Chapter 4 Perspectives on Managing Risk and Uncertainty Management: Commercial theory and practice

Chapter 4Perspectives on Managing Risk and Uncertainty

Management:Commercial

theory and practice

Learning objectives

• An understanding of the concepts of risk and uncertainty

• An awareness of the relevant theories associated with the concept of risk

• An appreciation of the broader perspectives of risk and its management

Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Learning objectives

• Knowledge of the risk management process in projects

• An awareness of some of the risk management tools available, their benefits and their limitations

• An understanding of the behavioural aspects associated with risk and uncertainty management


Definitions of risk ‘A situation involving exposure to danger; the possibility that something unpleasant or unwelcome will happen; expose (someone or something valued) to danger, harm, or loss’ (Oxford English Dictionary)

‘Effect of uncertainty on objectives. Note: effect is a deviation from the expected; uncertainty is the state of deficiency of information relate to, understanding or knowledge of an event, its consequence or likelihood; objectives can apply at different levels and aspects’ (BS/ISO 31000)

‘Combination of the probability of an event and its consequence’ (ISO/IEC Guide 73)


Definitions of risk

‘Uncertainty inherent in plans and the possibility of something happening (i.e. a contingency) that can affect the prospects of achieving business or project goals ֹ (BS 6079:3)

‘An uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives’ (PMBokⓇ 2008 Guide)

‘Combination of the probability or frequency of occurrence of a defined threat or opportunity and the magnitude of the consequences of occurrence’ (APM)


What is risk?

• Four elements to be considered:

• the possible future event and its source(s)

• the possible consequence(s) of the event

• the probability of the event occurring, and its severity

• The length of time vulnerable to the event and consequence (Edwards and Bowen, 2005)


What is uncertainty?

• Uncertainty is ‘inadequate or incomplete knowledge about the subject at issue’ (Edwards and Bowen, 2005)

• From a risk analysis perspective the level of uncertainty is ‘bounded’ by a probability

• For analysis purposes, a probability is considered a measure of uncertainty


Risk and uncertainty

• Winch and Maytorena (2011) present a cognitive model of risk and uncertainty:

• Risk is where the probability of an event occurring and its consequences can be calculated from historical data

• Uncertainty is where there is a lack of knowledge – about the probability of incidence due to the lack of reliable data (known unknown), or about the threat or opportunity itself (unknown unknown)

• They need to be understood in context


Factors that influence risk management behaviour


Perspectives on risk

• Rationalist:

• Concepts: expected value, expected utility, modern utility theory, subjective probability and subjective expected utility theory

• EU theory core to risk assessments in projects

• exemplified in the application of the probability–impact matrix

• individuals are rational and act to maximise utility



• EU theory makes three assumptions:

• The preferences of rational individuals are clearly defined, and they can choose rationally between two alternatives

• Rational individuals can decide consistently

• The rank order of individual preferences stays the same when those preferences are mixed



• Behavioural:

• concept of bounded rationality:

• rationality is limited to the information-processing capacity of an individual (Simon, 1947)

• consideration of heuristics and bias

• prospect theory – explanation of how individuals evaluate gains and losses (Kahneman and Tversky, 1979)


Heuristic• Anchoring and adjustment

• difficulty in adjusting our estimates significantly from the initial reference point, even in the light of new information.

• Availability

• tendency to estimate the probability of an event based on how easily instances of the event can be recalled

• Representativeness

• tendency to estimate probabilities of events by assessing how representative they are of a category – drawing considerable inferences from a small number of cases


Bias• Conjunctive and disjunctive event bias

• systematic tendency to overestimate the probability of events that must occur in conjunction and underestimate the probability of events that occur independently

• Overconfidence bias

• systematic tendency to be overly confident in our estimating abilities and beliefs

• Illusion of control

• systematic tendency to believe that we control or influence the outcome of future events


Bias

• Optimism bias

• systematic tendency to underestimate the probability of negative events happening to us and overestimate the probability of good events happening to us

• Framing effect

• the way in which information is presented – positively framed (gains) or negatively framed (losses) affects our decisions



• Cognitive:

• recognises the importance of individual mental states (beliefs, desires, motivations)

• acknowledges a decision-maker’s limited information-processing capacity

• considers how decision-makers, in their organisational context, process information, and then interpret the information in order to take action (Weick, 1995; Weick and Sutcliffe, 2001)


(Source: Winch, 2010 fig.13.2)

Cognitive model of risk and uncertainty on projects



• Cultural:

• Studies focus on understanding how:

• power, social status and political views influence an individual’s, group’s or organisation’s view of risk (Lupton,1999)

• social and cultural factors influence judgements on risk (Douglas, 1992; Douglas and Wildasky, 1982)


Benefits of effective risk management

• Perceived benefits:

• enhanced thinking about the future

• improvement in planning

• improvement in communication

• improvement in resource allocation

• promotion of continuous improvement

• protection and enhancement of reputation

• competitive advantage


Development of risk management

• Minimisation of corporate risk through disaster recovery planning

• Corporate governance practices

• UK Corporate Governance Code 2010

• Sarbanes-Oxley Act 2002

• Chief risk officer (CRO) role created:

• to ensure compliance with regulations, and to consider risk management across the organisation

• Enterprise risk management (ERM)Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Projects and risk

• With project size and complexity on the rise, and as competition increases, the management of risks early in the project lifecycle becomes an ever more important challenge

• Programme Evaluation and Review Technique (PERT)

• introduced probabilistic rather than deterministic task duration estimates

• limited to schedule delays against plan, and embodied the ‘negative events only’ concept of risk.

• Risk maturity modelsCommercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Recent developments• Winch and Maytorena (2011) identify four areas of

innovation:

• a focus on the governance of projects

• a focus on the front-end definition of projects as a way of reducing risks at later stages of the project lifecycle

• the consideration and application of real options thinking (considers the value in making an investment now to keep the option of a future investment opportunity open) as a way of generating opportunities

• the use of systems dynamics to improve our understanding of the interaction and interdependences of risks in projects


Project risk management (PRM)

• The systematic process of identifying, analysing, responding, monitoring and controlling project risk to improve project performance

• An iterative process bounded by the organisational mission

• Intent is to make the approach to managing risks more robust


Project risk management process


Identification and categorisation

• Several techniques used to aid the identification process:

• lists (checklists, risk registers, risk breakdown structures, risk taxonomy)

• soft techniques (causal mapping, soft systems methodology)

• strategic techniques (scenario planning, future and horizon scanning)

• technical/engineered system techniques (Hazard and Operability HAZOP, failure mode effects analysis FMEA)

• Information generated captured in risk registers (RR) and/or risk breakdown structures (RBS)Commercial Management: theory and practice, First Edition.

David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Risk register


Risk breakdown structure

(Source: Dalton, 2007) Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Analysis• Risk analysis uses outputs from the identification and

categorisation phase as inputs for analysis

• Probability–impact matrix is the most commonly used qualitative tool

• Quantitative analysis aims to produce a mathematical model of the situation under consideration, based on a number of inputs and assumptions

• Sensitivity analysis (deterministic approach) looks at the effects of varying the inputs or model parameters on the model output

• Monte Carlo analysis (probabilistic approach) uses a range of values of a distribution as inputs to determine the effect of uncertainty on the system being modelled

• Probability trees or decision trees Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Probability–impact–manageability matrix


Output of Monte Carlo simulation


Response• Reactive approach – aims to reduce the impact of

the event should it occur

• Proactive approach – aims to reduce the possibility of the event occurring

• Includes:

• changes in design, scope, processes and procedures to avoid the possibility of a future event occurring

• deciding not to proceed with a project ,to remove the possibility of the event happening

• contractually transferring the responsibility of the risk to another party

• sharing the gain and the pain with another partyCommercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Monitor and control• Often overlooked, but essential for effective risk

management

• monitoring – a continual review of the risk and their status

• controlling – ensures that appropriate actions are taken, based on the outputs of the response phase

• Continual review process aims to identify whether:

• any of the assumptions made during the previous phases have become invalid

• any of the risks identified are no longer possible

• a new threat or opportunity has been spotted Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Communicate and learn• Although a challenge – key to the successful

management of risk

• Central to:

• stakeholder understanding of the benefits of effective risk management and the consequences of poor risk management implementation

• understanding quantitative assessments and their limitations

• the identification of changes in the risk status and identification of new threats and opportunities

• ensuring risk ownership details are unambiguous in contracts and agreements

• capturing, disseminating and building on lessons learnt Commercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Summary• Risk is an important issue in society today, and its

management is a key feature of the commercial role

• It is concerned with two things:

• time, and the belief in the control of the future

• Definitions of risk typically include four main elements:

• source (of the event), consequence, probability and time

• We distinguish between risk and uncertainty

• Descriptions of risk vary greatly across contextsCommercial Management: theory and practice, First Edition. David Lowe.© 2013 David Lowe. Published 2013 by Blackwell Publishing Ltd.

Summary• Responses to risk and uncertainty are influenced by

various factors

• These should be kept in mind when undertaking the risk management process

• Individual behaviour is influenced by:

• cognitive factors such as perceptions, attitudes, beliefs and motivations

• organisational/social factors such as the organisational structure, strategy, culture, group dynamics

• situational factors such as our understanding of the evolving series of events during a project lifecycle


Summary

• Four perspectives on risk have been covered:

• rationalist

• behavioural

• cognitive

• cultural


Summary• Additionally, we have explored/reviewed:

• processes of risk identification, analysis, response, control, and communication, plus the main techniques for supporting the risk management process

• recent developments in integrated risk management approaches and enterprise risk management (ERM)

• the role of governance, and the focus on front-end definition to reduce risk in later stages of the project

• the application of real options thinking

• the use of systems dynamics to improve our understanding of risk interdependences


Recommended readingISBN-10: 1-4051-24687ISBN-13: 978-1-4051-24683

Chapter 4

Additional readingISBN-10: 1-4051-2450-4ISBN-13: 978-1-4051-2450-8

Chapter 10

Documents

Chapter 4 Perspectives on Managing Risk and Uncertainty Management: Commercial theory and practice