Project Risk Management"How to Avoid the Traps of

Cultural Thinking"

Mr. Darryl Updegrove, MBA, PMP

July 25, 2013

2

What is Risk?Risk is an uncertain event or condition that, if

it occurs, has an effect on at least one project objective. Objectives can include scope, schedule, cost,

and quality. A risk may have one or more causes and, if it

occurs, it may have one or more impacts.Positive risks (events that have a valued

impact) are often called opportunities.

3

How Do I Manage It?Known risks are those that have been

identified and analyzed, making it possible to plan responses for those risks.

Specified unknown risks cannot be managed proactively, which suggests that the project team should create a contingency plan.

The PMBOK guide has two approaches to Risk Management:Quantify RiskQualify Risk

4

Risk Approach – Quantify RiskDetermine Cost Impact or Cost Opportunity:

Risk: How much will I lose if the risk occurs and what is the

probability? What does it cost me to avoid that risk? Is it worth the cost to avoid the risk?

Risk Opportunity: How much will I gain if the opportunity occurs and what

is the probability? What does it cost me to take that opportunity? Is there a net Return On Investment (ROI)?

5

Risk Approach – Qualify RiskQualify Risk:

Identify likelihood (probability) and consequence (impact)

Determine risk level (low / medium / high)Determine risk handling approach (accept, avoid,

transfer, mitigate)Determine mitigation approach, if necessaryTrack risk handling strategyTrack risk status

6

Risk Matrix• Typically, we assign linear

likelihoods and look for ways to influence likelihood and/or consequence.

• The risk matrix is used to assign a risk level of low (green), medium (yellow), or high (red).

• Other methods are used, and levels of likelihood and consequence can be more or less than 5. It is rare to see lower than 3 levels.Often the approach to risk level are as follows:

•Low: Monitor risk level for change•Medium: Develop a handling strategy, but do not implement. Monitor risk level for change.•High: Implement the handling strategy

7

Using the Risk MatrixConsequence

1 2 3 4 5Likelihood

54321

Typically, we assign linear likelihoods:1. 0-20% - Highly Unlikely2. 20-40% - Unlikely3. 40-60% - Likely4. 60-80% - Probable5. 80-100% - Highly Probable

X

Consequence levels can be related to type of risk:• Cost: $ thresholds• Schedule: Time delays (days, weeks, months,

milestones)• Performance: Loss of capability• Quality: Reliability, availability, % returns,

warranty impacts• Others: Impacts can be relative (minor,

significant, major)

8

Risk Matrix IssuesConsequence

1 2 3 4 5Likelihood

54321

• Linear probabilities may not be appropriate

• Logic tells us that extremely high/low consequences should be evaluated very carefully.

• The same can apply to extremely high/low likelihoods

Question: What action would you take if you had a 20% chance or less likelihood of a risk with severe consequences occurring?Remember, by playing Russian roulette you have a 17% chance of fatally shooting yourself on just the first shot

X

9

Opportunity versus RiskDo we evaluate the possible value of an opportunity, without

first considering the consequence of failure?

Consequence1 2 3 4 5

Likelihood

54321

Value1 2 3 4 5

Possibility

54321

OPPORTUNITY RISK

10

Cultural Influence on RiskOur perspectives in life influence how we approach risk

mitigation and risk handling.• Risk takers may be inclined to accept the potential

consequences of risk without full consideration of the impacts

• Risk avoiders may rarely take chances, and miss beneficial opportunities

Media can influence our approach to risk

Stories, legends, news all influence our perspective on risk management

11

Risk Strategy Mistakes“It’s not a risk, it’s just a concern” – Avoiding

acknowledging risk“The risk isn’t really that high” – Minimizing risk

We often assume the highly unlikely cannot happen (i.e. L = 0) , and the unlikely is highly unlikely (L2 = L1)

Solving risks without documenting the approach Various reasons: laziness, unwillingness to notify

stakeholders, too busy, untrained in the process Although solving the risk seems like a good idea, without

thinking through the process, the most expedient approach is often taken

Without documenting the risk, getting funding for risk mitigation strategies is difficult, and there is no oversight/reporting usually until the risk is virtually realized

12

Risk Strategy Mistakes (continued)Not re-evaluating risk regularly

Low risks can become higher risks over time Mitigation strategies are not followed or are not as

successful as predictedEvaluating opportunity over risk

Winner-takes-all approaches lead to evaluating the possibilities of opportunities and ignoring the possibilities of failure

Modern cultural perspectives are very anti-risk handling: “Just Do It” “Go Big or Go Home”

13

Risk Consequence AnalysisAnalyze all the possibilities before deciding

on your strategy:Results

Risk occurs Risk does not occur

Choices Be risk

averse

Be a risk taker

False alarm: get labeled a

“Chicken Little”

You got lucky

You were prepared and

may have saved the daySpend the rest of

your life knowing you made the wrong

choice

14

If You Don’t Take Risks, You’ll Never Be a Success

There are multiple stories of those who gambled and won big:Paul Orfalea - Kinko’sDonald TrumpHoward Schultz – Starbuck’sBill Gates – Microsoft CorporationSteve Jobs – Apple ComputersJohn Lasseter - Pixar

Rarely do we remember those who gambled big and lost!

15

Disastrous Product LaunchesCoors Rocky Mountain Spring Water – 2 yearsHD DVD – 2 yearsCosmopolitan Yogurt – 18 monthsPepsi AM – 1 yearPepsi Crystal – 1 yearMcDonald’s Arch Deluxe – 1 yearMicrosoft Bob – 1 yearOrbitz Soda – 1 yearGoogle Lively – 4 monthsNew Coke – 77 daysHP Touchpad – 49 daysQwikster – 23 days

16

It’s Never Happened BeforeEvery instance where risk is

previously avoided builds a belief that it can’t ever happen

Various examples can be given, but probably the most famous is the Challenger Space Shuttle explosion Because the solid rocket booster

O-ring had never fully burned through before, NASA assumed that the O-rings were safe

The shuttle was launched at its coldest temperature ever, with NASA ignoring warnings that proved fatal for all seven passengers

17

It’s Not a Risk if it Can’t Be QuantifiedFollowing the Challenger disaster,

NASA followed up with the Columbia disaster A damage assessment team saw the

foam block strike the Columbia during launch

Pleas to request assistance from other organizations in damage assessment were denied because the risk that there was damage which could endanger the shuttle could not be verified (the very reason the request was made)

As a result of ignoring the risk, seven more lives were lost

18

Go Big or Go Home “Casey at the Bat” is a ballad about

a baseball team from the town of Mudville that is losing by two runs with two outs in their last inning.

With two runners now in scoring position, Casey represented the potential winning run.

Casey is so sure of his abilities that he does not swing at the first two pitches, both strikes.

On the last pitch, the overconfident Casey strikes out, ending the game and sending the crowd home unhappy.

And now the leather-covered sphere came hurtling through the air, And Casey stood a-watching it in haughty grandeur there. Close by the sturdy batsman the ball unheeded sped— "That ain't my style," said Casey. "Strike one!" the umpire said. …With a smile of Christian charity great Casey's visage shone; He stilled the rising tumult; he bade the game go on; He signaled to the pitcher, and once more the dun sphere flew; But Casey still ignored it and the umpire said, "Strike two!"

"Fraud!" cried the maddened thousands, and echo answered "Fraud!" But one scornful look from Casey and the audience was awed. They saw his face grow stern and cold, they saw his muscles strain, And they knew that Casey wouldn't let that ball go by again.

The sneer is gone from Casey's lip, his teeth are clenched in hate, He pounds with cruel violence his bat upon the plate; And now the pitcher holds the ball, and now he lets it go, And now the air is shattered by the force of Casey's blow.

Oh, somewhere in this favoured land the sun is shining bright, The band is playing somewhere, and somewhere hearts are light; And somewhere men are laughing, and somewhere children shout, But there is no joy in Mudville—mighty Casey has struck out.

Although fictional in nature, the moral of the story is to avoid unnecessary risk in project

planning

19

Just Do It ! "The Ballad of Casey Jones" is a

traditional song about railroad engineer Casey Jones and his death at the controls of the train he was driving. It tells of how Jones and his fireman Sim Webb raced their locomotive to make up for lost time, but discovered another train ahead of them on the line, and how Jones remained on board to try to stop the train as Webb jumped to safety.

On April 30, 1900, Casey Jones was killed when his passenger train, the Cannonball Express, collided with a stalled freight train at on a foggy and rainy night.

According to legend, when they found his body, his hands were still on the whistle and brake.

•Jones was issued nine citations for rules infractions in his career, with a total of 145 days suspended. However, in the year prior to his death Jones had not been cited for any rules infractions. Railroaders who worked with Jones liked him but admitted that he was a bit of a chance taker. He was by all accounts an ambitious engineer, eager to move up the seniority ranks and serve on the better-paying, more prestigious passenger trains.•The night of his death, Casey Jones was “high-balling” his train, hitting speeds as high as 115 mph. The opportunity of meeting schedule and the ensuing fame over-rode the risk of death and destruction that actually ensued.

Casey Jones is remembered for his bravery, not his risk-taking

mentality that ultimately claimed his life.

20

Superman - I Can Do AnythingThe belief in one’s own or team’s ability

to accomplish above-average performance on a regular basisMisrepresentation of actual capability

leads to a decrease in assigned likelihood of failure which is a near-automatic risk reduction

Success / past history can further influence the belief in this capability for future events

Ensure one is aware of the difference between surge capability and continued capability

Consequence

1 2 3 4 5Likelihood

54321

X X

21

Misunderstanding of ProbabilityNot understanding the laws

of probability leads to overconfidence in the unlikely possibility of risk occurrenceAn easy example to

understand is the likelihood of flipping a coin and it landing head side up at least once Each chance is 50%, but over

just a few flips it becomes close to certain it will occur (at least once).

Flips Chance of the Coin Landing Head Side Up

at Least Once

1 50%2 75%3 88%4 94%5 97%6 98%

22

Venetian Blind SyndromeIn calculating quantitative

opportunity/Return on Investment (ROI), it is easy to show future returns, with little or no near-term return.The overall ROI or opportunity is high, but

there is little to justify the future expectations of value

As the effort is re-evaluated on a regular basis, forecasts are updatedRepeated evaluation of future ROI with no

evaluation of actual versus planned performance can lead to the “Venetian Blind” syndrome

23

Venetian Blind Syndrome (cont.)The initial analysis shows future large

returns

0 2 4 6 8 10 12

-200

-100

0

100

200

300

400

500

Series1

24

Venetian Blind Syndrome (cont.)When the project is re-evaluated and found to

be lacking, future growth is shifted to the right, showing value in continuing the project

0 2 4 6 8 10 12

-200

-100

0

100

200

300

400

500

Series1Series3Series5

25

Venetian Blind Syndrome (cont.)This continues cycle after cycle

0 2 4 6 8 10 12

-200

-100

0

100

200

300

400

500

Series1Series3Series5Series7Series9Series11Series13

26

Venetian Blind Syndrome (cont.)Actual performance, when evaluated, might

show the project is not worth the time/effort

0 2 4 6 8 10 12

-200

-100

0

100

200

300

400

500

Series1

27

What Do We Do?Determine if we can live with the negative

result of riskWould you risk striking out in an embarrassing

wayWould you risk crashing a train and dyingWould you risk killing a space shuttle crew

Notify stakeholders earlyFollow PMBOK principles regarding risk

notificationPlan risk, execute risk mitigations, monitor

and control impacts

Project Risk Management

Questions & Discussion

Thank You !