Fme project-risk

Team FME
www.free-management-ebooks.com
ISBN 978-1-62620-986-4
Project Risk Management
Project Skills

Copyright Notice
© www.free-management-ebooks.com 2014. All Rights Reserved
ISBN 978-1-62620-986-4
The material contained within this electronic publication is protected under International
and Federal Copyright Laws and treaties, and as such any unauthorized reprint or use of
this material is strictly prohibited.
You may not copy, forward, or transfer this publication or any part of it, whether in elec-
tronic or printed form, to another person, or entity.
Reproduction or translation of any part of this work without the permission of the copy-
right holder is against the law.
Your downloading and use of this eBook requires, and is an indication of, your complete
acceptance of these ‘Terms of Use.’
You do not have any right to resell or give away part,
or the whole, of this eBook.

ISBN 978-1-62620-986-4 © www.free-management-ebooks.com 1
Table of Contents
Preface 2
Visit Our Website 3
About this Knowledge Area 4
Introduction 5
The PMBOK®
Project Risk Management Processes 8
11.1 Plan Risk Management 9
11.1.1 Plan Risk Management: Inputs 9
11.1.2 Plan Risk Management: Tools and Techniques 11
11.1.3 Plan Risk Management: Outputs 12
11.2 Identify Risks 16
11.2.1 Identify Risks: Inputs 17
11.2.2 Identify Risks: Tools and Techniques 19
11.2.3 Identify Risks: Outputs 22
11.3 Perform Qualitative Risk Analysis 23
11.3.1 Perform Qualitative Risk Analysis: Inputs 23
11.3.2 Perform Qualitative Risk Analysis: Tools and Techniques 25
11.3.3 Perform Qualitative Risk Analysis: Outputs 28
11.4 Perform Quantitative Risk Analysis 29
11.4.1 Perform Quantitative Risk Analysis: Inputs 29
11.4.2 Perform Quantitative Risk Analysis: Tools and Techniques 31
11.4.3 Perform Quantitative Risk Analysis: Outputs 33
11.5 Plan Risk Response 34
11.5.1 Plan Risk Responses: Inputs 35
11.5.2 Plan Risk Responses: Tools and Techniques 35
11.5.3 Plan Risk Responses: Outputs 38
11.6 Control Risks 39
11.6.1 Control Risks: Inputs 40
11.6.2 Control Risks: Tools and Techniques 41
11.6.3 Control Risks: Outputs 42
Summary 44
Other Free Resources 46
References 47

Preface
Every project involves risks and every project needs to have a management strategy for
dealing with the threats and opportunities represented by each risk.
This eBook explains the key issues and concepts involved in effective risk management in
a clear and accessible way, providing a comprehensive approach that is applicable to all
sizes of project, whether requiring detailed, quantitative analysis or a rougher approach
using only qualitative analysis.
You will learn:
●● Why a proactive approach to risk management is necessary
●● How to develop a risk management plan that will protect the project
●● How to identify and document risks
●● How to prioritize risks by assessing their probability and impact
●● How to assess risks using both qualitative and quantitative approaches
The Free Management eBooks ‘Project Skills’ series are structured around the ten key
knowledge areas of project management detailed in the ‘Project Management Institute,
A Guide to the Project Management Body of Knowledge, (PMBOK® Guide)—Fifth Edi-
tion, Project Management Institute Inc., 2013’. ISBN-13: 978-1935589679.
The eBooks in this series follow the structure of the PMBOK® Guide because it repre-
sents a tried and tested framework. We have tried to ensure full alignment of our eBooks
with the Guide by using the numbering convention as well as the naming convention.
If you need more detailed explanation of a particular subject then you can simply refer
to the related chapter and paragraph number in the PMBOK® Guide. Remember, many
of the generic project management methodologies available refer to the PMBOK® Guide
as a basic framework.
A knowledge of the PMBOK® processes will go a long way towards giving you an under-
standing of almost any project management methodology that your organization may
use.

Visit Our Website
More free management eBooks (FME) along with a series of essential templates and
checklists for managers are all available to download free of charge to your computer,
iPad, or Amazon Kindle.
The FME online library offers you over 100 free resources for your own professional de-
velopment. Our eBooks, Checklists, and Templates are designed to help you with the
management issues you face every day.
We are adding new titles every month, so don’t forget to check our website regularly for
the latest releases.
Visit http://www.free-management-ebooks.com

About this Knowledge Area
The PMBOK® defines project risk management as:
‘The processes concerned with conducting risk management planning, iden-
tification, analysis, responses and monitoring and control a project. The ob-
jective is to:
• Increase the probability and impact of positive events, and to
• Decrease the probability and impact of events adverse to the project ob-
jectives’.
A risk is a future event that may or may not happen, but if it does occur it will have an ef-
fect on project scope, schedule, cost, or quality. It may have one or more causes and, if it
occurs, it may have one or more impacts. The PMBOK® Guide advises that risks include
both threats and opportunities.
All project activities carry some element of risk, which are uncertainties about them that
could affect the project for better or worse. It is important to understand the difference
between business risks and project risks. The Project Risk Management knowledge area
has six processes include the following:
Process Project Phase Key Deliverables
11.1 Plan Risk Management
Planning
Risk Management Plan
11.2 Identify Risks Risk Register
11.3 Perform Qualitative Risk
Analysis
Risk Register Updates
11.4 Perform Quantitative Risk
Analysis
Risk Register Updates
11.5 Plan Risk Responses Risk Related Contract Decisions
11.6 Monitor and Control Risks Monitoring & Controlling Risk Register Updates

Introduction
What a project manager needs to know is what is the likelihood a risk will occur and if it
does what will it impact as this affects the project plan.
Project Scope
Project Schedule
Project Cost
Project Quality
May
occur—
what is the
effect on
Risk
a future
event that
May not
happen
What is certain is that if the risk happens in the future it will have an effect on project
scope, schedule, cost, or quality. It may have one or more causes and, if it occurs, it may
have one or more impacts. All project activities carry some element of risk, which are
uncertainties about them that could affect the project for better or worse.
The important distinction that must be understood is the difference between business
risks and project risks. Business risks are more general and relate to the organization,
whereas project risks relate specifically to the project objectives.
●● Business risk implies uncertainty in profits or danger of loss and the events that
could pose a risk due to some unforeseen events in future, which causes business
to fail. (Wikipedia)
●● Project risk is an uncertain event or condition that, if it occurs, has a positive or
negative effect on a project’s objectives. (PMI)

For example,
• Project scope—to build the stadium to the agreed specification within an
agreed timescale and budget.
• Project Risk—that the building costs may be higher than expected be-
cause of an increase in materials or labor costs.
• Business Risk—even if the stadium is constructed on time and within
budget that it will not make money for the business. This could be be-
cause of lower than expected ticket sales or higher than expected main-
tenance costs. These risks exist outside of the scope of the project.
Risks are caused by a requirement, assumption, constraint, or condition that creates the
possibility of negative or positive outcomes.
Requirements, Assumptions,
Constraints or Conditions can cause
Risks
potential positive or negative
outcomes
Continuing the example above:
• Risk Cause—change in health and safety legislation during the build
phase.
• Risk Outcome—increased costs to modify the parts of the stadium in ac-
cordance with the new legislation before it can be used.
• Project Impact on cost, schedule and performance needs to assessed:
• Shortage of skilled personnel due to demand by other building projects
• Unexpected cost of inspection & license
• The build of the affected parts of the stadium can be brought forward
to finish project on time.

The PMBOK® Guide advises that risks include both threats and opportunities that proj-
ect managers must assess.
Opportunities have uncertainty associated with them, but they should be grasped,
and action taken to ensure that they are realized.
Threats have potentially negative impacts that the project management team
should strive to mitigate.
Organizations and stakeholders are willing to accept varying degrees of risk. This is called
risk tolerance. Risks that are threats to the project may be accepted if they are in balance
with the rewards that may be gained from taking them. For example,
Using unproven productivity-boosting software is a risk taken in the expecta-
tion that the work will be completed more quickly and with fewer resources.
The risk of the software not performing as advertised would need to be considered as
part of the risk assessment.
All organizations have a ‘risk tolerance’ that is affected by their legal status and their
culture. For instance, a pension fund is likely to be more risk averse than a small start up
company. In all cases, attitudes to risk are driven by perception, tolerances, and other
biases, which should be made explicit wherever possible.
Risk Tolerance
Balance of: Risk vs Reward
Affected by:
• Organizational Culture
• Legal Status
• Perceptions
• Attitudes & Biases
To be successful, the organization should be committed to address risk management
proactively and consistently throughout the project. A conscious choice must be made

at all levels to actively identify and pursue effective risk management during the life of
the project. Communication about risk and its handling should be open and honest.
Risk exists the moment a project is conceived. Moving forward on a project without a
proactive focus on risk management increases the impact that a realized risk can have
on the project and can potentially lead to project failure. The remainder of this eBook
focuses on explaining the processes of project risk management knowledge area.
The PMBOK®
Project Risk Management Processes
There are six PMBOK® Project Procurement Management processes in this knowledge
area:
11.1 Plan Risk Management—the process of defining how to conduct risk manage-
ment activities for a project.
11.2 Identify Risks—the process of determining which risks may affect the project
and documenting their characteristics.
11.3 Perform Qualitative Risk Analysis—the process of prioritizing risks for further
analysis or action by assessing and combining their probability of occurrence and
impact.
11.4 Perform Quantitative Risk Analysis—the process of numerically analyzing
the effect of identified risks on overall project objectives.
11.5 Plan Risk Responses—the process of developing options and actions to en-
hance opportunities and to reduce threats to project objectives.
11.6 Monitor and Control Risks—the process of implementing risk response plans,
tracking identified risks, monitoring residual risks, identifying new risks, and eval-
uating risk process effectiveness throughout the project.
These processes interact with each other and with the processes in the other Knowledge
Areas. Each process is presented here as a discrete element with well-defined interfaces,
although in practice they will overlap and interact.
These are dealt with in detail in the following chapters of this eBook.

11.1 Plan Risk Management
This is the process of creating the risk management plan. This plan details how the proj-
ect management team will perform risk management for this project. It does not involve
actually identifying project risk.
Aim of Risk Management Plan—is to ensure that the risk management pro-
tocol that is used on the project is commensurate with both the risks and the
importance of the project to the organization.
Establishing this protocol early on in the project ensures that all members of the project
management team are using the same methods to evaluate risks and that the risk man-
agement tasks are budgeted for in the project plans.
The level of detail in the risk management plan will depend upon the level of risk within
the project and the level of risk that the performing organization is prepared to take.
The inputs, tools and techniques, and outputs of this process are summarized in the
table below.
Inputs Tools & Techniques Outputs
Project Management Plan Analytical Techniques
Project Charter Expert Judgment
Stakeholder Register Meetings
Enterprise Environmental Factors
Organizational Process Assets
11.1.1 Plan Risk Management: Inputs
This process requires the following inputs:
Plan Risk Management Inputs
Project
Charter
Enterprise
Environmental
Factors
Organizational
Process
Assets
Project
Management
Plan

11.1.1.1 Project Management Plan
All approved subsidiary management plans and baselines should be taken into consid-
eration in order to make the risk management plan consistent with them. For example,
●● Scope Statement defines the scope of the project, which will have a direct bearing
on the type and amount of risk that is likely to be encountered. It provides a clear
definition of such risk areas.
●● The Cost Management Plan defines how risk in terms of budgets, contingencies,
and management reserves will be reported and accessed.
●● The Schedule Management Plan includes information about activities and their
timing including aspects such as internal and external constraints that will help
identify risk areas.
●● The Communications Management Plan includes information on all key stakehold-
ers and in particular their concerns for specific risks, and hence, how such com-
munications should be handled.
11.1.1.2 Project Charter
This can provide various inputs such as high-level risks, high-level project descriptions,
and high-level requirements.
11.1.1.3 Enterprise Environmental Factors
These include any legal obligations and regulatory frameworks that the organization may
be subjected to as well as processes and procedures to be followed, the industry and its
norms towards risk and the organizations appetite towards risk.
11.1.1.4 Organizational Process Assets
These include risk categories, common definitions of concepts and terms, risk statement
formats, standard templates, roles and responsibilities, authority levels for decision-
making, lessons learned, and stakeholder registers, which are also critical assets to be
reviewed as components of establishing effective risk management plans.

11.1.2 Plan Risk Management: Tools and Techniques
There are three tools and techniques that can be used.
Plan Risk
Management
Tools
Meetings
Expert Judgment
Analytical Techniques
11.1.2.1 Analytical Techniques
These are used to understand and define the overall risk management context of the
project, which is based on a combination of stakeholder risk attitudes and the strategic
risk exposure of the current project.
11.1.2.2 Expert Judgment
This usually takes the form of expertise collated from:
●● Subject matter experts
●● Project stakeholders
●● Senior management
●● Lessons learned from previous projects.
11.1.2.3 Meetings
These involve people who are responsible for risk management including the project man-
ager, the project sponsor, selected project team members, selected stakeholders, anyone
with responsibility for any of the risk management processes, and others as needed.

Collective decision-making is very important area of project management that the PM-
BOK® does not go into any detail about but which can make or break this part of the
project. Almost all of the processes that form part of project risk management will in-
volve meetings between the project manager, the team and other stakeholders in order
to make decisions about the activity definitions and associated estimates.
How well these meetings are conducted will have a major impact on how smoothly the
project runs. To learn more about making your meetings effective and efficient download
the free resources on http://www.free-management-ebooks.com/skills-meeting.htm.
These free eBooks, checklists and templates cover all aspects of meetings including how
to set an agenda that will ensure that the meeting achieves it’s aims and how to chair a
meeting so that it is as productive as possible.
11.1.3 Plan Risk Management: Outputs
This process will create only one output, the risk management plan.
11.1.3.1 Risk Management Plan
This plan forms part of the project management plan and describes how risk manage-
ment will be structured and performed on the project. It contains the following elements:
●● Methodology
●● Roles & Responsibility
●● Budgeting
●● Timing
●● Risk categories
●● Definitions of Risk Probability & Impact
●● Probability & Impact Matrix
●● Revised Stakeholder Risk Tolerances
●● Reporting Formats
●● Tracking
Methodology
Defines the approaches, tools, and data sources that may be used to perform risk man-
agement on the project.

Roles and Responsibilities
This part of the plan needs to make clear who is responsible for each type of activity in
the risk management plan, and clarifies their responsibilities.
Budgeting
This part of the plan assigns resources, estimates funds needed for risk management
for inclusion in the cost performance baseline, and establishes how any extra funding
required (if risks are realized) will be raised.
Timing
This part of the plan defines when and how often the risk management process will be
performed throughout the project life cycle.
Risk categories
Risk Level 3
External
Market
Risk Level 2Risk Level 1RBS
Project
Ohio
Service
ITInternal
Price
Move to Apps
Skills
Reliability
Software
CapacityOps
Delivery
Quality
New EntrantCompliance

This provides a structure that ensures a comprehensive process of systematically iden-
tifying risks to a consistent level of detail. An organization can use a previously prepared
categorization framework, which might take the form of a simple list of categories or
might be structured into a Risk Breakdown Structure (RBS) as shown in the diagram
above.
This is a hierarchically organized depiction of the identified project risks arranged by risk
category and subcategory that identifies the various areas and causes of potential risks.
Definitions of Risk Probability and Impact
This ensures that all stakeholders have a common understanding of these definitions.
For example,
If the probability of a risk can be described as low, medium or high, what do
these categories actually mean?
Similarly, what effect would a high impact event have on the project in practical terms?
How much would it add to the costs? Could anything be done to mitigate it?
Risk Impact Scales for Project Ohio—Major Objectives
Major
Objective
<5% 10% 20% 40% 60% 85%
Scope Minimal Minor
areas
Major
areas
Unacceptable
to Sponsor
Project abandoned
Quality Very Minor Minimal Specific Need OK of
Sponsor
Sponsor
Reject
Project
ended
Time None Trivial <8% rise 15% rise 25% rise >30%
Cost <1% < 8% 15-20% 40-50% 55-65% >70%
The table above is an example of definitions that could be used in evaluating risk impacts
related to scope, quality, time and cost. By using pre-defined definitions in this way, the
project management team ensures that everyone involved is talking the same language
when it comes to risk.

Probability and Impact Matrix
Risks are prioritized according to their potential implications for having an effect on the
project’s objectives by using a matrix like the one shown.
Impact
Probability
Negligible-1 Minor-2 Moderate-3 Significant-4 Severe-5
>81% Low Risk
Moderate
Risk
High Risk Extreme Risk Extreme Risk
61-80% Minimal Risk Low Risk
Moderate
Risk
High Risk Extreme Risk
41-60% Minimal Risk Low Risk
Moderate
Risk
High Risk High Risk
21-40% Minimal Risk Low Risk Low Risk Moderate Risk High Risk
<20% Minimal Risk
Minimal
Risk
Low Risk Moderate Risk High Risk
The specific combinations of probability and impact that lead to a risk being rated as
‘extreme’, ‘high,’ ‘moderate,’ ‘low’ or ‘minimal’ importance, with the corresponding im-
portance for planning responses to the risk, are usually set by the organization.
Revised Stakeholder Risk Tolerances
If there is a need to revise stakeholder risk tolerances then these should be documented
here.
Reporting Formats
This part of the plan describes how the outcomes of the risk management processes will
be documented, analyzed, and communicated. It describes the content and format of the
risk register as well as any other risk reports required.
Tracking
This part of the plan describes how risk activities will be recorded for the benefit of the
current project, as well as for future needs and lessons learned, as well as whether and
how risk management processes will be audited.

11.2 Identify Risks
This is the process of determining risks that may affect the project and assessing the
impact of the risk should it occur. This information is documented in the risk register, a
list of all of the identified risks, their root causes, categories and responses. Because the
assessment of risk is an ongoing activity, the risk register will be updated continuously
throughout the life of the project.
All project team members should be encouraged to identify risks and this is an iterative
process because new risks may become known as the project progresses. The process
should involve the project team so they can develop and maintain a sense of ownership
and responsibility for the risks and associated risk response actions.
table below.
Risk Management Plan Documentation Reviews
Risk Register
Cost Management Plan Information Gathering Techniques
Schedule Management Plan Checklist Analysis
Quality Management Plan Assumptions Analysis
Human Resource Management Plan Diagramming Techniques
Scope Baseline SWOT Analysis
Activity Cost Estimates Expert Judgment
Activity Duration Estimates
Stakeholder Register
Project Documents
Procurement Documents

11.2.1 Identify Risks: Inputs
Identify Risks Inputs
Cost Management Plan
Quality Management Plan
Scope Baseline
Activity Cost Estimates
Schedule Management Plan
Activity Duration Estimates
Project Documents
Procurement Documents
Stakeholder Register
HR Management Plan
This is the sole output from the previous process. It defines the level of risk that is con-
sidered tolerable for the project, how all this will be managed, who will be responsible for
them, what time and cost is needed for each, and how risk will be communicated.
11.2.1.2—11.2.1.4 Cost, Schedule and Quality Management Plans
These plans describe how cost, schedule and quality are to be managed and implemented,
and as such, the information contained within them will have a bearing on project risk.
11.2.1.5 Human Resource (HR) Management Plan
This plan provides guidance on how project human resources should be defined, staffed,
managed, and eventually released. It can also contain roles and responsibilities, project

organization charts, and the staffing management plan, which form a key input to iden-
tify risk process.
11.2.1.6 Scope Baseline
The scope of the project in terms of the products to be created and the activities required
will be a source of risks to the project.
11.2.1.7 Activity Cost Estimates
These are useful in identifying risk as they provide a quantitative assessment of the likely
cost to complete scheduled activities. Reviewing these may indicate that the estimate is
insufficient to complete the activity and hence poses a risk to the project.
11.2.1.8 Activity Duration Estimates
These provide a quantitative assessment of the likely time to complete scheduled activi-
ties. Reviewing these may indicate that the estimate is insufficient to complete the activ-
ity and hence poses a risk to the project.
11.2.1.9 Stakeholder Register
This lists all of the project stakeholders as well as describing and classifying them. This
information will be useful in soliciting inputs for identifying risk, as it will ensure that key
stakeholders participate in the process
11.2.1.10
Project
Documents
Assumptions Log
Work Performance Reports
Earned Value Reports
Network Diagrams
Baselines
Other project information

11.2.1.10 Project Documents
These include, assumptions log, work performance reports, earned value reports, net-
work diagrams, baselines, and other project information proven to be valuable in identi-
fying risks.
11.2.1.11 Procurement Documents
If the project requires external procurement of resources, procurement documents
become a key input to this process. The complexity and the level of detail of the pro-
curement documents should be consistent with the value of, and risks associated with,
planned procurement.
These will have a major bearing on risks and will include laws and regulations governing
the creation or use of the projects products. Also important is the operational environ-
ment within which the project is taking place. The views of the project stakeholders and
their willingness to accept risk must also be taken into consideration.
These include project files, including actual data, organizational and project process con-
trols, risk statement templates, and lessons learned.
11.2.2 Identify Risks: Tools and Techniques
There are seven tools and techniques that can be used.
Identify Risks Techniques
Documentation Reviews
Information Gathering
Assumptions Analysis
SWOT Analysis
Expert Judgment
Checklist Analysis
Diagramming

11.2.2.1 Documentation Reviews
These are structured reviews of all project documentation up to this point in time includ-
ing plans, assumptions, previous project files, contracts, and other information.
The quality of the plans, as well as consistency between those plans and the project
requirements and assumptions, can be indicators of risk in the project. Missing, inac-
curate or incomplete information may hinder the identification of risks and may itself be
a source of risk.
11.2.2.2 Information Gathering Techniques
There are many ways in which information on the project risk situation can be gathered,
and these include:
●● Expert Interviews
●● Root cause identification
●● Brainstorming workshops
●● The Delphi technique.
11.2.2.3 Checklist Analysis
This technique uses the risk breakdown structure (RBS) developed either from this proj-
ect or from a previous project to help ensure that all significant risks or categories have
been identified.
11.2.2.4 Assumptions Analysis
Every identified project risk is based on a set of hypotheses, scenarios, or assumptions.
Assumptions analysis explores the validity of assumptions as they apply to the project.
It identifies risks to the project from:
●● Inaccuracy
●● Instability
●● Inconsistency OR
●● Incompleteness of assumptions.
The purpose of this tool is to challenge such assumptions and determine what risks may
arise from them.

11.2.2.5 Diagramming Techniques
Risk diagramming techniques may include cause and effect diagrams. These are also
known as Ishikawa or fishbone diagrams, and are useful for identifying causes of risks.
Ishikawa
Risk
Diagramming
Techniques
Fishbone
Cause &
Effect Flow Charts
Flow charts can also be used to show how various elements of a system interrelate, and
the mechanism of causation, as can influence diagrams, which show causal influences,
time ordering of events, and other relationships among variables and outcomes.
11.2.2.6 SWOT Analysis
This technique looks at the project from the perspective of its internal strengths and
weaknesses as well as external opportunities, and threats. SWOT analysis is a useful
approach to risk assessment and you can learn more about this technique from our free
online library http://www.free-management-ebooks.com/dldebk/dlst-swot.htm.
Risks can be identified directly by experts with relevant experience of similar projects
or business areas. Such experts should be identified by the project manager and invited
to consider all aspects of the project and suggest possible risks based on their previous
experience and areas of expertise.

11.2.3 Identify Risks: Outputs
This process will create the following output:
11.2.3.1 Risk Register
This is the only output from this process and consists of the list of all the identified risks,
their root causes, categories and responses. The information contained within the risk
register may be used to update the risk breakdown structure.
may be used to
update RBS
List of ALL
Risks
category
their root
cause
Risk Register
&
responses
Because of risk is an ongoing activity, the risk register will be updated continuously
throughout the life of the project and it is a key tool to aid in the management of risks
within a project. The risk register ultimately contains the outcomes of the other risk man-
agement processes as they are conducted, resulting in an increase in the level and type
of information contained in the risk register over time.

11.3 Perform Qualitative Risk Analysis
This process analyses each risk from the risk register in terms of its probability and im-
pact on the project if it were to occur. It should be performed as soon as possible after
risks have been identified so that appropriate time and resources can be allocated to the
more serious risks. It uses the probability and impact matrix (PIM) to rank and prioritize
risks, and this information is placed back on the risk register.
Like all the processes within risk management, this one should be performed regularly
because new risks will be identified and the characteristics of existing risks may change
as the project progresses.
table below.
Risk Management Plan Risk Probability & Impact
Assessment
Project Documents
Updates
Scope Baseline Probability & Impact Matrix
Risk Register Risk Data Quality Assessment
Enterprise Environmental Factors Risk Categorization
Organizational Process Assets Risk Urgency Assessment
Expert Judgment
11.3.1 Perform Qualitative Risk Analysis: Inputs
This is developed during process ‘11.1 Plan Risk Management’ and will explain the overall
approach that needs to be taken to risk management on this particular project. It will
detail how much risk is acceptable and who should be involved in carrying out the quali-
tative analysis of the known risks.

Elements of Risk
Management Plan
Budget
Risk Mgmt
Activity
Schedule
Deﬁnition Risk
Categories
Deﬁnition of
Probability &
Impact
Probability &
Impact Matrix
Stakeholder
Risk Tolerances
Roles &
Responsibilities
The key elements of this plan used in this process are roles and responsibilities for con-
ducting risk management, budget, schedule for risk management activities, definition of
risk categories, definition of risk probability and impact, probability and impact matrix,
and stakeholder’s risk tolerances.
11.3.1.2 Scope Baseline
The scope of the project will have a direct bearing on the type and amount of risk that
is likely to be encountered. In general terms, certain types of project are associated with
certain types of risk.
For example,
• Construction projects the risks would include such things like, planning
permissions, weather, health and safety legislation, and labor union issues.
• IT project risks tend to be concerned with whether development software
will perform as advertised and with compatibility issues.
Projects of a common or recurrent type tend to have well understood risks, whereas
those breaking new ground tend to have more uncertainty.

Amount of
Risk
Type of
Risk
Scope of
Project
has direct
bearing on
This is the central repository of all of the known risks that are to be analyzed.
These include industry studies of similar projects by risk specialists and risk databases
from industry or proprietary sources.
These will include the tools needed to carry out qualitative risk analysis, policies, proce-
dures and guidelines for risk management, and historical information including lessons
learned from previous projects.
11.3.2 Perform Qualitative Risk Analysis: Tools and Techniques
There are six tools and techniques that can be used.
Perform Quality Risk Analysis Techniques
• Risk Probability & Impact Assessment
• Probability & Impact Matrix
• Risk Data Quality Assessment
• Risk Categorization
• Risk Urgency Assessment
• Expert Judgment

11.3.2.1 Risk Probability and Impact Assessment
Risk probability assessment investigates the likelihood that each specific risk will occur,
whereas risk impact assessment investigates the potential effect on a project objective
such as schedule, cost, quality, or performance.
Risk
Probability—
likelihood each risk
will occur
Risk
Impact—
looks at potential
effect on schedule,
cost, quality or
performance
Both the likelihood and impact are given a score according to the definitions given in
the risk management plan and these can be considered together to provide a risk score.
Risks with a high score will be given high priority while those with a low score will be
included on a watch list for future monitoring.
11.3.2.2 Probability and Impact Matrix
Evaluation of each risk’s importance and, hence, priority for attention can be done using
a probability and impact matrix as shown.
Probability & Impact Matrix
Probability Threats Opportunities
0.90 0.05 0.18 0.54 0.72 0.72 0.54 0.18 0.05
0.75 0.04 0.15 0.45 0.60 0.60 0.45 0.15 0.04
0.50 0.03 0.10 0.30 0.40 0.40 0.30 0.10 0.03
0.25 0.01 0.05 0.15 0.20 0.20 0.15 0.05 0.01
0.10 0.01 0.02 0.06 0.08 0.08 0.06 0.02 0.01
Impact 0.05 0.20 0.60 0.80 0.80 0.60 0.20 0.05

This specifies combinations of probability and impact that lead to rating the risks as low,
moderate, or high priority. The type of management response should be:
●● Threats
○○ High-risk (shown in dark gray boxes) are priority and need a hard line response.
○○ Low-risk (mid-gray boxes) need to have a contingency made for them & monitored
●● Opportunities
○○ Dark gray boxes show ones to pursue first as they offer the most benefit & are
more easily achieved.
○○ Mid-gray boxes indicate the ones to be monitored.
It is possible to rate a risk separately for cost, time, scope and quality. In addition, it can
develop ways to determine one overall rating for each risk. An overall rating scheme can be
developed to reflect the organization’s preference for one objective over another and using
those preferences to develop a weighting of the risks that are assessed by objective.
11.3.2.3 Risk Data Quality Assessment
This involves examining how well the risk is understood and the accuracy, quality, reli-
ability, and integrity of the data regarding it. If data quality is unacceptable, it may be
necessary to gather higher-quality data.
11.3.2.4 Risk Categorization
The risk breakdown structure (RBS) is the normal way to help structure and organize all
identified risks into appropriate categories, and these will assist in determining which
aspects of the project have the highest degree of uncertainty.
11.3.2.5 Risk Urgency Assessment
Risks that are likely to occur in the immediate future require more urgent attention than
those that may occur later on in the project. Indicators of priority should include the time
required to affect a risk response. In some qualitative analyses the assessment of risk ur-
gency can be combined with the risk ranking determined from the probability and impact
matrix to give a final risk severity rating.
This would relate to experience of the probability and impact of typical risks for projects
of this type and could come from anyone with relevant experience.

11.3.3 Perform Qualitative Risk Analysis: Outputs
Perform
Qualitative
Risk Analysis
Output
• Project
Document
Updates
11.3.3.1 Project Documents Updates
The risk register can be updated with the following information.
●● Relative ranking or priority list of project risks—the probability and impact matrix
can be used to classify risks according to their individual significance. Risks may
be listed by priority separately for schedule, cost, and performance since organi-
zations may value one objective over another. The project manager can then use
the prioritized list of risks to focus attention on those items of high significance to
the most important objectives.
●● Risks grouped by categories—this can point to common underlying causes of risk,
which may in turn suggest a holistic approach to dealing with them. Discovering
concentrations of risk may also improve the effectiveness of risk responses.
●● List of risks requiring response in the near-term—includes those risks that require
an urgent response and those that can be handled at a later date may be put into
different groups.
●● List of risks for additional analysis and response—some risks might warrant more
analysis, including Quantitative Risk Analysis, as well as response action.
●● Watch lists of low-priority risks—those that are not assessed as important in this
process can be placed on a watch list for continued monitoring.
●● Trends in the analysis results—as this process is iterative, trends for particular
types of risk may become apparent. This information can be fed back into the risk
management process.
●● Assumptions Log—the project scope statement may contain assumptions about
the project, which may be updated as a result of the qualitative risk analysis done
in this process.

11.4 Perform Quantitative Risk Analysis
This is the process of analyzing the effect of those risks identified in the previous process
as having the potential to substantially impact the project. It may be used to assign a
numerical rating to those risks individually or to evaluate their aggregate effect.
In some projects it may be possible to develop effective risk responses without this pro-
cess. The availability of time and budget, and the need for qualitative or quantitative
statements about risk and impacts, will determine which method(s) to use.
table below.
Risk Management Plan Data Gathering & Representation
Techniques
Project Documents
Updates
Cost Management Plan Quantitative Risk Analysis &
Modeling Techniques
Schedule Management Plan Expert Judgment
Risk Register
11.4.1 Perform Quantitative Risk Analysis: Inputs
Perform Quantitative Risk
Analysis Inputs
• Risk Management Plan
• Cost Management Plan
• Schedule Management Plan
• Risk Register
• Enterprise Environmental Factors
• Organizational Process Assets

This is developed during process ‘11.1 Plan Risk Management’ and defines the level of
risk which is seen as acceptable, how risks will be managed, who will be responsible for
carrying out risk related activities, the time and cost of each risk activity and how the
communication of risk is to occur.
11.4.1.2 Cost Management Plan
Costs are also quantifiable and can be used as an input for this process.
11.4.1.3 Schedule Management Plan
Schedule timings are presented in a quantifiable manner, which means that risks that will
impact time scales can easily be quantified within this process.
This is the central repository of all of the known risks that are to be analyzed. It was up-
dated in the previous process to include information on relative ranking, categorization
and urgency of responses.
These include industry studies of similar projects by risk specialists and risk databases
from industry or proprietary sources.
These will include the tools needed to carry out qualitative risk analysis, policies, proce-
dures and guidelines for risk management, and historical information including lessons
learned from previous projects.

11.4.2 Perform Quantitative Risk Analysis: Tools and Techniques
Data Gathering & Representation Techniques
Perform Quantitative Risk Analysis Tools
Quantitative Risk Analysis & Modelling Techniques
Expert Judgment
11.4.2.1 Data Gathering and Representation Techniques
Structured interviews can be used to determine be probability and impact of risks from
subject matter experts. This information can then be used in the following modeling
techniques.
11.4.2.2 Quantitative Risk Analysis and Modeling Techniques
Several techniques can be used including:
●● Sensitivity Analysis—this involves analyzing the project to determine how sensi-
tive is to particular risks by analyzing the impact and severity of each risk.
●● Expected Monetary Value (EMV) Analysis—determining the expected monetary
value is to multiply the likelihood by the cost impact to obtain an expected value
for each risk, these are then added up to obtain the expected monetary value for
the project. A typical way of calculating EMV is using decision trees:
○○ Decision Tree Analysis—these are in the form of a flow diagram where each
node, represented by a rectangle, contains a description of the risk aspect and
its cost. These rectangles are linked together via arrows each arrow leading to
another box representing the percentage probability.

Event A
Event C
Decision 1
Outcome 2
Outcome 3
Outcome 1
Event B Outcome 4
Outcome 5Decision 2
●● Tornado Diagrams—these are named because of their funnel shaped and portray
graphically the project sensitivity to cost or other factors. Each tornado diagram
will represent the impact of risks in terms of particular aspects. These aspects
may be the stages of phases of all project, and are ranked vertically and repre-
sented by a horizontal bar showing plus or minus cost impacts.
●● Monte Carlo Analysis—is normally calculated by computer by analyzing many
scenarios for the project schedule and calculating the impact of particular the
risk events. It is helpful in identifying risks and the effect they have on the project
schedule.

Experts give a risk probability &
impact value for
Optimistic view
Pessimistic view
Realistic view
Rather than ask each expert for a single value for each, the project manager would nor-
mally encourage each experts to provide an optimistic, pessimistic and realistic prob-
ability and impact value for each risk.
11.4.3 Perform Quantitative Risk Analysis: Outputs
11.4.3.1 Project Documents Updates
Quantitative Approaches
Quantitative Outputs
Quantitative
Recommendations
11.4.3.1
Quantitative Risk
Report details:
The risk register is further updated to include a quantitative risk report detailing quanti-
tative approaches, outputs, and recommendations. Updates include the following:
●● Probabilistic analysis of the project. Estimates are made of potential project sched-
ule and cost outcomes listing the possible completion dates and costs with their
associated confidence levels. This output, often expressed as a cumulative distri-
bution, can be used with stakeholder risk tolerances to permit quantification of
the cost and time contingency reserves.

●● Probability of achieving cost and time objectives. With the risks facing the project,
the probability of achieving project objectives under the current plan can be esti-
mated using quantitative risk analysis results.
●● Prioritized list of quantified risks. This list of risks includes those that pose the great-
est threat or present the greatest opportunity to the project. These include the risks
that may have the greatest effect on cost contingency and those that are most
likely to influence the critical path. These risks may be identified, in some cases,
through a tornado diagram generated as a result of the simulation analyses.
●● Trends in the analysis results. As this process is iterative, trends for particular types
of risk may become apparent. This information can be fed back into the risk man-
agement process.
11.5 Plan Risk Response
This is the process of developing options and actions to enhance opportunities and to
reduce threats to the project. It is important that planned responses are appropriate to
the significance of the risk, cost effective in meeting the challenge, realistic within the
project context, agreed upon by all parties involved, and owned by a responsible person.
table below.
Risk Management Plan Strategies for Negative Risks or
Threats
Project Management Plan
Updates
Risk Register Strategies for Positive Risks or
Opportunities
Project Document Updates
Contingent Response Strategies
Expert Judgment

11.5.1 Plan Risk Responses: Inputs
Risk Mgmt
Plan
Risk
Register
Plan Risk
Response
Inputs
This document defines the level of risk which is seen as acceptable, how risks will be
managed, who will be responsible for carrying out risk related activities, the time and
cost of each risk activity and how the communication of risk is to occur.
This is the central repository of all of the known risks that are to be analyzed. It was up-
dated in the previous processes to include information on relative ranking, categorization
and urgency of responses and may include quantitative data if appropriate.
11.5.2 Plan Risk Responses: Tools and Techniques
Strategies for
Negative
Risks or
Threats
Contingent
Response
Positive
Risks or
Opportunities
Plan Risk Responses Tools

11.5.2.1 Strategies for Negative Risks or Threats
There are four possible strategies for dealing with threats or risks that may have negative
impacts on project objectives if they occur.
1. Avoid—This involves taking action to either reduce the probability of the risk and/
or its impact to zero. In either case this response enables the risk to be circum-
vented entirely.
For example, using a certain supplier might carry the risk of them going out of
business during the course of the project. This risk could be avoided by using a
supplier who was bigger, better established and more financially secure.
2. Transfer—This involves transferring the risk to a third party so that they are re-
sponsible for its management and impact. It does not eliminate the risk it simply
transfers the liability to someone else. This can be done by:
○○ Taking out insurance (the insurance company is now liable) or
○○ Having the work done under a fixed-price contract (the contractor is now liable).
Risk transference nearly always involves payment of a risk premium to the party
taking on the risk and may introduce new risks. For example, an insurance com-
pany may contest the claim or a contractor might dispute the terms and condi-
tions of the contract if they are having problems delivering.
Strategies
for Negative
Risks or
Threats
Avoid Transfer Mitigate Accept
3. Mitigate—Taking early action to reduce the probability and/or impact of a risk
occurring is often more effective than trying to repair the damage after it has oc-
curred. Adopting less complex processes, conducting more tests, or choosing a
more stable supplier are examples of mitigation actions.
4. Accept—The most common acceptance strategy is to establish a contingency re-
serve, including amounts of time, money, or resources to handle the risks. It is
usually chosen either because:
○○ Risk is low in terms of impact or probability, or
○○ Cost and effort of taking a different action is out of proportion to the risk itself.

11.5.2.2 Strategies for Positive Risks or Opportunities
There are four possible strategies for dealing with opportunities if they occur.
Strategies
for Positive
Risks or
Opportunities
Exploit Share Enhance Accept
1. Exploit—examples of directly exploiting responses include assigning an organiza-
tion’s most talented resources to the project to reduce the time to completion or
to provide lower cost than originally planned.
2. Share—sharing a positive risk involves allocating some or all of the ownership of
the opportunity to a third party who is best able to capture the opportunity for the
benefit of the project. Examples of sharing actions include forming risk-sharing :
○○ Partnerships,
○○ Teams,
○○ Special-purpose companies, or
○○ Joint ventures (JVs).
These can be established with the express purpose of taking advantage of the
opportunity so that all parties gain from their actions.
3. Enhance—examples of enhancing opportunities include adding more resources to
an activity to finish early.
4. Accept—accepting an opportunity is being willing to take advantage of it if it
comes along, but not actively pursuing it.
11.5.2.3 Contingent Response Strategies
These are strategies designed to manage the outcome either to reduce a threat or maxi-
mize an opportunity. For example, if there were a risk of the project falling behind sched-
ule then a contingent response strategy would be to assign extra resources to it.

Contingency Response Strategy
is a Response Plan
that is only executed under
certain predeﬁned conditions
and where sufﬁcient warning
exists to implement the plan
This could be planned for but would not need to be done unless the risk materialized.
In other words, it is a response plan that will only be executed under certain predefined
conditions if there is sufficient warning to implement it.
Any group or person with specialized education, knowledge, skill, experience, or training
in establishing risk responses may provide expertise.
11.5.3 Plan Risk Responses: Outputs
This process will create the following outputs:
Project
Document
Updates
Project
Management
Plan Updates
Plan Risk
Responses
Outputs

11.5.3.1 Project Management Plan Updates
Theriskmanagementplanmayneedtobemodifiedasaresultofidentifyingriskresponses.
11.5.3.2 Project Document Updates
This covers any other documentation that includes or reflects the management of risk
such as logs or registers.
11.6 Control Risks
This is the process of implementing risk response plans, tracking identified risks, moni-
toring residual risks, identifying new risks, and evaluating risk process effectiveness
throughout the project.
Planned risk responses that are included in the project management plan are executed
during the life cycle of the project, but the project work should be continuously moni-
tored for new, changing, and outdated risks.
table below.
Project Management Plan Risk Reassessment Work Performance
Information
Risk Register Risk Audits Change Requests
Work Performance Data Variance and Trend Analysis Project Management Plan
Updates
Work Performance Reports Technical Performance
Measurement
Project Documents Updates
Reserve Analysis Organizational Process
Assets Updates
Meetings

11.6.1 Control Risks: Inputs
Project
Management Plan
Work Performance
Data
Risk Register
Work Performance
Reports
Control Risks
Inputs
11.6.1.1 Project Management Plan
This contains the risk management plan, which includes risk tolerances, protocols and
the assignment of people, time, and other resources to project risk management.
This is the central repository of all of the known risks. Key inputs include risk owners,
agreed-upon risk responses, specific implementation actions, symptoms and warning
signs of risk, residual and secondary risks, a watch list of low-priority risks, and the time
and cost contingency reserves.
11.6.1.3 Work Performance Data
This includes the status of deliverables, schedule progress, and costs incurred.
11.6.1.4 Work Performance Reports
These include variance analysis, earned value data, and forecasting data.

11.6.2 Control Risks: Tools and Techniques
There are six tools and techniques that can be used.
Risk
Reassessment
Control
Risks
Techniques
Risk AuditsMeetings
Variance &
Trend Analysis
Reserve
Analysis
Technical
Performance
Measurement
11.6.2.1 Risk Reassessment
Project risk reassessments should be regularly scheduled to keep the risk register up-
dated. The amount and detail of repetition that is appropriate depends on how the proj-
ect progresses relative to its objectives, as well as, which risks (if any) actually manifest
themselves.
11.6.2.2 Risk Audits
These should be scheduled in the risk management plan and examine the effectiveness
of risk responses in dealing with identified risks and their root causes. The objectives
should be clearly defined in advance and the audit may form part of the routine project
review meetings, or may be run separately.
11.6.2.3 Variance and Trend Analysis
Earned value analysis and other methods of project variance and trend analysis may be
used for monitoring overall project performance. Outcomes from these analyses may fore-
cast potential deviation of the project at completion from cost and schedule targets. Devia-
tion from the baseline plan may indicate the potential impact of threats or opportunities.

may indicate
the potential
impact of
Threats
Opportunities
Deviation
from the
Baseline Plan
11.6.2.4 Technical Performance Measurement
This is designed to indicate the degree of technical risk faced by the project. Where de-
liverables can be measured against the plans in a quantitative way e.g.:
●● Response times,
●● Number of defects,
●● etc.
This can predict the degree of success in achieving the technical aims of the project.
11.6.2.5 Reserve Analysis
This compares the contingency reserves remaining to the amount of risk remaining at
any time in the project in order to determine if the remaining reserve is adequate.
11.6.2.6 Meetings
Project risk should be openly discussed at periodic status meetings so that project staff
can contribute to risk identification and management.
11.6.3 Control Risks: Outputs
This process will create the following outputs:
Control Risks
Outputs
Organizational
Process Assets
Updates
Work
Performance
Information
Project Document
Updates
Change Requests
Project Management
Plan Updates

11.6.3.1 Work Performance Information
This provides a mechanism to communicate and support project decision-making.
11.6.3.2 Change Requests
Implementing contingency plans or workarounds sometimes results in a change request.
●● Recommended preventive actions are documented directions to perform on activity
that can reduce the probability of negative consequences associated with project
risks.
●● Recommended corrective actions include contingency plans and workarounds.
The latter are responses that were not initially planned, but are required to deal with
emerging risks that were previously unidentified or accepted passively.
11.6.3.3 Project Management Plan Updates
If the approved change requests have an effect on the risk management processes, the
corresponding component documents of the project management plan are revised and
reissued to reflect the approved changes.
11.6.3.4 Project Document Updates
This covers any other documentation that includes or reflects the management of risk
such as logs or registers. The risk register will be updated to take account of any risk
reassessments, risk audits, and periodic risk reviews. These outcomes may include iden-
tification of new risk events, updates to probability, impact, priority, or ownership. If cer-
tain risks are no longer applicable then any associated reserves can be released.
11.6.3.5 Organizational Process Assets Updates
These include templates for the:
●● Risk management plan
●● Risk breakdown structure (RBS) &
●● Lessons learned from the risk management activities.

Summary
Risk plays a significant part in the planning of any project that requires a commitment
of time and resources. A project manager should have a clear understanding of the risk
tolerance of the project and organization from the outset.
Risk management’s sole purpose is to increase the probability and impact of posi-
tive events, whilst decreasing the impact and probability of threats or adverse. This is
achieved by thoroughly researching and defining any assumptions, conditions or con-
straints associated with the project requirements and objective. It is not concerned with
general business risks those are the responsibility of the organization’s executive.
The six processes of this knowledge area are:
●● Plan Risk Management—define how to conduct risk management activities for
the project.
●● Identify Risks—determine and document the risks along with their characteris-
tics that may affect the project.
●● Perform Qualitative Risk Analysis—prioritize the risks so further analysis or action
can be done to assess and combine their impact and probability of occurrence.
●● Perform Quantitative Risk Analysis—analyze the effect of identified risks on over-
all project objectives numerically.
●● Plan Risk Responses—develop options and actions that will enhance opportuni-
ties and reduce threats to project objectives.
●● Monitor and Control Risks—is the process that implements the risk response
plans responsible for tracking identified risks, monitoring residual risks, identify-
ing new risks, and evaluating risk process effectiveness throughout the lifecycle
of the project.
The depth of understanding a project manager has of his or her stakeholders’ degree risk
tolerance is essential to the smooth management of the project. Their perceptions, cul-
ture and environment play a significant part if forming their attitude towards risk.

This knowledge will enable the project manager to reassure and inform each stakeholder
appropriately through project communications. Success depends on all levels involved
with the project actively identifying and pursuing effective risk management throughout
the project lifecycle.
If you want to know more about project management the eBooks in this skill set available
from http://www.free-management-ebooks.com/skills-project.htm are:
●● Principles of Project Management
●● Process Groups
●● Integration Management
●● Scope Management
●● Time Management
●● Cost Management
●● Quality Management
●● Human Resources (HR) Management
●● Communications Management
●● Risk Management
●● Procurement Management
●● Stakeholder Management

Other Free Resources
The Free Management eBooks website offers you over 100 free resources for your own
professional development. Our eBooks, Checklists, and Templates are designed to help
you with the management issues you face every day. They can be downloaded in PDF,
Kindle, ePub, or Doc formats for use on your iPhone, iPad, laptop or desktop.
eBooks—Our free management eBooks cover everything from accounting principles to
business strategy. Each one has been written to provide you with the practical skills you
need to succeed as a management professional.
Templates—Most of the day-to-day management tasks you need to do have already
been done by others many times in the past. Our management templates will save you
from wasting your valuable time re-inventing the wheel.
Checklists—When you are working under pressure or doing a task for the first time,
it is easy to overlook something or forget to ask a key question. These management
checklists will help you to break down complex management tasks into small control-
lable steps.
FME Newsletter—Subscribe to our free monthly newsletter and stay up to date with the
latest professional development resources we add every month.
Social Media—Share our free management resources with your friends and colleagues
by following us on LinkedIn, Facebook, Twitter, Google+, and RSS.
Visit www.free-management-ebooks.com

References
Nokes S., & Kelly, S. (2007) 2nd Edition. The Definitive Guide to Project Management. Pren-
tice Hill, Financial Times.
Snijders, P., Wuttke, T. & Zandhuis, A. (2013) 5th Edition. A pocket companion to PMI’s
PMBOK® Guide. Van Haren Publishing.
Lock, D. (2007). 9th Edition. Project Management, MPG Books Ltd.
Billingham, V. (2008) 3rd Edition. Project management: how to plan & deliver a successful
project (studymates), The Project Management Excellence Centre Inc.
Project Management Institute Global Standard (2008) 4th Edition A guide to the project
management body of knowledge (PMBOK® Guide), Project Management Institute.
Kerzner, H. Ph.D. (2009). 10th Edition. Project Management—a systems approach to plan-
ning, scheduling & controlling. John Wiley & Sons Inc.
Larson, E.W. & Gray, C.F. (2010) 5th Edition Project management: the managerial process,
McGraw-Hill Higher Ed.
Lock, D. (2007). 3rd Edition. The Essential Project Management. Gower Publishing Ltd.
Knapp, B.W. (2010) Essential project management templates, The Project Management
Excellence Centre Inc.
Newton, R. (2007). Project Management step by step—how to plan & manage a highly suc-
cessful project. Pearson Business.
Dr Maylor, H. (2010) 4th Edition. Project Management (with MS Project CDRom). Prentice
Hill, Financial Times.
Shenhar, A.J. & Dvir, D. (2007). Reinventing Project Management: the diamond approach to
successful growth & innovation. Pearson Business.

Fme project-risk

More Related Content

Similar to Fme project-risk (20)

Recently uploaded (20)

Fme project-risk