*October 2008*

**FEDERAL LANDS HIGHWAY**

**PROJECT RISK MANAGEMENT POLICY**

**DEFINITIONS**

**Project Risk** is an uncertain future event or condition that, if it occurs, has a positive or negative effect on at least one project objective.  A risk may have one or more causes and, if it occurs, one or more impacts.  Risk impacts a project’s primary objectives of cost, time, scope or quality.

**Risk Management** is the systematic process of planning for, identifying, analyzing, responding to, and monitoring project risks.  It involves processes, tools, and techniques that help the Project Manager maximize the probability and results of positive events and minimize the probability and consequences of adverse events occurring during the project.  It is most effective when first performed early in the life of the project; however it needs to be a continuing responsibility throughout the project’s life cycle.

**PURPOSE**

The project risk management process helps project stakeholders and project teams make informed decisions regarding alternative approaches to achieving their objectives and the relative risk involved in each.  As the project evolves, risks are more defined and tangible resolution strategies emerge.  More realistic contingency plans and action plans can be developed.  Risk management encourages the project team to take appropriate measures to:

· Minimize adverse impacts to project scope, cost, schedule, and as a result, quality.

· Maximize opportunities to improve the project’s objectives with lower cost, shorter schedules, enhanced scope and higher quality.

· Minimize management by crisis.

**POLICY STATEMENT**

Risk is inherent in the delivery and operation of FLH projects.  The responsibility in risk management lies in identifying risks incurred through analysis of all pertinent issues, informing project team members and parties of these risks, and assisting in evaluating whether the risks are tolerable.  For highway design and construction projects, a consistent level of safety, operational, and project delivery risk should be maintained from programming through construction.  Where risk levels vary with different design or construction options, these risks must be fully explained, especially where there are disagreements over cost, safety, aesthetics, and other impacts.  Within the project delivery process the costs, time, and resources that are devoted to the process, and the amount of risk associated with performing varying levels of engineering analysis, should adhere to established quality expectations and be assessed continuously.  For each of the engineering disciplines involved in the project development, the operational and long-term performance risks (ie., functionality, service life, maintenance, safety) of various engineering solutions, should be evaluated continuously. 

It is important to plan for the risk management process to ensure that the level, type, and visibility of risk management are commensurate with both the risk and importance of the project to the organization.  The Project Manager has enough knowledge of the project to determine what level of risk management planning is required.  Following are some project factors that may be considered when making this decision: 

· High complexity

· Cultural sensitivity

· Environmental sensitivity

· Elevated public profile level

· Minimal stakeholder risk threshold

All projects in FLH require identification of the risks, development of risk response strategies, and monitoring of the risks throughout the life of the project, some projects need a greater level of risk planning and analysis, and some others have risks that are brought to the attention of the Branch Chiefs.  Most projects in FLH should have a Project Risk Management Register, or should at least have their risks identified in scoping reports and managed through a project issue management process or PMIS.   Projects greater then 50 million dollars are considered major in FLH and will always require extensive risk management planning and a Project Risk Management Register.

The evaluation of risk tolerability is not solely one discipline’s responsibility, as it is an interdisciplinary process requiring involvement of the Project Manager and other team members and stakeholders, as appropriate, based on all issues.  A key success factor for project risk management is a culture that supports the honest, realistic and open recognition of project risks even if they indicate problems with the project.  Decisions resulting from risk driven conflicts must be fully discussed and documented by the interdisciplinary team.  Another key success factor is the commitment to collecting realistic and high quality data about risks.  FLH supports the effort, time and resources needed to collect accurate data about project risk.  The Project Manager will generally lead the decision making process using a collaborative interdisciplinary approach to resolve disagreement over the acceptable level of risk.  The FLH Branch Chiefs will help provide management on the higher risk areas and set objectives for the level of risk taken to achieve a consistent office wide level of risk acceptance over time.  Where risks are elevated, the endorsement of the Directors or Division Engineer may be necessary.

**PROCESS OVERVIEW**

The project risk management process involves the following five steps:

1. Risk Management Planning   Risk planning includes the following components:

· Risk Management Methodology – approaches, tools available, predefined risk templates.

· Standard Risk Assumptions – any risk factors standard to the organization.

· Roles and Responsibilities for Risk Management – defines the lead, support and risk management team membership

· Timeframes- defines the frequency when risk management is performed throughout the project life cycle.

· Stakeholder Risk Tolerances- defines the threshold criteria for risks that may vary between the project manager and customer.

· Communications- how results of risk management processes will be documented, analyzed, and communicated to the project team, stakeholders and others.

· Tracking- how risk activities will be recorded for the current project, future needs, and lessons learned.

2. Risk Identification   Risk identification produces a deliverable- the Project Risk Management Register – where risks are identified that may affect the project’s ability to achieve its objectives.  The Risk Register is subsequently amended with the results from qualitative risk analysis and risk response planning, and is reviewed and updated throughout the project.  A FLH Project Risk Management Register template is included with this policy.

3. Qualitative and/or Quantitative Risk Analysis   This area includes identified project risk probabilities and impacts.  It’s the process of assessing the impact and likelihood of identified risks.  Qualitative risk analysis will be used in most instances, and on rare occasions a quantitative risk analysis will be used.

4. Risk Response Planning   The process of developing options and determining actions to enhance opportunities and reduce threats to the project’s objectives.  This process ensures that identified risks are properly addressed.  The effectiveness of response planning will directly determine whether risk increases or decreases for the project.

5. Risk Monitoring and Control    This process systematically tracks the identified risks.  A full review and update of the risk register will occur at the beginning of each subsequent phase of the project at either risk identification meetings, executive review meetings or project status meetings.  The risk owner reports on the status of the risk and the effectiveness of the risk response plan.  Reviewers discuss new risks and the effective handling of existing risks.

**ROLES AND RESPONSIBILITIES**

The Project Manger responsibilities include:

· Develop, distribute and implement the Project Risk Management Register.

· Update the Risk Register with the support of the cross functional team (CFT).

· Coordinate with risk owners to monitor risks and implement risk response strategies.

The CFT responsibilities include:

· Identify and describe the risk.

· Assess the probability that a risk will occur and specify the criteria used to assess the probability.

· Assess the impact of risks.

· Assist in identifying risk owners and developing risk response strategies.

· Perform risk response steps when appropriate.

· Assist the Project Manager in monitoring and controlling risk.

The Risk Owner responsibilities include:

· Develop and/or update the assigned risk strategy.

· Monitor the assigned risk and inform the Project Manager of any new threats or opportunities to the project.

· Inform the Project Manager if the risk becomes a real event.  Events that have occurred are no longer risks.  

� A Guide to the Project Management Body of Knowledge (PMBOK Guide), Third Edition, Chapter 11.

PAGE  

1