BUSM1276 Evaluating and Managing Project Risk SESSION 1: Introduction, definitions, etc.

Course Aims and Objectives:

To understand the concepts of risk in a project context. To explore the principles and processes of systematic project risk management. To apply these principles and processes in a simulated project environment (RMS Assignment). To develop a Risk Oriented Thinking

Course topics:
Risk. Threat & Opportunity. Risk and quality. Risk and uncertainty. Risk contexts: Project and project stakeholder organisational structures. Project decision-making. Systematic risk management.

Recording and evaluating risk outcomes. Building a risk management system Disaster Recovery and Emergency Management Quantitative Risk Management.

Risk identification. Risk analysis. Risk response. Risk monitoring and control.

Suggested reading...
HB 436: 2004. Risk Management Guidelines Companion to AS/NZS 4360. Standards Australia. NSW. AS/NZS 4360 (2004) Risk management. Standards Australia. NSW. ISBN 0-7337-0147-7. AS/NZS 3931 (1998) Risk analysis of technological systems-application guide. Standards Australia. NSW. ISBN 0-7337-1711-X. Raftery, J. (1994) Risk analysis in project management. E & F N Spon Ltd. (an imprint of Chapman-Hall). London. ISBN 0-419-18420-1. Flanagan, R & Norman, G. (1993) Risk management and construction. Blackwell Science Publications. London. ISBN 0-632-02816-5. Chicken, J. (1994) Managing risks and decisions in major projects. Chapman and Hall, UK. Chapman, C.B. and Ward, S.C. (1997) Project risk management: processes, techniques and insights. John Wiley and Sons. UK. Parkin, J. (1996) Management decisions for engineers. Thomas Telford. London. Smith, N.J. (1999) Managing risk in construction projects. Blackwell Science Ltd. Oxford. Edwards, P.J. & Bowen, P.A. (2005) Risk Management in Project Organisations. UNSW Press/Elsevier Science International.

Why has Risk Management Become So Important?

Always important Post September 11 Crisis in world insurance markets Corporate Collapses Enron Worldcom HIH Onetel Old Insurance model may no longer be valid Emergence of Corporate Governance

http://en.wikipedia.org/wiki/Corporate_governance Corporate governance is the set of processes, customs, policies, laws and institutions affecting the way a corporation is directed, administered or controlled. Key elements of good corporate governance principles include honesty, trust and integrity, openness, performance orientation, responsibility and accountability, mutual respect, and commitment to the organization

When it goes wrong

Esso/Longford 2 dead, class-action, criminal prosecution http://en.wikipedia.org/wiki/1998_Esso_Longford_gas_explosion Collins Class Submarines 2.5 years behind schedule, budget blow-out, specifications not met http://en.wikipedia.org/wiki/Collins_class_submarine HIH http://www.aph.gov.au/Library/pubs/RN/2002-03/03rn32.htm

Southern Cross Station Redevelopment Claim for losses on project - contractor unable to meet deadlines in contract due to conflict with rail operator. Vic Gov forced to pay $32.25m for contract variations. Pan Pharmaceutical http://www.tga.gov.au/recalls/pan.htm Dell Laptop batteries Recall https://www.dellbatteryprogram.com/ New Holden Commodore safety buckle Recall http://carsguide.news.com.au/story/0,20384,20734114-21822,00.html Myki $500million project already ?? months late

http://www.theage.com.au/news/national/citys-500m-ticket-chaos/2008/03/01/1204227055164.html? page=2
Connext new trains braking system problem

Poor risk management 'costing billions

http://www.vnunet.com/vnunet/news/2159588/firms-waste-billions-poor-risk
New Terminal At Heathrow, Credit Crunch, Bail out Packages, Where the hell are you (Campaign), iphone roll out in Oz,

Approximately 20% of risk is insurable. The remaining 80% must be managed effectively.

UNIVERSALITY OF RISK

We are all exposed to risk during our lives. We all have to deal with risk. For good risk management, the differences arise in how we perceive those risks, and how we respond to them.

We cannot avoid risk completely. Retreat from the world does not work! A recluse living in a cave still faces risks every day

RISK

There is a 60% chance of rain showers occurring over the area during the next 24 hours. The flight might be delayed. Which of these is a risk?

DEFINITION OF RISK

Risk is: The chance that an adverse event will occur during a stated period of time.

DEFINITION OF RISK

This definition implies: That probability (chance) is associated with the of occurrence of an event. That the event has a measurable adverse (unfavourable) outcome (impact, consequence). That the risk event and its consequences are each constrained to a period of time.
Weather forecast example: There is a 75% chance of heavy showers occurring over the next 5 days. (RM: beware putting washing out to dry; take an umbrella to work; and cancel Wednesdays golf date.)

ELEMENTS OF RISK

Probability Of Occurrence

Consequence / Impact Consequence / Impact Consequence / Impact

EVENT

Duration of exposure to event (Time)

Duration of exposure to consequences (Time)

latent defect phenomenon in most construction projects; or the medical negligence issue

DEFINITION OF RISK (AS/NZS 4360: 2004)

Risk is: The chance of something happening that will have an impact on objectives.

RE-DEFINITION OF RISK

Risk is: The chance of something happening during a stated period of time that will have an impact on objectives.

THREAT & OPPORTUNITY RISK STATEMENTS

Threat: There is a chance P that event E will occur during the T period, leading to X adverse consequences. Opportunity: There is a chance P that, if opportunity C is exploited during the T period, benefit B be will be obtained

RISK AS A SOCIAL CONSTRUCT

Risk is a social construct: It arises out of (human) societys world views and perceptions of events and their impacts. Different people will have different views about what constitutes risk; the source of risk events; and their treatment. A persons attitude towards risk is not necessarily consistent over all risks, nor even for specific risks over time.

A EX

S E L P

A society which knows nothing about surgery or disease may have no concept of health risks. Some insurance companies have removed the term acts of God from their policy contracts, as this has no meaning for some people. A heart surgeon might be:
highly risk averse at the operating table; off-hand about putting a plaster on the cut she got from a thorn on a rose bush in the garden; and very anxious to place a $10,000 bet on a particular horse in a well-known race!

RISK CONTEXTS

Risk is contextual: It arises in the context of a person or organisation. It arises in the context of a situation. It arises in the context of an objective, a task or a commitment.

EXA

S E L P

A cloud does not have a risk. Nor does rain, the sun or tomorrow (impersonal, non-organisational). A poorly performing company may be faced with the risk of a hostile takeover (situation). A person wanting to cross the road faces an accident risk (objective). A carpenter hammering a nail faces an accident risk (task). A bail guarantor faces a financial risk (commitment).

RISK CONTEXTS

One persons (organisations) risk threat may be anothers risk opportunity.

Example: The takeover company from the earlier example is presented with a new investment opportunity.

RISK CONTEXTS

The context is the key to identifying risks.

RISK CHARACTERISTIC

Risk is usually dynamic: For a risk event, the probability and impact elements of risk may change over the time element.

M A X E

S E L P

The technical risk of accident caused by falling from height may be constant (in terms of probability and impact) for the full period of a pipeline project. The probability of the same risk might start as low, then increase sharply, and finally decline again as a multi-storey building project emerges from the ground, structural floors are added, and the external scaffold is eventually removed from the completed faade. The impact is likely to remain the same throughout the period. For a software development project, the probability of the risk of losing key data occurring may be constant throughout, but the impact is likely to increase over time. For an open-air entertainment event, the probability of weather risk will change over time (seasons), as also will the type of impact (winter storms and summer heat).

RISK AND QUALITY Risk and quality management share similar concepts: Both are capable of multiple definitions by interested parties. Both are concerned with events and outcomes. Both involve decision-making processes, and the exercise of judgement. Both may be addressed (managed) through procedural systems. Enhancing quality may reduce risks. Reducing risk may enhance quality.

RISK AND QUALITY On the other hand, achieving high quality outcomes may involve taking more risks. The difference between risk and quality management lies in their overall objectives. Quality management is more about aiming to get things right. Risk management is concerned with dealing with the possibility that something will go wrong. These could be seen as points on the same continuum...

RISK MANAGEMENT

Value?

QUALITY MANAGEMENT

Avoiding things going wrong

Getting things right

RISK AND UNCERTAINTY

Uncertainty is associated with risk because of the inherent variability of one or more of the three risk elements (probability, impact and time).

LE OF P M A EX

INTY A T R E UNC

Assume that the financial performance of three alternative projects (A, B, C) has been modelled financially, using Monte Carlo simulation, each with 360 iterations. The IRR outcomes for each project are tabled below:

EXAM

PLE

TAI R E C N OF U

NTY

EX

OF E L P AM

INTY A T R NCE

P M A EX

FU O LE

TY N I TA R E NC

Project B has the greatest range of IRR values encountered (6.0% to 8.5%) and is therefore associated with the greatest IRR uncertainty. Project A has the smallest range of IRR values encountered (6.5% to 8.0%) and is therefore associated with the least IRR uncertainty. Project C is less risky than B, but more risky than A, in terms of IRR outcome.

RISK AND UNCERTAINTY

Uncertainty is the lack of complete information about any or all of the characteristics of a potential risk event: the probability of occurrence, the magnitude of impact, the period of exposure.

RISK AND UNCERTAINTY

Treating uncertainty may be a matter of setting boundaries on the range of values the risk analyst (decision-maker) is prepared to consider in terms of the magnitude of impact, or the period of exposure associated with a particular risk; or of assigning a particular distribution to the probability of occurrence.

EXA

LE P M

A property consultant may consider that a rental value of below $200, or above $275, per m2 p.a. for a particular building would be highly unlikely to occur. This sets the acceptable bounds of rental rate uncertainty (for that consultant assessing that property) as $200 -$275, and the consultant would proceed to model the financial risk of the property investment on this basis. Theoretically, however, an actual rental value might be found below or above the given range.

RISK AND UNCERTAINTY

Some economists see setting the bounds of uncertainty in terms of the analysts capacity to be surprised by the outcome (Gallie, 1957). Human judgement is therefore brought into play, and with it the potential for human error.

RISK AND UNCERTAINTY

Uncertainty may also be dealt with linguistically. Different verbal descriptors may be assigned to the elements of probability, impact and time.

Risk Likelihood Descriptors

RISK CONSEQUENCE DESCRIPTOR

RISK ASSESSMENT MATRIX

A three-dimensional matrix for a linguistic concept of risk.

AS4360 AS3931

Catastrophic 5. Long Major

IMPACT

Moderate

3. Medium

Minor Insignificant 1. Short Rare Moderate Unlikely Almost Certain Likely

DURATION

(P x I x D) (5 x 5 x 5)

PROBABILITY OF OCCURRENCE

COMPLEXITY OF RISK

Risk is a complex concept because: The characteristics of risk are dynamic. The characteristics of risk decision-makers are inconsistent. Uncertainty is often associated with one or more of the risk elements.

HENCE THE NEED FOR GOOD RISK MANAGEMENT!

RISK MANAGEMENT: DEFINITION

Risk management is: A systematic approach to dealing with risk (Edwards, 2001)

WHY USE RISK MANAGEMENT?

Using a systematic approach to risk management encourages: More effective decisions. Effective delivery of products and services. Effective allocation and use of resources. High standards of customer service. High standards of accountability. Creativity and innovation in management practice. Improved capacity to manage in the face of competing obligations. Improved organisational morale. Flexibility in meeting objectives. Transparent decision-making. (Knight, 1999) Are all these claims valid?

RISK MANAGEMENT: PROCESS

Systematic risk management comprises: Establishing the risk context. Identifying risks. Analysing risks. Responding to risks. Monitoring and controlling risk decisions. Recording and evaluating outcomes.

Summing it up
Risk is dynamic Risk is contextual Uncertainty brings the risk Risk for one may be an opportunity for the other Just insuring against the risk is not practicing Risk Management Risk Management is a systematic approach to identifying & managing risks

Next session: Contexts for project risk. Objectives. Organisational structures. Decision making