BOUN PM Ch7-v2-AK

7. 1 Project Management Aybek Korugan - Boazii University

Managing Risk


What is Risk?

The concept of risk and risk assessment has a long history.

2400 years ago the Athenians offered their capacity of

assessing risks before making decisions: We Athenians take our decisions in policy and submit them to

proper discussion. The worst thing is to rush into action before

consequences have been properly debated. This is an important

aspect in which we differ from other people.

We are capable of taking risks while assessing them beforehand. Others are brave out of ignorance; and when they stop to think, they

begin to fear. But the man who can most truly be accounted brave is

he who best knows of what is sweet in life and what is terrible, and

he then goes out undeterred to meet what is to come.

(Pericles Funeral Oration in Thurcydidas History of the

Peloponnesian War)

7. 3 Project Management

What is Risk?

History is full of miscalculated risks:

December 23-29 1914 Sarkam Operation

* Nearly 60.000 troops dead in seven days due to severe weather

conditions

December 18 1941 Operation Barbarossa

* During 1941-1944 nearly %95 of the German forces were lost. 3.9

million troops of axis forces were involved

And well calculated risks:

June 6 1944 D-Day Normandy Landings

April 11-17 1970 Apollo 13

* Oxygen tank explosion and safe return to earth

Aybek Korugan - Boazii University


What is Risk?

Point of Truth

The risks taken and not taken in Hollywood:

The Blair Witch Project: C 60.000; R 140 mil.

Ishtar: C WarrenBetty+Dustin Hofman + 55 mil,

R 14 mil.

American Graffiti: C


What is Risk?

Risk is a common term, heavily used in daily language. But,

issues/concepts reflected may differ: May refer to vulnerability/exposure;

May refer to likelihood of occurrence of the event;

May refer to the consequences of the event;

May refer to a measure combining the notions above.

Units deployed to measure Risk may also differ: Number of fatalities per year (fatalities/year);

Infrastructure damage (down time);

Business losses pear year ($/year);

Combination of the above.


By Hertz & Thomas

Risk means both uncertainty and the result of uncertainty. That is, risk refers to a lack of predictability about structure,

outcomes or consequences in a decision or planning

situation. Risk is therefore related to concepts of

change such as the probability of loss or the probability

of ruin.

A Definition of Risk


What is Risk?: Pascals Wager

Blaise Pascal (June 19, 1623, Clermont-Ferrand August 19, 1662, Paris)

The philosophy uses the following logic (excerpts from Penses, part III, note 233):

1. "God is, or He is not"

2. A game is being played... where heads or tails will turn up.

3. According to reason, you can defend neither of the propositions.

4. You must wager. It is not optional.

5. Let us weigh the gain and the loss in wagering that god is. Let us estimate these

two chances. If you gain, you gain all; if you lose, you lose nothing.

6. Wager, then, without hesitation that He is. (...) There is here an infinity of an

infinitely happy life to gain, a chance of gain against a finite number of chances

of loss, and what you stake is finite. And so our proposition is of infinite force,

when there is the finite to stake in a game where there are equal risks of gain and

of loss, and the infinite to gain.


A Definition of Risk

Lack of predictability about the structure:

Full knowledge => deterministic structure

=> Predictability without errors => certainty.

Thus, lack of predictability is due to

lack of knowledge.


What is Risk?

Lack of predictability about the outcomes

(consequences):

Predictions to the future are done with

information from the past and

the knowledge of present.

Finite information and finite knowledge results in prediction

errors.


What is Risk?

Risk is encountered in decision or planning situations.

(Planning is full of decisions.)

Due to lack of knowledge about the structure, the outcome

of a decision might be unpleasant.

Decisions are about change (whether they mandate or avoid

them.)

Change is not always towards a good outcome.


Risk is encountered when a decision is made at present time and

state of a system with present knowledge towards the desired future

state(s).

Present State(s) Future State(s) desirable

undesirable Risk

Lack of Information/Knowledge

Decision


Unforeseen Events

The definition is missing the impact of the

uncontrollable phenomena surrounding the system

where the risk prediction is made.

Uncontrollable events may alter the decision made for

an isolated environment.

When predictions are made the randomness resulting

from the environment has to be taken into account.


Alternative definitions of risk

Risk is uncertainty about and severity of the consequence of an activity with respect to something that humans value (Aven and Renn 2008);

Risk is equal to the combination of events/consequences and associated uncertainties (Aven 2007);

Risk is an uncertain consequence of an event or an activity with respect to something that humans value (Renn 2005);

Risk equals the expected disutility (Campbell 2005);

Risk is a situation or event where something of human value is at stake and where the outcome is uncertain (Rossa 2003);

Risk is the combination of probability of an event and its consequences (ISO 2002);

Risk refers to uncertainty of outcome, of actions and events (Cabinet Office, UK 2002);

Risk is the probability of an adverse outcome (Graham 1995).


What is Risk?

Systems are not isolated. They are connected to each

other. The outcome of a system may effect or even

define the outcome of another system.

Prediction of risk is not an easy task. It requires a broad

understanding of interconnected systems.


What is Risk?

Without a structured approach to dealing with risk (without odds and

probabilities), the natural way of dealing with risk is to appeal to gods or to

fate; risk is wholly a matter of gut.

A key factor in distinguishing modern age is the mastery of risk

The notion that man are not passive before nature;

By understanding, measuring and managing risk, risk-taking has been

converted into one of the prime catalysts that drives modern society;

facilitating economic growth, technological progress and improved quality of

life;

The nature of risk and the art and science of choice lie at the core of modern

market economy;

In any risky environment, negative outcomes from time to time cannot be

avoided; but what is more important from the societys perspective is the long term outlook.


The Intellectual Evolution of Risk Assessment

Fortune tellers: Reading: the stars, coffee residue,

behavior of natural elements etc. Consulting the

elderly.

Renaissance and Enlightenment: Probability Theory

Cardano => Calculating Odds

Pascal & Fermat => Theory of Probability.

Forecasts and decisions with the help of numbers.



=>Trade-off between risk and reward became the

centerpiece of the decision-making process.

(Still not the case for drivers in Istanbul though. Heavy

reliance on mystic elements. Excessive risks taken for

marginal gains.)

1703: Interaction btw. Leibniz and Jakob Bernoulli

result: Law of Large Numbers &

Statistical Inference



Marine Insurance flourishes in 1730s

De Moivr: Structure of Normal Distribution

standard deviation, measurement of risk.

Daniel Bernoulli. Definition of expected utility.

the utility resulting from any small increase in wealth will be inversely proportionate to the quantity of goods

previously possessed.

=> risk aversion and the ground works of portfolio

management.



1754 Bayes Theorem:

better-informed decisions by mathematically blending

new info into old.

Almost all risk management tools in use are discovered

between 1654-1754 except for

1875 Francis Galton: discovery of regression to the

mean

1952 Harry Markowitz: Application of quantified

diversification to portfolio management.


Managing Risk

Risk: The exposure to the chance of loss; the combination of the likelihood of an undesirable event (hazard) occurring and the significance (level) of the consequence of the event occurring.

[Risk Level = Probability X Level of Damage]

Project Risk Management A proactive attempt to recognize and manage internal events and

external threats that affect the likelihood of a projects success. It aims at,

* identifying as many risks as possible (what can go wrong);

* minimizing their impacts (what can be done about the events before or

during the project);

* providing contingency funds to cover risk events that actually materialize.


Technical New technology or materials. Test failures.

Enviromental Unforeseen weather/natural conditions.

Operational New systems and procedures. Training needs.

Cultural Established customs and beliefs.

Financial Freeze on capital, bankruptcy of stakeholders. Currency

fluctuations.

Legal Local laws. Lack of clarity of contract.

Commercial Change in market conditions or customers.

Resource Shortage of staff, operatives, materials.

Economic Slow-down in economy, change in prices.

Political Change of government or government policy.

Project Risks


Risk Management Dilemma


Risk Management Dilemma

The chances of an undesirable event occurring are greatest in the concept, design, planning and startup phases of a project.

* Unproven technology (design or technology selection errors);

* System complexity

* Integration requirements

* Physical or chemical requirements

* Modeling assumptions and estimation errors

* Interfacing with internal and external systems

* Operating environment

However, the magnitude of their negative impact is less if the event occurs earlier rather than later; The opportunity for minimizing the impact or working around a potential risk exists.

As the project progresses, the chances of undesirable events occurring decrease, but their potential magnitude increases rapidly.

Reassessment of needs, revitalized competition, newly emerging technologies, design changes after a prototype has been made.


Risk Preferences

Individuals attitude to take Risks.

Risk Averse Disinclined (afraid) to take Risks Preferring a certain environment having a specified damage level, to a

risky environment having the same risk level.

Risk Prone Inclined (seeking) to take Risks Preferring a risky environment having a specified risk level to a

certainty environment having the same damage level.

People may exhibit risk prone or risk averse behaviour depending on the circumstances. Buying insurance (risk averse behaviuor);

Buying lottery tickets; extreme sports (risk prone behaviour).


Risk Perception

Risk is essentially a cognitive phenomenon.

Social, cultural & professional bias may have considerable effects on groups or individuals perception of risk.

The current emphasis on security, ecological and IT risks could make excellent research material for an anthropologist in 200 years.

People respond to hazards that they perceive. If perceptions are faulty, public or organizational policy will be misdirected.

Laymen s perceptions of risk are more qualitative than experts.

Individuals have great difficulty in interpreting low probabilities in making their decisions;

There is evidence that people may not even want data on the

likelihood of an event occurring.


Risk Perception

Perceived risk is biased by imaginability & memorability of hazard. Peoples perception of risks are influenced by whether they are told of

likelihood and/or consequences of risk events or whether they personally

experience those disasters.

If risk event has not materialized yet, they underestimate; if an undesirable realization has occurred they tend to overestimate.

Such behavior is also supported by Inference Theory of Probability. Consider an urn populated mostly by (unknown number of) black balls and a

few (less than 0.1%) red balls;

Conduct a series of trials where a single ball is drawn randomly, its color noted and the ball is replaced;

Most trials should end up with black balls (representing non-occurance of hazards) and each additional black ball drawn does not affect the probability

estimate for the next ball drawn being black (thus taken for granted);

Whenever a red ball is drawn (representing the occurance of an hazard), the probability estimate for the next ball drawn being red increases dramatically.


Risk Perception

Availability Heuristic and it will happen/it wont happen to me belief is what guides individuals recognition of risk.

Many people buy their first set of battery cables only after their car doesnt start and has to be towed.

Most homeowners purchase earthquake insurance only after experiencing a quake.

Many drivers still refuse to wear seatbelts. When asked why, they responded, I wont have an accident.

Past events always look less random then they actually were. This is called Hindsight Bias.

After the fact, people always find logical and well fitting arguments

to explain why a past event was not as random (or even inevitable).


Risk Perception

Low probability / High consequence events are often perceived

as impossible until they happen; and then are seen as inevitable In many cases, these events are ignored because of the underlying

assumptions we have made about our environment;

Some were never envisioned (Bhopal/ World Trade Center);

Some were envisioned but thought to be extremely unlikely (New Orleans Flooding);

Some were thought likely to occur but would only have minor or controllable consequences (Exxon Valdez).

Had they been expected, they would not have caused the

damage they did. Strange to see an event happening and causing great damage precisely

because it was not supposed to happen.


Perception of Risk in Catastrophic Events

Perceived

risk level

Real risk

level

Time Realization of the

catastrophic event


Qualitative Factors in Risk Perception

Risk assumed voluntarily Risk assumed involuntarily

Risk of death delayed Risk of death immediate

Risk certain not to be fatal Risk certain to be fatal

Risk level of exposure known Risk level of exposure unknown

Personal risk can be controlled Personal risk cannot be controlled

Risk is old and familiar Risk is new and unfamiliar

Risk is chronic (one at a time) Risk is catastrophic (many deaths)

Risk is common Risk is dreaded

Rist to beneficiaries Risk to non-beneficiaries

Risks to unidentified persons Risks to identified individuals

Risks from open activities Risks from secret activities

Source: Baruch Fischhoff


Qualitative Factors in Risk Perception

Old/Familiar vs New/Unfamiliar: Traditional food, cosmic radiation versus new food additives or radiation

from nuclear industry.

Chronic/Catastrophic: Concentrated obvious risks (major industrial accidents) versus diffuse risks (such as

equal number of accidents scattered around as a result of a number of smaller scale industrial accidents).

Beneficiaries/Non-beneficiaries: Recipients of radio-therapy versus public exposed to emission from nuclear

power stations.

Unidentified/Identified persons: Those referred in traffic accident statistics versus specific persons trapped in a

sinking ship.

Smoking Cigarettes: Risk is voluntary, old/familiar, delayed; risk level is known.

Eating Meat (undertaking the risk of mad-cow disease): Risk is involuntary, fatal, new and unknown; level of

risk is unknown.

Traveling by Car: Risk is chronic, controllable (to some degree, by safe driving ), usually not fatal.

Traveling by Plane: Risk is catastrophic, uncontrollable, fatal.

Catching a Disease from Banknotes: Risk is voluntary (unintentional), old, known, delayed, not fatal.

Cathing Antrax from Letters: Risk is intentional, new, unknown, unfamiliar, fatal.

An individual may avoid eating beef because of mad-cow disease risks, yet smoke many cigarettes per day

or drink considerable alcohol before driving.

An individuals attitude and behaviour towards a risk may vary over time, even though objective conditions

may not have changed.



Risk Communication Issues

Perceived accuracy of a Risk Communication is hampered by: Real or perceived advocacy; Reputation for deceit, misrepresentation, coercion; Self serving framing of messages; Contradictory messages from other sources; Actual or perceived professional incompetence and impropriety.

It is not uncommon for the public to hear one expert say that there is nothing to worry about regarding a particular risk, while at the same time learning from another expert that this risk should be on your radar screen.

There may be many different reactions to these conflicting reports. One layperson may decide that they cannot rely on the judgment of any expert. Another individual may decide to focus on the expert supporting his or her own view of the risk.


Risk Communication Issues

Other Issues: People simplify; Once peoples minds are made up, it is difficult to change them; People remember what they see; People cannot detect incomplete information nor inconsistencies; People are highly influenced by the behavior and actions of others in

their immediate neighborhood; People may disagree more about what the risk is (impact) than about

how large it is (probability); The confusion in nomenclature creates fertile ground for ambiguity &

confusion in risk communication.

A problematic Risk Communication issue: Oversensitive/over-regulated Automated Alarm Systems.

Auto alarms (do they really serve a purpose or are they mostly annoyance?) Alarms in hospital operating rooms; Role of the automated alarm system in the Deepwater Horizon disaster.


Some Risk Perception Communication Cases From Everyday Life

Misperceptions regarding hazard likelihood, hazard consequence;

inadequate safety measures; unsafe practices; unsuccessfull risk

communication.

All the cases described below appeared in the media as unfortunate

accidents. Actually, any harm (let alone death) could easily have been

avoided with a little serious consideration of the risks involved.

(At an engagement ceromony in Dudullu) A balkony collapsed when 50 people tried to squeeze

themselves to the small space. Unfortunately many died in the ensuing accidental balcony

collapse. Hazard likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication

(Yalkavak - Bodrum) A young man spreyed insect sprey to his bed right before he lied down

and slept. Unfortunately, he was accidentally and fatally effected by the chemical and died. Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication

(Ali Kirca - at his home in Kurueme) Mr. Krca walked into the void while attepting to step

into the elevetor (which was at another floor). Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication


Some Risk Perception Communication Cases From Everyday Life

(Gztepe - Istanbul) Two nightwachmen operate the turning chairs at the

funfair and board them. Then, since there is nobody else to stop the system,

they remain trapped in the chairs circling at high speed till the next morning.

Unfortunately they both died. Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication

(Beyolu - Istanbul) Maintenance crews were replacing a large (180 x 180

cm) glass panel on an 8th floor window in a building on the crowded Istiklal

Caddesi. They accidentally droped the panel which duely fell down,

crashing on the pavement and seriously injuring one pedestrian. Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication

(Bahelievler - Istanbul) Cleaning crews were cleaning upper storey

windows of a 10 storey building with the aid of a mobile crane. The crew

decided to move the crane to a new positon for further window cleaning,

without lowering the extended ladder (the formal procedure strictly requires

the crane to be immobilized and stabilized on extended legs before the

ladder on which the crew nest resides can be raised). The crane accidentally

tipped over, the extended ladder crashing a passenger car and seriously

injuring wounding two persons. Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication


What is Risk Management

Risk Management: The making of public and private decisions regarding protective policies and actions that reduce the threat to life, property and the environment posed by hazards.

Risk Management is a set of integrated and coordinated proactive attempts in an organization to recognize and manage internal events and external threats that affect occurrence likelihood, impact level and recovery from technological, natural or any other hazards. It aims at, Identifying as many risks as possible (what can go wrong); Minimizing their impacts; Providing contingency funds, response and recovery plans to cover risk

events that actually materialize.

It is imperative that top management understand and comprehend the meaning of risk management.



What is Risk Management

It is the ability to predict what may happen in the future, assess associated risks & to choose among alternatives in a way to minimize potential loss.

It is the process of identifying and prioritizing risks, and then

of developing strategies to reduce risks and deal with

consequences

Few risks are straightforward. Most of the time there are competing risks to balance, trade-offs to

make.

Failure to do Risk Management properly could result in

recognizing and addressing only a small fraction of the many

risks affecting an organization.



Managing Risk

Planning for project risks formally addresses identification,

analysis & assessment of potential trouble spots before

implementing a project.

It prepares the PM to take risk when a time, cost and/or

technical advantage is possible.

It is a Proactive rather than Reactive approach;

Reduces surprises and negative consequences;

Prepares the PM to take advantage of appropriate risks;

Provides better control over the future;

Improves chances of reaching project performance objectives within budget and on time.


Role of Risk Manager

Setting policy and strategy for risk management;

Primary champion of risk management at strategic &

operational level;

Building a risk aware culture within the organisation including

appropriate education;

Establishing internal risk policy & structures for business units;

Designing and reviewing processes for risk management;

Co-ordinating the various functional activities which advise on

risk management issues within the organisation;

Developing risk response processes, including contingency and

business continuity programmes;

Preparing reports on risk for the board and the stakeholders.



Managing Risk

Major components of Risk Management Process: Identifying Sources of Risk;

Analyzing and Assessing Risk;

Risk Response Development;

Contingency Planning & Contingency Reserves;

Risk Response Control.


Step 1: Risk Identification Analyze the environment to identify sources of risk

Step 2: Risk Assessment

Assess risks in terms of,

Severity of impact; Likelihood of hazard occurrence; Controllability.

Step 3: Risk Response Development

Develop strategy to reduce occurance likelihood;

Develop strategy to reduce impact;

Develop contingency plans.

Step 4: Risk Response Control & Impl.

Implement risk strategy; Monitor & adjust plans for new risks; Trainings and Exercises.

New risks

New risks

New risks

Known risks

Risk assessment

Risk management plan

The Risk Management Process


Risk identification begins with a list of all areas that may cause project delays or failure & their respective outcomes.

Brainstorming and Risk Profiling is the initial step;

Things that have not been done before are potential trouble spots;

Risk sources depending on specific type of issue at hand: * Construction; Design; Software; Transportation.

Risk sources orginitaing from the organization: * Organizational size, structure and culture, resources, financial structure.

Risk Sources external to the organization: * Inflation; market acceptance; exchange rates; government regulations.

It is better to start with risks associated with the whole project;

Once macro risks are identified, specific areas can be checked.

WBS is an effective tool in identifying specific, technical risks associated with tasks and deliverables.

Managing Risk Step 1: Identifying Sources of Risk


Risk Profiling is a good tool to help identify risks. It is a list of questions addressing traditional areas of uncertainty; Good risk profiles are tailored to the type of work/environment under consideration;

Questions are usually developed from previous, similar experiences; They should recognize/focus on strengths & weaknesses of the organization They address both technical and management risk; Some management consulting firms provide/sell risk profiles.

Historical Records are also useful in risk identification.

Simulating all business processes, procedures is a good practice.

Risk Identification process should not be limited to a few persons. Input from employees, customers, sponsors, subcontractors, vendors should

be solicitude through interviews.

Risk Identification process should be repeated at regular intervals. The risk landscape constantly evolves and, with it, the risks.

Identifying Sources of Risk


Identifying Sources of Risk Partial Risk Profile for Product Development Project


Identifying Sources of Risk Risk Breakdown Structure


Identifying Sources of Risk Roots of Risk Propensity in Large & Complex Systems

One common mistake that is made early in the risk identification process is

to focus on objectives and not on the events that could produce

consequences. (e.g. failing to meet schedule is a consequence while cause s

can be, poor estimates, adverse weather, shipping delays, etc.).

Concentrate on actual events

Activities that are performed in the system may be inherently risky (e.g.

mining, hazardous material transportation, air transportation);

The technology used may have inherent risks, or exacerbate risk in the

system (e.g. heavy equipment);

Physical environment may be inherently risky, Susceptibility to natural disasters;

Proximity to and nature of populated areas and other businesses;

Supporting infrastructure (power, telecommunications, water, transportation)


The product or service provided may have inherent risks, Potentially dangerous materials, and products or services;

Demographics of customers;

Liability for defective services and products;

Quality issues.

Human & organizational errors can be propagated by organizations &

individuals executing/coordinating tasks, or using technology.

Organizational resources/policies may be inadequate or out of phase. Financial, manpower, equipment, management and technology resources;

Investments, marketing, strategies, suppliers, customers/partners/markets.



Identifying Sources of Risk Roots of Risk Propensity in Large & Complex Systems

Communications channels may be inadequate or prone to failure. Availability level of formal and informal channels of communication;

Procedures not clearly established nor well understood;

Ability to receive warning signals;

Receptivity and ability to properly interpret warning signals.

Organizational structures may enable risky practices to occur, or may encourage workers to pursue risky courses of action. For example:

Lack of formal safety reporting systems or departments in organizations;

Organizational standards that are impossible to meet without taking risks.

Organizational cultures may support/encourage risk taking, or fail to encourage risk aversion. For example:

Cultures that encourage the belief it cant happen here, Rewarding people for taking warranted/unwarranted risks.


At an individual level, informal risk assessments are more-or-less continous cognitive process.

When crossing the road;

Purchasing goods;

Deciding on mode of transport;

Engaging in social interaction;

Gauging job prospects.

The aim of (formal) risk assessment is to provide information on which decisions may be made about proposed actions, the

adequacy of risk controls and what improvements might be

required.

Not all risks deserve attention.

Managing Risk Step 2: Analyzing and Assessing Risk


Risk Assessment focuses on selected potential foreseen risk events exhibiting high probability of occurrence and/or having a

high consequence of loss.

Typically, such risk assessments focus on scenarios deemed to be credible and significant by experts.

Risk assessment for an off-shore oil and gas installation may focus on varios scenarios involving bad weather conditions, ship collision, riser

blow-out and helicopter crash.

Risk assesment for an investment bank may focus on rouge trading, major bad debts and multiple loss of key executives in an air crash.

One drawback: experts following a rationalistic approach may not give sufficient emphasis to all pertinent routes to causes of disaster.

* Three Mile Island, World Trade Center cases.

Analyzing and Assessing Risk


Risk Assessment is Multi-disciplinary in nature To Determine: We Need:

Vulnerability Physical Scientists (seismology, geology, hydrology)

Occurance Probability Systems Engineers, Modelers Forecasting

Built Environment Engineers (Civil, materials, environmental, transportation) Damage Potential

Health/ Social Impact Health & Social Scientists Potential (M.D., public health, sociologists)

Economic/Financial Economists Impact Potential



Two broad approaches to Risk Assessment Heuristic/Rule of Thumb approach, being in general, qualitative &

subjective in nature, relying on individuals collective judgment. * Expert opinion or gut feeling estimates are the most used, but they carry

serious errors depending on the skill of the persons making the judgment.

* Wishful thinking in forecasting erros (if forecasts involve potential personal

gain) may be a problem.

Scientific approach employing quantitative modeling and generally requiring formal training in mathematics.

* Quantitative methods, usually require serious data collection and a more

detailed analysis of the facts, while being limited in scope;

* So, they have low acceptance levels by practicing managers.



Main Risk Assessment Techniques Semi-Quantitative Approaches:

* Risk Assessment Charts;

* P-I Tables;

* Risk Assessment Forms & Matrices;

* Failure Modes and Effect Analysis (FMEA);

* Risk Scoring.

Quantitative Modeling and Analysis: * Statistical Analysis;

* Dynamic (Simulation) Analysis;

* Decision Trees, Event Trees, Fault Trees.

Scenario Analysis;

Choice depends on risk source, possible outcomes & impacts, and

managements attitude towards risk assessment.



Analyzing and Assessing Risk Risk Assessment Charts

A Simple Risk Assessment Chart

Risk 1 above

Risk 2 above

Risk 3 above

What is the Probability of the

above risks occurring?

0 to 1.0

None - Very High

What is the Impact if these

risks do occur?

0 to 1.0

None - Very High

Risk 1 above

Risk 2 above

Risk 3 above

3.

2.

1.

What are the three major risks for this environment?

Resources Available?


A qualitative assessment of the probability (P) of a hazard & the impacts (I) it would produce are made by assigning descriptions

to the probability & impact of each risk, by assigning

descriptions to the magnitutes of these probabilities & impacts.

The assessor is asked to describe the probability and impact of each risk

by selecting from a predetermined set of phrases

* (such as nil, very low, low, medium, high, very high);

A range of values is assigned to each phrase in order to maintain

consistency between the estimates of each risk.

* These values generally are not evenly spaced (there is a mulpitle difference

between each case (3-10);

* Usually the same multiple is applied to the probability and impact, so that

severity scores will be more meaningful;

* The value ranges can be selected to match the specific risk environment.

Analyzing and Assessing Risk P-I Tables


A table examplifying value ranges that could be associated with qualitative descriptions of the probabilities and impacts in a particular risk environment

Associated with the successful completion of a new product development project.

When the definition of each phrase is made specific to a particular risk environment, it becomes difficult to perform a combined analysis of the risks from multiple risk environments that the organization might face.

Catagory Probability (%) Cost Quality

Very high 10-50 > 1000 Failure to meet acceptance criteria

High 5-10 300-1000 Failure to meet >1 important spec.

Medium 2-5 100-300 Failure to meet an important spec.

Low 1-2 20-100 Failure to meet > 1 minor spec.

Very low < 1 < 20 Failure to meet a minor spec.



Value ranges can also be selected to reflect the potential effects of various hazards on the whole organization.

A table examplifying impact descriptions more fitting to the potential effects of various hazards on the organization as a

whole.

Catagory Quality Catastrophic Jeopardises the existance of the organization.

Major No longer possible to achieve strategic objectives.

Moderate Reduces the ability to reach strategic objectives.

Minor Some short term/tactical disruptions but little effect on strategic objectives.

Insignificant No impact on tactical operations nor on strategic ojectives.




An example description of Likelihoods in a P-I Table.



An example description of Consequence Levels

in a P-I Table.


Various types of impacts of each single risk can be individually defined and quantified.



A P-I Table offers a quick way to visualise the relative importance of all identified risks that pertain to a risk environment.

In the following table, all risks are plotted allowing easy identification of the most threatening risks as well as providing a general picture of the overall risks.

* Risk numbers 10, 2, 12, 8 are the most thretening in this example.

Combined Impact for Identified Risks

Imp

act

V. High 6 10, 2

High 8 12

Medium 5 4, 9 1

Low

V. Low 11 7 3

V. Low Low Medium High V. High

Probability



P-I scores can be used to rank identified risks, by assigning a scaling factor (such as 1 5) to phrases used to describe each type of probability & impact.

In this type of scoring, the base measure is probability x impact;

However, since the catagorization resembles a log scale, for consistancy, severity can be defined as S = P+I (which leaves severity on a log scale also).

Imp

act

V. High 6 7 8 9 10

High 5 6 7 8 9

Medium 4 5 6 7 8

Low 3 4 5 6 7

V. Low 2 3 4 5 6

V. Low Low Medium High V. High

Probability

High severity

Medium severity

Low severity



Rough estimates are inputted on Risk Assessment Forms/Matrices

A Risk Assessment Form

Risk Event Likelihood Impact Detect. Diff. When

Interface Problems 4 4 4 Conversion

System Freezing 2 5 5 Start-up

User Backlash 4 3 3 Post Installation

Hardware Malfunction 1 5 5 Installation

5

4 B I

3

2 F

1 H

1 2 3 4 5

I: Interface Prob

S: System Freeze

B: User Backlash

H: Hardware Malf.

Analyzing and Assessing Risk Risk Assessment Forms and Matrices

Some types of Risk Assessment

Matrices used to provide a basis

for prioritizing which risks to

address, resemble P-I tables.


Analyzing and Assessing Risk Risk Assessment/Severity Matrices

Some types of Risk Severity Matrices used to provide a basis

for prioritizing which risks to address, resemble P-I tables.


Analyzing and Assessing Risk Failure Mode and Effects Analysis (FMEA)

Each risk is assessed in term of the score,

Risk Value = Impact x Probability x Detection

Each of the three dimensions is rated along a 5 point scale.

Detection Score (ability to discern that the risk event is imminent) :

1 (spoting very easy) for anybody being able to spot the risk coming;

5 (spoting very hard) discovering after the fact.

Similar anchored scales would be applied to impact severity and

occurrence probability.

The weighting of the risks would be based on their overall score.

A broad range of numerical scores: 1 125


Analyzing and Assessing Risk Risk Scoring

Each risk is assessed in term of the score, Risk Value = Impact x Probability x Exposure

Impact: Potential consequences of the hazard as presently controlled;

Probability: Probability that the hazard will result in an accident;

Exposure: Typical frequency and duration of peoples exposure to the hazard.

Each of the three dimensions is rated along a 5 point scale.

1- Minor Injury

2- Serious Injury

3- Major Injury

4- Multiple casualties

5- At least one fatality Imp

act

Lev

el

1- Very unlikely

2- Unlikely

3- Likely

4- Very likely

5- Inevitable (imminent) Pro

ba

bil

ity

1- Rare/never

2- Infrequent (1-3 month)

3- Frequent (weekly)

4- High (daily)

5- Constant

Ex

po

sure

Typical Ratings for Impact, Probability and Exposure


Scenario Analysis is a commonly used technique for analyzing risk. Each risk is investigated in terms of:

The undesirable event;

All the outcomes of the events occurrence;

The magnitude or severity of the events impact;

Chances/probability of the event happening;

When the event might occur;

Interaction with and/or influence on other undesirable events.



10 Commandments of Risk Assessment & Analysis Do your homework with literature, experts and users.

Let the problem drive the analysis;

Make the analysis as simple as possible, but not simpler.

Identify all significant assumptions.

Be explicit about decision criteria and policy strategies.

Be explicit about uncertainties.

Perform systematic sensitivity analysis.

Iteratively refine the problem statement and the analysis.

Document clearly and completely.

Expose to peer review.



The more effort given to risk response planning before an incident or crisis occurs, the lesser are the surprises. Stress

and confusion when the risk event occurs is reduced.

Reducing Risk: Reducing likelihood and/or impact of a

hazard. Mitigating Risk: Modifying levels/likelihoods of the impact levels.

Preventing Risk: Changing the probability of occurrence of the hazard.

Avoiding Risk: Affecting environment/action change to eliminate risk. * Use a tried and tested technology instead of a new one;

* Change the country location of a factory to avoid political instability;

* Scrap the project under consideration.

Modifying Objectives: Reduce or raise performance targets, change tradeoffs.

Managing Risk Step 3: Risk Response Development


Transferring Risk: Passing the risk to another party, without changing it; usually results in paying a premium for this exemption.

Fixed price contracts;

Insurance;

Penalty clauses for exceeding agreed schedules;

Performance guarantee of product or service.

Sharing Risk: Allocates proportions of risk to different parties Leads to innovative continuous improvement procedures.

A primary driving principle regarding either risk transfer or risk sharing: The more the ownership of risks are allocated to those who control them the

better, up to the point where the owner could not reasonably bear the impact

where others can. * How big is the risk?

* What are the risk drivers?

* Who is in control of the risk drivers? Who has experience to control them?

* Who can absorb the risk impacts?

Risk Response Development


Retaining Risk: It may not be feasible to transfer or reduce risk; so, a conscious decision is made to retain the risk of an hazard.

Contingency Planing: Set aside resources to provide reactive capability.

Deferment: Delay (defer) choices and commitment.

Acceptance: Accept risk exposure, but do nothing about it.

Monitoring: Collect more data about the probabilities of occurrence,

anticipated impacts, in order to better understand the risk.

Controlling: Applies to high probability, low impact risks normally

associated with repetitive actions, aiming better management through

better internal processes.

Remaining unaware: Ignore the possibility of risk exposure and take no

action.

Increasing: Judging the present course of action as overly cautious and

taking actions to increase the probability of hazard occurance or impact.



Contingency Planning: Planning for an organization's reaction

to potential hazards to ensure the protection of life, safety, health

and the environment, to limit and contain damage to facilities

and equipment, to stabilize operational service and public image

impacts and to manage communications about the event.

Contingency Plan is an alternative plan to be used if a possible

foreseen hazard becomes a reality. It identifies preventive

actions that will mitigate the negative impacts of the hazard. It

includes: Emergency response plan;

Incident management plan;

Crisis communications plan;

Crisis management team plan.

Risk Response Development Contingency Planning


Contingency Plans should include cost estimates, as well as identifying and establishing the availability of the necessary

funding, equipment and materials.

Contingency Plans should be transparent and conditions for

activating them should be determined and clearly documented. The plan and related documentation should be communicated to team

members to minimize surprise and resistance.

All parties effected should agree to the plan and have authority to make

commitments.

Risk events arising from sources external to the project are

more difficult to foresee & tend to cause more disruption. Contingency plans responding to external events may involve new team

players, unfamiliar to the project and having conflicting goals.

Risk Response Development Contingency Planning


Contingency funds are established to cover project errors,

omissions, & uncertainties that may materialize as the project

progresses.

Owners are often reluctant to set up contingency funds that

seem to imply that the project plan might be a poor one.

Budget Reserves are allocated to specific segments or deliverables;

the amount is determined by costing out the accepted contingency plan.

Management Reserves are allocated to major, unforeseen, potential risk associated with the total project.

Time Buffers: Amounts of time used to compensate for unplanned delays in the project schedule.

Risk Response Development Contingency Reserves


TABLE 7.1

Risk Response Development Contingency Fund Estimation

The numbers are in $1,000


First step: Identify whether to reduce, retain, transfer or share risk;

Second step: Set up contingency plans in case risk event still occurs;

Third step: Determine what would trigger implementation of the contingency plan.

Risk Response Development Example

Risk Event Response

Type Response Description

Contingency Plan

Trigger

Interface Problems

Reduce Experimenting with a prototype of the system

Work around until help comes

Not solved within 24 hrs

System Freezing

Reduce Experimenting with a prototype of the system

Reinstall OS; call expert

Still frozen after 1 hour

User Backlash

Reduce Well designed & flexible time training sessions

Increase staff support

Call from top management

Hardware Malfunction

Transfer Reliable supplier with a strong warranty program

Order different brand

Replacement does not work

Risk Response Matrix


Automated Processing/Packaging Machine Procurement

Project: Risk Assessment and Response Matrix

Risk Event Chance Severity Detect Diffty

When Accept/Reduce Share/Transfer

Contingency Plan

Trigger Event

Late Delivery Low Medium Low Pre-

Instltn

Transfer/Accept:

Better contracts with penalty clauses; better

customs agencies

Having old machine on standby for

backup

Delay exceeding 5

days

Operators Adaptation Problems

Low Low Medium Post-

Instltn

Reduce:

On site training before delivery; Better training

procedures

Having experts flown in to

support local team

Prod rate 10% below

planned after 5 days

Machine not Confirming to Specifications

Low High Medium Post-

Instltn

Reduce:

Wide communication with order;Pre delivery

on site inspection

Having old machine on standby for

backup

Acceptance tests

negative

Financial Problems

Low High Low Order

Placmnt

Reduce: Influence top mngmt priorities; obtain self

financing from manufacturer

Having a leasing plan

ready

Order delayed by 5 days because of financing

Unresolved Installation Problems

Medium Medium Medium Pre-

Instltn

Reduce: Wide communication

with order

Have backup location;Have

old machine on standby;

Acceptance tests

negative


Schedule Risks Use of Slack: Use of slack moves that activity and all successors

nearer to their late start; managing slack can be an excellent

method for reducing schedule risk.

Imposed Duration Dates: Most project have imposed duration dates, which is frequently a top-down decision that does not

include bottom-up planning and often understates the normal

time required to complete the project.

Compression of Project Schedules: It is accomplished by shortening critical activities. This decreases total slack and more

paths become critical or near critical. The more critical activities there are, the higher the risk of delaying

project completion.



Cost Risks: Some management decisions increase cost risks. Time/Cost Dependency: In most activities time and cost do not occur

independently; if one increases the other is also expected to increase.

Cash Flow Decisions: Financial analysts prefer delaying activities to take advantage of time value of the associated expenditure. The increased risk of reducing slack is sometimes ignored or underestimated.

Funding Risks: Changes in funding for the project can seriously affect the likelihood of implementation or successful completion of a project.

Price Protection Risks: Long duration projects need some contingency for price hikes (using one lump sum to cover all price risks should be avoided).

Final Cost Forecasts: Most frequent & dangerous is comparing budget versus actual cost at a

particular point in time, & projecting it to project completion.

A more accurate and reliable approach is the Earned Value concept.



Technical Risks:

Often associated with new, untried, innovative processes or products.

Having comprehensive back-up plans is one option.

In addition, PMs need to develop methods to quickly assess whether technical uncertainties can be resolved.

Sophisticated CAD programs may help resolve design problems;

One should identify high risk technical areas, then build models or design experiments to resolve the risk as quickly as possible.

Usually, the owner & PM together make the decisions concerning technical risk.



Risk Response Development Documentation - Risk Registers

A Risk Register is a document or database that lists each risk pertaining to a project or organization, along with the following information that is useful

for the management of those risks: Date the register was last modified;

Name and description of the risk;

Description of why it would occur;

Description of factors that would increase or decrease the probability of occurance or size of

impact;

Semi-quantitative estimates of its probability & potential impact (e.g. P-I scores);

Name of owner of the risk (the person who will be responsible for monitoring the risk and

effecting any risk reduction strategies that have been agreed on);

Details of risk reduction strategies that it is agreed to be taken;

Reduced impact and/or probabilty of the risk, given the above agreed risk reduction

strategies have been taken;

Action window: period during which risk reduction strategies must be put in place;

Contingency plans (short description, person responsible, triggers, referenrce to details);

Description of secondary risks that may arise as a result of adopting risk reduction strategies.


Risk Response Control

Risk control

* Execution of the risk response strategy

* Monitoring of triggering events

* Initiating contingency plans

* Watching for new risks

Establishing a Change Management System

* Monitoring, tracking, and reporting risk

* Fostering an open organization environment

* Repeating risk identification/assessment exercises

* Assigning and documenting responsibility for managing risk

Managing Risk Step 4: Risk Response Control


A key factor in controlling the cost of risks is documenting

responsibility.

If risk management is not formalized, responsibility and

responses to risk will be ignored.

Risk Response Control Responsibility for Project Risks

Risk Assignments

Owner/PM Contractor Shared Inflation Schedule Safety

Natural disasters Cost Innovation

Scope changes

Technical



Change Control Management

Most projects will not exactly materialize as planned; controlling project changes is a major challenge for PM.

Scope changes (design and additions)

Contingency plan executions leading to cost/schedule changes;

Improvements suggested by team members.

Since change is inevitable, a well defined change control process should be set up early in the project planning cycle.

Identify proposed changes;

List expected effects of proposed changes on schedule and budget;

Review, evaluate and approve or disapprove changes formally;

Negotiate and resolve conflicts of change, conditions, and cost;

Communicate changes to parties effected;

Assign responsibility for implementing change;

Track all changes that are to be implemented.


Benefits of a well organized & established change control system:

Inconsequential changes are discouraged by the formal process;

Cost of changes are maintained in a log; accurate estimation of future

project costs is facilitated;

Integrity of the WBS and performance measures are maintained;

Allocation & use of budget & manag reserve funds are tracked;

Responsibility for implementation is clarified;

Effect of changes becomes visible to all parties involved;

Customer inquiries are better responded.

Implementation of change is monitored.

Scope changes will be quickly reflected in baseline and performance

measures.


Change Control Management


Since change is inevitable, a well defined change control process should be set up early in the project

planning cycle.

The Change Control Process

Identify proposed changes.

List expected effects of proposed changes on schedule and budget.

Review, evaluate, and approve or disapprove of changes formally.

Negotiate and resolve conflicts of change, condition, and cost.

Communicate changes to parties affected.

Assign responsibility for implementing change.

Adjust master schedule and budget.

Track all changes that are to be implemented.


Change Management Control


FIGURE 7.10

Change Request Form


FIGURE 7.11

Change Request Log


Managing Risk Handling Randomness in Activity Durations

In order to manage schedule risks, we have to be aware that only in rare cases is the exact duration of a planned activity known in advance. Realistic estimates of activity durations are prerequisites for managing risks, since the process of planning and scheduling a project depends upon time estimates.

Projects have to be planned before they are executed and carry an element of uncertainty and risk regarding the exact duration of activities which is seldom known with certainty

To gain an understanding of how long it will take to perform the activity, it is necessary to construct a frequency distribution.

This information in the frequency distribution can be summarized by two measures:

Center of the distribution, expected value ( )

Spread of the distribution, standard deviation( )


When there is no historical data regarding the random duration of a particular activity, direct estimation of and , based on PMs experience and subjective evaluation, is possible, but is not very reliable.

Instead an indirect estimation, based on an assumed probability distribution of the activity duration in question, is preferred.

It is a universally accepted practice to assume that it has Beta Distribution.

m = dii=1

n

n = 80 /20 = 4;

Duration data, di, of past 20 realizations of a particular activity

d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13 d14 d15 d16 d17 d18 d 19 d 20 4 4 4 3 5 4 4 2 5 4 4 1 4 4 6 4 5 4 5 4


The Expected Value & Standard Deviation of activity duration can be

estimated based on past data.



Extensive research have shown that Beta Distribution almost always

provides a good fit to random activity duration.

For almost all random activity durations associated with real projects,

parameters a1 and a2 can be determined such that a Beta distribution with

these parameters will provide a sufficiently accurate representation of the

randomness involved.

Beta distribution can accomodate data sets that do not fit normal

distribution.

The probability distribution of durations could even be skewed toward the

high or low end of the probability range.

f(x) =xa1-1(1- x)a2 -1

G(a1,a2 ); where, G(a1,a2 ) = x

a1-1(1- x)a2-1 dx

0

1


1.0 0.5

1.0

2.0

1.0 0.5

1.0

2.0

Managing Risk The Beta Distribution

x

f (x)

1.0 0.5

1.0

2.0

x

f (x)

x

f (x)

1.0 0.5

1.0

2.0

x

f (x)

a a a a

a a

a a

a a

a a

a a

a a

a aa a

a a

a a

a a a a

a a


PERT is specifically developed to address uncertainties in activity time estimates.

It assumes the duration of each activity is randomly distributed according to a Beta Distribution , whose parameters are known.

Beta distribution is flexible & can accommodate many different types of empirical data.

With Beta distribution estimation of 3 factors is sufficient to compute, expected value, , and standard deviation, , of the activity duration.

a = An optimistic estimate for the activity duration;

b = A pessimistic estimate for the activity duration;

m = Most likely estimate for the activity duration;

Managing Risk

Project Evaluation &Review Technique (PERT)

m = a+4m+b6

;


a1 and b1 correspond to 5 and 95 percentile points respectively

of the displayed probability distribution;

a2 and b2 correspond to 1 and 99 percentile points respectively

of the displayed probability distribution.

a1 b1 m

b1 - a1 = 3.2 x s

a2 b2 m

b2 - a2 = 6.0 x s

Managing Risk



Once, expected duration of each activity is computed, they are treated like

deterministic parameters & estimates for ES,EF,LS, LF, SL of all activities

are computed as in CPM.

Expected project completion time, TP, is similarly determined.

Variances of activities on the critical path are summed up to give an

estimate for the variance of project duration, P:

Then, the probability distribution of the project duration is assumed to be

normally distributed, and its expected value and variance are deployed to

give reliable probability estimates for completing the project by specified

times, TS.

Managing Risk


TP = miall critical path activities, i

s P2

= s i2

all critical path activities , i


Activity Times and Variances

Activity a m b 2

A 17 29 47 30 25

B 6 12 24 13 9

C 16 19 28 20 4

D 13 16 19 16 1

E 2 5 14 6 4

F 2 5 8 5 1

m = a + 4m + b

6 ;

s

2=

b -a

6

2

TP = miall critical path activities, i

= 64

s P2

= s i2

all critical path activities , i

= 36

Managing Risk

PERT Example


T is a random variable representing project duration; T is assumed to be normally distributed.

TS is a user specified (external) scheduled completion time;

Z is a random variable having standard normal distribution

By definition:

Values realizable by Z ranges in the interval {-3, +3};

P{Z k}, can be obtained from statistical tables, for all k in interval {-3,3}

Managing Risk

PERT Example

P Pr oject Duration TS = 67{ } = P T 67{ } = P Z

67- 64

6

= P Z 0.5{ } = 0.69

P Pr oject Duration TS = 60{ } = P T 60{ } = P Z

60- 64

6

= P Z -0.67{ } = 0.26

Z=

T -TP

s P


Possible Project Duration

FIGURE A7.3

Managing Risk

PERT Example


0.00 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09

0.0 0.0000 0.0040 0.0080 0.0120 0.0160 0.0199 0.0239 0.0279 0.0319 0.0359

0.1 0.0398 0.0438 0.0478 0.0517 0.0557 0.0596 0.0636 0.0675 0.0714 0.0753

0.2 0.0793 0.0832 0.0871 0.0910 0.0948 0.0987 0.1026 0.1064 0.1103 0.1141

0.3 0.1179 0.1217 0.1255 0.1293 0.1331 0.1368 0.1406 0.1443 0.1480 0.1517

0.4 0.1554 0.1591 0.1628 0.1664 0.1700 0.1736 0.1772 0.1808 0.1844 0.1879

0.5 0.1915 0.1950 0.1985 0.2019 0.2054 0.2088 0.2123 0.2157 0.2190 0.2224

0.6 0.2257 0.2291 0.2324 0.2357 0.2389 0.2422 0.2454 0.2486 0.2517 0.2549

0.7 0.2580 0.2611 0.2642 0.2673 0.2704 0.2734 0.2764 0.2794 0.2823 0.2852

0.8 0.2881 0.2910 0.2939 0.2967 0.2995 0.3023 0.3051 0.3078 0.3106 0.3133

0.9 0.3159 0.3186 0.3212 0.3238 0.3264 0.3289 0.3315 0.3340 0.3365 0.3389

1.0 0.3413 0.3438 0.3461 0.3485 0.3508 0.3531 0.3554 0.3577 0.3599 0.3621

1.1 0.3643 0.3665 0.3686 0.3708 0.3729 0.3749 0.3770 0.3790 0.3810 0.3830

1.2 0.3849 0.3869 0.3888 0.3907 0.3925 0.3944 0.3962 0.3980 0.3997 0.4015

1.3 0.4032 0.4049 0.4066 0.4082 0.4099 0.4115 0.4131 0.4147 0.4162 0.4177

1.4 0.4192 0.4207 0.4222 0.4236 0.4251 0.4265 0.4279 0.4292 0.4306 0.4319

1.5 0.4332 0.4345 0.4357 0.4370 0.4382 0.4394 0.4406 0.4418 0.4429 0.4441

1.6 0.4452 0.4463 0.4474 0.4484 0.4495 0.4505 0.4515 0.4525 0.4535 0.4545

1.7 0.4554 0.4564 0.4573 0.4582 0.4591 0.4599 0.4608 0.4616 0.4625 0.4633

1.8 0.4641 0.4649 0.4656 0.4664 0.4671 0.4678 0.4686 0.4693 0.4699 0.4706

1.9 0.4713 0.4719 0.4726 0.4732 0.4738 0.4744 0.4750 0.4756 0.4761 0.4767

2.0 0.4772 0.4778 0.4783 0.4788 0.4793 0.4798 0.4803 0.4808 0.4812 0.4817

2.1 0.4821 0.4826 0.4830 0.4834 0.4838 0.4842 0.4846 0.4850 0.4854 0.4857

2.2 0.4861 0.4864 0.4868 0.4871 0.4875 0.4878 0.4881 0.4884 0.4887 0.4890

2.3 0.4893 0.4896 0.4898 0.4901 0.4904 0.4906 0.4909 0.4911 0.4913 0.4916

2.4 0.4918 0.4920 0.4922 0.4925 0.4927 0.4929 0.4931 0.4932 0.4934 0.4936

2.5 0.4938 0.4940 0.4941 0.4943 0.4945 0.4946 0.4948 0.4949 0.4951 0.4952

2.6 0.4953 0.4955 0.4956 0.4957 0.4959 0.4960 0.4961 0.4962 0.4963 0.4964

2.7 0.4965 0.4966 0.4967 0.4968 0.4969 0.4970 0.4971 0.4972 0.4973 0.4974

2.8 0.4974 0.4975 0.4976 0.4977 0.4977 0.4978 0.4979 0.4979 0.4980 0.4981

2.9 0.4981 0.4982 0.4982 0.4983 0.4984 0.4984 0.4985 0.4985 0.4986 0.4986

3.0 0.4987 0.4987 0.4987 0.4988 0.4988 0.4989 0.4989 0.4989 0.4990 0.4990

P Z -0.67{ } = P Z 0.67{ }

1- P Z 0.67{ } =1- (0.5 + 0.24)

= 0.26

P Z 0.5{ } = 0.5 + 0.19

= 0.69

Standard Normal

Distribution Table

Area between 0 and z value


In PERT analysis only one critical path is taken into

consideration in assessing the probabilistic behavior of project

duration. Furthermore,

Near critical paths are disregarded;

Possible correlation among activity realizations is ignored;

Normality assumption may not be justified.

PERT results could be misleading when,

Number of critical / near critical paths is large;

Probabilistic dependency among activities cannot be ruled out;

Number of activities on the considered critical path are few.

PERT usually under-estimates the true project duration.

Managing Risk

A Critique of PERT


Managing Risk

PERT Example

A more accurate approach is to identify each sequence of activities that lead from the start node to the finish event and then to calculate separately the probability that the activities that compose each sequence will be completed by a given date.

It is assumed that central limit theorem holds for activities on each sequence

Furthermore it is assumed that the sequences themselves are statistically independent (i.e.time to traverse each path in the network is independent of what happens on the other paths).

Then the probability of completing the project by a given date is set equal to the product of the individual probabilities that each sequence is finished by that date.

Given n sequences with completion time X1, X2,..., Xn and X = max {X1, X2,..., Xn };

)().......()()( 21 XPXPXPXP n


Managing Risk

PERT Example

A

C D

B

S T

8,2 9,3

10,3 6,1.5

Activity durations are normally

distributed with the given

means and standard deviations

Length(A-B) = X1 ~ N (17, 3.61)

Length(C-D) = X2 ~ N (16, 3.35)

Length(S-T) = X


Performance time distribution for the two sequences

Managing Risk

PERT Example


Managing Risk

PERT Example

The project can end in 17 weeks only if both A-B and C-D are completed

within that time.

Thus the probability that the project will finish by week 17 is

approximately 31%

62.0299.035.3

1617172 ZPZPXP

62.0*5.017*1717 21 XPXPXP

5.0061.3

1717171 ZPZPXP


Managing Risk

PERT Example

A

C D

B

S E

8,2 9,3

10,3 6,1.5

3,4

The previous analysis is accurate if the sequences are independent. This

is not the case when one or more

activities are members of two or

more sequences.

Here activity E is a member of the two sequences that connect the start

of the project to its termination.

39.5234 222

22.55.134 222 10+6+3=19 C-D-E

8+9+3=20 A-B-E

Standard Deviation Expected Length Sequence


Managing Risk

PERT Example

The probability that the sequence A-B-E will be completed in 17 days is calculated as

The probability that the sequence C-D-E will be completed in 17 days is calculated

as

The probability of completing the project in 17 days is calculated to be 10%

assuming that the sequences are independent.

The true probability completing the project in 17 days is between 10% and 29%!!

29.05565.039.5

201717 ZPZPXP EBA

35.0383.022.5

191717 ZPZPXP EDC

35.0*29.017*1717 EDCEDC XPXPXP


Computer Simulation is a more laborous, but reliable way of assessing the probabilistic behaviour of projet duration.

The process of random activity duration/cost generation, and schedule determination based on the given probability distributions of activity durations and costs is called a simulation run.

Simulation runs are repeated many times (hundreds of times) to assemble a large set of project schedule, duration and cost realizations.

The data set obtained from the simulation runs forms a basis for a reliable, probabilistic assessment of project duration and cost, and potential resource conflicts

Risk retention or transfer decisions can be made using time, cost and schedule information gained from simulation runs.

Computer simulation is especially useful in large, complex projects that include a great deal of uncertainty, while having reasonably accurate time estiumates for activities.

Managing Risk PERT Simulation


References:

Larson E. W and Gray C. F., Project Management:

The Managerial Process, 5th ed. Mc Graw Hill/Irwin,

NY, USA, 2011

Original slides courtesy of Prof. Ilhan Or.

Aybek Korugan - Bogazii University

BOUN PM Ch7-v2-AK

Documents

risk assessment

concept of risk

definition of risk

hertz thomas risk

blair witch project

miscalculated risks

year combination

thurcydidas history