Download pdf - Qualitative & Quantitative Analysis

2014 © Alin Veronika Qualitative & Quantitative Risk Analysis


Determine the project overall risk ranking

Document non critical risks

Determine which risk to further analyze or go directly to risk response planning

Determine the probability and impact

Determine which risk events warrant a response


The process of prioritizing risks for further analysis or action by assessing and combining their probability of occurence and impact

Assign Probability •  High,

Medium, Low

Assign Impact •  High,

Medium, Low

Calculate the Severity •  Probability x

Impact


•  Describe in qualitative terms: –  High, moderate, low

•  Risk probability is the likelihood that a risk will occur

•  Risk consequence is the effect on project objectives if the risk event occurs


1. Estimate Probability • 10% through

90%

2. Estimate Impact • High=3 • Medium=2 • Low=1

3. Calculate the Severity • Probability x

Impact = Severity

4. Use Severity to identify • the risks worth

planning

Risk Description Probability (0.1 – 0.9)

Impact (1 – 3)

Severity (P * I))

Resources may be constrained due to team members working on multiple projects with conflicting priorities

70% 2 1.4

Significant schedule delays may occur because the team is unfamiliar with the new application

80% 3 2.4


•  A condition based on the combined probability and impact scales

•  Risk probability scale: –  General scale : 0.0 (no probability) up to 1.0 (certainly) –  Ordinal scale : very unlikely to almost certain

•  Risk impact scale: –  Ordinal scale : very low, low, moderate, high, very high –  Cardinal : linear or non linear


Medium High High

Medium Medium High

Low Medium Medium

High

High

Medium

Medium

Low

Low

Prob

abilit

y

Impact


Probabil ity-Impact (P-I) matrix: the multiplication of t h e s c a l e v a l u e o f probability and impact (P x I). The result is classified into high risk, moderate risk, or low risk


… or numeric:

Risk Score = P x I

Very Low 0.1 1

Low 0.3 2 Moderate 0.5 3 High 0.7 4 Very High 0.9 5

Negligible 0.1 1 Low 0.3 2

Moderate 0.5 3 Severe 0.7 4 Catastrophic 0.9 5


Code Risk Probabi l i ty Effects

R1 Organisational financial problems force reductions in the project budget.

Low Catastrophic

R2 Difficulties to recruit staff with the skills required for the project.

High Catastrophic

R3 Key staff are ill at critical times in the project.

Moderate Severe

R4 Software components that should be reused contain defects which limit their functionality.

High Severe

R5 Changes to requirements that require major design rework are proposed.

Moderate Severe

R6 The organisation is restructured so that different management are responsible for the project.

High Severe


Code Risk Probabi l i ty Effects

R7 The database used in the system cannot process as many transactions per second as expected.

Moderate Severe

R8 The time required to develop the software is underestimated.

High Severe

R9 CASE tools cannot be integrated. High Low

R10 Customers fail to understand the impact of requirements changes.

Moderate Low

R11 Required training for staff is not available. Moderate Low

R12 The rate of defect repair is underestimated. Moderate Moderate

R13 The size of the software is underestimated. High Moderate

R14 The code generated by CASE tools is inefficient. Moderate Negligible


Negligible Low Moderate Severe Catastrophic

Very High

High R9 R13 R4, R6, R8 R2

Moderate R14 R10, R11 R12 R3, R5, R7

Low R1

Very Low



Very High



Low R1

Very Low



Very High



Low R1

Very Low



•  Approach: Expected monetary value analysis. It computes the expected monetary outcome (according to different statistical criteria) of a decision/risk –  Technique: Decision tree analysis. Technique that helps

solving the EMV analysis.

•  Approach: Modeling. Provide a model of the project. –  Technique: Sensitivity analysis. Helps determining which

risks have the most impact by examining one variable at a time. (Tornado diagrams)

–  Technique: simulation, Monte Carlo technique.


Example 1: •  You are organizing the international conference.

There is 20% probability that paper prices will increase by 15%, thus costing you IDR 2 million in funding. What is the expected monetary value of the cost increase?

•  EMV = 0.2 * 2,000,000 = 400,000 rupiahs.


Risk Probability Maximum $ Impact of Risk

Contingency $ required

A 40% (30,000) (12,000

B 35% 20,000 7,000

C 50% 40,000 20,000

D 20% 70,000 14,000

Total Add $29,000 to your budget for contingency reserve needs 29,000

You are a project manager of construction project. You identify that there are four risks affect your project.


•  If Risk C occurs, how much is left in contingency reserves? –  Contingency Reserves : $ 29,000 –  Total required for Risk C : $ 40,000 (negative risk) –  Remaining amount : $ -11,000

•  If Risk A occurs, how much is left in contingency reserves? –  Contingency Reserves : $ 29,000 –  Total required for Risk A : $ 30,000 (positive risk) –  Remaining amount : $ 59,000


20


Choose the Vendor

Vendor A will cost $70,000?

Vendor B will cost $63,000

Delay will cost you $17,000

No Delay – No Cost

Delay will cost you $17,000

CNo Delay – No Cost

10%

Initial Cost Risk Cost Probability Total

Vendor A $70,000 $17,000,000 10% $71,700

Vendor B $63,000 $17,000,000 15% $65,550

90%

15%

85%



23

•  Sensitivity analysis is a technique used to show the effects of changing one or more variables on an outcome.

•  For example, many people use it to determine what the monthly payments for a loan will be given different interest rates or periods of the loan, or for determining break-even points based on different assumptions.

•  Spreadsheet software, such as Excel, is a common tool for performing sensitivity analysis.


24


Negative impact Positive impact •  To r n a d o D i a g r a m s i s general ly the result of Sensitivity Analysis –  A diagram to analyze project

sensitivity to cost or other factors

–  Ranks the bars from greatest to least on the project

Analysis to define the risk that has the most potential impact on the project



•  Introduce Monte Carlo Analysis as a tool for managing uncertainty

•  Demonstrate how it can be used in the policy setting

•  Discuss its uses and shortcomings, and how they are relevant to policy making processes


Copyright © 2004 David M. Hassenzahl

q  It is a tool for combining distributions, and thereby propagating more than just summary statistics

q  It uses random number generation, rather than analytic calculations

q  It is increasingly popular due to high speed personal computers


q  “Monte Carlo” from the gambling town of the same name (no surprise)

q  First applied in 1947 to model diffusion of neutrons through fissile materials

q  Limited use because time consuming q  Much more common since late 80’s q  Too easy now?


•  Takes an equation –  example: Risk = probability × consequence

•  Instead of simple numbers, draws randomly from defined distributions

•  Multiplies the two, stores the answer •  Repeats this over and over and over… •  Then the set of results is displayed as a new,

combined distribution


•  A model to translate the uncertainties into potential impact to project objective. Performed using Monte Carlo techniques

•  Monte Carlo Simulation can be used to determine how much the project or how long it will take


•  Could write this program using a random number generator

•  But, several software packages out there. •  Using Crystal Ball or @Risk

–  user friendly –  customizable –  r.n.g. good up to about 10,000 iterations




OPPORTUNITIES •  EXPLOIT •  SHARE •  ENHANCE •  ACCEPTANCE

THREATS •  AVOID •  TRANSFER •  MITIGATE •  ACCEPTANCE


Avoi

danc

e Is a very appropriate tool for working with undesirable risk in many circumstances Changing the project plan to eliminate the risk or condition or to protect the project deliverables from its impact

Tran

sfer

Transferring the risk impact to a third party together with the ownership of responses Contractual agreements and insurance are common ways to transfer risks

Mitig

atio

n Means to make it less e.g. using proven technology to lessen the probability that the product does not work), reducing the risk event value (e.g. buying insurance, use of fixed contract), or both

Acce

ptan

ce

Accepting the consequences Acceptance can be active (e.g.by developing a contingency plan to execute if the risk event occurs) or passive (e.g.by accepting a lower profit if some activities overrun) May be the best strategy if the cost or impact of the other strategies is too great


Enha

nce Sh

are

Acce

pt

Expl

oit Trying to remove

any uncertainty Examples of directly exploiting responses include assigning the organization’s most talented resources to the project to reduce the time to completion, or to provide better quality than originally planned

In order to share a positive risk, the project seeks to improve their chances of the risk occurring by working with another party Examples of sharing actions include forming risk-sharing partnership, teams, special purpose companies, or joint ventures

This strategy is used to increase the probability and/or the positive impact of an opportunity Examples of enhancing opportunities include adding more resources to an activity to finish early

Accepting an opportunity is willing to take advantage of it if the opportunity comes along, but not actively pursuing it


Negative Risk Response Strategies Positive Risk Response Strategies

AVOID (Eliminate the Cause)

TRANSFER (Find 3rd party to be

accountable or do work)

MITIGATE (Reduce probability and/or

impact)

EXPLOIT (Enable the Cause) CAUSE

OUTSOURCE

PROBABILITY & IMPACT

Negative or Positive Risk Response Strategies

ACCEPT (No actionable response)

Remove ac?vi?es or people

Ex: Insurance Fixed Price Contract

Ex: Training Prototype

Add ac?vi?es or people

Investors Partnering

Ex: Incen?ves

SHARE (Find 3rd party to support and

share in gain)

ENHANCE (Increase probability and/or

impact)


Transfer/Share

Avoid/Exploit

Accept Mitigate/Enhance

High Probability

Low Probability

Low Impact High Impact


40

Technical Risks Cost Risks Schedule Risks Emphasize team support and avoid stand-alone project structure

Increase the frequency of project monitoring


Increase project manager authority

Use WBS and CPM Use WBS and CPM

Improve problem handling and communication

Improve communication, project goals understanding, and team support

Select the most experienced project manager


Increase project manager authority

Use WBS and CPM


Cont

ingen

cy P

lans A plan that you

implement if a risk occurs during project execution.

Fallb

ack

Plan

s Plan B, which is to be implemented if the contingency plan failed. W

orka

roun

ds

Unplanned responses for unplanned risks that occur during project execution. Both risk and responses are not planned.


Secondary Risks • Risks are generated from implementing the risk response. • Secondary Risk should never have a higher Risk Rating

than the primary risk it is associated with. • For example, a response to use a even organizer to

organize a conference could lead to potential even organizer management risks. Document the event organizer management risks as Secondary Risks.


Residual Risks •  The remaining risk after a Risk Response Plan or Contingency Plan is

implemented. •  For example, a response may address 80% of the risk impact, so, the

remaining 20% represents the Residual Risk. •  Contingency Plans or Fallback Plans should be in place to respond to

known Residual Risks. •  New Residual Risks may be discovered during a Risk Audit, log on

the Risk Register and Perform Qualitative Risk Analysis.


Cont

ingen

cy R

eser

ves Money or time

assigned to deal with accepted risk, if they occur. Reserves for known unknown risk.

Man

agem

ent R

eser

ves Money or time

assigned to deal with risks that occur during project execution. Reserves for unknown unknown risk. May require a change to the schedule and cost baseline


Ac?vity Es?mates Work Packages Control

Account Project Es?mate

Con?ngency Reserve Cost Baseline Management

Reserve Cost Budget


Cost of the activities

Contingency reserves (based on the EMV of the risks cost)

Management reserves.

Project budget

Critical path duration

Contingency reserves

Management reserves.

Project schedule


Pass

ive A

ccep

tanc

e To accept a risk without a contingency reserve. No action except to document the strategy, leaving the project team to deal with the risks as they occur, and to periodically review the threat to ensure that it does not change significantly

Activ

e Ac

cept

ance

To accept a risk with a contingency reserve, including amounts of time, money, or resources to handle the risks.


Risk

Rea

sses

smen

t Monitor and control risk often results in identification of new risks and reassessment of risk, and should be scheduled regularly

Risk

Aud

it Risk audit examines and documents the effectiveness of risk responses in dealing with identified risks and their root causes, as well as the effectiveness of the risk management process

Varia

nce

and

Tren

d An

alysis

Variance analysis focuses on the difference between what was planned and what was executed Trend analysis shows how performance is trending


49

Monthly Ranking

Risk Item This Month

Last Month

Number of Months

Risk Resolution Progress

Inadequate planning

1 2 4 Working on revising the entire project plan

Poor definition of scope

2 3 3 Holding meetings with project customer and sponsor to clarify scope

Absence of leadership

3 1 2 Just assigned a new project manager to lead the project after old one quit

Poor cost estimates

4 4 3 Revising cost estimates

Poor time estimates

5 5 3 Revising schedule estimates


Risk Event Category Effect to

Project Root

Causes Triggers Potential Response Risk Owner Probability Impact Risk

Score Status

Initial Initial Add in this process The Urgent List for high priority risk

Risk that are high priority place on the Urgent List. Responses are developed. Low priority risks are placed on Watch List. Responses are developed if Risk Score increases. The Watch List for low priority risk


•  Each Group consists of 4 people •  Project Case Study •  Report Outline

–  Chapter 1: Introduction –  Chapter 2: Project Description –  Chapter 3: Risk Management Theory –  Chapter 4: Data Collection and Data Analysis –  Chapter 5: Discussion –  Chapter 6: Conclusion

•  Task Duration: 2 Weeks