Entering the Danger Zone: The Art of Risk Management

1. Entering the Danger Zone: The Art of Risk Management Cindy Margules, PMP PMO Director, Convio International Project Management Day November, 2010 www.allposters.com

2. Risk Terminology • What is a risk? • Risks are things / situations that MAY happen • Issues are things / situations that are in progress • What is risk management? • The processes involved with identifying, analyzing, and • responding to project risk • Little known fact: • Risk management is a time waster! • Risk management is proactive – effort not urgently needed • Issue management is reactive – firefighting • Every noble acquisition is attended with its risks; he who fears to encounter the one must not expect to obtain the other. - Metastasio -

3. First Activity • Quietly write on the paper given all the risks you can think of to the following situation. Additionally: • In the upper left corner estimate the probability of the risk happening (1=low, 2=med, 3=high) • In the upper right corner estimate the impact if the risk occurred (1=low, 2=med, 3=high) Your project is to build a zoo. Success is defined as doors open March 1, with 35 different types of animals to view and the infrastructure to support 400 guests / hour average. What are risks that might keep you from being successful?

4. Risk Management Knowledge Area The objective is to increase the probability and impact of positive events and decrease that of negative events. Risk Management Planning– deciding how to approach, plan, and execute the risk management activities for a project. Risk Identification– determining which risks might affect the project and documenting their characteristics. Quantitative Risk Analysis– numerically analyzing the effect on overall project objectives of identified risks.

5. Risk Management Knowledge Area Qualitative Risk Analysis – prioritizing risks for subsequent further analysis or action by assessing and combining their probability of occurrence and impact. Risk Response Planning– developing options and actions to enhance opportunities, and to reduce threats to project objectives. Risk Monitoring and Control– tracking identified risks, monitoring residual risks, identifying new risks, executing risk response plans, and evaluating their effectiveness throughout the project life cycle.

6. Writing a Risk Specific Quantitative Cause and effect Typical Risk Example: “The tool recommended may not be approved.” Good Risk Example: “If the tool recommended is not approved due to cost, then the schedule will slip by 3 months to reevaluate a different tool.”

7. Risk Assessments Typical: PM or other lead evaluates risks based on experience Benefits: Quick Covers “most” high risks (assumed) Disadvantages: Incomplete - does not utilize vast experience of team Biased - dependant on one person, his / her take on history which feeds type / amount / variety of inputs and impacts, probabilities, mitigations Skewed actions – less creative mitigations, reactionary and may not be well thought out Greater chance of risks becoming issues!!

8. Formal Risk Assessments • Entire group in one room • Establish directive parameters • charter, schedule, communication, etc • may have leading question • Focused response • sticky notes • group writes as many as possible within 5 minute period • Categorize • in silence, first person puts notes on board • second person “groups” like notes and adds his • continues through group – becomes “categories” • one more time through to regroup • exception – if same sticky note keeps going back and forth (3 times) then is reproduced and located in both categories • Clarify, Capture

9. Formal Risk Assessments - continued • Detailed analysis: • Evaluate probability (L, M, H or 1,3, 9, or 1, 2, 3) • virtual certainty vs. more likely than not • Evaluate impact quantitatively (same) and qualitatively • Determine risk total (P x I) - unacceptable, high, medium, low • Determine trigger • Determine response plan • avoid, accept, mitigate, transfer • owner • timeframe • Contingency plan • COMMUNICATE– team, stakeholders, etc. … OFTEN! Add: mitigation probability of working (L, M, H)

10. avoid, accept, mitigate, or transfer? www.cartoonstock.com

11. Non Co-located Formal Risk Assessments • Establish directive parameters • charter, schedule, communication, etc • create web survey with focused leading questions • Establish the time frame (one week to complete) • Focused response: • no communication between team members • additional inputs requested • Categorize: • Review in core team each risk – clarify • Group into categories – regroup / re-categorize • Evaluate probability; impact; status (uhml) – group buy-in • Determine trigger • Determine response plan • Avoid, accept, mitigate, transfer • Owner, timeframe

12. Excel Formal Risk Logs

13. Assumptions / Requirements Revisit risk analysis often and with different objectives

14. 5Ws and the H who, what, where, when, why, how For understanding Risk Management (the process) … and to utilize in the detailed evaluations of individual risks

15. Risk Management Process What are the risks What are the best ways to comprehend them What are your stakeholders / customers / team members concerned about How to find risks How to run a risk analysis How to mitigate risks How to prioritize risks How to store risk assessments, changes, status

16. Risk Management Process When should you look for risks When should you mitigate the risks When should people be informed of, and changes to, the risks Where should you conduct analysis Where should you share and store the information Who should have the information Who is the owner of the risk Who should you utilize to ensure your risks are thorough Who should you inform of changes Why is it a risk - probability and impact

17. Leading Question Categories • cost, schedule, quality • critical resource personnel availability • non-human resources not functioning • different motivations • objectives / business goals • requirements • gossip • mitigation not working / coverage of mitigation • assumptions • unplanned work • process maturity • communication paths

18. Leading Question Categories - continued • lost information, ignored or misunderstood email • poor documentation • utilize non team members, SMEs, customer • SWOT – strengths, weaknesses, opportunities, threats • positive risks • improvements • organizational barriers • risk of senior management not buying into proposed solution • non-participation • multitasking • other projects impacting • 5ws and the h

19. Best Reasons for Formal Risk Analysis • Communication! • Risks change • wording, probability, impact, status, closure, triggers, responses, ownership, timeframe, etc. • Less risks become issues • More time for quality work / reasonable workweek • Project efficiency – significant cycle time reduction • Most important business reasons … • Increased Profitability and • Customer Satisfaction

20. Control / Governance • Review top risks daily • Escalation • Change management • Resources NOT the problem! It takes a strategic mindset to focus on risks over issues or other items that take up your time

21. Successes Skeptical team members PM did this for client in-depth planning: • Took about 1 – 1.5 hours the first day • Additional time added the second day since the client found it so valuable • Client talked about how important this activity was (although they weren’t sure about it at first) • Client requested PM lead this same type of activity for the Partners • PM actively managing her risk log for this engagement Next slides can be cut / paste into presentation for a Risk Analysis

22. Risk Management Overview What is a Risk? • Anything that could potentially happen on a project that would impact its timing, budget, quality or overall success • Risks/Opportunities can either positively or negatively impact your project • Example: Your tire may have a blowout on your upcoming trip. What is a Mitigation Plan? • A plan to avoid or reduce the impact or probability (or both) of a specific risk or exploit an opportunity • Example: You buy new tires. (Decreased probability – NOT impact)

23. Risk Management Overview What is an Issue? • An issue is a risk or event that has already occurred. What is a Contingency Plan? • A pre-prepared action plan created if an identified risk turns into an issue anyway (usually for high risks) • Example: You buy a medical emergency kit and put it in your trunk.

24. Risk Management Overview Why is Risk Management Important? • Empowers us to think proactively over the lifecycle of the project • Allows us to plan for the future success of the project • Identifies those risks that are the most likely to occur and present the greatest impact to the project • Gives us an opportunity to develop a mitigation plan to avoid a risk turning into issue • Gives us an opportunity to develop a contingency plan to act when a risk becomes an issue

25. Writing a Risk Specific Quantitative Cause and effect Typical Risk Example: “The tool recommended may not be approved.” Good Risk Example: “If the tool recommended is not approved due to cost, then the schedule will slip by 3 months to reevaluate a different tool.”

26. Risk Management – Group Activity No talking and write legibly PLEASE! Risk Impact Ranking • Risk Probability - chance that risk will occur • 1 – Small (0 – 25%) • 2 – Medium (26 – 74%) • 3 – Large (75 – 100%) Risk Probability Ranking Description of Risk • Risk Impact • 1 – Minor Impact • 2 – Significant Impact • 3 – Huge Impact / Deal Breaker Possible Owner Your Name (you may want to first use an example to discuss with group to determine individual’s different perceptions)

27. Risk Management - Group Activity In silence: • First person puts sticky notes on white board (flip chart paper) their guess as to categories • Second person adjusts categories, adds their risks (combining if required) • Third person … until last. • Re-review and categorize with marker (no miscellaneous / 1 – 2 re-categorize).

28. Risk Management – Group Activity After notes are agreed upon by team in categories, mark the categories on the back of the sticky notes. Then, take the notes and re-decide as a group their probability and impact and place them in the appropriate boxes.

29. Risk Management - Group Activity Next Steps • The Project Manager enters the risks identified into a risk log and develops plans (with the team) for how to manage those risks • Risks are reviewed individually and with the team OFTEN: • To ensure new ones are captured • Identify risks changing wording, impact, probability, mitigation plans, contingency plans, dates, etc.

30. Thank you! Cindy Margules, PMP Project Management Office Director, Convio cmargules@convio.com www.linkedin.com/in/cindymargules