Project Risk Management
Projects can be risky ventures. Many run late, are over budget or fail to perform. Cost overruns directly affect the wider financial performance. And late delivery or poor functional performance mean that you do not reap the anticipated business benefits. A reduction in both shareholder and customer confidence may be the less direct, but equally damaging, result of delivery failures.
Project failures often lead to much debate over what went wrong. Frequently, management control, supplier performance, or external events are blamed. But more often the root causes lie in the way the business shaped the project early in its life.
Great expectations
We measure the success of any project against our expectations. These may not accept a venture’s inherent uncertainty. Budgets, timescales and performance criteria are normally established early in the life of a project. They are set in an environment of uncertainty. They are not absolute and may be distorted by several factors.
The accuracy of project performance measures is not just a factor in ensuring that our post-project learning is robust. These estimates of cost, time and performance are the parameters on which the decision to proceed with the project is based. If strategic project decisions are to be robust, then we must seek to fully understand the uncertainty present in estimates and be proactive in managing it.
With the best of intentions
There will always be unforeseen issues that affect project performance - those random events that are beyond our control. However, in reviewing a cross-section of projects, my conclusion is that such events have significantly less influence than factors relating to individual and organisation behaviour.
An interesting perspective from which to view the human influence in projects is the proposition that ‘every behaviour has a positive intention’. I came across this statement in the context of neuro-linguistic programming. In the context of projects, the presupposition is that all the people involved are acting and making decisions with a positive intention from their own perspective. If these behaviours and decisions are not in the best interests of the project, then it follows that either the interests of the individual conflict with those of the project, or the quality of decision-making is poor.
The business can influence both these factors in the early stages. Such failings can be tracked back to the way in which the project was established, the contractual frameworks adopted and the personnel selected. Creating the optimum project is always our goal. However, there are limitations in all supplier markets that you need to recognise and manage. The skill in project initiation is to create an environment that is most advantageous for project delivery within the prevailing constraints and then fully appreciate and manage residual risk.
Maximum leverage
Figure 1 illustrates a typical profile for spend, key decision making and uncertainty through the life cycle of a project. When the spend profile begins to rise steeply, the project delivery environment has already been formed. Contractual frameworks will be in place, organisations and key individuals selected. Corrective actions will generally be disruptive and inefficient as people try to modify the outcome of a system created some time earlier.
Strategic decisions have the greatest leverage in improving project performance early in the project life cycle The primary issues are clearly defining what is to be delivered and understanding the level of uncertainty involved. There are a number of approaches to project definition. The one that I most commonly use follows a value management methodology. Not only does this provide a clear definition of objectives without restricting creative solutions, it also enables stakeholders to co-create these project objectives. Strategic project risk management is then concerned with fully appreciating and responding to the project risk profile.
Core risk management process
Risk management follows the iterative process illustrated in Figure 3. Risks are identified, assessed and decisions taken on response strategies. The effectiveness of responses is monitored and the process repeated through the project life cycle.
The effectiveness of the process is generally maximised when clarity is retained between strategic and project level risks . Often there are two distinct levels of risk management. Strategic risk management provides the context for project delivery and maintains an interface with changes in the business continuum. Project risk management focuses on delivery of the project within the defined environment. The relationship is outlined in Figure 2
Risk profiling
The first stage in the risk management process is risk identification. There are a number of approaches. Commonly, the activity is undertaken in a group forum where risks are brainstormed, sometimes with the use of prompts or checklists. Alternatively, individual interviews can elicit areas of concern and uncertainty. A risk register or database captures the risks identified in this way. These processes can provide a comprehensive understanding of project uncertainty for those involved. However, they do not always provide information in a form easily communicated to others, and are not always best suited to the very early stages of project initiation.
To meet the need for a simple measure of project uncertainty, some organisations use risk profiling tools. These comprise a matrix of questions relating to project uncertainty and how this interfaces with the business. The questions are reviewed at key points in the project and the profiling tool generates a risk exposure rating. The full potential of risk profiling tools is realised when they are calibrated to the particular organisation, its objectives and risk appetite. They focus the risk exercise on strategic issues through a robust framework, provide metrics for use at a corporate level and are easily applied in the early project stages.
Some of the considerations explored in a typical risk profiling tool include:
Strategic responses
Undertaking a risk profiling exercise leads to the identification of specific risks and begins the formulation suitable responses. However, there are further strategic responses to discuss. The qualitative appreciation of project risk that these assessments deliver can be used to calibrate how the business deals with the project in a number of areas.
Through these strategic responses, the business can mirror the level of risk each of its projects presents in the management systems and measures applied. Repeating risk profiling at key milestones releases resources from projects with reducing risk and identifies those with rising risk profiles. Figure 4 refers.
Operational responses
Project risk management also involves identifying, evaluating and responding to project risk. Here, the emphasis is more on individual risks than considering the generic characteristics discussed at the strategic level. The benefits of formalised project risk management include prioritisation of issues, effective use of resources, knowledge sharing and the increased transparency of the issues facing the project. Above all, project risk management is a proactive process, encouraging people to look forward and plan for future eventualities.
The overall impact of a risk is a function of its probability and consequence. Determining the impact of risks can be undertaken either qualitatively or quantitatively, using some of the analytical software tools available. Experience shows that a combination of methods offers the optimal balance. Simple qualitative evaluations enable high impact risks to be rapidly identified and actions prioritised.
Qualitative analysis is most effectively targeted on particular areas of cost and/or time. For example, programme analysis can be invaluable in determining target dates for key events such as system changeovers. Cost analysis can add real value in establishing project funding levels and managing risk contingencies over a programme of projects. Figure 5 outlines a simple qualitative risk evaluation matrix
At a project level there are four main risk response strategies.
Residual uncertainty
A critical area of risk management is how to deal with residual uncertainty. While risk management processes help us to understand and respond to uncertainties, in the absence of perfect foresight, there will always be a level of residual uncertainty. This residual risk has to be accommodated through contingencies. By innovatively structuring the way contingencies are managed early in the project, you can empower people to achieve and generate improved performance targets. Ignoring residual uncertainty is not an option if you wish to exceed expectations in project delivery.
The task of strategic risk management is thus to appreciate project risk exposure, shape the delivery environment and increase the quality of decision making by a better understanding of uncertainty.
Alastair Bloore leads the delivery of Risk, Value & Facilitation services at Cyril Sweett Limited, Tel: 020 7242 9777,
E-mail: abloore@cyrilsweett.co.uk
AIRMIC COMMENT
On the subject of project risk management, David Ireland, AIRMIC deputy chairman and group risk manager of Norwest Holst Group of Companies, cited the example of a recent discussion on whether the World Athletics Championships which have been awarded to London in 2005 will now take place there. “So much of what was being said about the situation seems to point to inadequate risk assessment or planning and is linked into the fiasco over a national stadium. There seems to be no proper ownership of the project, with too many interested parties and none of them taking a co-ordinated approach.
“There also seems to be a totally different approach to risk depending on whether the project is ‘private’ or ‘public’. Would the millennium dome ever have been built if it had been a privately funded initiative?”
