Why Project Risk Management?

Overview

"Those who cannot remember the past are condemned to repeat it."

—GEORGE SANTAYANA

Far too many technical projects retrace the shortcomings and errors of earlier work. Projects that successfully avoid such pitfalls are often viewed as "lucky," but there is usually more to it than that.

The Doomed Project

Every project has risk. There is always at least some level of uncertainty in a project's outcome, no matter what the Microsoft Project Gantt chart on the wall seems to imply. High-tech projects are particularly risky, for a number of reasons. First, technical projects have high variation. While there are invariably aspects of a project that resemble earlier work, every project has unique aspects and has objectives that differ from previous work in some material way. Because the environment of technical projects evolves very quickly, there can be much larger differences from one project to the next than may be found in other types of projects. In addition, technical projects are frequently staffed "lean" and may also do their work with inadequate funding and equipment. To make matters worse, there is a pervasive expectation that, however fast the most recent project may have been, the next one should be even quicker. Technical projects chronically accept aggressive challenges to execute ever more rapidly. Risks on technical projects are significant, and their number and severity continue to grow. To successfully lead such projects, you must consistently use the best practices available.

Good practices come from experience. Experience, unfortunately, generally comes from unsuccessful practices and mistakes. People learn what not to do, all too often, by doing it and then suffering the consequences. Experience can be an invaluable resource, even when it is not your own. The foundation of this book is the experiences of others—a large collection of mostly plausible ideas that did not work out as hoped.

Projects that succeed generally do so because their leaders do two things well. One is to recognize that, among the unique aspects of a new project, some parts of the work ahead have been done before and that the notes, records, and lessons learned on earlier projects can be a road map for identifying, and in many cases avoiding, the problems of earlier projects. The second thing that these leaders do well is to plan the work thoroughly, including the portions that require innovation, in order to understand the challenges ahead and to anticipate at least some of the potential problems. Using this plan, they guide and monitor the work.

Effective project risk management relies on both of these ideas. By looking backward, managers may avoid repeating past failures, and by looking forward through project planning, they can eliminate or minimize many future potential problems.

The principal ideas addressed in this chapter are:

• A definition of risk
• Macro-risk management
• Micro-risk management
• Benefits of risk management
• The overall risk management process

Risk

In projects, a risk can be almost any undesirable event associated with the work. There are many ways to characterize these risks. One of the simplest, from the insurance industry, is:

"Loss" multiplied by "Likelihood"

Risk is the product of these two factors: the expected consequences of the event and the probability that the event might occur. All risks have these two related, but distinctly different, components. Employing this concept, risk may be characterized in the aggregate for a large population of events ("macro-risk"), or it may be considered on an event-by-event basis ("micro-risk").

Both characterizations are useful for risk management, but which of these is most applicable depends on the situation. In most fields, risk is managed primarily in the aggregate, in the "macro" sense. As examples, insurance companies sell a large number of policies, commercial banks make many loans, gambling casinos and lotteries attract crowds of players, and managers of mutual funds hold large portfolios of investments. The literature of risk management for these fields (which is extensive) tends to focus on large-scale risk management, with secondary treatment for managing single-event risks.

To take a very simple example, consider throwing two fair, six-sided dice. In advance, the outcome of the event is unknown, but, through analysis, experimenting, or guessing, you can develop some expectations. The only possible outcomes for the sum of the faces of the two dice are the integers between two and twelve. One way to establish expectations is to figure out the number of possible ways there are to reach each of these totals. (For example, the total 4 can occur three ways from two dice: 1 + 3, 2 + 2, and 3 + 1.) Arranging this analysis in a histogram results in Figure 1-1. Since each of the thirty-six possible combinations is equally likely, this histogram can be used to predict the relative probability for each possible total.

Figure 1-1: Histogram of sums from two dice.

If you throw many dice, the empirical data collected (which is another method for establishing the probabilities) will generally resemble the theoretical histogram, but since the events are random it is extraordinarily unlikely that your experiments rolling dice will ever precisely match the theory. What will emerge, though, is that the average sum generated in large populations (one hundred or more throws) will be close to the calculated mean, and the shape of the histogram will also resemble the predicted theoretical distribution. Risk analysis in the macro sense takes notice of the mean, seven (which for this case is also the most likely outcome, due to symmetry), and casino games of chance played with dice are designed to make money using this fact. On the other hand, risk in the micro sense, noting the range of possible outcomes, dominates the analysis for the casino visitors, who may play such games only once; the risk associated with a single event—their next throw of the dice—is what matters.

For projects, risk management in the large sense is useful, but, from the perspective of the leader of a single project, there is no population; there is only one project. Risk management for projects reverses the emphasis of the other fields, focusing primarily on management of risk in the small sense. Both types of risk management are discussed in this book, but risk management for single events dominates.

Macro Risk Management

In the literature of the insurance and finance industries, risk is described and managed using statistical tools: data collection, sampling, and data analysis. In these fields, analysts collect and aggregate a large population of individual examples and then calculate statistics for the "loss and likelihood." Even though the individual cases in the population may vary widely, the average "loss times likelihood" tends to be fairly predictable and stable over time. When a large number of cases in the population representing various levels of loss have been collected, the population can be characterized using distributions and histograms, similar to the plot in Figure 1-2. In this case, each "loss" result that falls into a defined range is counted, and the number of observations in each range is plotted against the ranges to show the overall results.

Figure 1-2: Histogram of population data.

Various statistics and methods are used to study such populations, but the mean is the main one used for managing risk in such a population. The mean represents the typical loss—the total of all the losses divided by the number of data points. The uncertainty, or the amount of spread for the data on each side of the mean, also matters, but the mean sufficiently characterizes the population for most decisions.

In fields such as these, risk is managed mostly in the macro sense, using a large population to forecast the mean. This information may be used to set interest rates for loans, premiums for insurance policies, and expectations for stock portfolios. Because there are many loans, investments, and insurance policies, the overall expectations depend much more on the typical result. It does not matter so much how large or small the extremes are; as long as the average results remain consistent with the business objectives, risk is managed by allowing the high and low values to balance each other, providing a stable and predictable overall result.

Some project risk management in this macro sense is common at the level of an overall business. If all the projects undertaken are considered together, performance of the portfolio will depend primarily on the results of the "average" project. Some projects will fail and others may achieve spectacular results, but the aggregate performance is what impacts the business bottom line. Business performance will be judged successful as long as most projects achieve results close to expectations.

Micro Risk Management

Passive measurement, even in the fields that manage risk using large populations, is never the whole job. Studying averages is necessary, but it is never sufficient. Managing risk also involves taking action to modify the outcomes.

In the world of gambling, which is filled with students of risk on both sides of the table, knowing the odds in each game is a good starting point. Both parties also know that if they can shift the odds, they will be more successful. Casinos shift the game in roulette by adding zeros to the wheel but not including them in the calculation of the payoffs. In many casino games that use cards, such as blackjack, casino owners employ the dealers, knowing that the dealer has a statistical advantage. In blackjack the players may also shift the odds by paying attention and counting the cards, but establishments minimize this advantage through frequent shuffling of the decks and by barring known card counters from play. There are even more effective methods for shifting the odds in games of chance, but most are not legal; tactics like stacking decks of cards and loading dice are frowned upon. Fortunately, in project risk management, shifting the odds is not only completely fair; it is an excellent idea.

Managing risk in this small sense considers each case separately—every investment in a portfolio, each individual bank loan, each insurance policy, and, in the case of projects, every exposure faced by the current project. In all of these cases, standards and criteria are used to minimize the possibility of large individual variances above the mean, and actions are taken to move the expected result. Screening criteria are applied at the bank to avoid making loans to borrowers who appear to be poor credit risks. Insurers either raise the price of coverage or refuse to sell insurance to people who seem statistically more likely to generate claims. Insurance companies also use tactics, such as auto safety campaigns, aimed at reducing the frequency or severity of events that result in claims. Managers of mutual funds work to influence the boards of directors of companies whose stocks are held by the fund. All these tactics work to shift the odds—actively managing risk in the small sense.

For projects, risk management is almost entirely similar to these examples, considering each project individually. Thorough screening of projects at the overall business level attempts to select only the best opportunities. It would be excellent risk management to pick out and abort (or avoid altogether) the projects that will ultimately fail—if only it were that easy. As David Packard noted, "Half the projects at Hewlett-Packard are a waste of time. If I knew which half, I would cancel them." Risk management at the portfolio level for projects is covered in the next chapter, but the majority of this book focuses on project risk management for the single project—risk management in the small sense.

As said before, for the leader of a project, there is no population. There is only the single project, and there will be only one outcome. In most other fields, risk management is concerned primarily with the mean values of large numbers of independent events, but for project risk management, what generally matters most is predictability—managing the variation expected in the result.

For a given project, you can never know the precise outcome in advance, but, through review of data from earlier work and project planning, you can predict the range and frequency of potential outcomes that may be expected. Through analysis and planning, you can better understand the odds and take action to improve them. The goals of risk management for a single project are to establish a credible plan consistent with business objectives and then to minimize the range of possible outcomes.

One type of "loss" for a project may be measured in time. The distributions in Figure 1-3 compare timing expectations graphically for two similar projects. These plots are very different from what was shown in Figure 1-2. In that case, the plot was based on empirical measurements of a large number of actual, historical cases. The plots in Figure 1-3 are projections of what might happen for the two projects, based on assumptions and data for each. These histograms are speculative and require you to pretend that you will execute the project many times, with varying results. Developing this sort of risk characterization for projects is explored in Chapter 9, where quantifying and analyzing project risk are discussed. For the present, assume that the two projects have expectations as displayed in the two distributions.

Figure 1-3: Possible outcomes for two projects.

For these two projects, the mean (or expected) duration is the same, but the range of expected durations for Project A is much larger. Project B has a much narrower spread (the statistical variance, or standard deviation), and so it will be more likely to complete close to the expected duration. The larger range of possible durations for Project A represents higher risk, even though it also includes a small possibility of an outcome even shorter than expected for Project B. Project risk increases with the level of uncertainty.

Managing project risk requires the project team to understand the sources of variation in projects and then to minimize them wherever it is feasible. Since no project is likely to be repeated enough times to develop distributions like those in Figure 1-3 using measured, empirical data, project risk analyses depend on projections and range estimates.

Benefits and Uses of Risk Data

Developing a project plan with thorough risk analysis can involve significant effort, which may not seem necessary to many project stakeholders and even to some project leaders. In fact, the benefits and uses of appropriate project risk analysis more than justify this effort. Some of the reasons for risk management follow, and each of these is amplified in detail later in this book.

Project Justification

Project risk management is undertaken primarily to improve the chances that a project will achieve its objectives. While there are never any guarantees, broader awareness of common failure modes and ideas that make projects more robust can significantly improve the odds of success. The primary goal of project risk management is either to develop a credible foundation for each project, showing that it is possible, or to demonstrate that the project is not feasible so that it can be avoided, aborted, or transformed.

Lower Costs and Less Chaos

Adequate risk analysis reduces both the overall cost and the frustration caused by avoidable problems. The amount of rework and of unforeseen late project effort is minimized. Knowledge of the root causes of the potentially severe project problems enables project leaders and teams to work in ways that avoid these problems. Dealing with the causes of risk also minimizes "fire-fighting" and chaos during projects, much of which is focused short-term and deals primarily with symptoms rather than the intrinsic sources of the problems.

Project Priority and Management Support

Support from managers and other project stakeholders and commitment from the project team are more easily won when projects are based on thorough, understandable information. High-risk projects may begin with lower priority, but a thorough risk plan, displaying competence and good preparation for possible problems, can improve the project priority. Whenever you are successful in raising the priority of your project, you significantly reduce project risk—by opening doors, reducing obstacles, making resources available, and shortening queues for services.

Project Portfolio Management

Achieving and maintaining an appropriate mix of ongoing projects for an organization uses risk data as a key factor. The ideal project portfolio includes both lower- and higher-risk projects in proportions that are consistent with the business objectives. The process of project portfolio management and its relationship to project risk is covered in Chapter 2.

Fine Tuning Plans to Reduce Risk

Risk analysis uncovers weaknesses in a project plan and triggers changes, new activities, and resource shifts that improve the project. Risk analysis at the project level may also reveal needed shifts in overall project structure or basic assumptions.

Establishing Management Reserve

Risk analysis demonstrates the uncertainty of project outcomes and is useful in setting reserves for schedule and/or resources. Risky projects really require a window of time (or budget), instead of a single-point objective. While the project targets can be based on expectations (the "most likely" versions of the analysis), project commitments should be established with less aggressive goals, reflecting overall project risk. The target and committed objectives set a range for acceptable project results and provide visible recognition of project risk. For example, the target schedule for a risky project might be twelve months, but the committed schedule, reflecting the uncertainty, may be set at fourteen months. Completion within (or before) this range defines a successful project; only if the project takes more than fourteen months will it be considered a failure. Project risk assessment data provides both the rationale and the magnitude for the required reserve. More detail on this is found in Chapter 10.

Project Communication and Control

Project communication is more effective when there is a solid, credible plan. Risk assessments also build awareness of project exposures for the project team, showing how painful the problems might be and when and where they might occur. This causes people to work in ways that avoid project difficulties. Risk data can also be very useful in negotiations with project sponsors. Using information about the likelihood and consequences of potential problems gives project teams more influence in defining objectives, determining budgets, obtaining staff, setting deadlines, and negotiating project changes.

The Risk Management Process

The overall structure of this book mirrors the information in the Guide to the Project Management Body of Knowledge, 2000 edition (or PMBOK Guide). This guide from the Project Management Institute (PMI) is widely used as a comprehensive summary of project management processes and principles, and it is the foundation for PMI certification. The PMBOK Guide has nine Project Management Knowledge Areas:

• Project Risk Management outlines processes for identifying, analyzing, and responding to project risk.
• Project Integration Management describes processes for overall project coordination.
• Project Scope Management covers project processes that ensure that the project defines the deliverable(s) and that it includes all the work required, and only the work required, for successful project completion.
• Project Time Management describes the processes for scheduling and timely project completion.
• Project Cost Management details the processes for budgeting and project completion within the approved budget.
• Project Quality Management discusses the processes for ensuring that the project will satisfy the need(s) for which it was undertaken.
• Project Human Resource Management outlines processes for staffing and working with the people involved with the project.
• Project Communications Management covers project information management processes.
• Project Procurement Management describes the processes required to acquire outside goods and services.

Of these areas, Project Risk Management is the most central to this book, but the other eight topics are strongly related.

The PMBOK Guide is also built around five Process Groups: Initiating, Planning, Executing, Controlling, and Closing. In the PMBOK Guide, the processes are related as shown in Figure 1-4. Project Risk Management is included in two of these groups, Planning Processes and Controlling Processes.

Figure 1-4: PMBOK links among process groups.

In this book, Risk Management Planning is discussed in Chapter 2. Risk Identification is covered in Chapters 3 through 6, on scope risk, schedule risk, resource risk, and management of project constraints. The analysis and management of project risk is covered first at a detail level and then for projects as a whole. (This is a distinction not explicit in the PMBOK Guide, which addresses project-level risk only superficially.) Both Quantitative and Qualitative Risk Analysis are covered on two levels, for activity risks in Chapter 7 and for project risk in Chapter 9. Risk Response Planning is also discussed twice, in Chapter 8 for activities and in Chapter 10 for the project as a whole. The final PMBOK Guide process, Risk Monitoring and Control, is the topic of Chapter 11, and Project Closure is covered in Chapter 12.

As in the PMBOK Guide, the majority of the book aligns with project planning, but the material here goes beyond the coverage in the PMBOK Guide to focus on the "how to" of effective risk management, from the practitioner's standpoint. There is particular emphasis on ideas and tools that work well and can be easily adopted in technical projects. This book also goes significantly beyond the PMBOK Guide in many areas to include risk topics not included there. All risk management topics in the PMBOK Guide are included here, for people who may be using this book to prepare for the PMP Certification test, but not every topic will get equal coverage.

Anatomy of a Failed Project The First Panama Canal Project

Risk management is never just about looking forward. Heeding the lessons learned on projects of all types—even some very distant examples—can help you avoid problems on new projects. One such example, illustrating that people have been making similar mistakes for a long, long time, is the initial effort by the French to construct a canal across Panama.

For obvious reasons, the building of the Panama Canal was not, strictly speaking, impossible. However, the initial undertaking was certainly premature; the first canal project, begun in the late 1800s, was a massive challenge for the technology of the day. That said, lack of project management contributed significantly to the decision to go forward in the first place, the many project problems, and the ultimate failure.

Precise definition for the project was unclear, even years after it began. Planning was never thorough, and changes in the work were frequent and managed informally. Reporting on the project was sporadic and generally inaccurate (or even dishonest). Risks were not identified effectively or were ignored, and the primary risk management strategy seems to have been "hoping for the best."

Although people speculated about a canal in Central America years before actual construction began, the first serious investigation of the possibility of such a project was undertaken in the mid-1800s. Estimates were that such a canal would provide $48 million a year in shipping savings and that it might be built for less than $100 million. Further study on-site was less optimistic, but in 1850 construction of a railroad across the Isthmus of Panama started. The railroad was ultimately completed, but the $1.5 million, two-year project swelled to $8 million before it was finished, three years late, in 1855. After a slow start, the railroad did prove a financial success, but its construction problems foreshadowed the canal efforts to come.

A few years later, on the other side of the world, the Suez Canal was completed and opened in 1869. This project was sponsored and led successfully from Paris by Ferdinand de Lesseps. This triumph earned him the nickname "The Great Engineer," although he was actually a diplomat by training, not an engineer at all. He had no technical background and only modest skills as an administrator. However, he had completed a project many thought to be impossible and was now world-famous. The Suez project was a huge financial success, and de Lesseps and his backers were eager to take on new challenges.

Examining the world map, de Lesseps decided that a canal at Panama would be his next triumph, so, in the late 1870s, a French syndicate negotiated the necessary agreements in Bogota, Colombia, as Panama was then the northernmost part of Colombia. They were granted rights to build and operate a canal in exchange for a small percentage of the revenue to be generated over ninety-nine years.

While it might seem curious today that these projects so far from France originated there, in the late 1800s Paris was the center of the engineering universe. The best schools in the world were there, and many engineering giants of the day lived in Paris, including Gustave Eiffel (then planning his tower). These canal projects could hardly have arisen anywhere else.

The process of defining the Panama project started promisingly enough. In 1879, Ferdinand de Lesseps sponsored an "International Congress" to study the feasibility of a canal connecting the Atlantic and Pacific oceans through Central America. More than a hundred delegates from a large number of nations (although most of the delegates were French) gathered in Paris. A number of routes were considered, and canals through Nicaragua and Panama both were recommended as possibilities. Construction ideas, including a very realistic "lock-and-dam" concept (somewhat similar to the canal in service today), were also proposed. In the end, though, the Congress voted to support a sea-level canal project at Panama, even though nearly all the engineers present thought the idea infeasible and voted against it. Not listening to technical people is a perilous way to start a project. The Panama Canal was neither the first nor the last project to create its own problems through insufficient technical input.

Planning for the project was also a low priority. De Lesseps paid little attention to technical problems. He believed that need would result in innovation, as it had at Suez, and that the future would take care of itself. He valued his own opinions and ignored the views of those who disagreed with him, even when they were recognized authorities. An inveterate optimist, he was convinced, on the basis only of self-confidence, that he could not fail. These attitudes are not conducive to good risk management; there are few things more dangerous to a project than an overly optimistic project leader.

The broad objective de Lesseps set for his Compagnie Universelle du Canal Interoceanique was to build a sea-level canal in twelve years, to open in 1892. He raised $60 million from investors through public offerings—a lot of money, but still less than one-third of the initial engineering cost estimate of more than $200 million. In addition to this financial shortfall, the project was dogged by the fact that very little detailed planning was done before work actually commenced, and most of that occurred at the 1879 meeting in Paris. Even on the visits that de Lesseps made to Panama and New York to build support for the project, he failed to involve his technical people.

Eventually the engineers did travel to Panama, and digging started in 1882. Quickly, estimates of the volume of excavation required started to rise, to 120 million cubic meters—almost triple the estimates used in 1879. As the magnitude of the effort rose, de Lesseps made no public changes to his cost estimates or to the completion date.

Management of risks on the project, inadequate at the start, improved little in the early stages of execution. There were many problems. Panama is in the tropics, and torrential rains for much of the year created floods that impeded the digging and made the work very dangerous. The frequent rains turned Panama's clay into a flowing, sticky sludge that bogged down work, and the moist, tropical salt air combined with the viscous mud to destroy the machinery. There was also the issue of elevation. The continental divide in Panama is not too high by North or South American standards, but it does rise to more than 130 meters. For a canal to cross the central portion of Panama, it would be necessary to dig a trench more than fifteen kilometers long to this depth, an unprecedented amount of excavation. Digging the remainder of the eighty-kilometer transit across the isthmus was nearly as daunting. Adequate funding for the work was also a problem, as only a portion of the money that was raised was allocated to construction (most of the money went for publicity, including a very impressive periodic Canal Bulletin, used to build interest and support). Worst of all, diseases, especially malaria and yellow fever, were lethal to many workers not native to the tropics, and they died by the hundreds. As work progressed, the engineers, already dubious, increasingly believed the plan to dig a sea-level canal doomed.

Intense interest in the project and a steady stream of new workers kept work going, and the Canal Bulletin reported good progress (regardless of what was actually happening). As the project progressed, there were changes. Several years into the project, in 1885, the cost estimates were finally raised, and investors provided new funds that quadrupled the project budget to $240 million. The expected opening of the canal was delayed "somewhat," but no specific date was offered. Claims were made at this time that the canal was half dug, but the truth was probably less than 15 percent. Information on the project was far from trustworthy.

In 1887, costs were again revised upward, exceeding $330 million. The additional money was borrowed, as de Lesseps could find no new investors. Following years of struggle and frustration, the engineers finally won the debate over construction of a canal at sea level. Plans were shifted to construct dams on the rivers near each coast to create large lakes that would serve as much of the transit. Sets of locks would be needed to bring ships up to, and down from, these manmade lakes. While this would slow the transit of ships somewhat, it significantly reduced the necessary excavation.

Even with these changes, problems continued to mount, and, by 1889, more revisions and even more money were needed. After repeated failures to raise funding, de Lesseps liquidated the Compagnie Universelle du Canal Interoceanique, and the project ended. This collapse caused complete financial losses for all the investors. By 1892, scandals were rampant, and the bad press and blame spread far and wide. Soon the lawyers and courts of France were very busy dealing with the project's aftermath.

The French do not seem to have done a formal postproject analysis, but a look at the project in retrospect reveals more than a decade of work, in excess of $300 million spent, lots of digging, and no canal. In the wake of the years of effort, the site was ugly and an ecological mess. The cost of this project also included at least 20,000 lives lost (many workers who came to Panama died so soon after their arrival that their deaths were never recorded; some estimates of the death toll run as high as 25,000). Directly as a result of this project failure, the French government fell in 1892, ending one of the messiest and most costly project failures in history.

The leader of this project did not fare well in the wake of this disaster. Ferdinand de Lesseps was not technical, and he was misguided in his beliefs that equipment and medicines would appear when needed. He also chronically reported more progress than was real (through either poor analysis or deception; the records are not clear enough to tell). He died a broken man, in poverty. Had he never undertaken the project at Panama, he would have been remembered as the heroic builder of the Suez Canal. Instead, his name is also linked forever to the failure at Panama.

Perhaps the one positive outcome from all this was clear evidence that building a sea-level canal at Panama was all but impossible because of the rains, flooding, geology, and other challenges. These are problems that probably could not be surmounted even with current technology.

While it is not possible ever to know whether a canal at Panama could have been constructed in the 1880s, better project and risk management practices, widely available at the time, would have helped substantially. Setting a more appropriate initial objective, or at least modifying it sooner, would have improved the likelihood of success. Honest, more frequent communication—the foundation of well-run projects—would almost certainly have either forced these changes or led to earlier abandonment of the work, saving thousands of lives and a great deal of money.