Online PMP Training Material for PMP Exam - Risk Management Knowledge Area

www.GLOBALSKILLUP.com

PMP® Certification Training!

www.GLOBALSKILLUP.com2

CONNECT WITH US


Risk Management

Chapter 11


Chapter 11Objectives

Understand the different Risk Management Processes

Their Inputs, Tools and Techniques, Outputs

This chapter entails one to understand the various Risk Management aspects required to identify, remove and harness threats or opportunities.

Driving the project towards the desired outcome while the project progresses with minimal impact to the project objectives being accomplished to make the project successful!


It includes the processes to ensure the project risks are identified, analyzed, acted, planned with responses and controlled for minimal impact on project objectives.

Project Risks can be broadly categorized based on the level of knowledge we have upon them.

Known Risks. The risks which are identified and are aware to the project management team.Unknown Risks. The risks which are not yet identified & might occur instantaneously without prior knowledge.

Risks should be perceived as:Overall Project Risk. This is the holistic risk of the project itself considering all individual project risks along with any other unknown risks beyond the project control.

Individual Project Risks. Risks which can standalone or in a category group well within reach of the project which impact partially or a complete project objective set.

Knowledge Area: Risk Management


There are 6 Risk Management processes, namely:

1. Plan Risk ManagementProcess of ensuring the Risk management is planned in detailed manner which can be applied over the course of the project.

2. Identify RisksIdentification of Risks over the Course of the Project and documentation of their characteristics.

3. Perform Qualitative Risk AnalysisPerforming a qualitative analysis of risks and conditions to prioritize their effects on project objectives.

4. Perform Quantitative Risk AnalysisMeasuring the probability and consequences of risks and estimating their implications for project objectives.

5. Plan Risk ResponsesOnce Risks are prioritized and weighted, each of risks are provided a response plan (Avoid, Transfer, Mitigate, Accept for Negative Risks and Exploit, Enhance, Share, Accept for Positive Risks)

6. Control RisksControlling Risks over the duration of the project to the benefit of the project objectives.

Knowledge Area: Risk Management


Risk responses by Stakeholders /Organizations depend on:

Risk Appetite. Degree of Risk which will be taken up in order to gain a reward. Variations are measured over course of the project in LCL (Lower Control Limit) & UCL(Upper Control Limit) to understand the stakeholder risk appetite levels.

Risk Tolerance Levels. Degree of Risk which will be entertained beyond which the attention is required.

Risk Threshold Levels. Extreme Levels of Risk either on lower side or upper side. Crossing the lower side, the Risk is absolutely negligible and crossing the upper side, the Risk will not be tolerated any further.

Knowledge Area: Risk ManagementTotal Cost to Sponsor/Stakeholder

{Proj

ect

Cost

{Contingency Reserve

Actual Work Cost

{{M

anag

emen

tRe

serv

e

Tolerance Level

Threshold Level

Appetite


11.1 Plan Risk Management

Inputs

• Project Management Plan

• Project Charter

• Stakeholder Register

• Enterprise Environmental Factors

• Organizational Process Assets

Tools & Techniques

• Analytical Techniques

• Expert Judgment

• Meetings

Planning Process

• Integration• Develop Project Management Plan

• Scope• Plan Scope Management• Collect Requirements• Define Scope• Create WBS

• Time• Plan Schedule Management• Define Activities• Sequence Activities• Estimate Activity Resources• Estimate Activity Duration• Develop Schedule

• Cost• Plan Cost Management• Estimate Costs• Determine Budget

• Quality• Plan Quality Management

• Human Resource• Plan HR Management

• Communications• Plan Communications Management

• Risk• Plan Risk Management• Identify Risks• Perform Qualitative Risk Analysis• Perform Quantitative Risk Analysis• Plan Risk Responses

• Procurement• Plan Procurement Management

• Stakeholder• Plan Stakeholder Management

Risks are uncertain events which may trigger positive or negative impact on the project outcome. Planning risk management involves end to end management of risks involved in the project.

Key benefit of this process ensures the degree, type and visibility of risks are given right and required risk ratings.

Risks in the project have to be dealt with due diligence and with complete understanding of the same from all the stakeholders. Risk management starts much before the project is actually conceived.

Identified risks are then in the later stages managed to be minimized, exploited and if not planned for contingencies. Risks are regularly revisited and reviewed over the duration of the project.


Analytical Techniques help understand the holistic view of the Risks on the project.

One mechanism beneficial to diagnose and understand the tolerance and risk appetite levels of the decision makers/stakeholders.

This definitely helps understand the amount of risks which can be handled and which need to be pitched as immediate escalation points on the project.

Analytical Techniques


This plan defines how the risk activities will be performed on the project. It may include the following:

MethodologyDefined approach along with the tools to perform Risk management

Roles and responsibilitiesDefines risk management resources roles & responsibilities

BudgetingHelps estimate budget to ensure the required reserves are defined

TimingTime when the information has to be conveyed

Risk categoriesRisks may be categorized into multiple categories based on the project being performed. They may be grouped based on various approaches.

RBS(Risk Breakdown Structure) helps identify risks from multiple sources identified in risk identification exercise and categorize them in a structured manner for ease of addressing them.

Risk Management Plan


Definitions of Risk Probability and Impact: Define the probability and impact definitions that will be used in the project. Sample Impact Definition Table is shown here.

Probability and Impact Matrix

Risk Management PlanVery Low

0.10Low0.25

Moderate0.50

High0.75

Very High0.90

Scope Insignificant Changes Changes Moderate Changes Major Changes Major Significant

Changes

Time <5% Increased Timeline

<25% Increased Timeline

25-50% Increased Timeline

50-70% Increased Timeline

>70% Increased Timeline

Cost <5% Increased Project Cost

<25% Increased Project Cost

25-50% Increased Project Cost

50-70% Increased Project Cost

>70% Increased Project Cost

Quality Quality Changes Not Significant

Quality May Need To Be Improved

Sponsor Needs To Approve The Quality

Product Quality Is Not Acceptable To

SponsorEnd Product Quality

Is Useless

Very LikelyMost Likely

Likely

Chance of Likely

Unlikely

Probability

/ImpactVery Low Low Moderate High Very High

Revised Stakeholders’ TolerancesContinuous revision of stakeholders tolerances based on their risk appetite over project duration.

Reporting FormatsDefine the report formats which include the manner, risks will be documented, formatted, communicated to which stakeholder group.

TrackingRisk Tracking is very important as the risks continuously evolve from one quadrant to another. Recording of their risk movements is equally important from the Risk Auditing perspective.


11.2 Identify Risks

Inputs

• Risk, Cost, Schedule, Quality, HR Management Plan

• Scope Baseline

• Activity Cost Estimates

• Activity Duration Estimates

• Stakeholder Register

• Project Documents

• Procurement Documents

• Enterprise Environmental Factors


Tools & Techniques

• Documentation Reviews

• Information Gathering Techniques

• Checklist Analysis

• Assumptions Analysis

• Diagramming Techniques

• SWOT Analysis

• Expert Judgment

Planning Process











Risks are uncertain events and identification of them early leads us to better preparation with suitable action plans.

Documentation of the identified risks with their characteristics helps us be prepared in likely or unlikely situation of the Risk occurrence.

Documentation of the risks in a consistent manner will provide sufficient detail so as to compare them with each other and suitable associated action response plan be derived.

This process of identification of risks is iterative and has to be performed across the intervals of the project duration.


Risk Register is a document which records the Risk Analysis and Risk Response Planning. This document evolves as the project progresses and is a live document.

Risk Register provides input about the Risk events to impact resource selection and availability during the Estimate Activity Resources leading to more finer estimates.

List of Identified Risks:Identified risks are detailed as much possible including the root cause.Risk statements may be used in conjunction to triggers such as Event->Impact and/or Event -> Effect.

List of Potential Responses:During the identification of the risks, there may be situations where in the risk response is readily known. These potential responses should be recorded.While the project progresses, the risks registered are continuously reviewed for triggers and/or risk responses.

Risk Register


Documentation ReviewsA detailed study or review of the various project documents may help indicate and identify the risks in the project.

Various documents which may be subjected to review, but not limited to:

Plan DocumentsAssumptionsPrevious Project DocumentsLegal DocumentsCompliance ConsiderationsOrganizational PoliciesDatabasesHistorical Plans

Information may be gathered in various formats:

BrainstormingDelphi TechniqueInterviewingRoot Cause Analysis

Information Gathering Techniques

Delphi


Checklist AnalysisRisk Identification Checklists may be evolved over a period of time in any organization which become a ready reckoner for identification of risks.However, proper care should be taken to explore risks beyond the Checklist itself as this may not be comprehensive to every project running in the organization.

Every project is conceived based on certain assumptions, scenarios and possible postulate.

Each one of these need to be evaluated and understood in the context of the project in progress.

Assumption Analysis

Certain

Un Certain

Leas

t Im

porta

nt

Mos

t Im

porta

nt

CriticalRegion

A AA

AA

A

A

A

A

A

A

A

A


Diagramming TechniquesDiagramming techniques involve the usage of the diagramming methods based on which the risks can be identified.

Such as:Ishikawa’s Fish Bone DiagramSystem or Process Flow ChartsInfluence Diagrams – Helps to identify the decision tree. As shown below.

Strengths, Weakness, Opportunities, Threats Analysis in short is known as SWOT analysis.

Analysis of the Project is performed to diagnose the Strengths, Weakness, Opportunities, Threats.

This is first done in a manner to identify Strengths and Weakness. Then based on Strengths, opportunities are further explored. Similarly based on weakness, threats are further explored.

SWOT Analysis

Strengths- Strong Brand Awareness among Customers

Weakness - Low Funds for Expansion

Opportunities- Build Partnerships- Increase

Investments

Threats- Increased Competition & Marketing Spends

FundResearch

Market Value

Launch Product

Research Success

Market Success

Influence Diagram


11.3 Perform Qualitative Risk Analysis

Inputs

• Risk Management Plan

• Scope Baseline

• Risk Register• Enterprise

Environmental Factors


Tools & Techniques• Risk

Probability And Impact Assessment

• Probability And Impact Matrix

• Risk Data Quality Assessment

• Risk Categorization

• Risk Urgency Assessment

• Expert Judgment

Planning Process











Performing a qualitative analysis of risks and conditions to prioritize their effects on project objectives.

Key benefit of this process is to ensure the specialized focus is on the high quality risks.

This is done through out the project duration and will cause re-assessment of certain risks as the project evolves.

In order to ensure there is no influence or bias on the assessment, the probability and impact definitions are defined upfront.

This also helps in establishing “perform quantitative risk analysis”.


Risk Probability Assessment investigates the likelihood that each specific risk will occur.

Risk Impact Assessment investigates the impact on the outcome of the project on Scope, Time, Cost, Quality parameters should the risk occur.

Each risk is analyzed for both probability and impact assessment. Risk probabilities and impacts are rated based on the definitions in the Risk Management Plan.

All risks are rated based on their assessed probability and impact as defined in the matrix.

Each of the risks are color coded and accordingly paid attention. The Risks which are more darker in color lead to more attention from the project management team.

Probability ↓ Threats (Negative Risks) Opportunities (Positive Risks)

0.90 .0090 .2250 .4500 .6750 .8100 .8100 .6750 .4500 .2250 .0090

0.75 .0075 .1875 .3750 .5625 .6750 .6750 .5625 .3750 .1875 .0075

0.50 .0050 .1250 .2500 .3750 .4500 .4500 .3750 .2500 .1250 .0050

0.25 .0025 .0625 .1250 .1875 .2250 .2250 .1875 .1250 .0625 .0025

0.10 .0010 .0250 .0500 .0750 .0900 .0900 .0750 .0500 .0250 .0010

Impact→

Very Low0.10

Low0.25

Moderate0.50

High0.75

Very High0.90

Very High0.90

High0.75

Moderate0.50

Low0.25

Very Low0.10

Risk Probability & Impact Assessment


A detailed study of the supplementary data for each risk helps ensure each risk is paid rightful attention.

This involves the degree of examination of the data about the risk is known and understood.

Parameters based on which the data quality assessment is performed usually involves accuracy, quality, reliability and integrity of the data about the risk.

Risks may be categorized based on the:

Sources of Risk Identified

Which affect a particular project area

Common root causes

Common actions or solutions adopted for risks and so on..

Risk Data Quality Assessment Risk Categorization


Risks which need immediate attention from the perspective of time criticality are required to be acted upon quickly.

Based on the time criticality, the risk priorities define the Risk Rank Ratings.

Risk Urgency Assessment


11.4 Perform Quantitative Risk Analysis

Inputs

• Risk, Cost, Schedule Management Plan

• Risk Register• Enterprise

Environmental Factors


Tools & Techniques

• Data Gathering and Representation Techniques

• Quantitative Risk Analysis and Modeling Techniques

• Expert Judgment

Planning Process











Key benefit is to measure the probability and consequences of risks and estimating their implications for project objectives.

Helps in reducing the project uncertainty by performing the quantitative risk analysis.

It is mostly used to evaluate the aggregate effect of all risks affecting the project.

Performing this process requires budget and involves cost. This Cost benefit should be evaluated before this process can be exercised.


Commonly used approaches involve:1. Sensitivity Analysis2. Expected Monetary Value analysis3. Modeling and Simulation

Quantitative Risk Analysis and Modeling Techniques

1. Sensitivity Analysis

This analysis helps identify the most potential impact on the project. A sample Tornado Diagram shows how it is performed.

Risk 5

Risk 4

Risk 3

Risk 2

Risk 1

-3000 -2000 -1000 0 1000 2000 3000 4000 5000 6000

Inverted Tornado Diagram

Negative Impact Positive Impact



2. Expected Monetary Value(EMV)Highest EMV wins.This type of analysis provides the future possible income or outgo values based on the statistical probability and impact values.

Risk A

Risk C80% likely

Risk B20% likely

Outcome1

70% likely

Outcome2

10% likely

Outcome3

20% likely

INR 100 Lakh Implication






What is your Investment decision based on Risk?

New Product or

Maintain?

New Product Development

Investment $60M

Maintain Product

Investment $30M

Strong Sales

Revenue: $150M

Weak Sales

Revenue : $70M

Strong Sales

Revenue : $80M

Weak Sales

Revenue : $20M


What is your Investment decision based on Risk?

New Product or

Maintain?


Investment $60M

Maintain Product

Investment $30M

Strong Sales

Revenue : $150M

Weak Sales

Revenue : $70M

Strong Sales

Revenue : $80M

Weak Sales

Revenue : $20M

150-60 = $90M

70-60 = $10M

80-30 =$50M

20-30 = -$10M

70% Chance

30% Chance

70% Chance

30% Chance


Investment decision is based on lowest risk(eliminating -10M) as well as based on highest EMV(66M)

New Product or

Maintain?


Investment $60M

Maintain Product

Investment $30M

Strong Sales

Revenue : $150M

Weak Sales

Revenue : $70M

Strong Sales

Revenue : $80M

Weak Sales

Revenue : $20M

150-60 = $90M

70-60 = $10M

80-30 =$50M

20-30 = -$10M

EMV of New Product = 70% * 90 + 30% * 10 =

63 + 3 = $66M

70% Chance

30% Chance

70% Chance

30% Chance

EMV of Maintain = 70% * 50 + 30% * -10 =

35 + (-10) = $25M



3. Modeling and SimulationThis type of analysis is performed when the actual cost of performing activities may have multiple variables and could cost immensely to actually perform feasibility in reality.

Monte Carlo Simulation provides unique multiple iterations of outcomes based on the predefined trigger values and parameters using which these simulations are performed statistically using a computing machine.

Example: Simply treat it as a task repeated over many times with different variables over a project schedule network. What will be the output? Will it vary every time? Yes. Though repetitions of the task many times will give us a precise range of how many days +/- it would take to accomplish that. That is how the Simulations would help you

come up with almost certain range of all. This includes the probability of the risks on the Project as well.

Benefits of such Monte Carlo or any other simulation includes:

- Almost precise calculations considering many parameters for Cost estimates, Schedule estimates, Overall risk and so on.

- Since it includes path convergence for the schedule network, the complexity of every task is accounted, which brings more stability in estimates.


}Monte Carlo Simulation Explained

Project or

Investment Decision

Risk of Investment 40,000 People, 2B$ Cost, 800 Machines 5 Years Project

Risk of Investment 20,000 People, 3B$ Cost, 600 Machines 10 Years Project

.

.

.

.

.

.

.

.

.

.

.

.

Definitive Range of Years based on Multiple Risk Based Scenarios

.

.

.

.

.

.

.

.


11.5 Plan Risk Responses

Inputs

• Risk Management Plan

• Risk Register

Tools & Techniques

• Strategies For Negative Risks Or Threats

• Strategies For Positive Risks Or Opportunities

• Contingent Response Strategies

• Expert Judgment

Planning Process











This is one of the most important Risk Management processes as we step into the effective actions and evaluate options of how to address these prioritized risks.

Key benefits of this includes the allocation of budget, resources and schedule for the identified and actionable risks.

From the multiple options available to response for each risk it is imperative to understand which option/response will be most appropriate in the context of the project limits.

Risks include both threats and opportunities for which the responses can be developed and initiated for action.


Negative Risks or Threats can be acted with response in following manner:1. Avoid2. Transfer3. Mitigate4. Accept (Applicable for both Negative Threat

& Positive Opportunity)

AvoidWhere possible it is always recommended to ensure the critical risks are completely avoided either by eliminating the threat or by ensuring the project is shielded completely from the impact of the threat.Most radical extreme step to avoid risk would be to shutdown the project itself.

TransferTransfer of risk to a third party for a price ensures the risk even if it occurs minimizes the impact on the project, since it is offset with the third party.Risks which are transferred to a third party involves risks with major cost implication to project.Transfer of the risk, does not eliminate risk itself, it just transfers the ownership to a third party.

MitigateProject team acts to minimize the impact & probability of the risk over a period of time to ensure the risk is brought to minimal state or completely eliminated.

AcceptTeam acknowledges the risk and waits until the risk occurs to respond on it.

Active Acceptance – Build a contingency reserve to ensure when the risk occurs it is readily acted with the contingency (time, cost, scope, quality).Passive Acceptance – It is documented and then awaited until risk occurs, so that further action can be taken up.

Strategies For Negative Risks Or Threats

Critical Risks with High Impact

Less Critical Risks with Low Impact

Avoid Good Strategy

Mitigate Good Strategy

Transfer Good Strategy

Accept Good Strategy


Positive Risk Example: A potential delay in the delivery of materials which happened to be delivered ahead of time. This risk is now an opportunity to check on the schedule what work can be done already in advance given the availability of materials.

Positive Risks or Opportunities can be acted with response in following manner listed below.

1. Exploit2. Enhance3. Share4. Accept (Passive Acceptance Only)

ExploitWhen there are risks which can be beneficial to the organization, it is natural that these risks are driven towards ensuring Risk occurs.

EnhanceWhen you want to increase the probability or likely chances to ensure the risk occurs

by maximizing the possibilities of risk occurrence.ShareSharing of the risk to third party for maximum throughput when we make the risk occur to maximize risk out come.

AcceptAccepting the risk to harness the opportunity when the risk actually arises on its own and not actively pursuing.

Strategies for Positive Risks or Opportunities


Some of the responses are planned only when the risks will occur such as in Accept – Active Acceptance.

In such a response planning, a contingent reserve or a fall back plan is established so as to respond appropriately upon the occurrence of such a risk.

There is no substitute to experience when it comes to Contingent Response Strategies – Expert Judgment stays on top of the list strategy.

While many project managers simply prefer to have a transfer of risks when they occur, rather than manage in practice.

Contingent Response Strategies


11.6 Control Risks

Inputs

• Project Management Plan

• Risk Register• Work Performance Data• Work Performance

Reports

Tools & Techniques

• Risk Reassessment• Risk Audits• Variance and Trend Analysis• Technical Performance

Measurement• Reserve Analysis• Meetings

Monitoring & Controlling Process

• Integration• Monitor and Control Project Work• Perform Integrated Change Control

• Scope• Validate Scope• Control Scope

• Time• Control Schedule

• Cost• Control Costs

• Quality• Control Quality

• Human Resource• Communications

• Control Communications• Risk

• Monitor & Control Risks• Procurement

• Control Procurements• Stakeholder

• Control Stakeholder Management

It is the process of controlling risks during the project by monitoring existing risks, their response plans, risk movements, identification of new risks, elimination of outdated risks to ensure the project objectives are least harmed or nil impact due to risks.

Key benefit includes the effective Risk management and its minimized or nullified risk impact on the project objectives.

This process also ensure the planned risk management processes are being followed during the course of the project and any further improvements to the risk processes are adopted.


Risk ReassessmentIt is a continuous process through out Project life cycle and performed across all Process Groups.

Risk Reassessments should be carried out frequently to perform the new risk identification, re-planning the risk responses, close the outdated risks.

Based on the project size and the organizational practice, the project management team and/or specialized risk management team reassess the risks at frequent intervals.

Identify

Observe

RegulateClose

Re-Assess


More Tools & TechniquesVariance & Trend Analysis

Performance baselines defined in the project should be constantly monitored for any variances.

Also based on the trend analysis of baseline performance, suitable actions should be planned, including further risk identification and actions in the Project.

Technical Performance Measurement

Technical performance of the Project is usually measured based on the type of project we execute.

Suppose in a software project, we would be interested in the Technical performance of Planned Flawless Modules against Actual Modules with Flaws.

Suppose in a construction project, we would be interested in the Technical performance based on planned bricks with weight of 2 KG versus actual weight being 2.4 KG.

Measuring such Technical performance gives an indication of the success chances of Project.


Chapter 11 - Debrief


THIS BRINGS TO “RISK MANAGEMENT” COMPLETION.

From what we have understood so far is:

6 Risk Management Knowledge Area Processes Identified their Inputs, Tools & Techniques, Outputs

Chapter 11


PMP Group Trainings across IndiaBangalore | Hyderabad | Pune | Delhi | Chennai | Mumbai | Noida | Gurgaon

Online Trainings Too


Acknowledgements & Disclaimer

PMI, PMBOK, PMP, CAPM, PgMP, PMI-ACP, PMI-RMP, PMI-SP are registered marks of Project Management Institute, Inc.All registered trademarks, symbols, names are marks of their respective owners and acknowledged.

Leadership & Management

Online PMP Training Material for PMP Exam - Risk Management Knowledge Area