Key Takeaways
- The Risk Register is the central repository for all identified risks, including descriptions, categories, causes, probability, impact, and response plans
- Probability-Impact Matrix is a qualitative tool that rates risks on likelihood and severity to prioritize response planning
- EMV (Expected Monetary Value) = Probability x Impact calculates the weighted average outcome considering uncertainty
- Decision Trees graphically represent decision points and chance events to calculate EMV for different options
- Risk responses for threats include Escalate, Avoid, Transfer, Mitigate, and Accept; for opportunities: Escalate, Exploit, Share, Enhance, and Accept
Risk Management Process
Risk management is the systematic process of identifying, analyzing, and responding to project risks. In predictive projects, risks are identified early and managed proactively throughout the project lifecycle.
Risk Management Processes
| Process | Purpose | Key Output |
|---|---|---|
| Plan Risk Management | Define how risk will be managed | Risk Management Plan |
| Identify Risks | Determine which risks may affect the project | Risk Register |
| Perform Qualitative Risk Analysis | Prioritize risks based on probability and impact | Updated Risk Register |
| Perform Quantitative Risk Analysis | Numerically analyze effect on objectives | Quantified risk exposure |
| Plan Risk Responses | Develop options and actions to address risks | Response strategies |
| Implement Risk Responses | Execute agreed-upon response plans | Updated Risk Register |
| Monitor Risks | Track risks and evaluate response effectiveness | Work Performance Information |
Understanding Project Risk
Risk Definition
A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.
| Risk Type | Definition | Example |
|---|---|---|
| Threat | Negative risk | Key team member may resign |
| Opportunity | Positive risk | New technology may reduce costs |
Risk Components
- Uncertainty — May or may not occur
- Probability — Likelihood of occurrence
- Impact — Effect on objectives if it occurs
Risk Register
The Risk Register is the central repository for all risk-related information:
Risk Register Contents
| Field | Description |
|---|---|
| Risk ID | Unique identifier |
| Risk Description | Clear statement of uncertainty and impact |
| Category | Technical, external, organizational, PM |
| Probability | Likelihood of occurrence (0-100%) |
| Impact | Effect on objectives if risk occurs |
| Risk Score | Probability x Impact |
| Risk Owner | Person responsible for monitoring and response |
| Response Strategy | Chosen approach to address the risk |
| Contingency Plan | Actions if risk occurs |
| Triggers | Warning signs that risk is about to occur |
| Status | Active, closed, occurred |
Qualitative Risk Analysis
Qualitative Risk Analysis prioritizes risks for further action based on their probability and impact.
Probability-Impact Matrix
The Probability-Impact Matrix is the primary tool for qualitative risk analysis:
| Probability | Very Low Impact | Low Impact | Moderate Impact | High Impact | Very High Impact |
|---|---|---|---|---|---|
| Very High (0.9) | 0.09 | 0.18 | 0.36 | 0.54 | 0.72 |
| High (0.7) | 0.07 | 0.14 | 0.28 | 0.42 | 0.56 |
| Medium (0.5) | 0.05 | 0.10 | 0.20 | 0.30 | 0.40 |
| Low (0.3) | 0.03 | 0.06 | 0.12 | 0.18 | 0.24 |
| Very Low (0.1) | 0.01 | 0.02 | 0.04 | 0.06 | 0.08 |
Risk Prioritization
| Risk Level | Score Range | Action |
|---|---|---|
| High (Red) | > 0.40 | Immediate attention, detailed response plan |
| Medium (Yellow) | 0.15-0.40 | Monitor closely, develop contingency |
| Low (Green) | < 0.15 | Monitor periodically |
Quantitative Risk Analysis
Quantitative Risk Analysis numerically analyzes the effect of identified risks on overall project objectives.
Expected Monetary Value (EMV)
EMV calculates the average outcome when the future includes scenarios that may or may not happen:
EMV = Probability x Impact
EMV Example
| Risk | Probability | Impact | EMV |
|---|---|---|---|
| Server failure | 30% | -$50,000 | -$15,000 |
| Early delivery bonus | 40% | +$20,000 | +$8,000 |
| Regulatory fine | 10% | -$100,000 | -$10,000 |
| Total Project EMV | -$17,000 |
Decision Tree Analysis
Decision Trees graphically represent decisions and chance events:
Decision Tree Components
| Symbol | Meaning |
|---|---|
| Square | Decision node (choice to be made) |
| Circle | Chance node (uncertain event) |
| Triangle | End point (outcome) |
Decision Tree Example
A company must decide whether to build a new factory ($5M) or upgrade existing ($2M):
Build New Factory ($5M investment):
- High demand (60%): Profit $10M → EMV = 0.6 x $10M = $6M
- Low demand (40%): Profit $3M → EMV = 0.4 x $3M = $1.2M
- Total EMV = $6M + $1.2M - $5M = $2.2M
Upgrade Existing ($2M investment):
- High demand (60%): Profit $5M → EMV = 0.6 x $5M = $3M
- Low demand (40%): Profit $2M → EMV = 0.4 x $2M = $0.8M
- Total EMV = $3M + $0.8M - $2M = $1.8M
Decision: Build New Factory (higher EMV of $2.2M vs. $1.8M)
Monte Carlo Simulation
Monte Carlo Simulation uses computer modeling to run thousands of scenarios:
How It Works
- Define probability distributions for uncertain variables
- Randomly sample from each distribution
- Calculate project outcome
- Repeat thousands of times
- Analyze probability distribution of results
Interpreting Results
| Confidence Level | Meaning |
|---|---|
| P50 | 50% probability of achieving this outcome or better |
| P80 | 80% probability of achieving this outcome or better |
| P90 | 90% probability of achieving this outcome or better |
Example Output
"There is an 80% probability (P80) that the project will complete within 18 months and cost less than $2.5M."
Risk Response Strategies
Strategies for Threats (Negative Risks)
| Strategy | Description | Example |
|---|---|---|
| Escalate | Risk is outside project scope, escalate to appropriate level | Organization-wide risks to sponsor |
| Avoid | Eliminate the threat by eliminating the cause | Change scope to remove risky work |
| Transfer | Shift impact to a third party | Purchase insurance, fixed-price contract |
| Mitigate | Reduce probability and/or impact | Add redundancy, prototype, train team |
| Accept | Acknowledge risk without proactive action | Document risk, monitor for changes |
Strategies for Opportunities (Positive Risks)
| Strategy | Description | Example |
|---|---|---|
| Escalate | Opportunity is outside project scope | Strategic opportunities to executives |
| Exploit | Ensure the opportunity is realized | Assign best resources to capture opportunity |
| Share | Allocate to third party best able to capture | Joint venture, partnership |
| Enhance | Increase probability and/or impact | Invest in R&D to maximize benefit |
| Accept | Take advantage if it occurs, but no proactive action | Document, be ready to capitalize |
Contingency Reserves
Contingency Reserves address "known unknowns" — identified risks:
Calculation Methods
| Method | Formula | Use |
|---|---|---|
| Percentage of Budget | Budget x 10-15% | Quick estimate |
| EMV Summation | Sum of all risk EMVs | Quantitative approach |
| Expected Value of Project | From Monte Carlo simulation | Most accurate |
Reserve Types
| Reserve | For | Controlled By |
|---|---|---|
| Contingency Reserve | Known unknowns (identified risks) | Project Manager |
| Management Reserve | Unknown unknowns | Management/Sponsor |
Key Takeaways
- The Risk Register is the central repository for all risk information
- Probability-Impact Matrix prioritizes risks based on likelihood and severity
- EMV = Probability x Impact calculates weighted average outcomes
- Decision Trees help choose between alternatives under uncertainty
- Monte Carlo Simulation provides probability distributions for project outcomes
- Threat responses: Escalate, Avoid, Transfer, Mitigate, Accept
- Opportunity responses: Escalate, Exploit, Share, Enhance, Accept
A risk has a 25% probability of occurring and would cost $80,000 if it occurs. What is the Expected Monetary Value (EMV) of this risk?
Which risk response strategy involves shifting the negative impact of a threat to a third party?
A Monte Carlo simulation shows a P80 value of $2.5 million for project cost. What does this mean?