1 of 36

Chapter 7�Project Risk Management

Chapter Objectives

By the end of this chapter students will be able to:

Discuss the importance of good project risk management.
List common sources of risks on IS/IT projects.
Describe the process of identifying risks.
Discuss qualitative and quantitative risk analysis and provide examples of different risk response planning strategies to address both negative and positive risks.
Discuss how to control risks.

2 of 36

7.1 Project Risk Management (PRM)- Introduction

PRM is the processes of identifying, analyzing and responding to risk throughout a project to meet project objectives.
Project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives such as scope, schedule, cost, and quality.

Negative risk/threats involves understanding potential problems that might occur in the project and how they might impede project success. Eg., having limited personnel for the project

If IT projects are so risky, why do companies pursue them?

Positive risks/ opportunities are risks that result in good things happening. Eg., availability of additional personnel
Positive risk management is like investing in opportunities.
Risk management is an investment- costs are associated with it.
the cost should not exceed the potential benefits.

3 of 36

Cont…

Project risk has its origins in the uncertainty present in all projects.
The objectives of PRM are to increase the likelihood and impact of positive events, while decreasing the likelihood and impact of negative events in the project.
Known risks: risks that the project team has identified and analyzed.
possible to plan responses for them - can be managed proactively
Known risks that cannot be managed proactively, should be assigned a contingency reserve.

Unknown risks: risks that have not been identified and analyzed.

cannot be managed proactively and therefore may be assigned a management reserve.
Risk Tolerance: the maximum acceptable deviation an entity is willing to accept on the project or business objectives as the potential impact.

4 of 36

Cont…

The project may be accepted if the risks are within tolerances and are in balance with the rewards that may be gained by taking the risks.
Positive risks that offer opportunities within the limits of risk tolerances may be pursued in order to generate enhanced value. For example, adopting an aggressive resource optimization technique is a risk taken in anticipation of a reward for using fewer resources.

A consistent approach to risk should be developed for each project, and communication about risk and its handling should be open and honest.
Risk responses reflect an organization’s perceived balance between risk taking and risk avoidance.
Moving forward on a project without a proactive focus on risk management is likely to lead to more problems arising from unmanaged threats.

Attitudes Toward Risk

Different organizations & people have different attitudes toward risk:

Risk Appetite: the degree of uncertainty an entity is willing to take on, in anticipation of a reward.

Risk Tolerance: the maximum acceptable deviation an entity is willing to accept on the project or business objectives as the potential impact.

Risk utility is the amount of satisfaction or pleasure received from a potential payoff/ taking a risk.

risk-averse, risk-neutral, and risk-seeking preferences

Figure 7-1: Risk utility function and risk preference

the y-axis represents utility, the x-axis shows the amount of potential payoff or dollar value of the opportunity at stake.

Risk-averse preference:

Utility rises at a decreasing rate - when more payoff or money is at stake, a person or organization that is risk-averse gains less satisfaction from the risk, or has lower tolerance for the risk.

For e.g., a risk-averse organization might not purchase hardware from a vendor who has not been in business for a specified period of time.

Risk-seeking preference:

have a higher tolerance for risk, and their satisfaction increases when more payoff is at stake.

prefers outcomes that are more uncertain and is often willing to pay a penalty to take risks.

For e.g., they might deliberately choose start-up vendors for hardware purchases to gain new products with unusual features that provide an advantage.

Risk-neutral preference:

achieves a balance between risk and payoff.

For e.g., they might perform a series of analyses (such as using risk) to evaluate possible purchase decisions.

5 of 36

Project Risk Management Processes

Plan Risk Management: deciding how to approach and plan the risk management activities for the project.
Identify Risks: determining which risks may affect the project and documenting their characteristics.
Perform Qualitative Risk Analysis: prioritizing risks based on their probability of occurrence and impact.
Perform Quantitative Risk Analysis: numerically estimating the effect of identified risks on overall project objectives.
Plan Risk Responses: developing options and actions to enhance opportunities and reduce threats to meet project objectives.
Control Risks: implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project.

6 of 36

7.2 Plan Risk Management

should begin when a project is conceived and should be completed early during project planning.

Output - a risk management plan –

documents the procedures for managing risk
important to clarify roles and responsibilities, prepare budget and schedule estimates for risk-related work and identify risk categories for consideration

The level of detail will vary with the needs of the project

The project team should review project documents, corporate risk management policies, lessons-learned reports from past projects and understand the organization’s and the sponsor’s approaches to risk

Topics Addressed in a Risk Management Plan

Methodology: How will risk management be performed on this project? What tools and data sources are available and applicable?

Roles and Responsibilities: Who are the individuals responsible for implementing specific tasks and providing deliverables related to risk management?

Budget and Schedule: What are the estimated costs and schedules for performing risk-related activities?

Risk Categories: What are the main categories of risks that should be addressed on this project? Is there a risk breakdown structure for the project?

Risk Probability and Impact: How will the probabilities & impacts of risk items be assessed? What scoring & interpretation methods will be used for the qualitative and quantitative analysis of risks?

Risk Documentation: What reporting formats and processes will be used for risk management activities?

7 of 36

Contingency & Fallback Plans, Contingency Reserves

In addition to a risk management plan, many projects also include:

Contingency plans: predefined actions that the project team will take if an identified risk event occurs.

For example, expecting new release of a SW package, must plan to use older version if delayed.

Fallback plans: developed for risks that have a high impact on meeting project objectives, and are put into effect if attempts to reduce the risk are not effective.

College graduate has main plan and contingency plans of where to live after graduation but needs fallback plan to possibly live at home.

Contingency reserves or allowances: provisions held by the project sponsor or organization to reduce the risk of cost or schedule overruns to an acceptable level.

Project falling behind schedule due to inexperience with new technology, use these funds to hire outside trainer .

8 of 36

Common Sources of Risk in IT/IS Projects

Several studies show that IT projects share some common sources of risk. The Standish Group developed an IT success potential scoring sheet (next slide) based on potential risks

If a potential project does not receive a minimum score, the organization might decide not to work on it or to take actions to reduce the risks before it invests too much time or money
The Standish Group developed specific questions for each success criterion to help decide the number of points to assign to a project

User Involvement:

Do I have the right users?
Did I involve the users early on?
Do I have a quality relationship with the users?
Do I make involvement easy? …
Did I find out what the users need?

8

9 of 36

IT/IS Success Potential Scoring Sheet

9

The number of questions corresponding to each success criterion determines the number of points each positive response is assigned

E.g: User involvement: add 19/5 (or 3.8) points for each question answered positively.

10 of 36

Broad Categories of Risk

Many organizations develop their own risk questionnaires.
Some of the categories of risk might include:

Market risk – Will the new service or product be useful to the organization or marketable to others? Will the users accept it? Will someone else create a better product?
Financial risk – can the organization afford to undertake the project? Will the project meet NPV, ROI and payback estimates?
Technology risk – is the project technically feasible? Is it leading edge or bleeding edge technology?
People risk – Are people with appropriate skills available to help complete the project? Does senior management support the project?
Structure/process risk – What degree of change the new project will introduce into user areas and business procedures? With how many other systems does a new project/system need to interact?

10

11 of 36

Risk Breakdown Structure

A risk breakdown structure (RBS) is a hierarchy of potential risk categories for a project
Similar to a work breakdown structure but used to identify and categorize risks

In addition to identifying risk based on the nature of the project or products produced, it is also important to identify potential risks according to PMKA

11

Sample Risk Breakdown Structure

12 of 36

Potential Negative Risk Conditions Associated With Each Knowledge Area

12

13 of 36

7.3 Identifying Risks

Risk identification is the process of understanding what potential events might hurt or enhance a particular project.

ongoing process throughout the project lifecycle as things change
key benefit: the documentation of existing risks and the knowledge and ability it provides to the project team to anticipate events.

Participants in risk identification:

project manager, project team members, risk management team (if assigned), customers, SME from outside the project team, end users,
other project managers, stakeholders, and risk management experts.

It is important to identify potential risks early, but you must also continue to identify risks

based on the changing project environment.

Also remember that you cannot manage risks if you do not identify them first.

By understanding common sources of risks and reviewing a project’s planning documents

(for risk, cost, schedule, quality, and human resource management), activity cost and duration estimates,

the scope baseline, stakeholder register, project documents, procurement documents, enterprise environmental factors,

and organizational process assets, project managers and their teams can identify many potential risks.

Identify Risks: Inputs

Risk Management Plan- the assignments of roles and responsibilities, provision for risk management activities in the budget and schedule, and categories of risk (RBS).

Cost Management Plan- provides processes and controls that can be used to help identify risks across the project.

Schedule Management Plan- provides insight to project time/ schedule objectives and expectations which may be impacted by risks.

Quality Management Plan- provides a baseline of quality measures and metrics for use in identifying risks.

Human Resource Management Plan- provides guidance on how PHR should be defined, staffed, managed, and eventually released. It can also contain roles and responsibilities, project organization charts, and the staffing management plan.

Scope Baseline- uncertainty in project assumptions, found in the project scope statement, should be evaluated as potential causes of project risk.

The WBS is a critical input to identify potential risks at both the micro and macro levels.

Activity Duration Estimates and Activity Cost Estimates- are useful in identifying risks related to the time and cost allowances respectively

for the activities or project as a whole, with the width of the range of such estimates indicating the relative degree(s) of risk.

Stakeholder Register- ensure that key stakeholders are interviewed or otherwise participate during the Identify Risks process.

Project Documents- such as project charter, project schedule, schedule network diagrams, quality checklist.

Procurement Documents- If the project requires external procurement of resources.

Enterprise Environmental Factors- such as published information, including commercial databases, academic and industry studies,

published checklists, benchmarking, and risk attitudes.

Organizational Process Assets - such as project files, including actual data, organizational and project process controls,

risk statement formats or templates, and lessons learned.

14 of 36

Identifying: Tools and Techniques

1. Information Gathering Techniques

Brain storming- is a technique by which a group (the project team and experts who are not part of the team), under the leadership of an experienced facilitator, attempts to generate ideas or find a solution for a specific problem by amassing ideas spontaneously and without judgment (to obtain a comprehensive list of project risks)
Delphi Technique is used to derive a consensus among a panel of experts who make predictions about future developments

a facilitator uses a questionnaire to solicit ideas about the important project risks, the responses are summarized and are then recirculated to the experts for further comment till consensus may be reached in a few rounds.
Provides independent and anonymous input and avoids the biasing effects possible in oral methods, such as brainstorming

15 of 36

Cont…

Interviewing - experienced project participants, stakeholders and SMEs helps to identify risks.
Root cause analysis - to identify a problem, discover the underlying causes that lead to it and develop preventive action.
SWOT analysis

Helps to identify the broad negative and positive risks that apply to a project

identifies any opportunities for the project that arise from organizational strengths, and any threats arising from organizational weaknesses.
examines the degree to which organizational strengths offset threats, as well as identifying opportunities that may serve to overcome weaknesses.

16 of 36

Identifying Risks: Outputs

Risk Register: a list of identified risks and other information needed to begin creating a risk register.
A risk register is:

a document that contains the results of various risk management processes and that is often displayed in a table or spreadsheet format
a tool for documenting potential risk events and related information
Risk events refer to specific, uncertain events that may occur to the detriment or enhancement of the project

Negative risks: delays in completing work as scheduled, increases in estimated costs, supply shortages, litigation, strikes
Positive risks: completing work sooner and/or cheaper than planned, collaborating with suppliers to produce better products, good publicity,

17 of 36

Cont…

Risk Register Contents:

An identification number, and a rank for, the name and description of each risk event, the category under which each risk event falls and the root cause of each risk
Triggers for each risk; triggers are indicators or symptoms of actual risk events.

Cost overruns on early activities, defective products

Potential responses to each risk
The risk owner: person who will own or take responsibility for each risk
The probability and impact of each risk occurring
The status of each risk

Fig.- Sample Risk Register

18 of 36

7.4 Perform Qualitative Risk Analysis

Assess the likelihood and impact of identified risks to determine their magnitude and priority.
key benefit: it enables project managers to reduce the level of uncertainty and to focus on high-priority risks.

19 of 36

Perform Qualitative Risk Analysis: Tools and Techniques

Risk Probability and Impact Assessment

Risk probability assessment investigates the likelihood that each specific risk will occur.
Risk impact assessment investigates the potential effect on a project objective such as schedule, cost, quality, or performance, including both negative effects for threats and positive effects for opportunities.
Risks can be assessed in interviews or meetings with participants selected for their familiarity with the risk categories on the agenda.

Probability and Impact Matrix

lists the relative probability of a risk occurring on one side of a matrix or axis on a chart and the relative impact of the risk occurring on the other
List the risks and then label/rate each one as high, medium, or low based on their assessed probability and impact.

20 of 36

Cont…

Deal first with those risks in the high probability/high impact cell

Fig.- Sample probability impact matrix

21 of 36

Cont…

Top Ten Risk Item Tracking

is a qualitative risk analysis tool that helps to identify risks and maintain an awareness of risks throughout the life of a project
Establish a periodic review of the top ten project risk items
List the current ranking, previous ranking, number of times the risk appears on the list over a period of time, and a summary of progress made in resolving the risk item
Keeps management and the customer aware of the major influences that could prevent or enhance the project’s success
By involving the customer, the project team may be able to consider alternative strategies for addressing the risks
It’s a means of promoting confidence in the project team by demonstrating to management and the customer that the team is aware of the significant risks, has a strategy in place and is effectively carrying out that strategy

22 of 36

Example of Top Ten Risk Item Tracking

22

Watch List

A watch list is a list of risks that are low priority, but are still identified as potential risks
Qualitative analysis can also identify risks that should be evaluated on a quantitative basis

23 of 36

7.4 Perform Quantitative Risk Analysis�

Perform Quantitative Risk Analysis is performed on risks that have been prioritized by the Perform Qualitative Risk Analysis process as potentially and substantially impacting the project’s competing demands.
key benefit: it produces quantitative risk information to support decision making in order to reduce project uncertainty.

24 of 36

Perform Quantitative Risk Analysis: Tools and Techniques

Decision Trees and Expected Monetary Value (EMV)

A decision tree is a diagramming analysis technique used to help select the best course of action in situations in which future outcomes are uncertain.
Expected monetary value (EMV) is the product of a risk event probability and the risk event’s monetary value.
You can draw a decision tree to help find the EMV
EMV Example
Suppose there is a 20% probability (P =.20) that Cliff’s firm will win the contract for Project 1, which is estimated to be worth $300,000 in profits and an 80% probability (P = .80) that the firm will not win the contract for Project 1, and the outcome is estimated to be $40,000. Also on Project 2, suppose there is a 20% and 10% probabilities that Cliff’s firm will lose $50,000 and $20,000 respectively, and a 70% probability that it will earn $60,000. Which project(s) the organization might pursue based on the EVM calculation of each project?

25 of 36

Cont…

EMV calculation of each project

Project 1: .2($300,000)+.8($40,000) = $60,000 - $32,000 = $28,000
Project 2: .2($50,000) + .1($20,000) + .7($60,000)= - $10,000 - $2,000 + $42,000 = $30,000

Because the EMV is positive for both Projects 1 and 2, Cliff’s firm would expect a positive outcome from each and could bid on both projects.

Decision Tree

Because the EMV provides an estimate for the total dollar value of a decision, you want to have a positive number;

the higher the EMV, the better.

Because the EMV is positive for both Projects 1 and 2, Cliff’s firm would expect a positive outcome

from each and could bid on both projects.

If it had to choose between the two projects, perhaps because of limited resources,

Cliff’s firm should bid on Project 2 because it has a higher EMV.

Also notice in the example that if you just looked at the potential outcome of the two projects,

Project 1 looks more appealing. You could earn $300,000 in profits from Project 1,

but you can only earn $60,000 for Project 2.

If Cliff were a risk seeker, he would naturally want to bid on Project 1.

However, there is only a 20 percent chance of getting the $300,000 on Project 1, as opposed to

a 70% chance of earning $60,000 on Project 2.

Using EMV helps account for all possible outcomes and their probabilities of occurrence, thereby reducing the tendency to pursue overly aggressive or conservative risk strategies.

26 of 36

Cont…

2. Sensitivity analysis is a technique used to show the effects of changing one or more variables on an outcome

For example, what the monthly payments for a loan will be, given different interest rates or periods of the loan, or for determining break-even points based on different assumptions
Spreadsheet software, such as Excel, is a common tool for performing sensitivity analysis

3. Modeling and simulation- uses a model that translates the specified detailed uncertainties of the project into their potential impact on project objectives. E.g., Monte Carlo simulation

4. Expert judgment

is required to identify potential cost and schedule impacts, to evaluate probability, and to define inputs such as probability distributions into the tools.

27 of 36

7.5 Plan Risk Response

After identifying and quantifying risks, you must decide how to respond to them.
key benefit: it addresses the risks by their priority, inserting resources and activities into the budget, schedule and project management plan as needed.

Risk responses should be appropriate for the significance of the risk, cost-effective, realistic within the project context, agreed upon by all parties involved, and owned by a responsible person.
Selecting the optimum risk response from several options is often required.

28 of 36

Plan Risk Responses: Tools and Techniques

Strategies for Negative Risks or Threats

Risk Avoidance: eliminate the threat or protect the project from its impact.
E.g., don’t use HW or SW if unfamiliar with them
isolating the project objectives from the risk’s impact or changing the objective that is in jeopardy.

Eg, extending the schedule, changing the strategy, reducing scope.

Risk Transfer: shifting the impact of a threat to a third party (usually with payment of a risk premium), together with ownership of the response
For example, to deal with financial risk exposure, a company may purchase special insurance for specific HW needed for a project. If the HW fails, insurer has to replace it.

Risk avoidance or eliminating a specific threat, usually by eliminating its causes. Of course, not all risks can be eliminated,

but specific risk events can be. For example, a project team may decide to continue using a specific piece of hardware or software

on a project because the team knows it works. Other products that could be used on the project may be available, but if the project team

is unfamiliar with them, they could cause significant risk. Using familiar hardware or software eliminates this risk.

Risk acceptance or accepting the consequences if a risk occurs. For example, a project team planning

a big project review meeting could take an active approach to risk by having a contingency or backup plan and

contingency reserves if the team cannot get approval for a specific meeting site. On the other hand, the team could

take a passive approach and accept whatever facility the organization provides.

Risk transference or shifting the consequence of a risk and responsibility for its management to a third party. For example, risk transference is often used in dealing with financial risk exposure. A project team may purchase special insurance or warranty protection for specific hardware needed for a project. If the hardware fails, the insurer must replace it within a specified period of time.

Risk mitigation or reducing the impact of a risk event by reducing the probability of its occurrence. Suggestions for reducing common sources of risk on IT projects were provided at the beginning of this chapter. Other examples of risk mitigation include using proven technology, having competent project personnel, using various analysis and validation techniques, and buying maintenance or service agreements from subcontractors.

risks that arise early in the project can be avoided by clarifying requirements, obtaining information, improving communication, or acquiring expertise

The most radical avoidance strategy is to shut down the project entirely.

29 of 36

Cont…

Risk Mitigation: reduce the probability of occurrence or impact of a risk. Mitigation actions include
use proven technology, prototype development, adopting less complex processes, conducting more tests, or choosing a more stable supplier, buy maintenance or service contract

Risk Acceptance: prepare for risk with backup plan or contingency reserves.

Table: General Risk Mitigation Strategies

30 of 36

Strategies for Positive Risks or Opportunities�

Risk Exploitation: doing whatever you can to make sure the the opportunity is realized.
For example a project manager might organize news coverage of the project, write a press release, or hold some other public event to ensure that the project produces good public relations for the company, which could lead to more business.
Risk Enhancement: is used to increase the probability and/or the impacts of an opportunity by identifying and maximizing key drivers of the positive risk.
For example, an important driver of getting good public relations for the computer classrooms project might be to generate awareness and excitement about it among students, parents, and teachers. These groups might then do their own formal or informal advertising of the project and Cliff’s company, which in turn might interest other groups and generate more business.

The four basic response strategies for positive risks are:

Risk exploitation or doing whatever you can to make sure the positive risk happens. For example, suppose that Cliff’s company funded a project to provide new computer classrooms for a nearby school in need. They might select one of their top project managers to organize news coverage of the project, write a press release, or hold some other public event to ensure that the project produces good public relations for the company, which could lead to more business.

Risk sharing or allocating ownership of the risk to another party. Using the same example of implementing new computer classrooms, the project manager could form a partnership with the school’s principal, school board, or parent-teacher organization to share responsibility for achieving good public relations for the project. On the other hand, the company might partner with a local training firm that agrees to provide free training for all of the teachers on how to use the new computer classrooms.

Risk enhancement or changing the size of the opportunity by identifying and maximizing key drivers of the positive risk. For example, an important driver of getting good public relations for the computer classrooms project might be to generate awareness and excitement about it among students, parents, and teachers. These groups might then do their own formal or informal advertising of the project and Cliff’s company, which in turn might interest other groups and generate more business.

Risk acceptance also applies to positive risks when the project team does not take any actions toward a risk. For example, the computer classrooms project manager might assume that the project will result in good public relations for the company and not feel compelled to do anything extra.

Risk Exploitation: doing whatever you can to make sure the the opportunity is realized.

Examples include assigning an organization’s most talented resources to the project to reduce the time to completion or using new technologies or technology upgrades to reduce cost and duration required to realize project objectives.

Risk Enhancement: is used to increase the probability and/or the impacts of an opportunity.

identify and maximize key drivers of the positive risk.

Examples include adding more resources to an activity to finish early.

Encourage your employees or users of your product to spread the word of your product

31 of 36

Cont…

Risk Sharing: allocating some or all of the ownership of the opportunity to a third party who is best able to capture the opportunity for the benefit of the project.
For example the project manager could form a partnership with the school board, or parent-teacher organization to share responsibility for achieving good public relations for the project. And, the company might partner with a local training firm to provide free training for all of the teachers on how to use the new computer classrooms.
Risk Acceptance: is being willing to take advantage of the opportunity if it arises, but not actively pursuing it.
Assume the product will speak for itself
For example, the computer classrooms project manager might assume that the project will result in good public relations for the company and not feel compelled to do anything extra.
Exercise: compare and contrast Risk exploitation & Enhance.

32 of 36

Cont… (Tools & Techniques)

Residual and Secondary Risks

Residual risks are risks that remain after all of the response strategies have been implemented

Even though used stable HW platform, it still may fail

Secondary risks are a direct result of implementing a risk response

Using stable HW may have caused a risk of peripheral devices failing to function properly

Contingent response strategies

responses designed for use only if certain events occur.
Events that trigger the contingency response, such as missing intermediate milestones or gaining higher priority with a supplier, should be defined and tracked.

Expert judgment

Expertise may be provided by any group or person with specialized education, knowledge, skill, experience, or training in establishing risk responses.

33 of 36

7.6 Control Risk

executing the risk management process to respond to risk events. It’s ongoing activity –
new risks identified, old risks disappear, weaken or get stronger
Workarounds are unplanned responses to risk events that must be done when there are no contingency plans.
key benefit: it improves efficiency of the risk approach throughout the project life cycle to continuously optimize risk responses.

Controlling risks involves executing the risk management processes to respond to risk events and ensuring that risk awareness is an ongoing activity performed by the entire project team throughout the entire project.
Project risk management does not stop with the initial risk analysis. Identified risks may not materialize, or their probabilities of occurrence or loss may diminish. Previously identified risks may be determined to have a greater probability of occurrence or a higher estimated loss value. Similarly, new risks will be identified as the project progresses. Newly identified risks need to go through the same process as those identified during the initial risk assessment. A redistribution of resources devoted to risk management may be necessary because of relative changes in risk exposure.
Carrying out individual risk management plans involves monitoring risks based on defined milestones and making decisions regarding risks and their response strategies.
It may be necessary to alter a strategy that becomes ineffective, implement a planned contingency activity, or eliminate a risk from the list of potential risks when it no longer exists.
Project teams sometimes use workarounds—unplanned responses to risk events—when they do not have contingency plans in place.
Tools and techniques for performing risk control include risk reassessment, risk audits, variance and trend analysis, technical performance measurements, reserve analysis, and status meetings or periodic risk reviews such as the Top Ten Risk Item Tracking method. Outputs of this process are work performance information, change requests, and updates to the project management plan, other project documents, and organizational process assets.

Controlling risks involves executing the risk management processes to respond to risk events and ensuring that risk awareness is an ongoing activity performed by the entire project team throughout the entire project.
Project risk management does not stop with the initial risk analysis. Identified risks may not materialize, or their probabilities of occurrence or loss may diminish. Previously identified risks may be determined to have a greater probability of occurrence or a higher estimated loss value. Similarly, new risks will be identified as the project progresses. Newly identified risks need to go through the same process as those identified during the initial risk assessment. A redistribution of resources devoted to risk management may be necessary because of relative changes in risk exposure.
Carrying out individual risk management plans involves monitoring risks based on defined milestones and making decisions regarding risks and their response strategies.
It may be necessary to alter a strategy that becomes ineffective, implement a planned contingency activity, or eliminate a risk from the list of potential risks when it no longer exists.
Project teams sometimes use workarounds—unplanned responses to risk events—when they do not have contingency plans in place.
Tools and techniques for performing risk control include risk reassessment, risk audits, variance and trend analysis, technical performance measurements, reserve analysis, and status meetings or periodic risk reviews such as the Top Ten Risk Item Tracking method. Outputs of this process are work performance information, change requests, and updates to the project management plan, other project documents, and organizational process assets.

34 of 36

Tools and techniques

Risk assessment: identification of new risks, reassessment of current risks, and closing of outdated ones
Risk audits: examine and document the effectiveness of risk responses in dealing with identified risks and their root causes, as well as the effectiveness of the risk management process.
Variance and trend analysis: compare planned results to the actual results, and review trends in the project execution
Technical performance measurement: compare technical accomplishments during project execution to the schedule of technical achievement
Reserve analysis: compares the amount of contingency reserves remaining to amount of risk remaining at any time to determine if the remaining reserve is adequate.
Meetings

35 of 36

Cont…

Main outputs of risk monitoring and control are:
Requested changes
Recommended corrective and preventive actions
Updates to the risk register, project management plan, and organizational process assets
Results of Good Project Risk Management
Unlike crisis management, good project risk management often goes unnoticed
Well-run projects appear to be almost effortless, but a lot of work goes into running a project well
Project managers should strive to make their jobs look easy to reflect the results of well-run projects

35

36 of 36

Discussion Questions

What are some questions that should be addressed in a risk management plan?
Discuss the common sources of risk on IT projects and suggestions for managing them. Which suggestions do you find most useful? Which do you feel would not work in your organization? Why?
What is the difference between using brainstorming and the Delphi technique for risk identification? What are some of the advantages and disadvantages of each approach? Describe the contents of a risk register and how it is used in several risk management processes.
Describe how to use a probability/impact matrix and the Top Ten Risk Item Tracking approaches for performing qualitative risk analysis. How could you use each technique on a project?
Explain how to use decision trees and Monte Carlo analysis for quantifying risk. Give an example of how you could use each technique on an IT project.
Provide realistic examples of each of the risk response strategies for both negative and positive risks.

36