Section Summary - Understanding Risk Management

In this section we have learnt about the basics of Risk Management that will be useful on our journey towards the PMI’s Risk Management Professional Certification.
Let us summarize what have learnt so far:

• A Risk is an uncertain event or condition that if it occurs, has a positive or negative effect on a projects objectives
• Risk Management is the act of increasing the probability and impact of positive events & decreasing the probability and impact of adverse events within a project
• The goal of risk management is to identify the risks within the project and develop a response to either reduce the impact or the probability of a negative risk. If the risk is a positive risk (opportunity) then the goal is to increase the probability and impact of the same.
• The PMBOK Guide covers the Risk Management knowledge area extensively and it is the basis on which our preparation for the RMP Certification is going to proceed
• The Risk Management Plan and the Risk Register are two important documents that are vital to efficient Risk Management
• The Environment in which the Project is executed can have a direct influence on the Project and can be a source of risks for the project. These environmental factors can be grouped into two “Internal” and “External” factors.
• The Project Organizational Structure is one of the vital Internal Factors that affects a Project. An organization can be of 3 types – Functional, Projectized or Matrix. A Matrix Organization in turn can be either a weak matrix, a balanced matrix or a strong matrix
• An Issue is something that is occurring now in the present and is currently being dealt with
• Risk Triggers are signs or indications that is risk event is about to occur or has already occurred. They are also known as Risk Symptoms or Warning Signs
• Pure risk is a type of risk that can result only in losses
• The purpose of Risk Categorization is to systematically identify risks in a consistent manner and organize them so that they can be managed better
• Uncertainty refers to the lack of knowledge of future events whether these events are positive or negative to the project.
• In almost all cases, a risk is taken in pursuit of some kind of benefit
• Part of managing risk is, knowing when to accept a risk.
• The Standard 5 Step approach to managing project risk is widely used to manage project risks and we will use it too. The 5 steps in it are:

o Risk Management Planning
o Information Gathering & Risk Identification
o Risk Assessment & analysis
o Risk Response Planning
o Plan Execution

Prev: Five Step Approach to Risk Management

Next: Risk Management Plan - An Intro

Risk Management & the PMBOK Guide

Are you PMP certified? Or have you read the PMBOK Guide? If so, you would already know that Risk Management is one of the 9 Project Management Knowledge Areas. The Risk Management Knowledge area of the PMBOK Guide will be a valuable resource in your preparation for the Risk Management Professional certification exam. Our exam preparation will closely follow how the PMBOK guide covers Risk Management.

If you are not PMP certified yet or do not have a copy of the PMBOK guide, don’t worry. In my earlier series on the PMP Certification exam preparation, I have covered the area of Risk Management in great detail. If you go through the chapters on Risk Management there, you should have more than enough information to proceed with your RMP exam preparation…

Risk Management Processes – As Per the PMBOK Guide

As per the PMBOK Guide, the Risk Management Knowledge Area is split into 6 distinct processes. Below is a short description of those processes with a link to learn more details about it. Those links contain the details regarding each of these processes from the PMBOK’s Perspective. That will be the basis for us in understanding the details that we will be covering in future from the RMP Exam perspective. So, spend some time and go through those chapters so that you establish the minimum level of knowledge required to easily progress towards the RMP Certification Examination.

The Risk Management Knowledge area includes the following Processes:

1. Plan Risk Management – Risk management planning is the process used to decide how the risk management activities for the project at hand will be performed. You can learn more about this Plan Risk Management process by Clicking Here
2. Identify Risks – The Identify Risk Process is the process where we actually identify all those uncertain events that might affect our project or its outcome. You can learn more about the Identify Risks process by Clicking Here
3. Perform Qualitative Risk Analysis – This is the process where we assess the Probability of the Risk event occurring and the Impact of the same. At the end of this process we will have a prioritized list of risks that we need to analyze further. You can learn more about the Perform Qualitative Risk Analysis process by Clicking Here
4. Perform Quantitative Risk Analysis – This is the process where we take the prioritized list of risks and apply mathematical analysis on them. You can learn more about the Perform Quantitative Risk Analysis process Clicking Here
5. Plan Risk Responses – This is the process where we will be deciding how we are going to handle the risks identified & analyzed in the previous processes if they occur. You can learn more about the Plan Risk Responses process by Clicking Here
6. Monitor & Control Risks – This is the process where we monitor the identified risks and identify & respond to new risks as they appear. You can learn more about the Monitor & Control Risks process by Clicking Here.

The whole Risk Management activity progresses step by step through these 6 processes. This is exactly how this blog is structured too. An important point to note here is that, the output of each of these processes serves as the input to the subsequent process. We will start with Plan Risk Management and progress towards Monitor & Control Risks…


The Risk Management Plan

The Risk Management Plan is the heart of our Risk Management activity and it is the artifact based on which we will be taking up each and every activity of Risk Management. The Risk Management Plan (we will call it RM Plan going forward) is a component of the Project Management Plan. We will be using the following as inputs to create the RM Plan:

a. Cost Management Plan
b. Schedule Management Plan
c. Communications Management Plan
d. Project Scope Statement
e. Organizational Process Assets &
f. Enterprise Environmental Factors

Don’t worry if you think I haven’t given much detail about the RM Plan creation here because there will be a whole section dedicated to it in future…

Key Inputs & Outputs of these Risk Management Processes

The RM Plan is the key output of the Plan Risk Management Process. As outlined in the previous paragraph on the Risk Management processes, the Identify Risks process takes this RM Plan as input and creates the Risk Register as the output. Each of the subsequent processes will take this Risk Register as input and then add or update it with more details and pass it on as input to the next process. This means that the Risk Register is going to be updated multiple times as it goes from Identify Risks to the Monitor & Control Risks process.

Along with the Risk Register, the Monitor & Control Risks process also uses Performance Reports (from the Report Project Performance process) and the Work Performance Information (from the Directing and Managing Project Execution process) that are created during the general Management of the Project. Also, any changes that may be suggested as output of this process will be submitted and put through the Perform Integrated Change Control process.

Prev: What is Project Risk?

Next: Understanding the Project Environment

What is Project Risk?

If you are preparing for the Risk Management Professional Exam or just simply reading this blog because you want to know more about risk, by now you must at least have a basic idea of what a Risk is. Unfortunately, by the term Risk, people immediately start thinking about all those negative possibilities that might impact their project outcome. Did you know that Risks can be positive too? You would be surprised to know that by the finish reading this series on Risk Management, your whole idea of what risks are is definitely bound to change. Most importantly, the way you react to risks (both positive & negative) will change too.

Before we go any further, let us take a look at the official definition of a Risk & Risk Management as per the PMBOK Guide

A Risk is an uncertain event or condition that if it occurs, has a positive or negative effect on a Project's Objectives.

Risk Management literally refers to the management of the Projects Risk. However, the official definition is:

Risk Management is the act of increasing the probability & impact of positive events and decreasing the probability & impact of adverse events within a project.

There are a lot of activities that go into planning & ensuring what is mentioned in the above two lines. All those activities put together encompass Risk Management. Positive Risks are also known as Opportunities. The scope of Risk Management is not only about how to handle the negative risks but also about how we can maximize on these opportunities.

Every Project contains some level of risk that is why Risk Management has become so important. No matter what the project or the business is, there is bound to be a certain level of Uncertainty. It is this uncertainty that represents Risks. Risk Management is central to any good Project Management practice. Unless we have sound Risk Management Practices, the chances of your project’s success is as good as we both clearing the PMI RMP Certification Examination without preparing for even a single day. Would you really want your project’s success chances to be so slim?

The Goal of Risk Management:

The goal of risk management is to identify the risks within the project and develop a response to either reduce the impact or probability that the negative risk will occur. If the risk is a positive risk (a.k.a Opportunity) the goal is to increase the probability and impact of the positive risk.

Much of Risk Management is about Planning. The Risk Management area deals with the following activities:

1. Identify Risks
2. Analyze the impact of the Risks
3. Quantify & Prioritize the Risks
4. Reduce the Impact through Risk Response Planning
5. Monitor Identified Risks
6. Uncover New Risks

Risk Management can be considered a Proactive Approach to Project Management to have a greater control of your Project and also to ensure a greater probability of success. Because a Risk involves a certain amount of Uncertainty you can never completely control the outcome. But, through proper planning you can definitely decrease the probability of negative events as well as increase the probability of positive events which is what the main purpose of this area of Risk Management.

Sweeping the risk under the rug and hoping that the risk will not occur is just plain wishful thinking on our part and can have significant consequences. So, it is important that we understand the fact that “Risk Management is not an optional activity in Project Management but a Mandatory one.”

Prev: Risk Governance

Next: Risk Management & PMBOK Guide

The Risk Management Framework

In the previous section, we learnt about the basic details about the PMI Risk Management Professional certification. This is going to be the first actual chapter in our study plan for this PMI RMP certification exam.

Overview of the Risk Management Framework

The Project Management Institute suggests a Framework that is tried & tested and widely used to manage project risks. It is extremely important to understand the basics of this Risk Management Framework.

There are 4 key domains in this Risk Management Framework. They are:

1. Risk Communication
2. Risk Analysis
3. Risk Response Planning &
4. Risk Governance

Our study plan will be revolving around each of these 4 domains of the Risk Management Framework. Before we go any further into these individual domains, let us now look at the basic details related to these domains and also look at the Exam Objectives that we need to focus on for the PMI RMP Exam.

Risk Communication

The Risk Communication domain deals with how effectively we can communicate about risk related events with all the Project Stakeholders. Risk Communication plays a key role in the overall Risk Management strategy because, as the Project Manager, it is our foremost priority to keep all stakeholders apprised of the Situation in the Project. They key exam objectives of this domain are:

a. Apply Interpersonal Skills
b. Assess Stakeholder Risk Tolerance
c. Document Risk Related Information &
d. Create Regular Status Reports

Risk Analysis

The Risk Analysis domain is by-far the most critical domain of the Risk Management Framework in terms of the impact it can have on the overall Risk Management Strategy in the Project. This is because, unless you can analyze risks properly you cannot plan effectively plan how to handle them and eventually result in project delays and losses. The key exam objectives of this domain are:

a. Identify Risks
b. Evaluate Risks using Quantitative & Qualitative Risk Analysis
c. Prioritize Risks
d. Establish Control Limits

Risk Response Planning

The Risk Response Planning domain too is a very critical domain of the Risk Management Framework because, this is where we actually create plans on how we are going to handle the risk events if they occur. Unless our response is appropriate, the risk will cause project delays and losses. The key exam objectives of this domain are:

a. Develop a Risk Response Strategy
b. Develop a Contingency Approach & Plan
c. Present the Recommendations to Key Stakeholders

Risk Governance

The Risk Governance domain sets up baselines & standards that you wish your project to follow. This is where we actually handle the risk events when they occur. We also take necessary steps to improve our process to ensure that the chances of risk events occurring are kept to the minimum. The key exam objectives of this domain are:

a. Document Lessons Learned
b. Refine Risk Policies & Practices
c. Create the Risk Management Plan
d. Establish metrics for the Risk Management Processes
e. Examine Process Performance
f. Monitor Risk Performance
g. Identify Relevant Policies & Standards

If all this information seems overwhelming to you, just relax and go through the chapter once more. This is just the first chapter. We still have a very long way to go where we will be covering each of these areas in detail…

Prev: Study Plan for the RMP Certification

Next: Risk Communication

Chapter 31: Risk Management during Monitoring & Controlling the Project

Aim: To understand the Monitor and Control Risks process

The monitor and control risk process enables the project manager to keep track of how risk responses are performing against the plan, as well as the place where new risks to the project are managed.

There could be cases in which risk might be identified as having a material impact to the enterprise but not to the project. For these risk types, the project must allow for an alternative communication path that forwards alerts to the people in enterprise risk management functions. In addition, the project manager must remember that risks can have negative and positive effects. For example, consider a project for a bridge that interconnects two roads with a max traffic flow of 10,000 cars and 300 tons. A weather event forces a traffic change from other roads, which doubles the capacity requirements for the bridge for at least 18 months after project completion. Although this wrinkle does not directly affect the project’s deliverable, it is important to consider the new information. In this case, the added traffic could affect the lifespan and performance of the deliverable after delivery.

The table below shows the inputs, tools and techniques, and outputs for the monitor and control risks process.

Monitor and Control Risks
Inputs	Tools & Techniques	Outputs
Risk register Project management plan updates Work performance information Performance reports	Risk assessment Risk audits Variance and trend analysis Technical performance measurement Reserve analysis Status meetings	Risk register updates Organizational processes assets Change requests Project management plan updates Project document updates

Remember that to determine how much of an effect a risk will have, multiply its probability by its material impact. As the probability of risk materialization increases, the risk register should make resource (money, equipment, people, and time) allocations ahead of time, thus increasing reserves. It is also important that the risk management plan include the processes that would replenish these reserves before they become depleted.

The purpose of project risk control is to

• Identify the events that can have a direct effect in the project deliverables
• Assign qualitative and quantitative weight—the probability and consequences of these events that might impact the project deliverables
• Produce alternate paths of execution for events that are out of your control or cannot be mitigated
• Implement a continuous process for identifying, qualifying, quantifying, and responding to new risks

The risk register accounts for positive and negative risks. A positive risk is a risk taken by the project because its potential benefits outweigh the traditional approach. A negative risk is one that could negatively influence the cost of the project or its schedule.

One of the techniques to evaluate risk control and monitoring effectiveness is to compare actual risk resolution practices to those that were planned at the time the risk was identified. Any deviations (negative or positive), would be cause to implement a corrective action in the risk management plan.

Exam Trivia:

Risk triggers are those events that cause the threat of a risk to become a reality. For example, you have identified the fact that you only have one water pump station available and the replacement takes six weeks to arrive. In the middle of your irrigation and recycling process tests, you discover that water pressure tends to fluctuate beyond pump tolerance levels. If you do not find a way to solve this problem your risk will become a reality.

Remember that for each identified risk, it is important to provide a response plan. It is not much help if the risk becomes a reality and there is no alternate execution path or an emergency procurement plan.

Exam Trivia:

Business risks and pure risks are different because a pure risk takes into account impacts on loss of financial profits, and business risk concentrates on events that might cause a company to lose position with its investors or to have financial difficulty.

In addition, the risk reserves must be evaluated to determine the best way to replenish them. Some examples of events that could have a negative impact in your risk mitigation and control strategies are

• Resource shortage
• Scope creep
• Contractual issues
• Lack of key resources availability

To know more about the Monitor & Control Risks process Click Here

Prev: Chapter 30

Next: Chapter 32

Monitoring And Controlling the Project

The following are the important themes that you must remember from the PMI Perspective with respect to the Monitoring & Controlling Phase of the Project.

1. Project changes should be expected, planned for, and well managed.
2. Out-of-scope work (gold-plating) adds no value to the project and should be avoided.
3. Scope verification ensures that the work product is formally accepted. Quality assurance ensures the correctness of the work product.
4. Lessons learned are important resources for planning and future projects. Maintaining the lessons learned during project control is important.
5. All change-control systems should include guidance on the following factors;
o How to influence the factors that cause change
o How to detect when a change has occurred
o How to obtain agreement on a change activity
o How to manage the change
6. Earned value is the preferred project controlling and performance reporting technique.
7. Cost variance (CV) = earned value – actual costs (EV – AC)
8. Cost Performance Index (CPI) = earned value / actual costs (EV / AC)
9. Schedule variance (SV) = earned value – planned value (EV – PV)
10. Schedule Performance Index (SPI) = earned value / planned value (EV / PV)
11. Estimate at completion (EAC) = budget at completion (BAC) / CPI
12. Estimate to complete (ETC) = EAC - actual costs (AC)
13. Variances are always “earned value” minus something. Performance indexes are always “earned value” divided by something.
14. Performance indexes of less than 1 are unfavorable. Nearer the index is to ‘1’ the better.
15. Practically speaking maintaining the SPI or CPI at exactly ‘1’ is very difficult. Most practical managers expect to maintain it around 0.95 to 1.05
16. Quality control focuses on measurement. Quality assurance focuses on all the planned and systematic quality activities within the project.
17. The key quality control tools and techniques are control charts, pareto analysis (80/20 rule), Ishikawa diagrams (cause and effect, fishbone), trend analysis, and statistical sampling.
18. Preventing a risk event is always preferred to mitigating a risk event.
19. A key goal of effective risk management is to have a response plan ready (that is, a mitigation strategy) to be implemented if the risk event occurs.
20. Risk management may require re-planning, developing alternate strategies, and re-baselining the project, depending on the severity of the new risk that was identified.

Exam Trivia:

Gold Plating or Value Addition is something that large IT company’s expect its employees to do as a mandatory activity during project work. But, from PMI’s perspective Gold Plating is prohibited and project managers and team members are not supposed to do stuff that is not part of the Project Scope. Though you might be asked to do so by your management and you may do it as part of your work, you must not select that as a choice in the exam.

Other PMI Themes:

General PMI Themes
Project Framework
Project Initiation
Project Planning
Project Execution
Project Closure
Ethics & Professional Responsibility

Points to Remember: Project Risk Management

A risk is any uncertain event or condition that might affect your project.

Not all risks are negative. Some events (like finding an easier way to do an activity) or conditions (like lower prices for certain materials) can help your project! When this happens, we call it an opportunity… but it’s still handled just like a risk.

Risk Breakdown Structure (RBS) is a great tool for managing your risk categories. It looks like a WBS, except instead of tasks it shows how the risks break down into categories.

It’s important to come up with probability and impact guidelines to help you figure out how big a risk’s impact is. The impact tells you how much damage the risk will cause to your project. A lot of projects classify impact on a scale from minimal to severe, or from very low to very high. The plan should also give you a scale to help figure out the probability of the risk. Some risks are very likely; others aren’t.

All four of the Risk Management processes are in the Planning process group—you need to plan for your project’s risks before you start executing the project.

The goal of all of the risk planning processes is to produce the risk register. That’s your main weapon against risk. It’s a list of all of the risks and some initial ideas about how you’d respond to them.

The risk register is built into the Risk Management Plan. Updates to the risk register are the only output of the Identify Risks process.

Perform Qualitative Risk Analysis helps you prioritize each risk and figure out its probability and impact. The only output of Perform Qualitative Risk Analysis is the updated risk register.

Sometimes you’ll find that some risks have obviously low probability and impact, so you won’t put them in the main section of your register. Instead, you can add them to a separate section called the watchlist, which is just a list of risks. It’ll include risks you don’t want to forget about, but which you don’t need to track as closely. You’ll check your watchlist from time to time to keep an eye on things.

The first step in risk management is Identify Risks, where you work with the whole team to figure out what risks could affect your project.

Qualitative and quantitative analysis are all about ranking risks based on their probability and impact.

Qualitative analysis is where you take the categories in your risk plan and assign them to each of the risks that you’ve identified.

Quantitative analysis focuses on gathering numbers to help evaluate risks and make the best decisions about how to handle them.

Decision Tree Analysis is one kind of Expected Monetary Value analysis. It focuses on adding up all of the costs of a decisions being made on a project so that you can see the overall value of risk responses.

To calculate EMV, be sure to treat all negative risks as negative numbers and all opportunities as positive ones. Then add up all of the numbers on your decision tree.

Don’t forget watchlists. They let you monitor lower-priority risks so that you can see if triggers for those risks occur and you need to treat them as higher priorities.

All of the processes in Risk Management are Planning or Monitoring & Controlling processes. There are no Executing processes here. Since the goal is to plan for risks, there is no need to focus on actually doing the work. By then, it’s too late to plan for risks.

Your risk register should include both threats and opportunities. Opportunities have positive impact values, while threats have negative ones. Don’t forget the plus or minus sign when you’re calculating EMV.

Plan Risk Responses is figuring out what you’ll do if risks happen.

Risk monitoring should be done at every status meeting.

The better you prepare for risks, the more secure your project is against the unknown.


Points to Remember - Other Topics:

Introduction to Projects & Project Management
Relationship Between Knowledge Areas & Process Groups
Project Integration Management
Project Scope Management
Project Time Management
Project Cost Management
Project Quality Management
Human Resource Management
Project Communication Management
Project Procurement Management
Ethics & Professional Responsibility

Points to Remember: Relation Between Knowledge Areas & Process Groups

Knowledge Area	Initiating Process Group	Planning Process Group	Executing Process Group	Monitoring and Controlling Process Group	Closing Process Group
Project Management Integration	Develop Project Charter	Develop Project Management Plan	Direct and Manage Project Execution	Monitor and Control Project Work Perform Integrated Change Control	Close Project or Phase
Project Scope Management	-	Collect Requirements Define Scope Create WBS	-	Verify Scope Control Scope	-
Project Time Management	-	Define Activities Sequence Activities Estimate Activity Resources Estimate Activity Durations Develop Schedule	-	Control Schedule	-
Project Cost Management	-	Estimate Costs Determine Budgeting	-	Control Costs	-
Project Quality	-	Plan Quality Management	Perform Quality Assurance	Perform Quality Control	-
Project Human Resources Management	-	Develop Human Resource Plan	Acquire Project Team Develop Project Team Manage Project Team	-	-
Project Communications Management	Identify Stakeholders	Plan Communications	Distribute Information Manage Stakeholder Expectations	Report Performance	-
Project Risk Management	-	Plan Risk Management Identify Risks Perform Qualitative Risk Analysis Perform Quantitative Risk Analysis Plan Risk Responses	-	Monitor and Control Risks	-
Project Procurement Management	-	Plan Procurements	Conduct Procurements	Administer Procurements	Close Procurements

Points to Remember - Other Topics:

Introduction to Projects & Project Management
Project Integration Management
Project Scope Management
Project Time Management
Project Cost Management
Project Quality Management
Human Resource Management
Project Communication Management
Project Risk Management
Project Procurement Management
Ethics & Professional Responsibility

Chapter 80: Monitoring and Controlling Risks

Risks are monitored and controlled by using the Monitor and Control Risks process. We have already covered the big picture of risk management in Chapter 49

For your reference, the image is displayed again below:

You must actively monitor the identified risks and identify & respond to new risks as they appear. The risk monitoring and controlling process is used to monitor and control risks and includes the following goals:

• Tracking identified risks
• Monitoring residual risks (risks that remain after risk responses have been implemented)
• Identifying new risks and preparing responses for them
• Executing the risk plan and evaluating its effectiveness

However, the risk situation can change from time to time. Therefore, monitoring and controlling risks also includes monitoring risk dynamics, which involves:

• Ensuring that the project execution is conforming to the risk management policies and procedures.
• Determining whether the project assumptions are still valid. If an assumption becomes invalid, it may eliminate a risk or may give rise to a new risk.
• Determining whether the current analysis has changed the risk assessment. The change in the risk assessment may require changes in other aspects of the project, such as cost, schedule, and contingency reserves.

The Monitor & Control Risks Process can be illustrated using the picture below:

Inputs to Monitoring & Controlling Risks Process

The risk register and risk management plan contain the list of risks you identified during risk planning and the responses you will execute if the risks occur. Work performance information from project execution and performance reports is also useful in monitoring risks. These items can help you determine whether risk response plans are being implemented, if those implementations are producing the desired results, and if there are signs of new risks.
To monitor and control risks, you must have a list of identified risks, a plan to deal with the risks, and the signs of risk occurrence. Accordingly, the input items to risk monitoring and controlling are risk management plans, risk registers, approved change requests, and work performance information.

Tools and Techniques for Risk Monitoring and Controlling

There are some tools and techniques available to detect risk triggers, to respond effectively to the risks that have occurred, and to identify new risks. They are:
Risk reassessment - Risks should be continually reassessed as the project progresses. For example, a risk on the watch list might become important enough that you might need to prepare a response plan for it. On the other hand, a risk may disappear and should then be closed. For ex: A risk that the web server may not be delivered on-time by the vendor may be closed the moment the physical device is delivered to us. Under such a situation, this particular risk needs to be closed.

Risk audits - A risk audit is conducted to examine the following:

• Root causes of the identified risks
• Effectiveness of responses to the identified risks
• Effectiveness of risk management processes

The project manager is responsible for ensuring that risk assessments and risk audits are conducted with needed frequency.

Risk analyses - Risk analyses are necessary to effectively respond to risks that have occurred, to detect risk triggers, and to identify new risks. The following two kinds of analyses are appropriate for risk monitoring:

• Variance and trend analysis - Trends in project performance should be reviewed on a regular basis as the project execution progresses. These trends can be determined by analyzing the performance data based on various performance control techniques, such as variance and earned value analysis. This analysis can help in detecting new risks.
• Reserve analysis - Recall that the contingency reserve is the amount of funds or time (in the schedule) in addition to the planned budget reserved to keep the impact of risks to an acceptable level when the project is executing. The risks occurring during project execution can have positive or negative effects on contingency reserve. You perform reserve analysis at a given time to compare the remaining reserve amount to the remaining risk to determine whether the remaining reserve amount is adequate.

Technical performance measurement - Technical performance measurements compare actual versus planned parameters related to the overall technical progress of the project. The deviation determines the degree to which system requirements are met in terms of performance, cost, schedule, and progress in implementing risk handling. The parameters chosen to measure technical performance could be any parameters that represent something important related to the project objectives and requirements; software performance, human resource performance, and system test performance are some examples.

Status meetings - You should always put risk management as an agenda item at project status meetings. The time spent on this item will depend on the number of identified risks, their priorities, and the complexity of the responses planned for them. Nevertheless, keeping risk on your agenda and discussing risks with the team on a regular basis helps make risk management smoother and more effective.

Output from Risk Monitoring and Controlling

The output of monitoring risks includes recommendations for actions and requests for changes to control the risks. The detailed outputs include:

Change requests - You will need to make some change requests as a result of risk monitoring and controlling. The change requests may arise from recommended actions. For example, recommended actions, such as contingency plans and workarounds, might result in requirements to change some elements of the project management plan to respond to certain risks. Of course, the change requests will need to go through the integrated change control process for approval, and the approved change requests will become the input to the Direct and Manage Project Execution process for implementation.

There are two kinds of actions recommended as a result of risk monitoring: corrective actions and preventive actions. Corrective actions include contingency plans and workaround plans. A workaround is a response to a negative risk that has occurred. A workaround is based on a quick solution and is not planned in advance of the risk occurrence event. Preventive actions are recommended to bring the project into compliance with the project management plan. Recommended corrective and preventive actions are input to the integrated change control process.

Updates - The risk monitoring and controlling processes might require updates to the following items:

• Risk register - You might need to include the following updates to the risk register:

o Outcomes of risk reassessments, risk reviews, and risk audits
o Outcomes of risks and responses to risks

• Project management plan - The project management plan might need to be updated as a result of risk monitoring and controlling. For example, change requests might change the risk management processes, which in turn will change the project management plan.
• Organizational process assets - As a result of the risk monitoring and controlling processes, some organizational process assets might need to be updated, such as templates for the project management plan, the historical information database for such information as actual costs and durations of project activities, the lessons-learned knowledge database, and checklists.

Prev: Controlling Quality

Next: Performance Reporting

Chapter 50: Planning Risk Management

In the previous chapter, we saw the big picture of risk management and the next step now is to plan for managing risks in our project.
So, lets get started!!!

Planning Risk Management

Risk management planning is the process used to decide how the risk management activities for the project at hand will be performed. The major goals for planning risk management are threefold: Ensure that the type, level, and visibility of risk management are proportionate to the actual risk involved in the project and the importance of the project to the organization; secure sufficient resources, including time for risk management activities; and set up an agreed-upon basis for evaluating risks.
To be more explicit, you use the risk management planning process to determine the following:
• How to approach the risk management activities for this project
• How to plan the risk management activities
• How to execute the risk management activities
The picture below explains the process used for Planning Risk Management:

Developing the Risk Management Plan

You perform risk management planning to develop a document called the risk management plan. As an input to this development process, you need to look at the project scope statement, which contains elements such as the following, which are relevant to risk management planning:
• Assumptions and constraints - Assumptions should be evaluated for their uncertainty and thereby the possible risks. Constraints represent fixed parameters, such as available funds and deadlines that can also pose risks to the project.
• Project objectives and requirements - You must address the risks that might prevent the team from meeting the project objectives and requirements.
• Product description - There might be risks involved in performing the work for meeting the product description.
• Initial risk identification - The project scope statement might contain some of the risks you initially identified. Now you have more information to build on that work.
The cost management plan may have information on risks related to budget, contingency, and management reserves. The schedule management plan may have information on how the schedule contingencies will be used and reported. The communication management plan should have information on who should receive reports about the different risks.

The enterprise environmental factors relevant to risk planning include the organizational attitude toward risks and the risk tolerance level of the organization. This information can be found from the policy statements of the organization and from actual experience with previous projects. The organizational process assets relevant to risk planning include organizational approaches toward risk management, definitions of concepts and terms used within the organization, standard risk templates you can use, a roles and responsibilities list, and authority levels for decision making.

You develop the risk management plan by holding planning meetings, which might include the following attendees:
• Project manager
• Selected members from the project team (Usually the team leads and other experienced members of the team)
• Selected stakeholders
• Any member from the performing organization who has responsibility for risk planning and executing

In these meetings, the input items are used to develop the risk management plan, the only output of the risk management planning process.

Risk Management Plan

The only output of the Plan Risk Management process is the risk management plan, which includes the following elements.

Methodology - This specifies the system of approaches, tools, and data sources that will be used to perform risk management on the project at hand. These tools and approaches might vary over projects, so you have to make the best selection for the given project.
Identifying and assigning resources - This identifies and assigns resources for risk management, such as human resources, cost, and time.
• Roles and responsibilities - This specifies the roles and responsibilities for each role involved in risk management. These roles are assigned to members of the risk management team. The risk management team might include members from outside the project team.
• Budgeting - The cost for risk management activities needs to be estimated and included in the budget and the project cost baseline.
• Timing and scheduling - The plan specifies how often risk management processes will be performed and which risk management activities will be included in the project schedule, which is planned and developed by using processes discussed in the chapter on Planning for Project Schedule and Communication.

Risk categories - This element specifies how the risks will be categorized. The risk categories typically correspond to the sources of risks. Depending upon the size and complexity of the project, you might need to develop a risk breakdown structure (RBS), which is a hierarchical structure that breaks the identified risk categories into subcategories. In developing this structure, you will end up identifying various areas and causes of potential risks. The performing organization might already have prepared a categorization of typical risks. However, you need to examine this categorization for each project and tailor it according to the needs of the project at hand. The risk categorization helps you identify risks to the extent that you will be identifying various areas and causes of potential risks for your project.

Risk probability and impact - Defining different levels of risk probabilities and impacts is necessary to ensure the quality and credibility of the qualitative risk analysis that we will discuss in just a bit. The basic issues are defining the scale of likelihood that the risk will happen and defining the scale of the strength of its impact if the risk occurs. These definitions, even if they already exist in the organization, must be examined and tailored to the needs of the specific project.

You can define the risk probability scale from very unlikely to almost certainly, called the relative scale. As an alternative, you can define a numerical scale in which the probability is represented by numbers, in which a value close to 0.0 means very unlikely and a value close to 1.0 means almost certainly. The impact scale represents the size of the risk impact on the given project objective should the risk occur. Just like the probability scale, you can define the impact scale relatively or numerically. The relative scale can range from very low impact to very high impact, with points in the middle such as low, moderate, and high. As an alternative, you can define the impact numerically; it might be linear, such as the first point at 0.1, the second point at 0.2, and the tenth point at 1.0, or it might be nonlinear, such as the first point at 0.001, the second point at 0.01, and the third point at 0.1.

Look at the picture below for a simple example: It shows an example of linear and nonlinear impact scales, in which the impact scale for Objective 1 is nonlinear and the impact scale for Objective 2 is linear. You can think of the X axis as a variable on which the risk impact depends.

Risks are prioritized according to the size of their impact on the project objectives, which can be recorded in what is called an impact matrix or lookup table. Even if your organization already has a typical impact matrix, you should examine it and tailor it to the needs of the specific project at hand. I will discuss the probability and impact matrix in more detail later in this chapter.

To understand the risk impact better, lets look at a sample that defines the impact of risks on the various project objectives.

Project Objectives	Very Low (0.05)	Low (0.10)	Moderate (0.35)	High (0.65)	Very High (0.90)
Time	Insignificant time increase	1-10% time increase	10-30% time increase	30-60% time increase	60-100% time increase
Cost	Less than 1% cost increase	1-20% cost increase	20-50% cost increase	50-80% cost increase	80-100% cost increase
Scope	Scope decrease unnoticeable	Scope of only a few minor areas affected	Sponsor approval necessary for scope reduction	Scope reduction unacceptable to the sponsor	Project and item are effectively useless
Quality	Unnoticeable quality reduction	Only a few applications will be affected	Quality requires sponsor approval	Quality reduction unacceptable	Project and item are effectively useless

A point to note is that, this example shows only the negative impact.

Risk reporting and tracking - This element describes the format of risk reports, such as the risk register, a document that contains the results of risk analysis and risk response planning. Furthermore, it describes how different aspects of risk activities will be recorded so that the risks can be monitored for the current project. Also, should the performing organization decide to audit the risk management process, one should be able to track these activities. Another reason for recording these activities could be to save the information for the benefit of future projects in the form of lessons learned.

During the process of planning risk management for a specific project, you revisit the tolerance levels of the stakeholders for certain risks, and these levels may be revised. Risk management planning is the process that generates the risk management plan document, which contains the information that will be used in risk identification, risk analysis, and risk response planning.
You cannot manage a risk if it’s not identified. Dont worry, thats going to be the next chapter.


Prev: Big Picture of Risk Management

Next: Identifying Risks

Chapter 49: The Big Picture of Risk Management

The word Risk signifies or means Danger and our perception is that, whenever it happens, the result will be negative or something undesirable. That’s the general description but we are preparing for PMP and what the PMI says matters!!!

According to PMI

Risk is an uncertain event or condition that if occurs, has a positive or negative effect on meeting the project objectives related to components such as schedule (time), cost, scope or Quality.

For example, one of the obvious schedule objectives for a project is to complete the project by the scheduled deadline. If a risk related to the schedule occurs, it can delay the completion of the project, or it can make it possible to finish the project earlier. So, the two characteristics of a risk in project management are the following:

• It stems from elements of uncertainty.
• It might have negative or positive effects on meeting the project objectives.

Risk management includes planning risk management, identifying and analyzing the risks, preparing the response plan, monitoring the risk, and implementing the risk response if the risk occurs.

Look at the picture below that explains the big picture of Risk Management

The picture above shows the corresponding processes used to accomplish these tasks, which are also explained below:
• Plan Risk Management - A process to determine the how of risk management: how to conduct risk management for the project at hand.
• Identify Risks - A process to identify and document the risks that might occur for a given project.
• Perform Qualitative Risk Analysis - A process used to estimate the overall probability for risks to occur and their impact and to prioritize them accordingly for further analysis.
• Perform Quantitative Risk Analysis - A process used to analyze numerically the effect of identified risks on meeting the project objectives.
• Plan Risk Responses - A process used to prepare a risk response plan in order to increase the positive impact and decrease the negative impact of risks on the project.
• Monitor and Control Risks - A process used for tracking identified risks, identifying new risks, executing risk response plans, and evaluating the effectiveness of executing responses throughout the lifecycle of the project.

The risk monitoring and control process is part of the control process group; therefore, we will discuss them later while discussing Monitoring and Controlling Quality and Risk. The other five processes will be discussed in the next few chapters.

Trivia:
The data flow between the different processes as shown in the picture above is true in general. However, a point to note is that, depending upon the project and the experience of the risk management team, shortcuts can be taken. For example, you can go directly from risk identification to quantitative risk analysis, or even to risk response planning depending on how comfortable you are with respect to these tasks.

Prev: Planning Quality

Next: Planning Risk Management

Chapter 46: Introduction to Quality & Risk Management

Till now we have covered how to plan for a project scope, project resources and project procurement. The next planning we need to do is “Planning the Projects Quality & Risk”. In the next few chapters, we will be covering these in details.

So, lets get started!!!

Why Quality & Risk Management is Essential?

Quality and risk are two important interrelated aspects of any project that need to be managed. While quality refers to the degree to which a set of characteristics of project deliverables and objectives fulfill the project requirements, risk refers to an uncertain event or condition that, if it occurs, has a positive or negative effect on meeting the project objectives.

Consider the following two scenarios:

Scenario 1:

Your project just went live. You have created an online banking website for some bank in America and the website is live. As soon as customers start using the website, it is frequently crashing, customers are not able to view their account balance or perform fund transfer. All in all, the website isn’t meeting its required objectives. What went wrong here?

There was no quality management done. The quality of the work product delivered to the customer isn’t up to expectations and hence it’s a total disaster.

Scenario 2:

Lets say, you are on your way to deliver a major online banking website for a large bank in America. You are midway through the project and suddenly your Technical Lead has resigned. He was the center point for all technical discussions in the project and his departure is going to leave a big void and now people are worried that we may not be able to finish the project. What went wrong here?

There was no risk management done. Every project has its own set of inherent risks that may delay the project delivery and if we fail to plan for such risks, the project will be a total disaster.

After you have planned the project scope to the WBS level, as discussed in the previous chapters, you are ready to plan the quality and risk management. After the project starts executing, you will not have enough time to plan a response to a risk if it occurs, so you need to plan risk responses before the project starts executing. To do that, you need to identify the risks and analyze them.

So, the main things we will learn in this section are:
1. How do you plan for quality and risk management?
2. Learn how to plan quality
3. Identify and analyze risks
4. Plan risk responses.

This chapter is just an introduction and we will jump into the details in the subsequent chapters.

Prev: Important Terms - Project Resource Planning

Next: Big Picture of Quality Management

Chapter 24: Planning the Project

In the previous chapters, we learnt how to Initiate a Project, how to create a project charter, how to identify stakeholders and how to prepare a stakeholder management strategy.

The next big step after initiating a project is to plan for the project.

What is Project Planning?

Any Project that needs to be executed has to be planned. Any tasks that was begun without proper planning and due diligence is almost always a failure. So, as a responsible project manager you have to plan your project properly to ensure that, your baby is a success. After all, which project manager wants to spend months of his time on a failing cause? Atleast, I don’t …

What are the Phases Involved in Project Planning?

Project Planning involves 4 important phases. They are:

1. Planning the Project Scope
2. Planning the Project Resources
3. Planning the Project Schedule
4. Planning Quality & Risk Management

Each of these 4 phases is equally important and have a significant impact on the success of the project.

As Project Managers we need to put in dedicated effort to plan for each of these phases and as expected, the PMP exam covers each of these in depth.

In the forthcoming chapters, we will be starting with Project Scope Management and then move on to the other phases in Project Planning one by one.

Previous: Important Terms & Definitions

Next: Introduction to Project Planning

Chapter 7: Project Management Knowledge Areas

In the previous chapter, we saw the project lifecycle in detail. In this chapter, we are going to take a look at the Project Management Knowledge Areas.

So, lets get started!!!

Project Management Knowledge Areas

Managing projects requires applying knowledge, skills, and tools and techniques to project activities in order to meet the project objectives. You do this by performing some processes at various stages of the project, as discussed in the previous chapter. That means processes are part of the knowledge required to manage projects. Each aspect of a project is managed by using the corresponding knowledge area. For example, each project has a scope that needs to be managed, and the knowledge required to manage scope is in the knowledge area called project scope management. To perform the project work within the project scope, you need human resources, which need to be managed; the knowledge used to manage human resources is called human resource management.

I guess, by now you have a fair idea of where we are getting to.

Each process belongs to one of the nine knowledge areas:

1. Scope Management
2. Time Management
3. Cost Management
4. Human Resource Management
5. Procurement Management
6. Risk Management
7. Quality Management
8. Integration Management
9. Communications Management
10. Stakeholder Management (This Knowledge Area was introduced in PMBOK 5th Edition)

Each knowledge area has its own place in the project lifecycle and they are all equally important from a project managers point of view. In practical experience you might fine one or more areas to have a greater impact on the outcome of the project, but nonetheless they are all important and play a vital role in the success or failure of a project.

Let us now look at each of these knowledge areas in detail…

Project scope management

The primary purpose of project scope management is to ensure that all the required work and only the required work is performed to complete the project successfully. This is accomplished by defining and controlling what is included in the project and what is not.

Obviously, these activities are performed by using the corresponding processes. So, project scope management, in part, defines the work required to complete the project. It’s a finite amount of work and will require a finite amount of time and resources. These need to be managed as well. The other knowledge areas cover them.

Project time management

The primary purpose of project time management is to develop and control the project schedule. Any project has a timeline by which it is expected to be completed and a well managed project is expected to complete by the set timelines.

Trivia:
Even though project time management takes care of all requisite parameters to manage the timelines of a project effectively, in reality you might find that the project managers are running around like headless chickens trying to get the project completed on time. This usually happens almost always. As an efficient manager, we should ensure that we don't become one of those headless chickens.

Project cost management

The primary goal of project cost management is to estimate the cost and to complete the project within the approved budget. This is one of the important activities because our bosses wouldn't approve if we exceed our approved budgets and it might have severe repercussions. Not to mention, finishing a project within budget with money to spare will always help you during your own appraisal!


The resources needed to complete the project activities include human resources, which need to be managed as well.

Project human resource management

The primary purpose of project human resource management is to obtain, develop, and manage the project team that will perform the actual project work.


There will be situations in which your organization does not have the expertise to perform certain schedule activities in-house. For this or for several other reasons, you might want to acquire some items or services from a vendor Ex: Servers from IBM. This kind of acquisition is called procurement, which also needs to be managed.

Project procurement management

The primary purpose of procurement management is to manage acquiring products (that is, products, services, or results) from outside the project team in order to complete the project. The external vendor who offers the service is called the seller.

Project Risk Management:

Any work, that is done will always have some uncertainties that give rise to project risks, which need to be managed. A project risk is an event that, if it occurs, has a positive or negative effect on meeting the project objectives. The primary purpose of project risk management is to identify the risks and respond to them should they occur.

The goal of risk management is to help meet the project objectives and to help avoid/handle situations that might compromise the project schedule or outcome.

Project quality management

Project quality is defined as the degree to which a project satisfies its objectives and requirements. For example, a high-quality project is a project that is completed on time and with all the work in the project scope completed within the planned budget.

Project integration management

The project is initiated, planned, and executed in pieces, and all those pieces are related to each other and need to come together. That is where integration management comes in. For example, integrating different subsidiary plans into the project management plan needs to be managed. Project integration management includes developing the project charter, developing the project management plan, directing and managing project execution, monitoring and controlling project work, performing integrated change control, and closing the project or a phase of a project.

While managing all the aspects of the project, you as the project manager, will need to coordinate different activities and groups, and for that you need to communicate.

Project communication management

It is absolutely mandatory for the success of the project that the project information is generated and distributed in a timely fashion and to all the stakeholders involved. Experienced managers would say communication is the most important aspect of a project and the most important skill a project manager must have. Without any doubt, communication management is certainly a critical component of project management and a common thread that runs through the project lifecycle.

Project Stakeholders Management

As of the PMBOK 4th Edition there was no such knowledge area. In fact, processes related to stakeholders were actually part of Communications Management. Considering how critical managing stakeholders is, to the success of a project, PMBOK 5th edition included a separate knowledge area for the same. Anyone who is involved with or impacted by a project is a stakeholder and this knowledge area deals with how the project manager is supposed to manage them.

As you can see, managing a project involves performing a set of processes at the various stages of the project. Accordingly, processes are grouped corresponding to these stages and the groups are called process groups.

Processes are part of the knowledge required to manage projects. Each of these processes belongs to one of the nine knowledge areas identified in the PMBOK Guide. So a process has a dual membership—one in a process group, indicating at what stage of the project the process is performed, and the other in a knowledge area, indicating what aspect of the project is managed by using the process.

Below is a table that relates these two aspects:

Now that we know all the processes involved in project management, we will next take a look at the Project Stakeholders.

Previous: Project Lifecycle

Next: Project Stakeholders