# Presentation: 250361

## Program/Project ManagementGovernment Specific Course II 

## Module 6 – Risk and Opportunity Management

## Topic 1- Introduction and Objectives 

## Introduction

- Every project is unique; therefore, every project inherently has risks associated with it.
- Risk management allows a project manager to reduce the level of uncertainty at an earlier point in the project’s life cycle.

## Risk Management 

- The question is not “How do I eliminate risk?” It is, “How do I manage risk”.  Risk management:

- Provides managers with tools to assess and handle possible risk events.
- Requires team members to use disciplined approaches to reduce risk.
- Allows managers to reduce a system’s life cycle costs.

## Learning Objectives

- At the end of this module, you will be able to:

- Describe key features of risk and opportunity management processes.
- List different management actions and techniques for risk.

## Learning Objectives (cont.)

- Explain how risk management is used within the management of the program/project.
- How risk management is critical to the development of a product
- How risk management is used throughout a project’s life cycle

## Topic 2 – Risk Assessment Process 

## Risk Defined 

- What is risk?

- Risk is a measure of the inability to achieve overall program objectives within defined cost, schedule, and performance constraints.
- Risk can be measured in terms of:
- Probability of failing to achieve particular outcomes
- Consequences of failing to achieve those outcomes

## Examples of Risk 

- Examples of risk that affect costs include:
- Increases in material prices
- Higher than anticipated labor rates
- Other factors that can change current program cost estimates
-  Examples of risk that affect schedules include:
- Late deliveries
- Political pressure
- Changing requirements

## Performance Constraints 

- Examples of performance constraints include:
- Use of new or exotic materials or processes
- Use of unproven technology
- Use of new applications to meet demanding user requirements

## Question

- What are some other examples of risk that you have encountered?

## Risk Management Defined 

- What is risk management?
- Risk management is the process of planning for potentially adverse outcomes.  These potential outcomes are called “risk events.”

## Risk Management Guidelines 

- It is ultimately the responsibility of the program/project manager to plan for, allocate resources to, and execute risk management.
- Risk management is a team function.
- Any attempt to implement an aggressive, forward-looking risk management program without the involvement of all team members can result in confusion, misdirection, and wasted resources.

## Risk Management Process

- Risk management planning
- Risk identification
- Qualitative risk analysis
- Quantitative risk analysis
- Risk response planning
- Risk monitoring and control

- The risk management process consists of:

## Risk Management Planning 

- Risk management planning includes:

- Developing an organized, interactive strategy to identify and track risk management activities
- Assigning adequate resources to manage risk
- Training IPT personnel in risk management techniques
- Drafting a risk management plan which provides a process to manage risk

## Risk Identification 

- Risk identification includes:

- Determining which risks might affect the project
- Documenting the characteristics of the identified risks

## Risk Identification (cont.) 

- Risks can be identified by:

- Appealing to the experience of subject matter experts
- Researching historical data
- Brainstorming sessions
- Creating checklists of opportunities, threats, strengths, and weaknesses

## Qualitative Risk Analysis 

- Qualitative risk analysis involves prioritizing risks for subsequent further analysis or action by assessing and combining their probability and impacts.

- The ‘problem identification stage’
- Analyze and prioritize program risk events in terms of likelihood of occurrences and consequences
- When analyzing risks, you want to determine:
- The probability of a risk event occurring
- The impact on cost, schedule, and performance

## Probability and Consequences 

- To make determinations about the probability and consequences of a risk event:

- Isolate causes
- Determine the relationship to other risks
- Express the risk rating (high, medium, or low)
- Prioritize risks in a watch list

## Root Cause Analysis 

- The root cause analysis is a method of extracting the root cause associated with an identified risk.

- Helps make determinations about the probability and consequences of risk events
- For example, an apparent risk could be identified as “assembly parts arrive late”; but, the root cause is actually related to the inefficient record of the shipping service.

## Watch List

- Risk rating is a simple method to represent risk factors in a useful matrix
- Y axis shows likelihood of a risk event occurring
- X axis shows the impact of its occurrence
- Consequences are shown in terms of impacts to cost, schedule, and performance

## Risk Tolerance  

- A project with a low risk tolerance is one that cannot tolerate a lot of risk.
- A project with a risk tolerance that is high has a high tolerance for risk.
- A low risk tolerance project will have few green boxes (low disruption) in its watch list, while a high risk tolerance project may have many.

## Question

- Why might items on a watch list become prime candidates for identification as exit criteria?

## Quantitative Risk Analysis 

- The quantitative risk analysis section of the risk management process involves analyzing numerically the effect on overall project objectives of identified risks.

## Risk Response Planning 

- The risk response planning section of the risk management process involves developing options and actions to enhance opportunities and to reduce threats to project objectives.

## Risk Monitoring and Control 

- The risk monitoring and control section includes:

- Tracking identified risks
- Monitoring identified risks
- Identifying new risks
- Executing risk response plans
- Evaluating the effectiveness of risk response plans throughout the project life cycle

## Topic 3 – Management Actions for Risk and Opportunity 

## Risk Management Process  

- To review, the necessary sections for a successful risk management plan are:

- Risk management planning
- Risk identification
- Qualitative risk analysis
- Quantitative risk analysis
- Risk response planning
- Risk monitoring and control

## Handling Risk Options 

- It is the program/project manager’s prerogative to select from different handling approach options, identified by IPTs who asses risk, for implementation.  Options include:

- Deal with known risk
- Develop a schedule for accomplishing risk handling tasks
- Identify who is responsible for the risk area
- Provide estimates of any cost and schedule impacts associated with handling the risk

## Handling Risk Strategies 

- Three common strategies for handling risk:

- Risk avoidance
- Risk mitigation
- Risk transfer

## Risk Avoidance 

- Eliminate the source of the risk by changing some aspect of the program/project plan
- May be avoided by implementing one of the following techniques:
- Reducing the scope of performance objectives
- Using different materials or processes with proven track records
- Extending the schedule to increase the probability of success

## Risk Mitigation 

- Seeks to reduce the probability that a risk event occurs and/or the impact if it does occur
- Synonymous with control
- Risk mitigation methods usually require the allocation of program resources (time, money, people, etc.).

## Methods of Risk Mitigation 

- Multiple development efforts
- Two or more independent design teams create competing systems that meet the same performance requirements
- Early prototyping
- A prototype of a system is built and tested to evaluate the nature of a risk
- Evolutionary acquisition
- System development completed in steps using mature technology to meet desired capabilities

## Methods of Risk Mitigation (cont.) 

- Technology maturation efforts
- Off-line development effort to bring an element of technology to the appropriate level for incorporation into the system
- Robust design
- Advanced design and manufacturing techniques to achieve quality through design
- Usually results in products with little sensitivity to variations in the manufacturing process

## Methods of Risk Mitigation (cont.) 

- Open systems
- Uses widely accepted commercial specifications
- Uses standards for system interfaces, products, practices, and tools
- Can result in lower risk through increased design flexibility, reduced design time, predictable performance, and easier product integration
- Use of standard items/software module reuse
- Can minimize development risk by capitalizing on already proven capabilities or performance

## Methods of Risk Mitigation (cont.) 

- Two phase development
- Incorporates a formal risk reduction effort during first part of the System Development and Demonstration (SDD) phase
- May involve using two or more contractors with a  down-select occurring at a pre-determined point

## Methods of Risk Mitigation (cont.) 

- Modeling/simulation
- Can provide insight into a system’s performance and effectiveness sensitivities
- Can provide data on design capabilities and failure modes
- Requires resources, commitment to refine models, and a concerted verification and validation effort

## Risk Transfer 

- Reallocating the risk from one part of the system to another
- Redistributing risks:
- Between the government and the prime contractor
- Within government agencies
- Between members of the contractor team
- Use of successful system design techniques determines the effectiveness of transferring parts

## Examples of Risk Transfer 

- Within the system transfer
- A system function from hardware to software implementation
- System modularity transfer from one module to another
- Government to contractor transfer
- Using firm fixed-price contracts
- Warranties
- Incentives

## Handling Opportunity 

- Three common strategies for handling opportunity:

- Opportunity exploitation
- Identify steps needed to capture the opportunity
- Opportunity enhancement
- Seek to improve the probability or magnify the impact of the opportunity to benefit the project
- Opportunity sharing
- Allocate ownership to the organization best able to capture the opportunity

## Handling both Risk and Opportunity 

- Two response strategies common to handling both risk and opportunity:

- Acceptance
- Project team decides not to alter the project plan in response to the risk
- No other suitable handling strategy is considered suitable
- Contingency plans
- Predefined plans only to be executed if the risk occurs
- Usually associated with acceptance strategies

## Risk Acceptance 

- Generally associated with risks that have been assigned low risk ratings
- Keys to effective risk acceptance:
- Identify resources and management actions needed to overcome a risk if it occurs
- Set aside schedule and cost risk reserve
- Ensure that the necessary administrative actions are taken to quickly report on risk event

## Choosing a Handling Strategy 

- Here are some questions to ask when choosing a handling strategy:

- Is this option feasible to implement?
- Will this option be effective in reducing program risk to an acceptable level?
- Is this option affordable?
- Is there time to implement this option?  Is there a schedule impact?

## Government/Contractor View

- Though the government and the contractor do a majority of the risk management together, each views risk from a different perspective.

## Contractors and Risk Management 

- Contractors typically divide risk into two basic types:

- Business risk
- Involves the inherent chance of making a profit or incurring a loss
- Both an upside and downside for the contractor (risk to the government is generally negative)
- Program risk
- Includes uncertainties in technical requirements, design, cost, funding, and scheduling

## Government and Risk Management 

- Government does not dictate how a contractor should manage risk.
- The government can look for these key characteristics in a contractor’s risk management approach:
- Clear definition of risks and their assignment
- Flexibility for assignment of risk and risk management responsibilities among IPTs
- Strong emphasis on best management practices to avoid unnecessary risk

## Risk Management Approach 

- When initiating a risk management approach with a contractor:

- Conduct initial meeting with the contractor to describe program’s objectives
- Train PMO members and contractor’s organization on risk management basics
- Review programs’ documentation requirements with the contractor to ensure that the PMO and contractor understand the purpose, format, and contents of various risk reports

## Risk Management Approach (cont.) 

- Work with the contractor to refine risk-monitoring plans and procedures
- Establish program reporting requirements with the contractor
- Work with the contractor to develop appropriate measures to track moderate and high risk items

## Topic 4 - Review 

## Learning Objectives Review

- Describe key features of risk and opportunity management processes.
- List the different management actions associated with risk management and opportunity management.
- Explain how risk management is used within the management of the program/project.

## Key Points 

- Risk is a measure of the inability to achieve program goals within defined cost, schedule, and performance constraints.

- Risk is measured in terms of the probability and the impact of a specific risk.
- Risk management is an integral part of program/project management.

## Key Points (cont.)  

- The program/project manager oversees and participates in the risk management process.
- The program/project manager is ultimately responsible for planning, sourcing, and executing program risk management activities.

## Key Points (cont.) 

- The risk management process consists of:

- Risk management planning
- Risk identification
- Qualitative risk analysis
- Quantitative risk analysis
- Risk response planning
- Risk monitoring and control

## Key Points (cont.) 

- Three commons strategies, to be used alone or in combination, for handling risk:

- Risk avoidance
- Changing some aspect of the program to eliminate the risk’s source
- Risk mitigation
- Reducing probability that an event will occur and/or the impact to the program if it does
- Risk transfer
- Reallocating or redistributing risks

## Key Points (cont.) 

- Three strategies:

- Opportunity exploitation
- Identifying steps needed to capture the opportunity
- Opportunity enhancement
- Seeking to improve the probability, or magnify the impact, of the opportunity
- Opportunity sharing
- Allocating ownership to the organization best able to capture the opportunity

## Key Points (cont.)

- Effective risk management requires collaboration between the government and the contractors.  Characteristics of good government/contractor interaction:

- Clear definition of risks and their assignments
- Flexibility for assigning risk management responsibilities among IPTs
- Strong emphasis on risk management best practices