146
tenkoerting.com [email protected] Risk Management Presenter Torsten J. Koerting www.torstenkoerting.com Session #

Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Embed Size (px)

DESCRIPTION

Presentation on Risk Management Tools, like Risk Register, Risk Profile Presentation Options, How to facilitate a Risk Assessment and effective Processes for day to day application of Risk Management in your Project

Citation preview

Page 1: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

Risk ManagementPresenter

Torsten J. Koerting

www.torstenkoerting.com

Session #

Page 2: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

T H A N KY O U

Page 3: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 4: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 5: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 6: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 7: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 8: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 9: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 10: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 11: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

www.torstenkoerting.com

Page 12: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 13: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Page 14: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

What are we going totalk about today

• NO standard stuff about Risk Management

• Get more ideas• Interact and share• Increase your toolbox

Page 15: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

Risk Mgmt Standard (AS/NZS 4360)

Page 16: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 17: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]… A U D I E N C E …

• Introduce yourselfWho are you?What are you?Why are you here?

Page 18: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 19: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

Why does Risk Management becomes

MORE and more important ?

Page 20: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

The Worldis flat

InconvenientTruth

The Worldis changing

Page 21: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

The Worldis flat

1.The Fall of the Berlin Wall2.The Internet3.Work-Flow Software4.Open-Sourcing5.Outsourcing6.Off-Shoring7.Supply-Chaining8.In-Sourcing9.In-Forming10.Information Steroids

Page 22: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

InconvenientTruth

1.Global WarmingSea Levels risingWater shortageMore storms than everLakes disappearMore wildfires

2.Shortage in ResourcesResource shortageWar for resources

Page 23: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

The Worldis changing

1.Financial Crisis2.Terrorism3.Increase of Knowledge4.Growth in Population5.Flatter6.Warmer

Page 24: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

What does all this mean for usas the Project Managers ?

?

Page 25: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected][email protected]

The Impact :

1.Increased Complexity

2.Increased Competition

3.Dynamics of Change

? ? ?

Page 26: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 27: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Mgmt Standard (AS/NZS 4360)

Page 28: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register

• Purpose• What is it and how is it structured• Critical success factors• Audience• Discuss different options

Private, Government, etc.

and discussCharacteristics, Pro’s and Con’s

Page 29: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – What is it ?• records details of all the risks identified at the

beginning and during the life of the project

• their grading in terms of likelihood of occurring and seriousness of impact on the project

• initial plans for mitigating each high level risk

• the costs and responsibilities of the prescribed mitigation strategies and subsequent results.

Page 30: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register - holds• a description of each risk and how it will affect the

project• an assessment of the likelihood it will occur and the

possible seriousness/impact if it does occur (low, medium, high)

• a grading of each risk according to company standards

• who is responsible for managing the risk• an outline of proposed mitigation actions

(preventative and contingency)• in larger projects, costings for each mitigation

strategy

Page 31: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – why ?

• provide a useful tool for managing and reducing the risks• document risk mitigation strategies being pursued in response

to the identified risks and their grading in terms of likelihood and seriousness

• provide the Project Sponsor, Steering Committee/senior management with a documented framework from which risk status can be reported

• ensure the communication of risk management issues to key stakeholders

• provide a mechanism for seeking and acting on feedback to encourage the involvement of the key stakeholders

• identify the mitigation actions required for implementation of the risk management plan and associated costings

Page 32: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Critical Success Factors

• Needs to be filled

Risk Assessment

• Needs to be up to date

Process

• Needs to be complete

special Risks

• Needs to be communicated

Presentation

Page 33: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 1 (private industry)

• IdentificationDate, Risk, Description

• Qualitative AnalysisType, Probability, Impact

• Quantitative AnalysisProbability (%), Effect ($ or days)

• Response StrategyStrategy, Response Action, Affected Phase

• Monitoring and ControlResponsibility, Date, Comments

Page 34: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 1 (private industry)

• IdentificationDate, Risk, Description

Page 35: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 1 (private industry)

• Qualitative AnalysisType, Probability, Impact

Page 36: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 1 (private industry)

• Quantitative AnalysisProbability (%), Effect ($ or days)

Page 37: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 1 (private industry)

• Response StrategyStrategy, Response Action, Affected Phase

Page 38: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 1 (private industry)

• Monitoring and ControlResponsibility, Date, Comments

Page 39: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 1 (private industry)

• Pro’s• Easy to use• Information in one spot• Covers all relevant areas• Not overburdened

• Con’s• No View (Risk and Cost) after Likelihood• Doesn’t identify Options• No Comprehensive Action

Page 40: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 2 (Airline)

• RiskRisk, Status

Page 41: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 2 (Airline)

• Current Risk ProfileDimension, Current Controls, Consequence, Likelihood, Control Effectiveness, Risk Priority, Risk Severity, Accept or Treat

Page 42: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 2 (Airline)

• Proposed Risk ProfileTreatment and Actions, Responsibility, Due Date, Revised Consequence, Revised Likelihood, Revised Control Effectiveness, Revised Risk Priority, Risk Severity, Accept or Treat, Last Review Date, Next Review Date

Page 43: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 2 (Airline)

• Pro’s• Comprehensive Calculation

(good for presentation later one)• All in one place

• Con’s• Might overburden immature organizations or staff• Hard to explain• Still subjective

Page 44: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 3 (Government)

• RiskDescription of Risk, Impact on ProjectId Description of Risk

(including any identified ‘triggers’)

Impact on Project (Identify consequences 1)

Asses

smen

t of

Lik

eliho

od

Asses

smen

t of

Se

rious

ness

Gr

ade

(com

bined

Lik

elihoo

d and

Se

riousn

ess)

Change Date of Review

Mitigation Actions (Preventative or Contingency)

Responsibility for mitigation action(s)

Cost Timeline for mitigation action(s)

Work Breakdown Structure

<n> <A “newspaper headline” style statement. Also identify relevant triggers that may cause the risk to be realised.>

<Describe the nature of the risk and the impact on the project if the risk is not mitigated or managed>

<Change in Grade since last review>

<Date of last review>

<Specify planned mitigation strategies: Preventative

(implement immediately)

Contingency (implement if/when risk occurs).>

<Specify who is responsible for undertaking each mitigation action(s)>

<Specify timeframe for mitigation action(s) to be completed by>

This is to indicate that the identified mitigation action has been included in the WBS (workplan).

1 In larger projects, the consequences of the threat may not be evident, and noting them under each risk or in a separate column can be useful in identifying appropriate mitigation actions.

Page 45: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 3 (Government)

• Qualitative Assessment and ChangeLikelihood, Seriousness, Grade, ChangeId Description of Risk

(including any identified ‘triggers’)

Impact on Project (Identify consequences 1)

Asse

ssme

nt of

Lik

eliho

od

Asse

ssme

nt of

Se

rious

ness

Gr

ade

(com

bined

Lik

eliho

od an

d Se

rious

ness

)

Change Date of Review

Mitigation Actions (Preventative or Contingency)

Responsibility for mitigation action(s)

Cost Timeline for mitigation action(s)

Work Breakdown Structure

<n> <A “newspaper headline” style statement. Also identify relevant triggers that may cause the risk to be realised.>

<Describe the nature of the risk and the impact on the project if the risk is not mitigated or managed>

<Change in Grade since last review>

<Date of last review>

<Specify planned mitigation strategies: Preventative

(implement immediately)

Contingency (implement if/when risk occurs).>

<Specify who is responsible for undertaking each mitigation action(s)>

<Specify timeframe for mitigation action(s) to be completed by>

This is to indicate that the identified mitigation action has been included in the WBS (workplan).

1 In larger projects, the consequences of the threat may not be evident, and noting them under each risk or in a separate column can be useful in identifying appropriate mitigation actions.

Page 46: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 3 (Government)

• MitigationMitigation Actions, Responsibility, Cost, Timeline, WBS

Id Description of Risk (including any identified ‘triggers’)

Impact on Project (Identify consequences 1)

Ass

essm

ent o

f

Like

lihoo

d

Ass

essm

ent o

f

Ser

ious

ness

Gra

de

(co

mbi

ned

Like

lihoo

d an

d S

erio

usne

ss)

Change Date of Review

Mitigation Actions (Preventative or Contingency)

Responsibility for mitigation action(s)

Cost Timeline for mitigation action(s)

Work Breakdown Structure

<n> <A “newspaper headline” style statement. Also identify relevant triggers that may cause the risk to be realised.>

<Describe the nature of the risk and the impact on the project if the risk is not mitigated or managed>

<Change in Grade since last review>

<Date of last review>

<Specify planned mitigation strategies: Preventative

(implement immediately)

Contingency (implement if/when risk occurs).>

<Specify who is responsible for undertaking each mitigation action(s)>

<Specify timeframe for mitigation action(s) to be completed by>

This is to indicate that the identified mitigation action has been included in the WBS (workplan).

1 In larger projects, the consequences of the threat may not be evident, and noting them under each risk or in a separate column can be useful in identifying appropriate mitigation actions.

Page 47: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 3 (Government)

• Pro’s• Straight forward• Simple

• Con’s• Hard to present risk profile based on it• Format• Cost of Risk vs. Cost of Mitigation

Page 48: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• RiskDescription of Risk, Project Stream, Work package

Page 49: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• Risk DescriptorsDescription of Risk, Project Stream, Work package

Description of source of identified risk.

Example:Controlling has raised cost-rates

Financial RiskFunctional RiskTechnology RiskTimeline RiskResource RiskInformation Security RiskDisaster Recovery RiskRegulatory RiskReputational RiskSupplier Risk

Date CostTarget DateQualityBusinessClient

Project InitiationRequirementDesignDevelopmentTestingDeploymentProject closureMiscellaneous

Description of loss-occurrence at which the estimation and incident rate are based.

Example: overdraft of budget with difference of old/new charge-rate.

Page 50: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• Risk DescriptorsDescription of Risk, Project Stream, Work package

Calculation of probability that risk will happen (in %)

Example:increasing of charge-rate are established by controlling-department. in this case the probability is 100 %

Rating from project-management of impacts to the project-success 6 = critical 5 = very high 4 = high 3 = medium 2 = low 1 = almost not presentExample:4 = Medium if the profitability of the project is in question.2 = low, if an increase in budget or overdrawing of a Budget is possible

Estimated costs (max. loss-occurrence) to the project, if risk will happen

CostTarget DateQualityBusinessClient

AnalyzedClosedIssueNewCommunicatedEscalated

Page 51: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• Final CommentsRemarks, Communication, Date

Page 52: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• Risk Remedial ActionsRemedial Actions, Documents, Expected Results

Possible strategies:- Accept (Risk is suitable and requires no intervention.)- Transfer (The risk will transfer by regulations, e.g., by the project

order on the principal, e.g., assumption of costs in the case of an incoming risk.)

- Reduce (In the approach, processes are taken up in the project

plan to minimize the risk or to remove)- Risk Contingency Plan (In the approach processes are taken up in the project

plan to minimize the risk or to remove.)For the chosen Strategies no concrete description/ explanation is given.

Description of the expected results of the Risk-reducing measures. .Example:Arrangement with customers w/function reduction and therefore saving of employee's days.

If subsequent risks arise from the remedial actions, the Risk-Id of these new risks, which is to be assigned newly, must be referred.

Page 53: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structureoption 4 (Finance / Banking)

• After Risk Remedial ActionsProbability, Rate of Consequences, Risk-Rate , Responsibility

Likelihood that the described risk can still enter after the carried out risk reduction measures. information in %)

6 = critical 5 = very high 4 = high 3 = medium 2 = low 1 = nearly not present 0 = not present

Appraisal of the project management for which effect the called risk has on the project success after the carried out risk reduction measures. 6 = critical 5 = very high 4 = high 3 = medium 2 = low 1 = nearly not present 0 = not present

Page 54: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Structure option 4 (Finance / Banking)

• Pro’s• Very comprehensive• Great for analysis• Clear Structure and guidance

• Con’s• Needs two tabs for Risk and Mitigation• Might overburden some

Page 55: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• What kind ofStructures did you use ?

• What fieldshave you seen ?

• Challenges ?

Page 56: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Register – Summary !

• Many options to choose from

• Always need to be adapted to companies standards and maturity

• Should support critical success factors relevant for your company

Page 57: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Questions …

Page 58: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 59: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Mgmt Standard (AS/NZS 4360)

Page 60: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Assessment - Definition• Risk assessment is a common first step in a risk

management process.• Risk assessment is the determination of

quantitative and qualitative value of risk related to a concrete situation and a recognized threat (also called hazard).

Page 61: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Challenges

• How to set the scene• Identify risks without knowing

what a risk is• Keep the audience in the room and

engaged• Take them on a journey

Page 62: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Way’s how to do it !

• Ask the question:What kind of risks do you see ?

• Go based on questionnaire !

• Domains of Change(Location, Data, Technology, Processes, People, etc.)

• The ‘Diamond Model’

Page 63: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Assessment approach

• Set the scene• Establish the Context• Identify Risks• Analyse and Evaluate• Develop Risk Treatment

Page 64: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Assessment

• How to set the scene based on “Reinventing Project Management”

a book byAaron J. Shenhar & Dov Dvir

• How to run a Risk Assessment with a group of lower maturity

Page 65: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Reinventing Project ManagementThe Diamond Approach to Successful

Growth and Innovation

Aaron J. ShenharDov Dvir

Page 66: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

The ‘Diamond Model’

• Identifies the Characteristics of the project and its deliverables based on

• 4 Dimensions- Technology- Novelty- Pace- Complexity

Page 67: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

The Diamond Model

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 68: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

The Diamond Model

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 69: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

• Aim is to identify the “technology uncertainty”

• Impact on Design, Testing, required communication and number of design cycles needed

• Identifies the technical competence needed by Project Manager and Team

Page 70: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology• Low-tech projects are based and rely on

well – established technologies

• Medium-tech projects are based on existing technology but incorporate new technology

• High-tech projects are projects where most of the technology is new but do exist at project initiation

• Super-high-tech projects are based on new technologies that do NOT exist at project initiation and must be developed during the project

Page 71: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

The Diamond Model

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 72: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Novelty

• Aim is to identify how new the product is going to be when its delivered to the “market” how hard it is to define the project goal

• Impact on how to manage the project and which approach is best

• Identifies reliability of market research, the time it takes to define requirements and specific marketing stages / training needed

Page 73: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Novelty

• Derivative products are improvements or extensions of existing ones

• Platform products are new generations of existing product lines

• Breakthrough products are new to the world products and transform a new concept or new idea into a new product

Page 74: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

The Diamond Model

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 75: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Pace

• Aim is to identify how much time is availableand how urgent is it

• Impact on autonomy of project teams, the bureaucracy, the speed of design making and the intensity of top management involvement

Page 76: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Pace• Regular projects are non time critical ones and not critical to

immediate success

• Fast / competitive projects are driven by profit focused organizations, to create a strategic position or form a new business line

• Time – critical projects have a specific end date that they need to be completed by, driven by a window of opportunity. Missing the deadline is a project failure.

• Blitz projects are most urgent, most time critical. Mostly they are crisis projects and the crisis need to be solved immediately.

Page 77: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

The Diamond Model

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 78: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Complexity

• Aim is to identify the various levels of complexity within the project

• Impact on project organization and the formality of project management

• Identifies … the complexity

Page 79: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Complexity

• Assembly projects may produce a simple stand – alone product based on a collection of elements. They may involve creating a new organization that is responsible for the product / function.

• System projects involve a complex collection of elements, that jointly perform multiple functions.

• Array projects deal with a large, widely spread collection of systems that need to function together to achieve a common purpose .

Page 80: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

Example – World Trade Center

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 81: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

World Trade Center

• 1964 decision to build the tallest building in the world and planning took 15 years and 8 years to build

• 7 buildings on 16 acres and >12mio feet2 office space• Biggest shopping mall, 7 level garage and public transp.• Build into bedrock going through the table of Hudson

River• 50.000 people had to be transported to their office

every day (100 elevators opening both sides)• Newly developed highly strength steel was used• Big economic and business consequences (1 day delay

would cause US$1mio additional cost)

Page 82: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• How does the Diamondlook like? (next slide)

Page 83: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Technology

Example – World Trade Center

NoveltyComplexity

Pace

Low-tech

Medium-tech

High-tech

Super-high-tech

Regular

Fast/competitive

Time-critical

Blitz

Derivative Platform Breakthrough

AssemblySystemArray

Page 84: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Assessment approach

• Set the scene• Establish the Context• Identify Risks• Analyse and Evaluate• Develop Risk Treatment

Page 85: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Areas in Company (example)

© Strategic Planning Group 2002

Page 86: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

A practical method (option 1)

Financial Management

Funding Membership Fees Fund Raising

Fundingis late

FundingIs terminated

Area

Cash Flowissues

MajorProjects

RISKS•Not enough money to

meet our needs•Not enough money to

buy supplies•Program delays

OUTCOMES• Unable to supply some• of our services• Damage to our reputationif we can’t supply someservicesSecondary Outcomes• Financial • Social• Legal • Political

Sour

ces

CONTROLS IN PLACE• Budget done• Bank Overdraft• Competent Leaders• Financial Reports

Page 87: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

A practical method (option 2)

Training Project

Delivery Admin & Mgmt Assessment

Course SupportMaterial & Design

Location &Delivery Mode

Proj

ect

RISKS•Failure to use

materials relevant toand supportive of thetraining package oraccredited course.

•Failure to employcompetent, qualifiedstaff to design, produceand evaluate supportmaterials.

OUTCOMES•Clients do not achieve

package competencies•RTO reputation damaged•Qualifications not

recognised•Trainees not employableSecondary Outcomes• Financial • Social• Legal • Political

Wor

kpac

kage

s

CONTROLS IN PLACE• Quality system to

ensure relevance• Library of related

materials foradaptation

• Policy for versioncontrols

• Qualified,competent staff

Page 88: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• How do youfacilitate a Risk Assessment ?

• How do youaddress the challenges ?

Page 89: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Questions …

Page 90: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• Relaxation …What is wrong in thenext picture?

Page 91: Kuala Lumpur - PMI Global Congress 2009 - Risk Management
Page 92: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 93: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Mgmt Standard (AS/NZS 4360)

Page 94: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – What is it ?

Risk Management Process is the systematicapplication of management policies,

procedures and practices to the tasks ofidentifying, analysing, evaluating,

treating and monitoring risk.AS/NZS 4360 - Risk Management Standard

Page 95: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – StandardPMBOK

Page 96: Kuala Lumpur - PMI Global Congress 2009 - Risk Management
Page 97: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – Critical Success Factors

• Needs to be effective

• Needs to be understood

• Needs to be applicable

Page 98: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Challenge !

To squeezethis ….

intothis ….

Page 99: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

Focus of Process• The Risk Management Process identifies and analyses Risks

and defines Mitigation Strategies to mitigate or eliminate Risks for the project.

Process Design• Everybody needs to be responsible to identify and

document Risks as well as mitigate Risks on his level.• Decisions how to treat risks are made by Project

Management under consultation with roles involved.• The PMO is managing the Risks overall.• A risk identifies a threat to reach the project goal and does

have a likelihood under 100% (otherwise ist treated as a Problem or Issue)

Page 100: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

Prog

ram

m

Man

agem

ent

Stre

am L

ead

PMO

Tool

s/

Doc

umen

ts

Proj

ect M

gmt

RiskIdentification

RiskIdentification

RiskIdentification

RiskIdentification

RiskQualification

RiskQualification

RiskQualification

RiskQualification

Consolidation &QS Risks

ReviewRisks

ReviewRisks

ReviewRisks

DecisionMitigation

DecisionMitigation

DecisionMitigation

UpdateRisk Register 1

Risk Register Risk Register Risk Register Risk RegisterRisk Register

ongoing ongoing

until

Monday COB

Stream JF

Tues 15:00 - 16:30

Sream JF

Di 15:00 - 16:30

until

Monday COB

Page 101: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

Prog

ram

m

Man

agem

ent

Stre

am L

ead

PMO

Tool

s/

Doc

umen

ts

Proj

ekt M

gmt

UpdateIssue Log

UpdateProject Plan

UpdateProject Plan

1

Issue Log Projekt Plan

Risk Management

Issue Management

Projekt Planning

Projekt Planning

until

Monday COB

Page 102: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

Risk ID.

Risk-Title/ Risk-Description Teilprojekt Arbeitspaket

betroffenes Release/Iteration[Rel 0.1|Rel 1.1| Rel 1.1 It1|Rel 1.1 It2|Rel 1.1 It3|Rel 1.2 |Rel 1.2 It1|

alle Rel]

Risk-Cause Risk-Category Date of Risk-

Identification

ImpactCategory

1 Scope Creep TP Anforderungsmanangement Timeline Risk 12-Nov-082 Abstimmung mit betroffenen Bereichen in

time nicht möglich z.B. Finance, LegalTP Anforderungsmanangement Timeline Risk 12-Nov-08

3 Staffing Business und GTO (Verfügbarkeit der internen Ressourcen für Abstimmungen und Rückfragen)

TP Anforderungsmanangement Resource Risk 12-Nov-08

4 Fachliche Anforderungen technisch nicht umsetzbar (z.B. Flexibilisierung Online-Änderungsdienst)

TP Anforderungsmanangement Technology Risk 12-Nov-08

Prediction: Impact in

Project-Phase

Loss-occurrence / description of Consequences

Probability (%)

Rate of Conse-quences

Risk-Rate

PossibleRisk-Costsin T€

Risk Cost weighted against Budget

CurrentStatus

Last Modification of Current

Status

Remarks(If Risk is closed)

Name of Management-

Team Communicated

with

Communication-Date

Total

AverageZeitverzug 2 - Low NewZeitverzug 4 - High New

Zeitverzug 4 - High New

reduzierte Funktionalität 4 - High New

Risk Register – Maintained by PMO

Page 103: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

• There is only one risk register with all risks of all streams• The risk register is managed centralized by the PMO• Every stream lead is held accountable to identify, qualify and

mitigate the risks on his level• The review and discussion of all risks is managed by project

management as part of the weekly jour fix• The ongoing risk process is ensured by the PMO• What happens if risk becomes an issue?

• Mail to PMO • Information to Project Mgmt by PMO• Update Issue Log by stream lead• Update risk register

Page 104: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Process – option 1 (Banking)

• Pro’s• Embedded in Project Setup• Process as mature as the organization• Clear roles and responsibility

• Con’s• Process driven via and by the PMO

(depends on size of the project)

Page 105: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• What kind ofprocesses have you seen ?

• Challenges ?

Page 106: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Questions …

Page 107: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 108: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Mgmt Standard (AS/NZS 4360)

Page 109: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile PresentationKey Challenge

How to present the risk profileof your project

to various stakeholders

(eg. Team Members, Stream Leads, Programme Management, Steering Group, Project Sponsor, Senior Management, Clients, Vendors etc.)

Page 110: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 1 )

Risk Register

Page 111: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 1 )

Risk Register• Target Audience

• Project Team, Stream Leads, Project and Program Management, Abstract for Steering Group

• Pro’s• High Level of Detail• Good for Monitoring and Control

• Con’s• Too much detail for Senior Audiences

Page 112: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 2 )

Likelihood vs. Consequence

Page 113: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 2 )

Likelihood vs. Consequence• Target Audience

• Almost everybody around the project including Steering Group Members and Sponsors

• Pro’s• Key Data out of the register aggregated• Maintains itself• Based on Standard almost known to everybody

• Con’s• Could add ‘Before / After’ comparison

Page 114: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 3 )

Risk Matrix

Page 115: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 3 )

Risk Matrix• Target Audience

• Project Members incl. Steering Group

• Pro’s• Abstract out of Register• Same as Likelihood vs. Consequence

• Con’s• Level to low and a little bit unattractive to Senior

Management

Page 116: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 4 )

Index vs. Timeline

Page 117: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 4 )

Index vs. Timeline• Target Audience

• Everybody in the project plus senior Management

• Pro’s• Adds timeline to visibility• All selected risks visible on one slide

• Con’s• Could add size of risk (Dollars or severity)

as size of bubble

Page 118: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 5 )

Heat Map

Page 119: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 5 )

Heat Map• Target Audience

• Project and Senior Management

• Pro’s• Clearly shows and identifies areas of risk rather

than just a risk itself• Clearly shows and identifies projects with high risk

profile• Inherent and residual risk on one page

• Con’s• None, could be perceived to complex

Page 120: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 6 )

Opportunity / Risk and Threat

Page 121: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 6 )

Opportunity / Risk and Threat• Target Audience

• Project and Senior Management

• Pro’s• Summarizes Opportunities vs. Threats

• Con’s• No real message out of it

Page 122: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 7 )

before / after

Page 123: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Profile Presentation ( option 7 )

before / after• Target Audience

• Project and Senior Management

• Pro’s• Before / After view based

on likelihood / consequence

• Con’s• Size of bubble could show dollars before and after

mitigation

Page 124: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

… A U D I E N C E …

• What type of optionshave you seen ?

Page 125: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Questions …

Page 126: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

05 min

2.Why

15 min

3.Project Register

30 min

4.Risk Assessment

30 min

5.Effective Process

30 min

6.Risk Profile presentation

30 min

7.Project Health Check

30 min

Agenda

Page 127: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Project Health Checks

How to proactively mitigatethe risk of project failure

Page 128: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Risk Mgmt Standard (AS/NZS 4360)

Page 129: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

129

Project Health CheckAgenda

• Project Health Check as part of an effective Project Governance• Why check Project Health and the Benefits• Different Methods of Project Health Checks• The Quick Assessment

– Overview• The comprehensive Health Check

– Overview and Elements– The Questionnaire– The Assessment– The Results and the Comparison

• Practice Experience

Page 130: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

130

Effective Governance Structure

Ready forProject Delivery

Ready forProject Planning

Ready forInitiation

Ready forProject Closure

ProjectClosed

Health Check &Post Imp Review

Gate /Checklist

Steering Group

HC / mini HC6 weeks afterPlanning Gate

HC / mini HCcalled byexception

Individual Cycle after Prio Gate, but not less then every 6 weeks

DepartmentalControl Groups 2 to 4 week cycle / routine depending on category of project

Starts with Planning and Ends with Project Final Delivery

QualityGates Milestone

Gate 1Ready forPilot

Ready forProduction

Post ImpReview

Post PostImp Review

PLANNINGINITIATION DELIVERY CLOSURE BENEFITSREALIZED

DEMAND

Status & GeneralReporting

Portf

olio

Mgm

tPr

ojec

t Man

agem

ent

Spec

ial F

uncti

ons

Facilitator

HC / mini HCcalled byexception

HC / mini HCcalled byexception

Page 131: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

131

Why check on Project Health

• Comprehensive analysis of a project• Instant summary of the current situation• Identification of weaknesses and a generation of

package of measures• Identification of Best Practices used• Equal comparison of projects • Project Manager Competence development

based on several assessments• Management oversight project governance

Page 132: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

132

Different Methods and Tools to conduct a Project Health Check

• Quick Assessment (self conducted)– Based on 15 key questions around risk, team, commercials, management and

scope– Could be done in 10 to 15 minutes

• Mini Health Check based on Knowledge Areas or Stages – For low risk profile and small projects– Approximately 40 questions– 1 hour– Moderation is optional

• Full Health Check based on Knowledge Areas or Stages (moderated)– For high risk profile and large projects– Approximately 150 questions– 3 – 4 hours– Moderation is mandatory

Page 133: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

133

Quick AssessmentOverview

• 14 Questions in different areas, examples:– The Delivery Team output will match the requirements– The Business Case is still valid and understood– The Delivery Team understand what needs to be delivered and when– Project progress is monitored– Project monitoring is accurate– ….– ….

• Answers between 0 and 10– 0 – no confidence for that area– 10 – maximum confidence for that area

• Benefit– Simple to use– Quick overview of project– Below 70, immediate action

Result View

75%

Page 134: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

134

Project Health CheckQuestionnaire and Assessment

• QuestionnaireIdentical questionnaire in all areas, adjusted to the relevant knowledge area and project management method used and the assessed stage(Invest, Initiation, Planning, Delivery, Closure)

• Assessment5 step rating : – 0 to 4 or “not relevant”– 0 if not available or not accomplished / implemented– 4 only if relevant result and deliverable is complete– traceable documented according to the requirements

Maximum can be reached– rated 4 in all areas would be a best practice– project with adoptable best practice approaches– that contribute to the Project Method and can be reused in other projects

Page 135: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

135

Project Health CheckAreas to be checked

• Initiation, Investment, Business Case• Project Hand Over• Project Planning• Project Organisation• Work Packages• Staff Management• Communication Management• Project Start• Change Management• Quality Management• Project Management• Project Controlling• Project Closure• Business Satisfaction• Documents• Roles

Initiation

Planning

Delivery

Closure

General

Page 136: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

136

Project Health Check Questionnaire Input Mask

Page 137: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

137

Input Project Documents Steering Group

Presentations Former Health Check

Assessments and results

Former Action Logs, Tasks and Measures

Agenda Action Log from last Assessment Assessment Result Sign Off

Attendees Risk / Audit (lead / moderation) Project Manager Portfolio Manager of the relevant arm

Output Assessment Result Action Log Status Report to Stake

Holders

Supportive Docs

Cycle, Time, Duration, Location Recurrence – AdHoc / Exception / Check Points Time – to be defined Duration – 4 hours Location – to be defined

Project Health Check - The Assessment

Action Log Health Check Tool Result PDF

Page 138: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

138

Project Health CheckResult View

0

0.5

1

1.5

2

2.5

3

3.5

4Initiation, Inv estment, Business Case

Project Hand Ov er

Project Planning

Project Organisation

Work Packages

Staff Management

Communication Management

Project Start

Change and Claim Management

Quality Management

Project Management

Project Controlling

Project Closure

Business Satisfaction

Documents

Roles

• All relevant areas according to Project Methodused within the specific Company are covered and assessed

BenchmarkResult

Page 139: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

139

Project Health CheckComparison

0

0.5

1

1.5

2

2.5

3

3.5

4Initiation, Inv estment, Business Case

Project Hand Ov er

Project Planning

Project Organisation

Work Packages

Staff Management

Communication Management

Project Start

Change and Claim Management

Quality Management

Project Management

Project Controlling

Project Closure

Business Satisfaction

Documents

Roles

• Comparison of a certain project to– best practice– To other projects– To a former assessment of the same project

Result

Page 140: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

140

Project Health Check Practice Experience

• Identifies risks before they become issues• Structured view on project situation in sense of processes

and methodologies used as well as roles and documents facilitated

• Catalyst to facilitate communication and clarification of open points within the project management team

• Fixation of measures and tasks that implicit have been scheduled but got never executed because of the daily business

• Might cause some awkward but important strategic measures(e.g.: involvement of top management)

• Biggest advantage achieved by repeating assessments(first assessment after signing the Project Request)

Page 141: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Questions …

Page 142: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

1.Introduction

2.Why

3.Project Register

4.Risk Assessment

5.Effective Process

6.Risk Profile presentation

7.Project Health Check

Agenda

Page 143: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

A – C – T

• A – Actively stay involved and keep informed

• C – I will call you

• T – Template as additional softcopy

Page 144: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

T H A N KY O U

Page 145: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

www.torstenkoerting.com – [email protected]

Contact Information

• Name: Torsten J. Koertingwww.torstenkoerting.com

• Email: [email protected]

• Phone: Australia +61 (0) 4 8848 0801Germany +49 (0) 173 3082185

• Session Number #

Page 146: Kuala Lumpur - PMI Global Congress 2009 - Risk Management

Picture Credits ( 1 / 1 )agenda 1 - http://www.flickr.com/photos/24293932@N00/WTC - http://www.flickr.com/photos/kidneynotes/question - http://www.flickr.com/photos/eleaf/Aaron Shenhar - http://howe.stevens.edu/fileadmin/Files/people/photos/Aaron-Shenhar-new.jpgDov Dvir - http://web.bgu.ac.il/NR/rdonlyres/C4956661-14AD-438E-95B7-EC1C18E30A87/0/DvirDov.JPGbreak - http://www.flickr.com/photos/dullhunk/Audience - http://www.flickr.com/photos/oreilly/