Written by Admin on 21st November 2010.
Risk Management:
Risk management is a discipline for dealing with the possibility that some future event will cause harm. It provides strategies, techniques, and an approach to recognizing and confronting any threat faced by an organization in fulfilling its Projects mission. Risk management may be as uncomplicated as asking and answering three basic questions:
What can go wrong?
What will we do (both to prevent the harm from occurring and in the aftermath of an “incident”)?
Every project involves some degree of risk (“nothing ventured, nothing gained….”), but that risk can be controlled with a bit of careful analysis, planning and communication. As a project manager (or a manager dealing with projects), it is your job to anticipate project risks, and then to devise the means for controlling those risks before they can get out of hand. This is where the risk management process comes in…..
RISK MANAGEMENT DEFINED
Risk is all about the three questions: 1) What can happen? 2) What could result? 3) What can be done? Risk management is based on the need to anticipate and manage the elements of risk. If realized, risks can threaten the success of a project, both in terms of process and outcome. To effectively manage risk, threatening events and consequences should be probabilities, not merely possibilities.
Without a crystal ball, risk management can be a challenging process. But instead of just trying to see into the future, we can manage risk by looking at the past. By examining prior project, experiences you can get a better handle on risk probabilities. And if you can anticipate an event, you should be able to weigh the consequences, and control the outcome.
A Practical Process:
Although specifics may vary based on the nature and complexity of a project, an effective risk management process will have three key components:
Risk Identification
Risk Analysis and Assessment
Risk Response and Control
You will note the repeated use of the word realistic. This is to emphasize an important aspect of the risk analysis process… time spent analyzing risks that are possible, but improbable, will usually be an ineffective use of time and resources. While it is possible that a meteor will strike the earth in the midst of any given project, it is not probable, and certainly not something that can be realistically anticipated. This extreme example aside, it still can be said that to achieve the most effective analysis possible, it is best to keep identified risks realistic and probable. Overall, the goal is to develop a list of probable risks, and thus lay the foundation for the assessment and ultimate response to those risks, whether you choose avoidance, mitigation or acceptance.
The starting point in the risk analysis process is to consider the nature and complexity of the project at hand. Risk analysis will take time, and any steps taken to avoid or mitigate risk may negatively impact project schedules and budgets. Therefore, you want to carefully consider the effort to be put into risk management. A short term, non-production project, such as an internal review of purchasing procedures, would warrant limited risk analysis. However, the physical deployment of new purchasing systems, with the potential for operational disruption, could call for further risk consideration. In view of the operational impact, most technology projects deserve some degree of risk management.
Once you know that risk management is warranted, begin by identifying the types of probable risks. Depending upon the nature, complexity and duration of your project, you may encounter different types of risks. To facilitate identification and assessment, and to pave the way for clarity in thought and communication, group potential risks into categories. This will allow you to view risks according to type, source and underlying cause…..
The end result of this risk identification process should be a listing of likely project risks, organized by appropriate category. This list is your roadmap to the next step…..analyzing and assessing the impact of these risks, and then ultimately to forming an effective plan for response and control.
Controlling Project Risks
The risk management process begins with identification … to assess a project for potential risks that could threaten the project process itself, or the outcome. But identification is only the beginning.
Once probable risks are identified, they must then be assessed to determine the level of impact … will there be a negative impact, and how serious will it be? If the impact is serious, that raises another question …. is the negative impact so serious as to warrant further action?
This is a critical juncture in the risk management process. Every effort to control and mitigate risk has a price – in terms of time, money or resources. Before any action is taken to accept, avoid, or mitigate risk, these costs must be carefully considered.
Once you have identified and categorized probable risks to your project, you can turn to the assessment phase of the risk management process.
The goal of the risk assessment phase is twofold:
To determine the likely impact of probable risk.
To evaluate that impact in order to determine the need for further action.
5
Determine the Impact:
Identifying Project Risks
Now is the time to take out that crystal ball. In order to properly manage any threats to project success, you must first anticipate and predict the likely impact of probable risk. There is no magic formula for this prediction, just knowledge, common sense and experience.
The starting point for this type of risk assessment is predicated upon the existence and quality of project scope and goals. If you have clearly identified your project goals and priorities, then you will be able to use that knowledge to assess the impact and consequences of any probable project risks. For example, if you view probable risk and likely impact in context of overall project priorities, you will be in a better position to evaluate the need for targeted action.
To that end, with your identified risks in hand, you will now need to consider the following types of questions…..
Can this risk affect the quality of my product or project end-result?
Can this risk affect project budgets and costs?
Can this risk affect the project schedule?
Can this risk affect the project planning and management process?
Can this risk affect the stability of project work environment?
For each “yes”, you can then proceed to the next series of questions ….
Does this risk pose a sufficient threat to my project so that further action is warranted?
THE ANSWER = NO
If the answer is “no”, then the results of that analysis should be properly documented, thus declaring that no further action is warranted. Remember that the goal of risk management is not just to avoid risk, but to also apply logic and reality to any decisions and strategies for dealing with risk. If, at this point, you can acknowledge risks, and logically decide to take no further action, your goals in risk management will be realized.
THE ANSWER = YES
However, if the answer is once again “yes”, thus acknowledging the need for further action, then continued assessment should proceed.
Once you acknowledge the possibility of impact, and the need for further action, you will then need to look at the issue of consequences. For example, you may know that a delay in network card delivery could impact a desktop installation project, but how will that delay affect the overall project …. will that one delay affect the entire schedule, or can other parallel activities help to make up for that lost time? The answers to these types of questions will help you to pinpoint the likely consequences of a given risk.
TAKE ACTION …
With this information in hand, you can then evaluate the need for mitigation and control.
If something happens, how will we pay for it? Simply speaking, a risk is any uncertainty about a future event that threatens your organization’s ability to accomplish its mission. Although your “fund balance” may be small, and equipment may be second generation, your nonprofit has vital assets at risk. Nonprofit assets fall into the following categories.
People — board members, volunteers, employees, clients, donors, and the public. Property — buildings, facilities, equipment, materials, copyrights, and trademarks. Income — sales, grants, and contributions.
Goodwill — reputation, stature in the community, and the ability to raise funds and appeal to prospective volunteers.
Consistent risk management is one of the keys to the success of a project and must always be applied at the right time in the course of all project phases, from the tendering right through to project conclusion. The Risk Management process defined sample formats as per the write up enclosed below and normally organizations needs to be adhered strictly to their risk mitigation processes, base upon their policies.
Organization Risk Process Sample Format:
Risk Management Process in GAUTAM KOPPALA ORG India
The Risk Management process has been introduced in GAUTAM KOPPALA ORG since December 2000.
GAUTAM KOPPALA ORG became a full fledged business group within GG Inc. effective 23.02.2004 and has since then imbibed this philosophy gradually.
Today’s business environment is subjected to stiff competition, globalization of markets, complex technologies, projects having a faster cycle time coupled with tricky contractual conditions. As an outcome of these factors there is an exposure to a large number of risks that arise in the ordinary course of business.
The current profile of GAUTAM KOPPALA ORG business is approx 75% solution business and the balance being the product business. The solution business typically revolves around supply of a spectrum of standard products from the various GG Inc. factories, and customizing / integrating the standard software around the hardware supplied so as to offer a complete solution to the customer.
The business is heavily dependent on imports from GG Inc., with absence of local manufacturing, local value addition is in the form of panels, cables, conduits and installation services and project management. There are no “tailor made” goods or made to order products, therefore the risk profile of the business to that extent is lower.
With this background, the risk management process within GAUTAM KOPPALA ORG has been structured accordingly to review and manage:
Technical Risks
Commercial/Contractual risks
Operational risks like currency fluctuation, liquidated damages etc
Risk Management process in GAUTAM KOPPALA ORG does not aim at removing all risks in totality but is an enabler towards risk identification and managing of these risks in an efficient manner. On the other hand it also allows us to focus on the opportunities available and there by ensuring financial compliance and minimising risk impact on the Business group operations.
The Risk Management Process within GAUTAM KOPPALA ORG is followed in the manner mentioned below :
The activity is centrally controlled from Head office through the Organisational Risk Management divisional co-ordinator.
The Strategic Risks / Financial risks are centrally identified and controlled at the Divisional Management level
The Risk identification of operational risks is done through the bi-monthly regional reviews and analysis of the Projects on POC basis and other regional financial statements.
The Complete risks at the Divisional level are compiled and circulated to the regions for conformance and completeness
Based on this report the Top 5 risks are reviewed and reported in the quarter ending process to GG Inc. Management
Managing Director Risk Controller
Ideal risk management:
A prioritization process is followed whereby the risks with the greatest loss and the greatest of occurring are handled first, and risks with lower probability of occurrence and lower loss are handled in descending order. In practice the process can be very difficult, and balancing between risks with a high probability of occurrence but lower loss versus a risk with high loss but lower probability of occurrence can often be mishandled.
Types of Risks:
Intangible risk management identifies a new type of risk - a risk that has a 100% probability of occurring but is ignored by the organization due to a lack of identification ability. For example, when deficient knowledge is applied to a situation, a knowledge risk materializes. Intangible risk management allows risk management to create immediate value from the identification and reduction of risks that reduce productivity.
Relationship risk appears when ineffective collaboration occurs.
Process-engagement risk may be an issue when ineffective operational procedures are applied. These risks directly reduce the productivity of knowledge workers, decrease cost effectiveness, profitability, service, quality, reputation, brand value, and earnings quality.
Financial risk management is the practice of creating economic value in a firm particularly credit and market risk
Management Risks: Risks that relate to the scope, structure and strategy of a given project.
Some examples……
The scope and complexity of the project is too large…i.e. are you biting off more than can be chewed?
Project requirements and outcomes are poorly defined.
The project does not have effective sponsorship or management support.
Technology Risks: Specific technical risks including design omissions, version conflicts, operational failures, incompatibilities or bugs.
Some examples……
Potential incompatibilities exist within current desktop platforms or internally customized applications.
Outdated or insufficient hardware exists for running new software products.
Early adopter’s risk – early adoption of new technology will limit the ability to benefit from the experiences of others.
Resource Risks: Human resource risks can involve staff changes, a lack of skilled resources, staff non-performance, or the reliability and availability of external service providers.
Some examples…..
Continual resource availability may be compromised during lengthy projects.
The loss of key staff to competitors or vendors may occur once they are trained in new products or technologies.
Timing Risks: Timing and scheduling risks can include product delivery delays, or missed deadlines along the critical path.
Some examples……
Annual budgets will lapse if product delivery is delayed.
An overly aggressive project schedule may limit the execution of thorough test plans.
Political Risks: Internal sensitivities relating to project support, sponsorship, internal cooperation and communications.
Some examples……
Is the project dependent upon one individual for visibility and support – and what would happen if that person leaves the company?
Are project deliverables in alignment with stated company priorities?
Are there any political issues that could negatively impact resource availability and cooperation?
Are there other competing projects within the company?
Could pending organizational changes impact the project?
External Risks: Risks beyond the direct control of the project team, caused by external environmental or industry factors.
Some examples……
Potential regulatory changes
Potential economic changes
Potential company mergers
Seasonal issues, including conflicts with holidays or weather related issues
Risk management is a structured approach to managing uncertainty through, risk assessment developing strategies to manage it, and mitigation of risk using managerial resources.
The strategies include transferring the risk to another party, avoiding the risk, reducing the negative effect of the risk, and accepting some or all of the consequences of a particular risk.
Steps in the risk management process:
Establish the context
Establishing the context involves
Identification of risk in a selected domain of interest
Planning the remainder of the process.
Mapping out the following:
the social scope of risk management
the identity and objectives of stakeholders
the basis upon which risks will be evaluated, constraints.
Defining a framework for the activity and an agenda for identification.
Developing an analysis of risks involved in the process.
Mitigation of risks using available technological, human and organizational resources.
Identification
After establishing the context, the next step in the process of managing risk is to identify potential risks. Risks are about events that, when triggered, cause problems. Hence, risk identification can start with the source of problems, or with the problem itself.
Source analysis Risk sources may be internal or external to the system that is the target of risk management. Examples of risk sources are: stakeholders of a project, employees of a company or the weather over an airport.
Problem analysis Risks are related to identified threats. For example: the threat of losing money, the threat of abuse of privacy information or the threat of accidents and casualties. The threats may exist with various entities, most important with shareholders, customers and legislative bodies such as the government.
When either source or problem is known, the events that a source may trigger or the events that can lead to a problem can be investigated. For example: stakeholders withdrawing during a project may endanger funding of the project; privacy information may be stolen by employees even within a closed network; lightning striking a Boeing 747 during takeoff may make all people onboard immediate casualties.
The chosen method of identifying risks may depend on culture, industry practice and compliance. The identification methods are formed by templates or the development of templates for identifying source, problem or event. Common risk identification methods are:
Taxonomy-based risk identification The taxonomy in taxonomy-based risk identification is a breakdown of possible risk sources. Based on the taxonomy and knowledge of best practices, a questionnaire is compiled.
Common-risk Checking In several industries lists with known risks are available. Each risk in the list can be checked for application to a particular situation. An example of known risks in the software industry is the Common Vulnerability and Exposures list found at
Risk Charting This method combines the above approaches by listing Resources at risk, Threats to those resources Modifying Factors which may increase or reduce the risk and Consequences it is wished to avoid. Creating under these headings enables a variety of approaches. One can begin with resources and consider the threats they are exposed to and the consequences of each. Alternatively one can start with the threats and examine which resources they would affect, or one can begin with the consequences and determine which combination of threats and resources would be involved to bring them about.
Assessment
Once risks have been identified, they must then be assessed as to their potential severity of loss and to the probability of occurrence. These quantities can be either simple to measure, in the case of the value of a lost building, or impossible to know for sure in the case of the probability of an unlikely event occurring. Therefore, in the assessment process it is critical to make the best educated guesses possible in order to properly prioritize the implementation.
Furthermore, evaluating the severity of the consequences (impact) is often quite difficult for immaterial assets. Asset valuation is another question that needs to be addressed. Thus, best educated opinions and available statistics are the primary sources of information. Nevertheless, risk assessment should produce such information for the management of the organization that the primary risks are easy to understand and that the risk management decisions may be prioritized. Thus, there have been several theories and attempts to quantify risks. Numerous different risk formulae exist, but perhaps the most widely accepted formula :
Rate of occurrence multiplied by the impact of the event equals risk
Later research has shown that the financial benefits of risk management are less dependent on the formula used but are more dependent on the frequency
In Project it is imperative to be able to present the findings of risk assessments in financial terms. Robert Courtney Jr. (IBM, 1970) proposed a formula for presenting risks in financial terms.
Potential risk treatments:
Once risks have been identified and assessed, all techniques to manage the risk fall into one or more of these four major categories: (Dorfman, 1997)
Avoidance (aka elimination)
Reduction (aka mitigation)
Retention
Transfer (aka buying insurance)
Ideal use of these strategies may not be possible. Some of them may involve trade-offs that are not acceptable to the organization or person making the risk management decisions.
POME Prescribe:
About Work / Life Balance:
Naps, Breaks and Vacations: The rejuvenation trio
ü Take a break: When you feel overwhelmed, take a break; get your mind off work for some time. Chances are, you will be able to handle the situation better after a break.
ü Get enough sleep: There is no substitute for sleep. All else being equal, a well-rested person is better equipped to meet the challenges that the day presents, as compared to a person who has not had enough rest.
ü When you plan a vacation and want to really enjoy it, ensure that all the work-oriented nitty gritty is taken care of, and out of the way.
ü Manage your vacation as a project (a lot of planning) if you enjoy doing a lot of things rather than just lying around idly all day (which is also an excellent way to recharge your batteries, by the way).
Gautam Koppala,
POME Author
0