Risk Breakdown Structure Planned Risk Breakdown Structure Planned

Likely Cost Likely Cost

Project Title Ferry Terminal Project RISK MANAGEMENT SUMMARY RESULTS
(functional assignment)
Response
Avoidance (functional assignment)
Response
Avoidance
Cost Cost
Proactive Risk
Estimate Date 08/08/17 Target AD date 05/01/21 Planned and Actual MIN MAX LIKELY Management: Develop an Enviromental 0.0 $M 0.0 $M Railroad 0.0 $M 0.0 $M
action response strategy;
Project PIN # PIN Estimated CN Duration 1.0Mo Planned Cost to Respond 0.0 $M assign risk owners to Str & Geotech 0.0 $M 0.0 $M Partner Stakeholder 0.0 $M 0.0 $M
implement action; monitor
Last Review Date 08/11/17 Estimated PE Cost 1.0 $M Est. $ of Cost Avoided (via risk management) 0.0 $M 0.0 $M 0.0 $M and record effectiveness Design 0.0 $M 0.0 $M Management 0.0 $M 0.0 $M
of the risk response
Mr. XXX Estimated ROW Cost 1.0 $M Actual Cost to Respond 0.0 $M action. Right Of Way 0.0 $M 0.0 $M Contracting 0.0 $M 0.0 $M
Project Manager
Est $ Impact of Signficant Response Cost & Cost Avoidance
Project Risks (exp. Value)
0.0$M Estimated CN Cost 1.0 $M Est. Actual $ Cost Avoided (via risk management) 0.0 $M 0.0 $M 0.0 $M Utility 0.0 $M 0.0 $M Construction 0.0 $M 0.0 $M
(based on estimated expected values)

Estimated Calculated Actual Calculated

Critical
Risk Identification Quantitative Analysis Qualitative Display of Most Likely Impact Response Monitoring and Control Issue
Response $ Est. Cost Response $ Actual Cost
Entered Avoidance Entered Avoidance

Actual Cost to Respond [$M]

Project Phase--Date Identified

Phase (pre CN, CN, or ROW)

([min + (4 X ML) + max] X [probability])/6

(Expected Value of Risk) -

Est. Actual Costs Avoided

Planned Cost to Respond

(enter single number estimate)

Is Risk on Critical Path?
Estimated Expected Risk Impact ($M)

(Est. Cost to Respond)

Est Cost Avoided [$M]
Detailed Description of Risk

Risk Owner
RBS Group

Probability

Probability
Summary Event Risk

Strategy
ACTION TO BE TAKEN Response Actions Date, Status and Review Comments (Do

Impact
Status
Risk #

Description (Specific, Risk Impact Revie

Type

[$M]
Risk Trigger Risk Matrix including advantages and disadvantages not delete prior comments, therefore
Threat and/or Measurable, Attributable, ($M or Mo) w
include date providing a history)
Opportunity Relevant, Timebound) Dates
[SMART]

[$M]
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) [10a] (11) (12) (13) (14) (15) (16) (17) (18) (19) (20) (21) (22) (23) (24) (25)
Threat MIN 1.0$M VH $0.7 $0.0
Mar-06

Very High

2007-Jan-2
Design Leader/Enviro. mgr
4.8$M
Cost
EXAMPLE

EXAMPLE
70% MAX 12.0$M H Mo $ $8.4 $0.0

Probability
The mitigation ratio has not been
Environmental

If Wetland Most Likely 7.0$M M $4.9 $0.0

finalized and also there could be As of Nov. 15, 2005 there are only two potential

Mitigation
Wetland mitigation impact is larger Finalize design to identify all wetlands that are
Active

ROW

additional impacts to wetlands areas where there could be additional wetland

High

YES
may require than 1/2 acre L impacted. Early coordination with the outside
which would increase the amount impacts. As of Dec. 2, 2005 agency has initially
additional R/W and ratio agencies to determine mitigation ratio.

2006-Dec-2
of R/W needed for the mitigation determined that mitigation ration would be 4:1.
Design/PS&E

exceeds 4:1. MIN 0.0Mo VL

Schedule

Very Low
area.

1.9Mo
MAX 4.0Mo VL L M H VH

Threat Most Likely 3.0Mo Impact

90%
Threat MIN VH $0.0 $0.0

NO RISK
0.0$M
Cost

MAX H $0.0 $0.0

Probability
Pre-construction

Acceptance
Most Likely M $0.0 $0.0 $0.0

NO RISK
Active

1 L
MIN VL
Schedule

NO RISK
0.0Mo
MAX VL L M H VH
Threat Most Likely Impact

Threat MIN VH $0.0 $0.0

NO RISK
0.0$M
Cost

MAX H $0.0 $0.0

Probability
Pre-construction

Acceptance
Most Likely M $0.0 $0.0 $0.0
NO RISK
Active

2 L
MIN VL
Schedule

NO RISK
0.0Mo

MAX VL L M H VH
Threat Most Likely Impact

Threat MIN VH $0.0 $0.0

NO RISK
0.0$M
Cost

MAX H $0.0 $0.0

Probability
Pre-construction

Acceptance
Most Likely M $0.0 $0.0 $0.0
NO RISK
Active

3 L
MIN VL
Schedule

NO RISK
0.0Mo

MAX VL L M H VH
Threat Most Likely Impact

Threat MIN VH $0.0 $0.0

NO RISK
0.0$M
Cost

MAX H $0.0 $0.0

Probability
Pre-construction

Most Likely M Acceptance $0.0 $0.0 $0.0

NO RISK
Active

4 L
MIN VL
Schedule

NO RISK
0.0Mo

MAX VL L M H VH
Threat Most Likely Impact

Threat MIN VH $0.0 $0.0

NO RISK
0.0$M
Cost

MAX H $0.0 $0.0

Probability

Acceptance

Most Likely M $0.0 $0.0 $0.0

NO RISK
Active

5 L
MIN VL
Schedule

NO RISK
0.0Mo

MAX VL L M H VH
Threat Most Likely Impact
 Project Risk Management Plan Spreadsheet (RMP) Users Guide
A convenient tool for tracking risk management of projects.
The top part of the risk management plan spreadsheet (rows 1 thru 6) require the user to enter project
information in boxes shaded yellow; information that must be entered includes: Project Title, Estimate
date, Project PIN, Last review date, Project Manager, Target AD date, Estimated CN duration,
Estimated PE Cost ($M), Estimated ROW Cost ($M), Estimated CN Cost ($M).
Risk Management is a key component of Project Management.
Risk Management is comprised of the following steps:
1) Risk Management Planning (this is a part of the project management plan)
The remaining steps are captured in the RMP spreadsheet:
2) Risk Identification (this is the eight column sections of the spreadsheet)
3) Qualitative Risk Analysis (depicted with the risk matrix red-yellow-green chart)
4) Quantitative Risk Analysis (captured in four column sections following risk identification)
5) Risk Response (strategy: avoid/transfer/mitigate/accept) and (action to be taken)
6) Risk Monitoring and Control (who owns the risk and will track the response to it?)
Risk Identification: focus on significant risks that affect project objectives. Risk identification occurs
througout project development as old risks are successfully mitigated and retired new ones can
emerge.
The Risk Identification section includes:
(1) Risk # (the spreadsheet is setup for 12 - more can be added if desired)
(2) Status of the risk event, there are three status scenarios to choose from:
Active, when the risk is being actively monitored and controlled
Dormant, when the risk is low priority but may become high priority in the future
Retired, when the risk is demised for any reason.
(3) RBS Group = Risk Breakdown Structure category (the RBS is found on the website)
(4) Date Identified and Project Phase, represents the date when the risk was first
identified and the phase of the project when the risk was first identified. Valid entries for
the project phase are: Scoping, Design/PS&E and Construction.
(5) Phase: Pre-construction, Construction or Right-Of-Way.
(6) Summary Description (threat/opportunity).
Threat = if event occurs it negatively impacts objectives (increase cost or schedule)
Opportunity = if event occurs it positively impacts objectives (decrease cost or
schedule)
(7) Detailed Description of Risk Event (SMART Column) stands for Specific,
Measurable, Attributable (a cause is indicated), Relevant and Time bound. It presents
detailed risk description. Take some time and thought to fill this out thoroughly - so that
others reading it, who are not familiar with the project, can understand the risk event being
described.
(8) Risk Trigger presents symptoms and warning signs that a risk event is about to occur.
This information is used to determine when to implement the Risk Response Strategies.
Risk Analysis Strategy prioritizes risks based on the Probability and Impact Risk Matrix. The
section has two major segments: Quantitative Analysis and Qualitative Analysis.

(9) - (15) Includes Qualitative depiction of Quantitative Analysis of most likely impacts.
The key features are: impact affects cost, schedule or both? Probability of occurrence and the
impact range (min, max, most likely) if it does occur.
(9) Type of risk (does it affect cost and/or schedule?)
(10) Probability of Occurrence
(11) Risk Impact in $M and/or Months; (min, max, most likely).
(12) Estimated Expected value of impact (min + 4*ML + max)/6
(13) Qualitative description of probability (based on % that is entered)
(14) Qualitative description of impact (based on figures for risk event and project cost)
(15) Qualitative graphicaly display risk event (red/yellow/green risk matrix)

Risk Response Strategy (16) - (18)

(16) The project manager and Project Team identify which strategy is best for each risk, and then
design specific actions to implement that strategy, and determine who owns the risk and will make sure
risk response action is taken. These strategies and actions include:
THREAT REPONSES
Avoid: The team changes the project plan to eliminate the risk or to protect the
project objectives from its impact. The team might achieve this by changing scope, adding
time, or adding resources (thus relaxing the so-called triple constraint). These changes
may require WSDOT upper management approval.
Transfer: The team transfers the financial impact of risk by contracting out some
aspect of the work. Transference reduces the risk only if the contractor is more able to
taking steps to reduce the risk and does so.
Mitigate: The team seeks to reduce the probability or consequences of a risk event to
an acceptable threshold. They accomplish this via many different means that are specific
to the project and the risk. Mitigation steps, although costly and time-consuming, may still
be preferable to going forward with the unmitigated risk.
OPPORTUNITY REPONSES
Exploit: Action taken to insure the benefit of an opportunity is realized. Taking action
to make the opportunity happen, such actions include: assigning more talented resources
to a project to reduce time to completion, and/or to provide better quality than originally
planned.
Share: Allocating risk ownership for an opportunity to another party who is best able
to handle it, in terms of maximizing probability of occurrence and benefits if it does occur.
Transferring threats and sharing opportunities are similar in that a third party is used.
Those to whom opportunities are allocated should also be allowed to share in the potential
benefits.
 Mitigate: Enhance the opportunity by increasing the probability and/or impact
thereby maximizing benefits realized for the project. If the probability can be increased to
100% this is effectively an exploit response. Fortify the cause of the opportunity by
proactively promoting the trigger conditions. Also look at what is driving the impact
drivers to increase the projects susceptibility to the opportunity.

Accept: The project manager and the project team decide to accept certain risks. They
do not change the project plan to deal with a risk, or identify any response strategy other
than agreeing to address the risk if it occurs.

(17) Describe specifically what action will be taken and by whom.

(18) RISK OWNER Enter the name of the person responsbile for monitoring the risk event and
insuring that the risk response action is effectively implemented.

Risk Monitoring and Control Strategy (Columns 19-21) To insure risk response actions are
followed through and monitoring and reporting of the effect of the risk response action occurs. The
Risk review dates should be identified as well as that status of each review. The list of project risks
changes as the project matures, new risks develop, or anticipated risks disappear. Periodic project risk
reviews repeat the tasks of identification, analysis, and response strategies. The project manager
regularly schedules project risk reviews, and ensures that project risk is an agenda item at all Project
Team meetings. Risk ratings and prioritization commonly change during the project lifecycle.
If an unanticipated risk emerges, or a risks impact is greater than expected, the planned response
strategy and actions may not be adequate. The project manager and the Project Team must perform
additional response strategies and actions to control the risk.
Risk control involves:
q Choosing alternative response strategies
q Implementing a contingency plan
q Taking corrective actions
q Re-planning the project
The risk owner assigned to each risk reports periodically to the project manager on the effectiveness of
the plan, any unanticipated effects, and any mid-course correction that the Project Team must take to
mitigate the risk.
Monitoring and Control - Risk Management Performance Measurements
Response Cost and Cost Avoidance (Columns 22-25) provides
a convenient and succinct record of risk management, monitoring and control. It is very important for
project managers and project teams to understand that response to a risk is a pro-active endeavour.
The primary benefit of risk management is to pre-empt the threat and/or maximize the opportunity by
taking action as soon as possible after the risk event has been identified. Risk management is not a
recovery plan that is implemented after a risk event occurs but is an action plan to be utilized long
before the risk event occurs.

(Column 22) Planned Cost to Respond This is the amount the project manager plans to
spend to respond to the risk. The action taken to minimize the threat or maximize the
opportunity typically will have some dollar cost associated with it. The amount spent to respond
should of course be less than the estimated value of the risk event.

NOTE: Even if your response action is successful, in many cases a residual risk remains.

(Column 23) Estimated Cost Avoided (MIN.) This is a calculated figure as follows:
Cost is avoided by reducing/evading impact of a threat or exploiting an opportunity.
Planned Cost Avoidance = (Risk Impact Value X Probability of Occurrence) Planned Cost to Respond
(Column 23) = (Column 10 X Column 11) Column 22
Note: For column 10 the figure used will be estimated from the workshop uncertainty forecasts.
Note: For column 11 the figure used will be the most likely impact as identified in the workshop.
The calculated planned cost avoidance figure represents an estimated amount of cost burden the
project has successfully avoided by taking action to pro-actively respond to the risk event.
AFTER THE PROJECT IS COMPLETED
(Column 24) Actual Cost to Respond This is the amount actually spent to respond to the risk.
Once the project is complete, the actual cost to avoid, mitigate, or transfer the risk is known and
can be entered.
(Column 25) Estimated Actual Cost Avoidance (MIN.) calculated as follows:

Actual Cost Avoidance = (Risk Impact Value X Probability of Occurrence) Actual Cost to Respond
(Column 23) = (Column 10 X Column 11) Column 24
Note: For column 10 the figure used will be estimated from the workshop uncertainty forecasts.
Note: For column 11 the figure used will be the most likely impact as identified in the workshop.
The actual cost avoidance figure represents an estimated amount of the actual cost savings based
on the estimated cost of the risk minus the actual cost to avoid the risk.
NOTE: Even if your response action is successful, in many cases a residual risk remains.

GENERAL NOTES:
The RMP spreadsheet, for purposes of simplicity, assumes zero residual risk. As noted
above in many cases there may be residual risk after the response and the project manager will
need to insure the project team is aware of this.
 The last four columns in the spreadsheet provide a metric of the effectiveness of the risk
response efforts. This allows the project manager to monitor and control risk management
throughout the life of the project.
The RMP spreadsheet also serves as a nice project performance measurement tool.

If you have questions about this spreadsheet or other issues related to Project Risk Management
at WSDOT contact: Mark Gabel 360.705.7457.
 Project Risk Management Plan Spreadsheet (RMP) Foreword

The Washington State Department of Transportation manages 7,000 miles of road in the state. We
have a mandate to build roads on time, keep them safe and to prudently use the monetary funds we
receive for this purpose. Every year there are new road building projects. Every project has a unique
set of circumstances and risks that must be confronted and dealt with before the project is successfully
completed. Over the course of the project, some of the risks will decrease, some will remain potential,
and some will actually happen. Current thinking is that we better serve our mandate if we carefully
manage the costs of the road projects. That means managing the risks. Accordingly, we have found
the project 'Risk Management Plan' spreadsheet to be a very useful tool to help keep costs manageable.
Here we describe how risk management is structured and performed on a WSDOT project. The RMP
is a subset of the Project Management Plan and serves as a tool to identify, analyze, respond or
monitor risk.

If you have questions about this spreadsheet or other issues related to Project Risk Management
at WSDOT contact: Mark Gabel 360.705.7457.