Project Risk Management
Total Page:16
File Type:pdf, Size:1020Kb
PROJECT ADVISORY Project Risk Management Leadership Series 9 kpmg.com/nz About the Leadership Series KPMG’s Project Advisory Leadership Series is targeted towards owners of major capital programmes, but its content is applicable to all entities or stakeholders involved with major projects. The intent of the Project Leadership Series is to describe a framework for managing and controlling large capital projects based on the experience of our project professionals. Together with our simplified framework, we offer a sound approach to answer the questions most frequently asked by project owners. Project risk management Project risk management is frequently overlooked yet is one of the more critical elements to successful project delivery. Generally, delivering a project’s defined scope on time and within budget are characteristics of project success. Unfortunately, these success factors are often not achieved, especially for large complex projects where both external influences and internal project requirements may change significantly over time. Project risk management is a continuous process of identifying, analysing, prioritising and mitigating risks that threaten a projects likelihood of success in terms of cost, schedule, quality, safety and technical performance. Organisations and owners often consider project risk management activities as “nice to have” on a project rather than as a core component of project controls. Additionally there is some confusion between organisations and project teams as to what exactly constitutes risk management activities. In this paper, we provide a standard framework for risk management and discuss implementation techniques for projects of all types and sizes. This should provide you with a better understanding of how to address the following challenges: » Do we have a comprehensive project risk management policy? » What elements of project risk management are necessities for our organisation to implement? » How do we balance the requirements and controls of a risk management programme with efficient and streamlined project execution? » Are our current project risk management procedures effective at mitigating project risk? » How do we align our project specific risk management activities with our enterprise risk management objectives? » What are some key questions we should be asking about project risks throughout the project lifecycle? Defining project risk management The objective of project risk management is to understand project and programme level risks, minimise the likelihood of negative events and maximise the likelihood of positive events on projects components, which should be scalable » Available resources (staffing, budgets); and programme outcomes. Project risk to the specific project’s size and type: management is a continuous process » Preferred reporting and that begins during the planning phase 1. Strategy and planning; communication protocols; and and ends once the project is successfully 2. Risk identification; » The organisation’s strategic objectives. commissioned and turned over to operations. 3. Analysis (quantitative and qualitative); Strategy and planning activities include: Construction owners, project teams and 4. Response planning; and » Assigning roles and responsibilities contractors often define and apply risk 5. Monitoring and control. related to risk management activities; management activities differently on a identifying and defining requirements project. Owners may use informal or ad 1. Strategy and planning for project stakeholders regarding risk hoc practices, such as stage gate approval, management activities; Strategy and planning activities set that they interpret as risk management the foundation for a risk management » Establishing common risk categories for activities, contractors may define risk programme and ultimately determine identified risks. Categories can wither management as tracking potential whether the initiative is successful. be based on common industry risks change orders, and project teams may During the strategy and planning phase or on the organisations risk categories express the view that “everything we do an organisation will define how risks are (e.g. construction, financial, operations, is risk management”. While all of these addressed and managed. Strategy and governance etc); and activities help to identify and manage planning should take into consideration: discrete elements of project risk, they » Developing a risk matrix and assigning do not fully describe a comprehensive » Corporate or enterprise-wide risk risk ratings to identify risks. The risk approach to project risk management. A management guidelines (including matrix should define risk ratings based comprehensive project risk management tolerance level for risk); on probability and impact by taking into approach should have the following account the organisations risk tolerance. 2. Risk identification 3. Analysis 4. Response planning Risk identification is the identification of all The analysis phase determines the Response planning is the phase where possible risks that could either negatively or likelihood and impact of each identified the project team develops response positively affect the project. It is important in risk and prioritises risks for management actions and alternative options to reduce the risk identification process to solicit input attention. Successful risk analysis requires project risks. Project teams use response from all project stakeholders including those objective thinking and input from those planning to decide ahead of time how they outside of the core project team. Potential most familiar with the area affected by the will address possible risk occurrences and contributors to risk identification include: possible risk. Analysis is typically a two- how they will avoid, transfer, mitigate or step approach: accept project risks. Response planning » Project team members (planners, must take into consideration available engineers, architects, contractors etc); Step 1 – Qualitative analysis resources and potential repercussions » Risk management team members; of the response plans. The goal of For the qualitative analysis, the project response planning is to align risks with » Subject matter professionals team assigns a priority level (e.g high, an appropriate response based on the (IT, Safety, Legal etc); medium, low) to each risk. The priority level severity of the risk along with cost, tie and » Customers (internal and external); should be aligned with the organisations feasibility considerations. Risk response risk management plan, risk tolerance level » End users; and planning includes: and other organisational objectives. The » Organisation management priority levels can be used to rack the risks » Assigning responsibility for identified and leadership. on the risk register and develop efficient risks to appropriate project team members or stakeholders. It is Successfully capturing all project risks response plans that focus attention on imperative that the assignment takes increases with frequent communication items with a higher priority. It is important into consideration the individual’s and feedback amongst team members to identify all potential risks that will capability to address specific risk areas. and stakeholders. These discussions require follow up by the project team. Assigning a risk to someone who has should attempt to identify inaccuracies, little or no knowledge of a risk area is inconsistencies and assumptions regarding Step 2 – Quantitative analysis not an effective risk planning approach. the project. The resulting product of these For the quantitative analysis, the project working sessions should be the initial list of team assigns a most likely cost value to » Developing a response plan to address identified risks. each identified risk. This value takes into the identified risk. This process should be iterative and include all stakeholders From the initial list of identified risks, a risk consideration both the probability and affected by the risk. Common options for register or log can be populated to ensure potential impact of the risk event occurring. a response include: that all risk items are analysed, prioritised Determining probability and impact can and monitored. Risk registers should typically result from a variety of exercise including: Ì Avoidance – modifying the project plan include the following fields: » Interviews – gathering impact and to avoid the potential condition probability data for a range of scenarios or occurrence » Risk type; (e.g optimistic, most likely and Ì Transference – shifting the » Description; pessimistic) consequences and responsibilities » Cost impact; » Decision trees – comparing the associated with the risk to a third » Probability; probability of risks and rewards party (often accomplished by between various decisions contractual agreement) » Risk level; » Model simulations – conducting a Ì Mitigation – taking preventative » Possible responses; and project simulation in order to quantify action to reduce the probability of risk » Action owner. potential impacts to the project. occurrence or impact on the project Ì Acceptance – proceeding as planned and accepting the outcome of a risk. » Finalising and documenting the various risk responses identified by each responsible party. The plan should clearly define the agreed upon response for a risk, the responsible party, results from both the quantitative and qualitative analysis and a budget and timeframe for the