Risk Management (PMP)

Risk Management (PMP Exam)

Risk

• Undefined event that can impact one or more project objectives.

• All projects have risks.

• We need to document risk, plan a response, and then monitor it.

• Risks can be

  • positive - Opportunities

  • negative - threats

• Imp to know how much risk org or person is willing to take.

• Risk appetite is the amount of risk someone is willing to take for a reward

• Risk Threshold is the point at which you will not accept the risk.

• Two levels of risks.

  1. Individual project risk -

     • Specific risk that impacts the project’s scope, schedule, and cost. May impact positive or negative to project.

     • PM is concerned about this mainly

  2. Overall project risk

     • Overall project risk is sum of all the individual risks.

     • How the risks will affect the objectives of the project

     • Project sponsor is more concerned about the bigger/overall risk

• Plan continuously

Risk Processes

1. Plan Risk Mangement -P -risk register, risk report

2. Identify Risks - P -

3. Perform Qualitataive Risk Analysis - P

4. Perform Quantitative Risk Analysis - P

5. Plan Risk Responses - P

6. Implement Risk Responses-E

7. Monitor Risks (MC)

Identify Risks (P)

• Identify the risks that could affect the project throughout the project phases

• risk changes and arise every day.

• TT - Prompt List- List of categories that the team can use to help identify risks. The risk breakdown structure (RBS) is an example of a prompt list.

• Main output- risk register, risk report

Risk Register vs. Risk Report

1. Risk Register:

   • List of all the identified individual project risks

   • Can be positive or negative risks.

   • Includes details of the Response, but it’s just a possible option until the “Plan Risk Response” is completed

2. Risk Report:

   • It covers the overall project risks

   • Covers source of the overall project risks, categories, and identified threats and opportunities.

Perform Qualitative Risk Analysis (P)

• Qualitative risk analysis is the process of prioritizing the risks listed in the risk register.

• Have to determine which risk has most significance to the project

• Risk is prioritized based on its impact and its probability of occurrence.

• organization’s risk appetite and tolerance will play a big part in ranking risks

• TT- Data Analysis-

  1. Risk probability and impact assessment

     • Review risk probability and impact assessment

     • It can be done by interviewing or meeting.

     • Value'/rank it high, med, low

  2. Risk data quality assessment

     • refers to the assessment of the data used to rank the risk.

     • Source of data can lead inaccurate assessment/false ranking

• TT- Data Representation

  1. Probability and Impact Matrix

     • Table of all the risks and you assign a rating (high, medium, low) to each risk

  2. Hierarchical charts/Bubble charts (in place of Scatter Diagram):

     • Uses more parameters than the risk probability and impact.

     • Bubble chart uses three parameters instead of two

     • X-Axis, Y-Axis, and the size of the bubble.

     • Size of the bubble represents the urgency of the risk is.

Perform Quantitative Risk Analysis

• numerically analyzing the risk on the project.

• Takes time and skills to complete it

• It will not produce rank like the qualitative analysis

• TT-

  1. Expert Judgement

  2. Data Gathering

     i) Interviewing

     ii) Probability Distribution- will look at the probability of risks actually taking place.

     • Numerical analysis of probability actually taking place

  3. Interpersonal and Team skills

  4. Representation of Uncertainty

     • Representation of uncertainty, quantifying the risk probability or risk probability of distribution

  5. Data Analysis

     i) Simulations/ Monte Carlo Analysis

     • Numerical analysis of risk impacting the project

     • By simulating various scenarios and estimating the range of possible outcomes, Monte Carlo analysis helps create a more realistic and accurate budget, accounting for uncertainties and potential risks.

     ii) Sensitivity Analysis/Tornado chart

     • looks at the risk that has the most impact on a project

     • how one risk affects multiple parts of the project

     • Essentially, the left-hand side shows how much risk the variable carries, and the right-hand side shows the reward.

       iii) Expected monetary value analysis (EVM)/Decision Tree Analysis/make or buy analysis

       • assigns certain dollar amount to the risk.

       • To calculate the EMV, multiply the probability by the risk costs. Add EMV to initial cost to get the total.

Plan Risk Responses

• Do not respond to risk without assessing it

• Plan Risk Responses - TT - Strategies for Threats

  1. Escalate- outside scope of the project

  2. Avoid-eliminating the risk entirely

  3. Transfer-give the risk another company

  4. Mitigate-reducing the risk probability

  5. Accept-

• Plan Risk Responses - TT - Strategies for Opportunities

  1. Escalate

  2. Exploit- opposite to avoid. Ensure it happens

  3. Share -opposite of transfer. share with other projects

  4. Enhance-opposite of mitigate. Increase its probability

  5. Accept

• Plan Risk Responses - TT - Strategies for Overall Project Risks

  1. Avoid

  2. Exploit

  3. Transfer/Share

  4. Mitigate/Enhance

  5. Accept

Implement Risk Response

• Once the project executes, the pm should monitor the work and identify if any listed risks in the risk register materializes.

• If it materializes, then implement the risk responses that were created during the planning processes.

Agile and Hybrid Risk Management

• Agile and Hybrid projects have more uncertainty and risks

• As such frequent reviews are done at the end of each iteration

  1. Risk adjusted backlog - reprioritized product backlog for risk

  2. Risk based spikes- short proof of concept to investigate if particular solution would solve the problem.

  3. Risk burndown chart- how the risk severity changes over the duration of agile project.

     • Over the time some risks become more severe than and some become less severe.