Project Risk Management Project Part 1

Automations Migration Risk Management Plan: 1-1 SFG (A) Headquarters RelocationCourse Project Part 1Peter J. Veiga IIDeVry University Keller Graduate School of Management

Professor Rich HilesProject Risk Management (PROJ595)February 2, 2014

Table of ContentsProject Background- A Plan 20 Years in the Making 3Project Scope 3Work Breakdown Structure 5Risk Management Plan 5Identified Risks 6Qualitative Risk Analysis 8Negative Risk Analysis Table 10Positive Risk Analysis Table 11Quantitative Risk Analysis 12Risk Response Planning (Negative) 12Risk Response Planning (Positive) 14Decision Making and the Project Risk Management Plan 16Decision Tree Analysis 16Decision Tree Analysis Figure 18Decision Tree Discussion 19Fault Tree Analysis 20Fault Tree Analysis Figure 23Conclusions 24Works Cited 25

Project Background- A Plan 20 Years in the MakingIn 2014 the keys to a brand new building built by the government of Japan on the island of Okinawa will be turned over to the United States Armys 1st Battalion, 1st Special Forces Group (Airborne) at Torii Station. The intent of the Japanese construction project is to foster relations between the Japanese government and the United States military while alleviating some of the problems involved with a battalion sized element operating in a sixty plus year old building piecemealed together from three oddly shaped structured pieced together over six decades.As the battalion S6 shop, we are responsible for the smooth transition of services from one building to the other. While the government of Japan is responsible for the acquisition and installation of all required wires and cabling, the burden of moving all equipment related to network access (both Secret and Unclassified), radio and satellite communications, telephone services (both VoIP and conventional) and VTCs falls to us.Project Scope The battalion S6 shop ensures proper removal, relocation, installation, and operation of all unit automations equipment from the current headquarters building into the new headquarters building.Some key factors to work into this project include the fact that the unit is the only forward deployed Special Forces unit in the Asia-Pacific area of operations, and as such, requires a zero down time solution. In order to provide services with zero down time, this indicates that all new equipment will be required in the new building located immediately adjacent to the current building. Since the unit is comprised of over 400 members with varying schedules, services will have to be up and running in both buildings for an as of yet undetermined amount of time (likely one month) in order to allow a smooth transition. Implications of this are an interconnection of LAN services between the buildings, which will require armed personnel guarding any exposed LAN cabling run between buildings. The projected timetable for completion of our portion of the project is four months (September 1, 2014-December 31, 2014) with a targeted budget of one million dollars while the end product would be a fully compliant automations operation with all current equipment up and running with minimal impact to operations and remaining within the guidelines for information systems network operations as set forth by the Department of Defense.The most logical approach to our project given the requirement to maintain 100% uptime will be to continue in three phases: Prepare the new building Link services between the two buildings Deconstruct the old buildingThe large overarching tasks involved in each phase of our operation are included below in the Work Breakdown Structure (WBS).Work Breakdown StructureRisk Management PlanWhile the organization we are a part of tends to be very familiar and open to taking risks, we will be taking a much more risk adverse type of approach since we have much planning time prior to action. Also, given the critical nature of information systems today and our constraint of maintaining 100% uptime during transition, we will be taking very little risk where avoidable during this project, especially during the second phase depicted above in the WBS.While the overall manager regarding decisions regarding risk is typically the battalion commander, he has deferred risk decisions to the battalion signal officer, Captain Veiga, for all matters regarding the movement of information systems. As it relates to individual tasks during each phase, the Automated Data Processing (ADP) Chief Warrant Officer will be in charge of risks involved with information systems remaining in compliance with all security mandates while the Signal Detachment Commander will be the risk authority on all tasks regarding the movement of actual tactical satellite communications systems and radios. For each of the above, teams will be assembled constituted with no less than five personnel each who are the most experienced in their sections. Budgeting has been deemed to be of relatively little concern given the mission requirements of our unit, but all other risk analysis will be reevaluated on a weekly basis and immediately prior to the engagement of any new section of the WBS, and no new WBS task will be started prior to the previous task being completed.Identified RisksResults of brainstorming activities to identify risks for this project have led to the following identified risks: Negative risks1. Service member injured while moving heavy equipment racks into new building2. Servers dropped/damaged due to mishandling during installation3. Equipment damaged due to power fluctuations during installation4. Equipment damaged due to improper grounding during installation5. Configuration errors prevent new radios from being brought online6. Electrostatic discharge damages new computers during installation7. Sensitive camera equipment for VTC damaged during installation8. Cables run between buildings damaged due to external exposure9. Cable run between building compromised causing information security breach10. Guards placed on watch over exposed cables fall asleep endangering information security11. Live animals cause damage to exposed cabling bringing down services12. Delays due to port switching when bringing new equipment online13. Risk of electric shock to personnel while disconnecting old communications equipment14. Failure to properly zeroize old equipment leads to security breach15. Deconstruction crew fails to turn in all old equipment for destruction leading to security breach Positive risks1. Project completed ahead of 4 month timeline2. No mission impact/downtime during project for unit3. Lower than expected budget cost4. Increased capabilities upon moving into new building vice maintaining current capabilities5. Increased productivity in new building due to better layout and services6. Accolades for the unit from higher headquarters due to successful project completion7. New VTC equipment better than old, increasing command and control capabilities8. Higher headquarters provides specialty team to assist with construction9. Higher headquarters provides specialty team to assist with deconstruction10. Confidence due to successful move results in higher headquarters increasing responsibility in area of operations11. Positive resale market for old equipment has positive effect on project budget12. Changes in most updated pricing for new equipment have positive impact on budget13. Department of public works is approved to assist with external cable runs14. Government of Japan offers to assist with costs associated with external cable runs15. Government of Japan offers to defray costs of new equipment for trade on old equipmentQualitative Risk AnalysisFor qualitative risk analysis for this project we will work off an example risk matrix from the Project Management Book of Knowledge.

(pg. 330)Using the above listed negative and positive risks (and the number assigned to save space in the following chart), we can assess the probability of each event occurring as well as its likely impact to determine whether it is a low, medium, or high risk, which results in a table demonstrating all of the identified risks. All resident experts on the tasks to be accomplished have been assembled to assess the risks involved, and IMPACT scores have been assessed in regards to impact to the entire project and its timeline/budgetary goals. As a result of this, while some risks involve individual personnel and potential injury which can be serious, injury to a single individual will likely have little to no impact to overall project success. Injury has virtually no impact to budgetary concerns also due to the nature of the worker (military member covered by full medical insurance and no legal rights to workplace hazard/consequence litigation).

Negative Risk Analysis TableRisk NumberProbability assignedPotential ImpactMatrix ScoreResultant Risk Level

1.5Low.05Low

2.5High.2High

3.5Very High.4High

4.5Very High.4High

5.7Low.07Medium

6.7Very High.56High

7.7High.28High

8.9Very Low.05Low

9.7Very High.56High

10.3Very High.24High

11.7Low.07Medium

12.9Very Low.05Low

13.7Low.07Medium

14.5Very High.4High

15.3Very High.24High

Positive Risk Analysis TableRisk NumberProbability assignedPotential ImpactMatrix ScoreResultant Risk Level

1.1.2.02Low

2.3.8.24High

3.1.05.01Low

4.3.2.06Moderate

5.5.2.1Moderate

6.7.4.28High

7.1.2.02Low

8.1.8.08High

9.1.8.08High

10.3.4.12Moderate

11.1.1.01Low

12.1.1.01Low

13.1.2.02Low

14.3.1.03Low

15.5.1.05Low

Quantitative Risk AnalysisOur quantitative risk analysis really started when we used the matrix above to determine a matrix score and resultant risk level for our negative and positive risks. As a result, the following negative risks are the ones we want to focus our efforts on:2.Servers dropped/damaged due to mishandling during installation3.Equipment damaged due to power fluctuations during installation4.Equipment damaged due to improper grounding during installation6.Electrostatic discharge damages new computers during installation7.Sensitive camera equipment for VTC damaged during installation 9.Cable run between buildings compromised causing information security breach10.Guards placed on watch over exposed cables fall asleep endangering information security14.Failure to properly zeroize old equipment leads to security breach15.Deconstruction crew fails to turn in all old equipment for destruction leading to security breach

The following positive risks are those that have the most benefit for us to actively pursue:2.No mission impact/downtime during project for unit6.Accolades for the unit from higher headquarters due to successful project completion8.Higher headquarters provides specialty team to assist with construction9.Higher headquarters provides specialty team to assist with deconstruction

Risk Response Planning (Negative)In this section we will identify how best to proactively respond to each of the listed High level negative risks using avoidance, transfer, and mitigate response strategies.

2.Servers dropped/damaged due to mishandling during installationAll server equipment will remain boxed in its original shipping container and manufacturers recommendations for minimum manpower for lifting will be followed. Should a manufacturer recommendation not exist, the standard adhered to will be one person for each 40 pounds of equipment load, rounded up to the nearest whole person.3.Equipment damaged due to power fluctuations during installationUninterruptable power supplies (UPS) will be used for all major components. These devices provide clean filtered electrical power, and no major components will be plugged into any electrical source without being directly plugged into an UPS first.4.Equipment damaged due to improper grounding during installationAll equipment will be fully rack mounted and grounded prior to being plugged into an UPS.6.Electrostatic discharge damages new computers during installationStandard operating practices regarding safe handling of electrostatic sensitive devices such as wearing grounded wrist bands and maintaining safe temperature and humidity controls in the work environment will be adhered to in order to prevent electrostatic discharge. More complete detail regarding safe handling of sensitive electronics items can be referenced in the Fundamentals of Electrostatic Discharge. It is here that they acknowledge that we (the military) used to be at the forefront of ESD identification and standards, but have taken a less than proactive approach recently. (Fundamentals of Electrostatic Discharge, 2010)7.Sensitive camera equipment for VTC damaged during installationCertified VTC installation contracting company will be used in order to install VTCs. We have used a team in the past to do this when contracting out VTC work, and they warranty not only the equipment they are working on but their labor as well.9.Cable run between buildings compromised causing information security breachCable runs to support connectivity between the two buildings will have metal conduit through which they pass. This metal conduit will be buried within a trench in the ground. This should mitigate compromises to the cabling during the four month transition period.10.Guards placed on watch over exposed cables fall asleep endangering information securityGuard duty shifts over exposed or externally run cables not within a secured facility will be composed of no less than two individuals at a time and shifts will be no longer than two hours at a time between shift changes in order to minimize potential complacency.14.Failure to properly zeroize old equipment leads to security breachFull inventory prior to removal of all cryptographic items will be conducted. Upon inventory completion, a first line supervisor (rank no less than E-7) will conduct inspection on each item and ensure cryptographic keys have been zeroized. Regulations regarding the safe handling of cryptographic keys can be found in Army Europe Regulation 380-40.15.Deconstruction crew fails to turn in all old equipment for destruction leading to security breachFull inventory of all items to be removed for destruction will be conducted by a first line supervisor. That same first line supervisor will personally sign for, document, and turnover said equipment to the Property Book Officer for destruction.

Risk Response Planning (Positive)Taking advantage of positive risks that have been identified as High can have a very dramatic impact on our project. Positive risk strategies of exploit, share, and enhance can be used to maximize the benefits of these risks in the following ways:2.No mission impact/downtime during project for unitThis risk is absolutely critical and has been identified by higher headquarters and our mission set as being requirements. As such, all decisions on risk will be centered on no loss of services during transition. This can be accomplished best by allowing some of the riskier tasks to be completed during non-working hours. An example of this is that any equipment to be taken offline will have an automatic cascading backup unit to which services will automatically switch to. UPS that are to be replaced will only be done so by using zero fault tolerance equipment (equipment with multiple power input sockets that automatically switch from one to the other in the event of one input losing power). Any services that absolutely have to come down during transition will be planned well in advance and signed off on by the overall project manager to occur during a timeframe in which no personnel are in the buildings and no missions are ongoing.6.Accolades for the unit from higher headquarters due to successful project completionTo ensure this risk occurs, one person from the automations section will be designated to give our higher headquarters a weekly report on our progress, focusing on our achievements during the week, essentially creating a positive public relations campaign with our higher headquarters.8.Higher headquarters provides specialty team to assist with constructionThis risk can be enhanced by dropping regular hints to headquarters on our rigorous schedule and shortage of qualified manpower. If they can see that we are stretched thin, they are much more likely to take pity upon our cause and send additional assets to assist during the construction phase.9.Higher headquarters provides specialty team to assist with deconstructionBy establishing good rapport with our higher headquarters, and especially directly with any specialty team they may send out to assist with construction, we can again drop hints on assistance and its value to us when it comes time for deconstruction.Decision making and the Project Risk Management PlanNow that we have identified both negative and positive risks in our project, given the size of our project, we have to identify some tools that can help us make decisions that will provide the best benefit for us and our project success. Decision Tree Analysis Decision trees use a graphic approach to compare competing alternatives and assign values to those alternatives by combining uncertainties, costs, and payoffs into specific numerical values. (Olivas, 2007) For our decision tree analysis for our project we will take the largest risk from our qualitative analysis on the projects negative risk:9.Cable run between buildings compromised causing information security breachThis risk had the highest resultant matrix score, and therefore is our highest rated risk in that it has the ability to produce the most damage to our project overall. That being said, our decision tree analysis will compare the expected monetary value associated with deciding on a vendor to contract for construction of a secure means of running cables between the buildings. The critical factor involved when determining the decisions to make in this analysis will center on the $1,000,000 unit operating fund bonus that has been offered for completion of our overall project without a security breach which is the critical piece of managing this particular risk.

1-1 SFG (A) Headquarters Relocation

1 Decision Tree Analysis

Decision Tree DiscussionProbabilities displayed in our decision tree analysis are the best available determination as to the potential effects of making certain decisions on this project and have been obtained over decades of historical projects that we have undertaken which are very similar to our current project.As our organization places a very high premium on the integrity of the information systems during our transition to the new building, security breaches have an extremely small fault tolerance, but since there is a dollar figure attached to all decisions during the planning process, we still need to be able to show on paper the cost of our decisions. As demonstrated by our analysis, our expected monetary value lies in favor of hiring a contractor to provide a means of providing a secure connection between buildings. While the rather large $300,000 expense of hiring a contractor is quite formidable, the resultant probability of having a major security breach is significantly lowered, which translates to only a 10% chance of ending up with no bonus awarded for maintaining the highest standard of security tolerance throughout the project.As demonstrated, going with the in-house route saves us a significant amount of money on the front end, but the possibilities of security breaches increase significantly, opening us up to the very real possibility of not attaining the maximum $1,000,000 unit bonus. While we can lust after the maximum profit available and turn that one million dollar bonus into a net gain of $950,000, the odds are not in our favor. Dr. David Hulett discusses decision tree analysis in our type of organization (risk averse), and his characterization is spot on when he says we may be more concerned with the possibility of failure or significant loss than they are enamored with the possibility of the up-side potential. (Hulett) As displayed, our safest play since we are a risk adverse organization when it comes to the security of our information is to contract out the construction of this portion of the project, and while we will never have the ability to earn the type of return available from doing the work in house, the higher level of security does the best to virtually assure us a positive return while minimizing the possibility of failure.Fault Tree AnalysisFor our fault tree analysis we will demonstrate faults that can feed into the following identified risk:3.Equipment damaged due to power fluctuations during installationFault tree analysis can be useful because it can be used to help identify root causes of trouble and to design remedies and countermeasures as stated in Concordia University in Fault Tree Analysis.In our fault tree analysis, we analyze the different causes that can lead to the effect of our equipment being damaged due to power fluctuations. According to the diagram, we have to primary causes for equipment to be damaged due to power fluctuations, and those are due to equipment failure (in this case equipment that brings in power to our devices) and operator error (in this case the installation team that is handling the equipment).At the root of equipment failure we identified that if the incoming power from the local substation creates an overvoltage or under voltage condition, OR there is faulty wiring involved, be it outside our building from the substation or inside the building, then ONE of those conditions COMBINED with a faulty uninterruptable power supply can cause equipment failure. As shown by our use of the OR gate at the lowest level, either incoming power issues OR faulting wiring can feed into the process, but WITHOUT the UPS being faulty as well, neither incoming power issues nor faulty wiring will cause equipment failure. On the other hand, we have also demonstrated that faulty grounding alone ranks much higher up and can cause equipment failure all by itself without any other outside forces acting upon the situation. This cause and effect situation which is readily demonstrated by a fault tree analysis can then propel us in a direction to take steps to ensure that we spend as much if not more effort during our project to insure that our grounding is not faulty. The potential problems of bad incoming power or faulty wiring are easily mitigated by ensuring that our UPS are in good working condition as those faults cannot come to bear on equipment failure as long as our UPS is working correctly.On the operator error side of the equation which could feed into equipment damage from power fluctuations are situations that could arise that cause static discharge conditions which could destroy sensitive electronics. As displayed, climate control systems, designed for spaces with sensitive electronics that require precise humidity controls, could possibly fail, and coupled with the humidity being too low in a space where work is being done on electronics could lead to damage. While these two conditions may not seem to be related to operator error, it is presumed that there is someone working inside or on static sensitive devices while these input conditions occur.Also a feeder into this analysis is the potential failure of the technician to take standard electrostatic safety measures which include wearing an electrostatic inhibiting strap (wrist strap attached to a ground point in order to shunt any spurious voltage from the technicians body) and standing on an electrostatically safe mat and working on an electrostatically safe work bench. Again, given that the lack of electrostatic safety measures taken, this could be a single point of failure, as demonstrated by our fault tree analysis, that indicates where we should focus our efforts in order to ensure that we do all we can to avoid equipment damage due to power fluctuation. In the case of our analysis, we should focus on this and alleviating faulty grounds.2 Fault Tree Analysis

ConclusionsThe goal of risk management in any project is to minimize the impact that negative risks pose to the overall project while taking what opportunities we can to achieve positive risks. Through each step of the risk management process, whether it be using the ATOM methodology or the PMBOK methodology or any other methodology, we are looking for opportunities to hedge our bets in order to make our project a success. Sometimes risk factors affect the cost or the timeline of a project, but for some projects lives can actually be part of the risk equation.In this project we have demonstrated multiple ways to identify our risks as well as tools that we can use to take action on our risks. Sometimes just being able to use a fault tree analysis to identify processes that end up leading to risks, tools that show a cause and effect, can give us great insight into how to deal with individual risks, especially if you are playing a role as project manager and are not familiar with different technical aspects of a project.

Works CitedA guide to the project management body of knowledge (PMBOK guide) (Fifth ed., p. 308). (2013). Project Risk Management. Newtown Square: Project Management Institute Inc.Fault Tree Analysis. (1995, June 23). Concordia University Office of Quality Programs . Retrieved February 16, 2014, from http://web2.concordia.ca/Quality/tools/15fta.pdfFundamentals of Electrostatic Discharge. (n.d.). Electrostatic Discharge Association. Retrieved February 16, 2014, from http://www.esda.org/documents/FundamentalsPart6.pdfHulett, D. D. (n.d.). Decision Tree Analysis for the Risk Averse Organization. www.projectrisk.com. Retrieved February 16, 2014, from http://www.projectrisk.com/white_papers/Decision_Tree_Analysis_for_the_Risk_Averse_Organization.pdfOlivas, R. (n.d.). Decision Trees Primer. www.lumenaut.com. Retrieved February 16, 2014, from http://www.lumenaut.com/download/decision_tree_primer_v5.pdfSafeguarding and Controlling Communications Security Material. (2003, July 10). Federation of American Scientists. Retrieved February 16, 2014, from http://www.fas.org/irp/doddir/army/aer380-40.pdf