# Consequence

Figure TVJl. Impact Analysis Matrix Sequence

### Step 2

Assess the probability associated with the risk event(s). This is perhaps one of the more subjective steps, although there are a number of procedures which can help. An estimate of the degree of uncertainty may be arrived at by:

Influence diagrams Risk contribution analysis Probability distribution Probability trees Risk modelling Sensitivity profiles

Where the determination of probability is particularly elusive, but important, there are more elaborate techniques available as described in Appendix C. Beware, however, of overconfidence in the accuracy of the results of these various approaches. At best, they are estimates based on good experience and thoughtful opinion.

Step 3

Assess the consequences and severity of the risk event(s) by determining:

• the criticality.

Note that amount at stake and criticality may vary with time, i.e., according to the stage in the project life cycle, as discussed earlier in Chapter II.E.

In most cases, the amount at stake and criticality can be arrived at by a simple examination of the available data and some subjective judgment. In complex situations, however, it may be necessary to develop some form of mathematical model and conduct a series of computer runs.

### Step 4

Having identified the consequences and their significance, this step involves planning to mitigate the likelihood of the risk event(s) in question, and/or developing suitable responses and contingency plans, as discussed in Chapter VI. It may even be necessary to gain more insight and gather additional information to complete this step. Either way, it should be the most creative step of all because it provides the occasion for converting risks into opportunities.

### Step 5

The final step in the process is to accumulate the results of the assessment in a set of "Conclusions and Recommendations" such that appropriate management decisions can be made with full knowledge of the apparent risks involved. Either the residual risks must be accepted, or the project abandoned.

By following these steps the management of risk and uncertainty can be directly incorporated into the early project planning process as well as dealt with expeditiously during the course of project execution.

### Risk Quantification

The application of the various techniques noted in Steps 2 and 3 above can provide insight into risk event interdependencies, the merits of further detailed consideration of specific risks, and the manner in which combined effects of risk events might be modelled mathematically. In such an analysis, especially on large projects, it is often necessary to develop a further breakdown in which each activity is numbered and documented for reference. Using this breakdown, the risks within each activity are identified by mentally stepping through all aspects of the activity to produce a comprehensive list of uncertainties.

As with the project work breakdown structure, this breakdown serves to focus discussion, to aid in identification of all risks, and to provide a basis for formalizing dependency links within the project. In this way a model may be developed in which the variables are represented by discrete probability distributions having specified linkages. This allows maximum flexibility in representing distribution shapes as well as offering mathematical simplicity. It also paves the way for solving complex combinations of dependent and independent variables by repetitive computerized calculations.

Where risk combination is analyzed by such modelling, three levels of model are typically required. These are:

1. For detailed analysis of the joint impact of a small number of risks within an activity,

2. For examining the joint effects of all risks within an activity, and

3. For examining the broad overall impact of risks from several or all activities.

This can be conceptualized as the successive summarization of a large probability tree and the resulting output shows overall distributions as they impact cost, schedule and quality. These distributions can be displayed graphically so as to show the relative importance of each contributing risk, as well as their cumulative effect. Such risk analysis is discussed in more detail in Appendix B.

In-depth project risk impact analyses are generally the purview of specialists in risk analysis who are familiar with the various technical aspects of the project management application in question. This may require a significant commitment of time and resources and may only be appropriate where there is substantial uncertainty, the stakes are high, and there is a need for significant management attention.

From the foregoing it can be seen that there are additional benefits which derive from this assessment methodology by providing:

1. The vehicle for incorporating uncertainties directly into the project management process of planning, development and implementation of the project

2. A clear understanding of the overall project's goals, objectives, scope definition and feasibility

3. What the risks really are, which are the most significant, and hence which should receive attention to lead to the most risk reduction

4. The models and techniques by which the variability and uncertainty of estimates can be conveyed quantitatively

5. An information base of quantitative and order-of-magnitude data to support trade-off decisions, such as choices between cost and performance, or the comparison of different options

6. A more rational basis for contingency planning and evaluation

7. A more consistent and workable project plan

8. An early warning for risk

It is better to avoid risks now than to encounter them later.

### D. The Basics of Probability

Probability may apply to simple on/off or go/no-go type situations such as getting approval or not getting approval, or it may be more complex and apply to ranges of probability as encountered in estimating time and cost.2

### Simple Probability

To provide a better understanding of simple probability, consider the following question and answer: "What is the probability that we shall get approval for our project next month?" "It looks good, say, about 75%!" So what is the estimated probability of this event occurring? 75%? However, it also means that there is a 25% probability that approval will not be obtained. Note that the probability of the event occurring Pr(Event) plus the probability of the event not happening Pr(No Event) equals one—always.

What if there are two related events? For example, consider the following question and answer: "What is the probability that we shall have the scope defined by next month and that we shall get approval?" "Well, it still looks pretty good, say, about 80% that it will be ready and 70% that we shall get approval." If the two events are possible but not certain, then how likely is it that they will both happen?

But Pr(Event #1) is 80%, and Pr(Event #2) is 70%, so how likely is it that both will happen?

That's barely over a 50-50 chance. Suppose that only one of these things is necessary before starting project planning. What is the probability that we shall start project planning?

Pr(No Scope) x Pr(No Approval) = Pr(No Planning) 0.30. x. 0.20 = 0.06 = 6%

The probability that neither will happen is very low, so it is 94% likely that we will start planning.

Another way to look at this problem is in three parts:

0.94 or 94% likely

### More Complex Probability

Probability ranges are more complex to deal with, especially in project work. For example, if a given human activity is repeated many times, ostensibly under identical conditions, then the actual durations experienced will nevertheless not be identical. This variation will be due to a number of influences impacting the activity such as human productivity. Theoretically, if the frequency of occurrence (i.e., the number of times that a particular duration occurs) is plotted against the time taken for the activity, the resulting plot will produce a "Gaussian" distribution curve, popularly known as a bell curve. The bell curve is typically symmetrical about its highest frequency value, in which case it is described as a normal distribution.

The probability of any particular time being taken is, strictly speaking, its number of occurrences divided by the total number of times the activity was repeated in the whole sample. This fraction may be expressed as a percentage. For example, the probability (chances) of landing a "heads" or "tails" in a coin toss is 0.5 or 50%. Similarly, the chances of pulling any given playing card from a full deck is 1 in 52, or approximately 2%.

In project work, two practical difficulties arise with the application of this theory. In the first place, a set of observations rarely exists upon which a discrete probability calculation can be made, and rarely is there the opportunity to carry out repeated runs of an activity during project planning in order to make the calculation. Consequently, where future events are being postulated, it is necessary to rely on speculation.

This leads to the second difficulty. When people are asked to speculate on probability, there is typically a tendency to be optimistic. This may be due to natural human optimism, but is more likely due to it being easier to overlook obstacles than it is to account for them. Consequently, such bell curves of probability are rarely symmetrical. Two examples are shown in Figure V.l, Chapter V. These probability distribution curves show the many values that an element might take. The concept is used in Range Estimating (see Chapter V.C).

When speculating on the probability of future events, it is usual to establish three values in order to fix the shape of the curve. These values are the two outer limits of the element plus the value which has the highest probability of occurrence, i.e. the "most likely." This simpler approach is used in PERT calculations (see Chapter V.B).

Two examples of how these might be expressed:

• The cost of project planning will fall between \$x and \$y with the cost distributed "normally" around \$z;

• Activity #B116 has a low value of "o" days, a high value of "p" days, a most likely value of "m" days with a triangular (square, stepped, bell, etc.) distribution.

The "mean" of a probability distribution curve (i.e., the value at which there is 50% of the total area under the curve on each side) is known as its "expected value," and this expected value is found by taking:

(the value an element can take) x

(probability that it will take that value)

then summing the results, i.e., the expected value is the "weighted average" (possible values weighted by their likelihood of occurrence).

The "most likely" value referred to earlier is that value which has the most likelihood of occurring. It is only the same as the "expected value" if the distribution is symmetrical around the "most likely."

Note that the sum of the "means" (expected values) is the mean of the sums (total). That is, if the total cost of a project = the sum of WBS items #1-100, then the "expected" total cost is the same as the sum of the "expected" costs for each WBS item #1-100 since these are all arrived at by calculation from the given observations. The sum of the separate "most likely" values, on the other hand, is not necessarily the "most likely" for the whole project.

When all is said and done, the project manager should be wary of false impressions of accuracy generated by extensive calculations. The assessment of the probability of an event occurring is only as good as the available historic data upon which the assessment is based, or the quality of the experience and opinions of those making the assessment.

### E. The Quality Risk

The goals of risk management are to increase understanding of the project, hence improve project plans, system delivery selection, and especially to identify where the greatest risks are likely to occur during the phases of project accomplishment. This helps to establish where management can best focus its attention during the project and much of that attention will be concentrated on containing potential overruns of schedule and cost. Presuming that the project is not complete until the entire scope is accomplished, there will nevertheless still remain a major area of project risk.

This risk can best be expressed by the question: "What if the project fails to perform as expected during its operational life?" This may well be the result of less than satisfactory quality upon project completion, and is especially true if quality is not given due attention during the project life cycle. Since the in-service life of the resulting product is typically much longer than the period required to plan and produce that product, any quality shortcomings and their effects may surface over a prolonged period of time.

Consequently, of all the project objectives, conformance to quality requirements is the one most remembered long after cost and schedule performance have faded into the past. It follows that quality management can have the most impact on the long-term actual or perceived success of the project.

This may be demonstrated by considering the long-term cash flow, including project costs, of a commercial venture as displayed in Figure IV.3. As the figure shows, the intended return-on-invest-ment could be thwarted by "poor" quality. Quality risk impacts may remain hidden or ignored, but are not forgiven if the project fails to deliver its long-term objectives.

F. The Schedule Risk

It is possible to manage the "critical path" of a schedule activity network but not manage the project duration. This is

Figure IV13. The Quality Risk: Difference Between Success and Failure

because the schedule risk3 is the "highest risk path" that contributes the most risk to project completion, and this path is not necessarily the critical path as determined by simple network analysis. In fact, the "likelihood of finishing on time" requires examination of the risks associated with all the activities necessary to reach completion.

There is risk in the duration of every activity because any duration in the future is uncertain. Therefore, duration must be measured as a range, and this is typically expressed in terms of the low, most likely (or alternatively, expected) and high durations associated with specified degrees of certainty. The extent to which the high-risk durations impact project completion will depend on the logical relationships between activities and the skillful management of available float.

Note that the longest activities are not necessarily the "riskiest" (a long-duration activity could be quite reliable). Indeed, any activity may be "highly risky," and any such activity could delay the project, whether or not it is on the critical path. Therefore, it is necessary to identify and manage all the activities that could contribute to the most delay to the project, which are not necessarily those on the critical path as observed earlier. This suggests that where significant project activity risks are involved a standard "critical path method" (CPM) may be of only limited value. However, the CPM approach could suffice if the "expected" (calculated) durations are used rather than the "most likely" (see Section D above for discussion of "expected" and "most likely").

After considering significant activity duration risks on a particular project, it is quite possible that a sound management strategy would be to forego the "expected" completion date by several days in order to reduce the overall project risk. To make this determination it would be necessary to combine activity risks along alternative paths of the schedule network. On simple networks this is relatively easy but for complex networks the process is not self-evident nor intuitive.