20 Project Risk Management Terms Explained

I need a break from blogging to cool-off my brain, which as you rightly guessed, has got deep fried. I’m planning to go to Bali for vacation. I’ve heard it’s a great place and I have never been there before. But, I need your help in planning my trip, and particularly on Risk Management.

Let’s first give this project a name. How about we call it “The Deep Fried Brain Project”? As we plan the trip, we are going to identify the risks involved in the project, analyze the risks and plan risk responses. Also during the course of planning, we are going to explore some common Project Risk Management terms and see how they fit into our project. I’m quite excited about this project and looking forward to your support. So, shall we begin?

Project Cost Estimate

I’m going to fly to Bali, stay in a hotel, see a lot of places, do plenty of shopping and have loads of fun. The main cost components for the vacation (project) include:

• Airfare - $500
• Hotel accommodation - $1000
• Car rental - $500
• Food & leisure - $2000
• Shopping - $1000

All these costs “roll up” to $5000. This is my project cost estimate.

Risk

I’ve never been to Bali before, and as a foreigner in a country, there’s always a level of uncertainty or risk involved.

PMBOK^® Guide, 5th Edition defines risk as an uncertain event or condition that, if it occurs, has an effect on at least one project objective. Objectives can include scope, schedule, cost, and quality. A risk may have one or more causes and, if it occurs, it may have one or more impacts. A cause may be a requirement, assumption, constraint, or condition that creates the possibility of negative or positive outcomes.

It’s not all negative

Note the keywords negative or positive. The dictionary definition of the word ‘risk’ has a negative connotation. Therefore, it’s a bit counter-intuitive to think that risks can be positive too.

Image credit: Flickr / tango48

Negative Risks or Threats

What are some of the things that can go wrong during my trip? Let’s list them down. I might:

• Fall sick
• Get robbed or mugged
• Lose my wallet, passport, luggage or other valuables
• Run out of money
• Get kidnapped or high-jacked (if that adds any humor)
• Become shark food on Bali beach
• Drown or get killed
• Call-off the vacation prematurely due to an emergency
• Run into unfavorable weather
• Get caught in a natural calamity

Positive Risks or Opportunities

Well, if I’m lucky, things may turn out better than I expect. What are the opportunities that lie ahead? I may:

• Discover a great business opportunity
• Meet an old friend
• Get a good deal on hotel room and car rental
• Win a lottery or lucky draw
• Discover a hidden treasure at one of the remote beaches of Bali

Strategies for Negative Risks or Threats

Which are the risks I should really spend effort and resources on? Are there any risks that I can completely eliminate (avoid)? Can I do something to reduce the impact or probability (mitigate) of certain risks? Can I transfer the risk to someone else? Let’s see.

• Fall sick
  • Get health insurance to cover the medical costs (transfer cost risk to the insurance company)
  • Get vaccinated (avoid - prevention is better than cure)
  • Carry a first aid kit along (mitigate)
  • Keep telephone numbers of local hospitals and emergency services handy (mitigate)
• Get robbed or mugged
  • Get travel insurance (transfer cost risk to the insurance company)
  • Keep local emergency numbers handy (mitigate)
  • Not carry valuables along (avoid)
• Lose wallet, passport, luggage or other valuables
  • Get travel insurance (transfer cost risk to the insurance company)
  • Keep copies of all my important documents. Perhaps, I can store scanned copies in a secure online file storage system, so that I can access them from anywhere as long as I have an internet connection. This will reduce the impact if this risk event occurs (mitigate).
• Run out of money
  • Use credit card.
• Become shark food on Bali beach
  • Wear shark-repellent body-spray (mitigate)
• Unfavorable weather
  • Plan the trip around a time when weather forecast is good (mitigate)
• Natural calamity
  • Make sure that life insurance premiums have been paid.

Strategies for Positive Risks or Opportunities

Can I increase the chances of getting a good deal on hotel room and car rental? What will I do with the treasure if I ever discover one? Let’s see.

• Get a good deal on hotel room and car rental
  • Try to plan the trip during off-season (enhance)
  • Make reservations early (enhance)
• Win a lottery or lucky draw
  • Buy a lottery everyday and fill up every lucky draw coupon that I can get my hands on (exploit)
• Discover a hidden treasure at one of the remote beaches of Bali
  • Donate treasure to the needy (share)

Residual Risks

Residual Risks comprise of:

• Risks that remain after applying risk response strategies have been implemented.
• Risks that are not worth dealing with upfront (probably the cost involved in dealing with them is less than the cost to address their outcome). We simply accept them.

Examples:

• Early end to the vacation due to an emergency: There's nothing I can (or want to) do upfront to avoid/mitigate/transfer this risk.
• Unfavorable weather: Even though we'll plan the trip around a time period when weather forecast is good, there's still a risk of bad weather. We'll also add this risk to the list of Residual Risks.

In order to deal with the outcome of residual risks, we put “Contingency Plans” in place.

Image credit: Flickr / sflovestory

Contingency Plans

Contingency Plans are plans specifying the action to be taken when the risk event (positive or negative) occurs. These plans are specifically for the Residual Risks. For example:

• Early end to the vacation due to an emergency: I'll reserve $500 for purchasing a potentially more expensive flight ticket back home. This is "cost" contingency reserve.
• Unfavorable weather: I'll keep two "reserve days" in my vacation plan. This is "time" contingency reserve. I'll also keep additional $500 to cover for the expenses for these two days. This is also a "cost" contingency reserve.

Contingency Reserves

These are time and cost reserves that account for “known-unknowns” or simply “knowns”. They cover the “Residual Risks” on the project. In our Bali vacation project, we have $1000 and 2 days of contingency reserve. Project Manager is authorized to approve the use of contingency reserves.

Risk Triggers

Triggers are indications that a risk has occurred or about to occur. We can think of them as events, conditions, early warning signs that trigger the contingency response. For example, if the temperature shoots above 103 deg F, I’ll call an ambulance.

Risk Tolerance

I can go for bungee-jumping but skydiving is not my cup of tea.

Image credit: Flickr / divemasterking2000

Risk Threshold

If I lose $200 in the casino, I’ll stop gambling and go back to my hotel room. Losing $200 in gambling is my risk threshold.

Fallback Plan

This is the so-called “Plan B” for the Residual Risks. If the contingency plan doesn’t work, we move to “Plan B”. For example:

• If the weather turns hostile and flights stop operating, I will check-out of the hotel room and move to Denpasar International Airport departure terminal.

Watchlist

These are low priority (non-critical / non-top risks).

• Meet an old friend: I'll be on a lookout for known faces.
• Discover a great business opportunity: This is not my priority during vacation, but if something comes my way, then why not?
• Drown or get killed: I'll be more careful near the water and will try not to venture into isolated places.
• Get kidnapped: Highly unlikely, but I'll give my father-in-law's contact number to kidnappers, just in case they ask for ransom.

Secondary Risks

These are new risks that emerge as a result of applying risk response strategies. For example, the swine flu vaccine shot leads to serious side-effects and jeopardizes my vacation.

Workaround

Workarounds are “corrective actions” taken to deal with a risk event that has occurred. Unlike contingency plans, these are “unplanned responses” to a risk. For example, I had planned to spend a day at the beach, but it was raining heavily. So, I went and watched a movie. Movie was not on my plan.

Management Reserves

These are time and cost reserves that account for “unknown-unknowns” or simply “unknowns”. What if something unforeseen happens, that I cannot think of right now? Usually the management reserves a certain amount (say 5% of the project cost baseline) for such unforeseen events. The Project Manager is NOT authorized to approve the use of management reserves. “Management” approval is required to use such funds.

For example, I spent all the cash and also used up the limit on my credit cards. I called my credit card company for help. They extended another $500 of credit for me to pack my bags and return home.

Project Cost Baseline

Project Cost Baseline = Project Estimate + (Cost) Contingency Reserves

For this project,

Project Cost Baseline = $5000 + $1000 = $6000

Note that Project Cost Baseline is usually not a single big lump-sum amount. It’s a time-phased budget (or costs by calendar period) and usually represented in the form of an S-curve.

Cost Budget

If we add the Management Reserves to the Project Cost Baseline, we get the Project Cost Budget.

Project Cost Budget = Project Cost Baseline + Management Reserves

For this project,

Project Cost Budget = $6000 + $500 = $6500

Refer to the diagram below to see graphical representation of the Contingency Reserves and Cost Budget.

Image credit: Flickr / bookis

Risk Averse

If you have been following this blog, you might have noticed that this is the first ever post on Risk Management on this site. This shows how risk averse I am.

Summary

Let’s summarize the main points:

• Risks are not always negative. Positive events or opportunities are considered risks too.
• Residual Risks comprise of a) risks that remain after applying risk response strategies, and b) risks that we simply accept - if it happens, it happens, and we have a plan to deal with it.
• Contingency Plans deal with the outcome of Residual Risks on the project.
• Contingency Reserve covers the outcome of Residual Risks, and account for the "known unknowns".
• Fallback plans are employed for Residual Risks when Contingency Plans fail.
• Secondary Risks are new risks that emerge as a result of Risk Response planning.
• All non-critical / non-top risks are put on the Watchlist and monitored ("watched") regularly.
• Project Cost Baseline includes the Project Cost Estimates and Cost Contingency Reserves.
• Management Reserves account for the "unknown unknowns".
• Project Cost Budget is derived by adding Management Reserves to the Project Cost Baseline.
• Project Manager can authorize the use of Contingency Reserves, but not Management Reserves. "Management" authorizes the use of Management Reserves.

I hope you enjoyed this exercise. Thanks for helping me out with the project. I’ll post the snaps soon. Let me know if you have any questions, tips or suggestions for me.