and get going with your project. Keep in mind that risks and opportunities can come and go (once the supplier delivers whatever he was to deliver there's no more risk on a late delivery, is there?) and that it is a very, very active part of the planning that interconnects everything up to here.
In fact, I'll tell you a little secret of back when I was a trainer: although I always had my training sessions carefully planned, I seldom followed the plan. When talking to people about their experience on the subject to address there always seemed to be something better to follow than what I had initially planned. But this was also into the plan, as without this talks I would be forced to just follow the plan. So please, please seek those opportunities, they're out there!
I tried to cover the basics of risk planning here but after reading this article from start to end but there's just too much about and around Risk Management...

Image from http://www.georgehart.com/

Posted by

No comments: