Implementing a Project Risk
Management System
By David Hulett
Risk analysis is an important tool for project managers.
What are the steps of an effective, disciplined risk analysis and management system?
The application of these step-by-step procedures will ensure effective risk management of projects.
The Project Manager should make support for the risk analysis visible to all.
PMs are often the champions of risk analysis since they see it as a way to improve their control of the project. This enthusiasm energizes the team leaders, cost account managers, and other middle managers in their efforts during a risk analysis.Make sure that the project models are analytical project management tools.
- Often, critical path method (CPM) project schedules are only reassuring pictures of project success instead of powerful tools to tell how long the project should take. It is important to let the project scheduling software determine the completion date through the critical path.
- Often, the estimate at completion (EAC) is composed of "bare bones" or optimistic estimates that are destined to be overrun. A cost risk analysis must start with honest, realistic estimates.
Identify key project managers who will participate in the risk analysis.
The most important element of the risk management system is gathering the risk data. These people are in the best position to provide this information, but they are also the busiest, most valuable project staff. The risk analyst has to go to some lengths to minimize the time required of these people.Conduct an independent risk analyses.
Sometimes the project office itself cannot be relied upon to provide unbiased estimates of project risk. In this case, or if it is suspected that there will be some bias, independent experts in the project subject matter as well as in risk analysis discipline should be engaged to make the assessment.Train project members on the concepts and language of risk analysis before the risk analysis.
First-time participants are unfamiliar with the risk analysis approach to project management, so the effectiveness of this briefing is very important. It is also where the parameters are set to specify what is included in the risk scenarios.Organize the project data the way the project member see risk.
Schedule activities may be organized into groups with similar risk, called "risk banding," for instance. This greatly facilitates the risk analysis without sacrificing much accuracy, and is crucial to the success of risk data interviews.Conduct risk data interviews to develop quantified risk analysis information.
This is the most important phase of a risk analysis because it requires the best data possible. There are some well-known biases, mainly leading to underestimating risk, that should be avoided. There are some approaches that work to gather the data needed. It is not unusual to see the project model change even at this stage.Select the right software specifically designed to handle the task.
Software to analyze risk in spreadsheets, schedules and decision trees are referred to elsewhere in this web site. Software is not the answer, but it ought to be a transparent tool of analysis. The suite of other project management products often dictates some software choices.Perform the analysis of risk.
The software usually makes the analytical part of a risk analysis simple. Software does a Monte Carlo simulation or solves complex logic of decision trees or fault trees. Do not expect the first results to be acceptable, because they will probably indicate the need for serious risk management steps to drive the overrun risk down to acceptable levels.Propose and risk-analyze alternative risk management approaches.
Project management uses the analytical results to prioritize the most productive, cost-effective risk mitigation alternatives. Project risk reduction is the benefit of the efforts toward risk analysis.Install Risk Analysis as a regular part of the status update and reporting cycle.
Project management should revisit the risk analysis periodically throughout the project or when risk is known to have changed.Benchmark the risk management process itself periodically.
Benchmarking the risk management process is needed to make sure that the system has not departed from the original design or practice and continues to use the best available software and methods. Outside expert observers can do a risk analysis system audit in a few days, examining documented analyses and interviewing participants.
