Topic is risk management. The term risk is associated with it a connotation of negativeness
and uncertainty.
Risk may be defined as a possibility of a loss and the project risks are uncertain events
which if they occur will have an unexpected usually negative effect on the project's objective.
So, risks are taken because associated with the risks are opportunities and the organization
accepts only those risks which are balanced with the reward that may be gained by accepting
the risks.
So the risk of adopting a fast track schedule is taken with the intention of early completion.
That means the time to complete is reduced when you are taking a risk that in the event
if something goes wrong you may need to redo that particular job.
So, organizations and individuals balance the risks and the opportunities. This implies
that different organizations do not look at all the risks in the same way know. Different
organizations will have a different level of risk tolerance and some may be risk averse
and some may be risk prone. Of course you have the in between category of risk being
neutral.
Risk conditions are those aspects of project environment that could contribute to the risks.
Therefore poor quality of project management, dependency on external partners, working on
a technology which is not yet well established are some of the examples which could lead
to such problems.
The known risks of any particular project therefore can be managed but whereas the unknown
risks cannot be managed.
So the unknown risks need to be tackled in some form for contingency. They will have
to be done based on past experience.
So we ask the next question why do we manage risk and the answer is very simple, the time,
money and effort spent on risk management is like insurance.
Risk management is an activity undertaken to reduce the impact of a potentially adverse
event. It is a form of investment in that the cost associated with it will be less than
the possible benefits that may accrue because of non occurrence of the risk.
The extent of investment will depend on the nature of the project, the experience of the
project team, the constraints in the model and the enthusiasm of the client and so on
and so forth.
So, the extent of investment in risk management will not exceed the potential benefits that
may come along.
Now, one measure of organization's commitment to risk management is to see the dedication
with which the data in respect of the risk management is gathered and used.
So, management's dedication in gathering high quality data about the risks and their consequences
is a sure indicator that the management is taking the risk management activity very seriously.
In case you manage your risks well what does happen?
So, effective risk management can result in significant improvement in the ultimate success
of the project by way of having fewer problems and more expeditious to resolution of problems
that do occur. It will also help the stake holders in understanding
the nature of the project and other things that are associated with it.
It gets the team members involved in defining the strengths and the weaknesses of the project,
it also helps in integrating various project management knowledge areas.
So selection of a project and establishing a project scope, making estimates etc are
good examples where you need to integrate knowledge from several project management
areas or knowledge areas.
Now this is one word of caution "the good risks often go unnoticed".
Crisis management is visible but the projects with well managed risks are often not noticed.
What we say is, here is a simple example; if a driver of a company executive was on
leave and the executive had to take somebody else's car and a driver to drop him in the
airport and midway through the car fails or the petrol in the tank is empty then the driver
makes frantic effort to make sure that he has a taxi or calls another car or whatever
and gets the boss to the airport in time and the boss is very happy at the enthusiasm of
our friend and gives him a hundred rupee tip.
The boss never realizes all that his driver takes him to the airport the car never failed,
it was always taken care of, the tanks were full, the oil whatever else needs to be checked
was properly checked and because there was no crisis the driver never got either acknowledged
or rewarded.
In the same sense a project which has good risk management you will find that the project
will have fewer crises but then you it may look like the project is running very smoothly
without any particular problem.
So the crisis poses obvious danger to the project and these results in one of the team
members.
So resolving crisis is more visible so from outsider's point of view it may not realize
that the project risk is being well managed.
So we say, the well run project seems to run with effortless ease and that itself is the
sign of success of the project.
Project risk management basically is a process which is aimed at minimizing the probability
and the consequences of adverse events to the project's objective. Project management
activity like other management activity is done throughout the life of the project.
And the project risk management process is directed at identifying, analyzing and responding
to the project risk with the simple intention of meeting the project objectives within the
constraints specified.
Now what are subprocesses in risk management? Let us look at the slide.
1) Risk management planning process 2) Risk identification process,
3) Risk analysis process, 4) Risk response planning process and we have
5) Risk monitoring and control process.
Now ask the next question; what does the risk management planning process do?
Risk management planning process is aimed at deciding how the project will approach
the risk, how to approach the risk management activity.
If you look at the slide from our point of view we say risk management planning process
is aimed at deciding how to approach and to plan for risk management activities in the
project.
This process ensures that the level, type and the visibility of the risk management
activity is commensurate with both the risks and the importance of these particular risks
in the organization.
Now what you need to remember again is, the process does not address response to individual
risks. This is not the process which addresses individual risk.
Individual risk can be addressed to at a later stage in the risk response planning process.
So, risk management planning process is only sort of outlines the organization's approach
to tackling the risks.
First what we need to do for risk management planning is to organize a meeting with all
the concerned stake holders. So the project team should hold planning meetings and develop
risk management planning.
At this particular meeting you will get all, project manager, team leader, team member,
key stake holders, other project management or you may have risk management team of the
sponsoring organization or the performing organization, you might even have external
experts and so on and so forth. And once you have done that particular thing then risk
management templates and inputs may be used to evolve a risk management planning.
When you do this particular activity and decide how you are going to tackle that particular
job then at the end of it you are going to get certain output.
So the first output that you will get is the risk management plan.
typically this particular plan describes how the risk identification will take place, how
the analysis will take place, both quantitative and qualitative analysis, how the responses
will be planned, how they will be monitored, controlled and so on.
So it describes general approach to risk management and summarizes the findings in the form of
risk identification process and obviously the risk quantification process.
Now the methodology part of it defines the approach, tools, techniques, data sources
that may be used for performing the risk management project.
The budgeting need obviously establishes a budget for project risk management. the roles
and responsibilities are defined and the lead, support, risk management, team membership
all such details are finalized, independent risk management teams may perform the job
more unbiasely but it may not always be possible for you to have such a team.
Timing in terms of when the risk management will run, how frequently it will run, all
those particular things are also equally important.
The result should be early enough to affect the decisions and the decisions should be
revisited periodically in the life cycle to make sure that the decisions are correct.
The scoring and interpretation is an approach for methods and the tools, techniques that
you will use for assessment and evaluation of the risks.
Thresholds: The risk levels at which action is to be taken
by whom and in what manner. there are many things as what you call gradual degradation
and the things which have sudden degradation, when you have gradual degradation we have
a problem, normally we have a problem of late coming then you are going to say that like
how late is late enough before you invoke your authority and put your foot down and
tell people to be on time, so, that will be a threshold.
In many such particular situations there are number of people leaving a project, number
of people joining a project all these kinds of things can have a threshold.
Then the information about the risk management activity needs to be reported so the reporting
formats also need to be drawn out.
So how will the risks be documented, analyzed and communicated etc all these are to be put
in a proper format. Making a plan is not enough what is important is you track the plan.
So, tracking depends how all the facets of risk managerial activities be recorded for
the benefit of the current project and the future needs and how will the lessons learnt
be put in the processes.
So how you will define, for instance, the risk processes, how will they be audited is
another important issue which will be done in risk tracking?
There are another two outputs from risk management planning process.
We will look at the slide; one is a contingency plan and the other one is going to be contingency
reserve.
What is a contingency plan? The contingency plan specifies the pre defined
action that will be put into action, should a risk materialize. Remember, we will see
another term ahead, mitigation.
So the mitigation activities are put into our project plan immediately with immediate
tracking whereas the contingency plan is put into effect only if the risks were to materialize.
so if a project team knows that the new release of a software is not likely to be available
in time they may have a contingency plan to use a available version of some kind of software
tool such as the emulator or a simulator or some kind of a thing that will serve the purpose
half as good may be but it will serve the purpose alike.
The contingency reserves are the funds or resources which are kept available for coping
with unexpected changes that may happen to scope, cost, schedule and content.
Remember, in case we anticipate something we take care of it right away usually in the
form of some mitigation action. But whatever, things are residual like residual error the
residual risks to the particular project need to be tackled through contingency planning
and contingency reserve.
If a project goes of course then we need to withdraw some credit out to the contingency
particularly.
Once we have made a risk management plan the next thing is to go to next process known
as the risk identification.
Risk identification may affect the project in terms of classifying what sort of risks
are involved; market risks, financial risks, technology risk and so on.
So, the risk identification process involves identifying the risks that may be affecting
a particular project. There are many ways in which the risk can be classified or grouped
or identified for that matter. It can for instance do everything in terms of knowledge
areas.
So you can do the risks associated with the scope management, with the schedule management,
with the cost management and so on and so forth.
Once you got these risks identified documenting their characteristics is very important. As
we already understanding is followed by documenting.
So risk identification involves gaining and understanding of the potentially unsatisfactory
outcomes associated with a particular project and then we will see the action to be taken.
There are two terms which are very often used associated with risk; one is the risk event.
Risk events are specific things that may occur to the betterment of the project.
For instance significant change to the scope of the project performance failure on the
produced product or delays in work relation, delays in non availability of resources, litigation
against the organization all these are basically risk events.
After these risk events are identified it is important to define what is their likely
probability of occurrence and the consequence and once that particular thing is known then
we need to finalize on how to do the planning.
These details help the project team in deciding there responses to it.
Another particular concept is the event is preceded usually by symptoms. It is like saying
that in case you are going to go down with fever you might get cough and cold as prior
symptoms. By the same particular token risk symptoms are indicators or triggers for actual
risk event.
Let us take a simple example of symptoms; Suppose they are going to be cost over runs
on early activities, the early activities in the project show cost over run it is going
to be an indicator it is a symptom for may be understanding that the cost estimates are
poor in quality or inappropriate resource allocation has been done or the management
control is not adequate etc.
So detection of defective products similarly can be a symptom for poor requirement analysis,
poor reviews, inadequate quality planning, low quality suppliers, supply of product of
low quality etc can happen. The marketers will know whether the new product
produced will be marketable, will someone else make a similar product, make it available
immediately after yours, then the financial risk is if the whole project affordable, return
on investment, pay back period and so on and so forth.
The technology risk is in terms of the technology being adequate, appropriate, and feasible
and all that kind of thing.
So what we find is that when you are doing this kind of risk identification one of the
most useful tools that will be available at your disposal will be risk identification
check list. If you have to go on internet you might try 7 or 8000 project risks associated
with software projects but not all of them are applicable to each project.
So, the check list provides the starting point for tailoring the requirements in terms of
risk management.
Why source of risks was known? The potential risk can be identified using
the techniques like flowcharts, fish bone diagram, check list, interviews and so on
and so forth.
Risk identification check list have been promoted by different groups. For instance group or
() and many other particular people have given a specific check list which can be used associated
with the risk management.
Once we have done the risk identification the next thing we need to do is analysis.
Once the risk can be identified it is essential to assess their impact in the project. The
impact of the project needs to be assessed into the qualitative and the quantitative
impact.
Obviously the quantitative analysis will be more rigorous but it will cause more and take
longer time. Obviously it is not likely that you will spend equal amount of time, money
and effort on each particular risk that might be associated with the project.
Therefore what qualitative risk analysis does is that it helps us in identifying few risks
which are of major concern to the organization. And from that particular point of view attention
can be paid only to those particular risks for detailed analysis.
Therefore risk analysis is used in all risk related decisions and answering questions
like if the risk is worth reducing, if the proposed solution is economically viable,
is the case of multi--risks situation there and so on.
Now let us first look at the risk analysis processes, what they are.
The objective of risk analysis process is to help highest management to strike economic
balance between the impact of risk and the cost of productive measures.
Risk analysis involves evaluating the risk and assessing the risk tolerance, risk interaction
so that the likely project outcomes can be detected. So the probability of each risk
its impact on the project objectives and its impact on the overall project risks can still
be studied very well.
When you start this thing we have to do quantitative and qualitative analysis.
So, if you do qualitative risk analysis the qualitative risk analysis process is aimed
at assessing the likelihood and impact of the identified risk.
This analysis involves evaluation of the probability and the consequences of risks using established
qualitative analysis tools and techniques.
So it helps you in correcting the biases if any in the project plan.
This particular process prioritizes the risks which will throw up the importance of the
risk and the time criticality associated with this particular risk.
The quality of available information also influences the assessment of the risk kind
of activity.
So what we do now? From this point onwards we will say that quality of available information
will influence our risks so from that point of view an organization's collection of database
with respect to risks becomes a very important factor.
Now let us look at an example of how this kind of qualitative analysis can be done.
You can have a risk impact rating table that can be developed.
These are the means by which some kind of a quantification of the risk can be done based
on judgment of the individual.
If you look at our slide then it says that if your project objective is cost and we say
that a particular risk is identified then we ask a question that what kind of impact
this risk will have on the cost. And if the impact of this particular risk is insignificant
then we say that the risk rating is very low, if it is say less than 5 or 10% of course
these numbers 5%, 10% or 20% are very subjective based on the organizational judgment and the
seriousness about those particular factor.
We can do exactly similar kind of a thing associated with the schedule and then we can
do the same particular thing with scope, we can do another thing with quality and so on.
So in this particular manner we can say take a example of each particular risk and see
what will be its impact on each of these particular four factors.
If you had a risk that some key people associated with a project will abscond in the middle
of the project then you see what the impact is of that decision on cost, schedule, scope
and quality.
Now when we are doing this particular kind of job you get an output that overall risk
tracking of the project is one particular thing.
Here this particular aspect goes beyond an individual project. as we have seen earlier
many a times the project portfolio is a key factor and from that point of view a single
rating overall risk ranking of the project is very necessary from an organizational point
of view.
This enables them to compare one project with another particular project. But otherwise
this particular process gives you a prioritized list of risks. It is for this list of risks
for which additional analysis is to be done and it shows trends in the qualitative risk
analysis results as to whenever you have done such particular activity how many risks you
have found and how the impact and the assessment was done subsequently and how much time, money
and effort was spent on it.
Once we have done the qualitative risk analysis we have identified few risks which need to
be analyzed in great deal of details and for that quantitative risk analysis process will
be useful. The key analysis on this particular thing will be in terms of impact and the likelihood.
So, impact upon materialization of the unfavorable event and the likelihood of such an event
occurring are the two major considerations that we have in quantitative analysis.
The impact and the likelihood are estimated by using a combination of historic data, the
knowledge about the system and our own experience and judgment.
So, impact frequency and the risk exposure is something that is of great interest to
the project manager. For the purpose of risk analysis, estimates in order of magnitude
are good enough.
Now let us look at the slide. If you had an impact of Rs. 10 then the next particular
level the quantum jumps in terms of, like we need responses to 100, 1,000, and 10,000
and so on.
Therefore it is possible for us to get the quantification to these kinds of levels that
are possible.
So rounding-off of impact and the likelihood estimates to a factor of 10 will considerably
reduce the time needed for doing the analysis. Please remember, the exact data may not available
and exact analysis of risks at this particular stage may not be economically viable.
So, if the impact is so much then the frequency can be considered in terms of these particular
kinds of levels.
What are the quantitative risk analysis techniques? Some of the well known techniques which we
have already referred to is expected money value, decision tree analysis, sensitivity
analysis, simulation analysis and so on.
What is sensitivity analysis? It is like if you had a xy curve and you say
if you make a small change to x how great a change does it make to the y axis and that
will give a sensitivity analysis. In our well known break event chart you have
seen that the curve is more sensitive to the left of the bottom trough than to the right.
There are situations where some risks are of great magnitude but the probability is
very low and in such situations it is possible for us to group all these particular risks
together and take one chart kind of decision.
The second illustration is; suppose you are developing software and this particular software
has the penalty clause associated with it, a very stiff penalty. Now we have a simple
question to answer; should we do the activity or should we contract it outside like testing
and all such activities.
So let us see how we can do this using a decision tree.
There is a probability that the software has a critical error let us 04 please remember
that the software may not have any bugs at all.
Next we ask a question; how much is the consequential loss due to critical error?
Suppose the critical error does surface, suppose we say that the loss is 20mn we say with independent
vv what is the probability that the error will be detected and the answer is .95. The
cost of independent v and v activity assumed is 1mn and without independent vav our catching
rate is 80%.
So what we are basically saying is our project teams do not do only testing. When they do
testing their catching efficiency only 80% but there is an organization may be like Disha
or somebody which can do this particular assessment for us and their catching rate they have projected
as .95.
Now how do you decide whether to or not to do this particular job?
Let us look at the slides.
We have product, we need to decide whether to or not to do v and v from an outside agency.
Of course doing that is going to be done but whether to give it to an outside agency is
the issue.
So now if you look at the slide what do you see?
Suppose we decide to do the vv activity ourselves there are three things that can happen. One
is, there may be no error at all in the software in which case you will not find it. The probability
of there being no error at all is .60.
Then we have a particular activity where we will find, here we are talking of doing the
vv activity from an outside agency. The data is absent we have just lost 1mn. in case we
find that there is an error that the probability of there being a error is .4 and the probability
of that being caught is .95 we say .38 is the chance that there will be an error and
it will be cost and this for instance will cost us a million.
If you look here however you find that even the external vv a specialist may not be able
to catch the error that is the probability of .05 in which particular case what will
happen is you will pay 20mn as the damage plus 1mn to the vv experts so you will have
spent 21mn.
What happens in case we do it ourselves? If the error is absent we spend no money,
in case we find the error we spend no money, in case we do not find the error then we lose
only .25.
But if you have to now do the probability multiplied by the expected loss then you find
that the first option gives you the expected loss of only -- 1.4 lakhs whereas the second
option gives you an unexpected loss of -- 1.6.
So normally under these circumstances your decision will be that it is worth getting
the vv job done outside.
This may not be the only way that we take decisions but this is one particular example
of how this job can be done.
Another way of tackling risk quantification is by doing simulation, typical techniques
used in Monte Carlo simulation. What it does is repeats a model's outcome several times.
It determines basically if the project will meet its schedule like what is the chance
that we meet with 10% probability, 50% probability or 90% probability to determine if a project
will meet its schedule with 10% confidence or 50% confidence or 90% confidence.
So such a particular thing can be done by using this thing.
If you were to look at the basic steps that are involved in doing Monte Carlo simulation
they are first; assess the range of variables and determine the probability distribution
of each, may be use techniques like optimistic most likely and pessimistic values and determine
the probabilities, for each variable set a random value based on its probability distribution
and run the deterministic analysis one pass through the model and using the combination
of values select each variable.
Now these steps two and three can be repeated large number of times so that we get a probability
distribution for the results.
At the end of our risk quantification we will come out with a ranked set of risks which
need to be tackled by us on a priority basis. Obviously all the sundry risks also are to
be tackled but they will not be dealt with in such a great detail.
So, for the identified risk now we need to plan a response. so the risk response planning
process involves developing options to combat the risks.
If you look at the slide let us say that the risk response planning process involves developing
options to combat the risks.
There are several strategies which we can use or we can have back up strategies also
which can be chosen from amongst the several strategies that are available and this will
help us in facing our risks.
After selecting the appropriate strategy specific actions must be developed to implement the
strategies that we got in mind.
So, the risk response planning includes identification and assignment of responsibilities to individuals
or to groups of people for each particular response.
Planning alone does not do anything like identifying and deciding what to do, do not by itself
get implemented so the responsibility has to be specifically assigned to be somebody.
Effective response planning is something that directly determines whether the risk will
increase or decrease during the project's particular life.
So if you do the response planning well then you will find that you have very well taken
care of these particular situations.
Now what are the typical kinds of strategies that you can follow?
Typical risk response strategies are; risk avoidance, risk transfer, risk mitigation
and risk acceptance.
Now let us look at these particular strategies a little more in detail.
As the name suggests the risk avoidance strategy involves eliminating the risk usually by eliminating
its cost or to protect the project from its impact. It is like not using a particular
technology which is available in a market but it is not yet very proven so we may not
go by that but we will go by one of the established technologies so we have avoided the possibility
of risk arising out of unknown technology.
Some risky events that occur during the early stages of a project can also be dealt with
by clarifying the requirements, obtaining the information, improving the communication
etc. So what you basically try to do is do everything and the risk itself will get eliminated.
Therefore reducing the scope of the project to avoid high risk activities, adding resources
or time, adopting familiar approach rather than innovative approach, avoiding unfamiliar
sub contractor or de-allocating a specific team member are some of the defensive actions
that we have. It is not possible to have all project risks but some specific project risks
can be avoided by planning in this particular manner.
The next approach is transfer the risk. This is very akin to taking an insurance policy
so we are trying to transfer your risk from yourself to the insurer. This involves transferring
the risk to minimize this impact and shifting the consequence of the risk to the third party
together with the ownership of the response. So this transfers the responsibility for the
risk and does not eliminate the risk itself. Understand the difference between the avoidance
and this particular strategy.
The risk persist but is not eliminated that is transferred. Suppose the hospital had a
problem with retaining systems managers they could always think in terms of contracting
the job out to a very large company like Tata Consultancy Services so that what happens
is that possibility of people leaving still continues but this consequence or the dealing
with that particular situation is transferred to the agent. Obviously it costs money to
do this particular thing. Therefore particularly this is the most appropriate
form of response to financial risks. If you have entered into a penalty clause in the
event of failures or consequential cause because of your software people always get yourself
being insured against it.
In airlines industry for instance they go one step further that there were insurers
for the aircrafts and they are reinsures for the aircrafts so that the risk is further
subdivided amongst the larger number of participants than just a few.
In general the risk transfer always involves paying the risk premium; it is akin to paying
an insurance premium. So you might have warranties, performance bonds or whatever else that you
might to need to respond to in this particular manner.
Contracts may use this particular risk for fixing the price of the contract to a contractor.
If the project design is stable then what will happen is otherwise this particular thing.
So contracts may be used for transferring the risks so you give this lump sum basis
to somebody else to do. If you want to develop some critical driver or some such particular
software it is possible for you to subcontract that.
We have different types of contracts like reimbursable contracts and many other particular
cost plus basis contracts and all that.
Another particular approach is mitigation. What you are doing basically in mitigation?
We are trying to lesson the risk. The first two approaches are one was not to take it
and the other was to shift the responsibilities somewhere else. Now we are trying to reduce
the probability of risk and reduce the consequential loss arising out of these risks.
Now we need to look at it from a different point of view.
So if you look at the slide we have a lessening of the risk associated with the probability
into that. So one approach that we could take would be to reduce the probability of occurrence
of the risks.
If you are minimizing the probability of the occurrence of the risks then reducing of the
frequency of errors or reducing the opportunity to make the errors can both help you in reducing
the probability. Reducing the frequency of errors can be for
example entering the data once instead of several times so that the integrity loss is
not there.
Suppose we have this illustration that we are interested in listening the risks of improper
data entry then we can reduce the frequency of error by making the data entry only once
and then making sure that we use this data rather than re-entering the data ever again.
Reducing the opportunity for making errors can be done by adding data validation routines
or check digits of the data so that the person cannot make a mistake in that particular sense
.
Now if you look at a slide again the other particular object approach is to reduce the
loss that may arise.
Therefore if you cannot tackle the probability then we try to reduce the loss. That can be
done by minimizing the exposure to loss or minimizing the impact of loss.
if you are interested in minimizing the exposure to loss we can have two computer rooms instead
of one so that in case there is a problem then one of the two areas will still be available
for doing the data entry or any other particular activity.
Now in case you are interested in minimizing the impact of loss we can have insurance for
computer room loss.
But these kinds of examples will only give you an illustration as to what kind of things
can happen. So, basically what we are saying is our aim at mitigation activity is at reducing
either the probability of occurrence or the likely loss due to occurrence of that particular
thing.
So to say mitigation actions are aimed at preventing the risks from materializing or
to reducing their impact. So reducing the probability or whatever actions as these are
result oriented, they address the cause. The mitigation action gets scheduled when they
are identified. Mitigation actions are put into the project plan as soon as they are
identified.
Remember, we prepare two types of plans; the contingency plan and the mitigation plan.
The mitigation plan is put in the project plan immediately whereas the contingency plan
is kept ready and only if things go wrong we put the contingency plan into the project
plan that is a post facto kind of a situation.
Mitigation may involve changing the conditions so that the probability of risk is reduced.
It can also be used for reducing the impact by targeting linkages to severity and many
other particular things can be done in this particular fashion.
What are the typical kinds of risk mitigation strategies associated with software project?
One; we can increase the frequency of project monitoring. Obviously project monitoring is
an overhead, it consumes time, money and effort and it slows down the project to some extent.
So, increasing the frequency is going to have a small negative impact in that particular
sense but the chances are that something going wrong will be caught earlier. It is increasing
frequency of project monitoring. Increasing the projects manager's authority can be another
way of mitigating. Using work breakdown structures and techniques like pert CPM in a formal sense
can also reduce the chances of making a mistake.
We can improve communication. That is another big area where the risks arrives and increased
or improved communication may definitely lead to reduce risk likelihoods.
Emphasizing on team support, getting everyone involved, using a stand alone project structure
as against getting some other project goals, understanding, clarified all these are aimed
at emphasizing that the team support is there.
If you have technical risks then will have say ok avoid a stand alone project structure,
there are different ways in which we can organize this particular project. In case you want
cost reduction kind of a thing you can improve the project's goal understanding so that people
do the job properly.
Strategies for scheduled list can be tackled by selecting the most experienced project
manager or many other considerations.
What is the last kind of job we have? Last is we live with risk acceptance. It is
like saying we will see if we come to it then we will take care of it.
Risk acceptance of course may be taken in a calculated way. This particular strategy
may be adopted in a calculated way but it means that basically knowing that there is
something likely to go wrong you say there is always a chance that it may not go wrong
and you go ahead with it.
For staring on a rare technology project this is a good way, there may be not be enough
training material available, trained instructors available, trained replacements available
and so many other particular problems are there, we will say we live with those problems
and handle them if and when they arrive. This involves deciding to accept the consequences
if the risk should materialize. I had no specific strategies found useful
so you say ok if our people leave we will go to one of the head hunters and pay him
whatever money he asks and say that by tomorrow we need people of this particular kind of
background available with us.
Active acceptance of risk involves preparation of a contingency plan. That is, if things
go wrong what we will do which is executed if the risk materializes.
So, preparing the contingency plan is to make sure that we do not start thinking after things
are gone wrong.
Remember, preparing the contingency plan is a part of the risk management activity. Even
if you want to build the expense in that sense to the project management it is not exactly
like a risk mitigation activity but making a contingency plan is a very essential kind
of a thing. You might sometimes have a fall back plan,
if the risk strategy is weak then change the scope of the project, choose another alternative,
go to another site, go to another project manager, allot more contingency funds and
so on are kinds of back up or fall back plans that can also be there.
We can also use triggers for tracking such risks and we say if things appear to go dwindling
in a particular manner then we will take this.
suppose we have a team of hundred and we are worried about the project members leaving
the team and we say ok if the number of people leaving the project exceeds five then we need
to put a contingency plan into action.
But remember, risk acceptance does not mean not thinking about it, it only means that
we think and consciously take a decision that we would not like to have another particular
mitigation activity or other situation as such.
So, if we look at the slide now we have the contingency action.
The contingency actions are aimed at limiting and containing the impact of risk if they
happen.
From that point of view in case the customer hardware is not in place for acceptance testing
it may be performed by hiring resources at an alternative site.
Similarly if the hardware is not going to be available for testing you could think in
terms of using an emulator for doing that particular job. These actions get identified
during the planning stage however these things are not going to be put in practice at an
early stage.
Once we got this strategy planned the next thing is monitoring and controlling the risks.
Again looking at the slide we say risk monitoring and control is an ongoing process which operates
throughout the life of the project.
As the project progresses new risks may emerge, anticipated risks may disappear or some risk
may persist. So it is not a one time kind of an activity. The risk response owner should
therefore periodically report to the project manager about the effectiveness of the risk
response plan and any unanticipated effects, side effects that may be happening.
Midcourse corrective action can also be taken in case of many risk plans that we have. This
process basically records the risk matrix associated with the implementation of contingency
plans.
So we say, a good risk monitoring and control process should provide data that will assist
in taking preemptive actions in the phase of the risks.
In industry the typical approach that is used is tracking the top ten risks. Again the number
10 is not sacrosanct whether it should be 7, 8, 9, 10, 12 it depends on the size of
the project and many other things.
So what we say is that the top ten risks will be monitored very critically. It involves
establishing periodic reviews for project's most significant risks items and appropriate
stake holders are involved in doing the review.
The review begins with the summary of the status of the ten project risks. Every time
you sit for the review you see the status of these ten risks, for each item find out
what is its current ranking and the item may keep on changing their ranking up and down
the number of times it has appeared in the list.
Suppose we find that a particular risk keeps on appearing in the top ten risks for a long
time it means there is a more serious problem associated with that particular area then
the progress is made in resolving this particular risk should also be reported.
This review achieves several objectives. First it keeps the stake holders aware of the major
influences impeding the project's progress. Alternative mitigation actions can also be
considered at the suggestions of the stake holders and it promotes the confidence by
demonstrating to the stake holder that the project team is not sitting on it is back
side but it is very conscious of the significant risks and it has got the contingency plan
ready for these particular situations.
Now let us look at an illustration. If you look at the slide again it gives you a typical
format. Suppose we had four risks; one is in adequate planning, if you look at the slide
we have inadequate planning, then we have poor scope definition, then absence of leadership,
poor cost estimates and poor time estimates are the risk items and we want to do a monthly
risk ranking for this particular thing.
so we would like to have this month's ranking and last month's ranking and then we would
like to find out how long has this particular risk has been perpetuated in the top ten risks
table and last but not the least what kind of a risk resolution progress should be there.
Then we find that we have risk ranking of this particular type inadequate planning this
month it is number 1, last month it was number 2 it has been in top ten list for the last
four months out of whatever we have.
Similarly we can do that job for poor scope definition and so on and from that we will
get idea as to what case or what is not going along with our particular project and where
if at all some kind of a corrective action is required on the risk front.