Program Management and Risk Control

Due to the rapid changes in the external environment of organizations, projects of any kind are subject to risks and uncertainty. If uncertainty is uncontrollable, the risk instead, potentially, can be expected, measured, and manageable. In this context, the paper focuses on a number of common aspects of project risk, risk types, and project risk management. Also, the project risk management process is presented in detail, dealing with four stages: risk identification, risk analysis or evaluation, risk management, and risk management.

Project risk management is often overlooked but is one of the most important factors in successful project delivery. In general, delivering a defined project scope on time and within budget is a key to the success of a project. Unfortunately, these aspects of success are often unattainable, especially in large complex projects where both external influences and internal project requirements may change significantly over time. Project risk management is a continuous process of identifying, analyzing, prioritizing, and mitigating risk that threatens a project's chances of success in terms of cost, schedule, quality, safety, and technical performance. Organizations and owners often view project risk management activities as a “pleasure to have” in the project rather than a major part of project management. Additionally, there is some confusion between organizations and project teams about what exactly integrates risk management activities.

In this paper, we provide a comprehensive disaster risk management framework and discuss strategies for implementing projects of all types and sizes. This should give you a better understanding of how to deal with the following challenges:

• Do we have a comprehensive project risk management policy?
• What aspects of project risk management are necessary for our organization to implement?
• How do we measure the requirements and controls of a risk management plan and project implementation in an efficient and effective manner?
• Are our current project risk management procedures effective in reducing project risk?
• How do we integrate our risk management activities with our risk management goals?
• What other important questions should we ask about project risk throughout the project life cycle?

Defining Project Risk Management

The purpose of project risk management is to understand project risk and program risk, reduce the likelihood of adverse events and increase the likelihood of positive events in project projects and outcomes. Project risk management is an ongoing process that begins during the planning phase and ends when the project is successfully deployed and converted into operation.

Property owners, project teams and contractors often define and implement risk management activities differently from the project. Owners may use informal or interim procedures, such as stage gate approval, which they interpret as risk management activities, contractors may define disaster management as compliance with potential change orders, and project teams may express the idea that “everything we do is risk management”. Although all these functions help to identify and manage different aspects of a project risk, they do not fully explain the comprehensive approach to project risk management. A comprehensive risk management project should consist of the following components, which should be measured in size and type of project:

Strategy and planning

The strategic and planning activities lay the foundation for a risk management plan and ultimately determine whether the plan is successful. During the strategy and planning phase the organization will explain how the risk is managed and managed. Strategy and planning should be considered:

• Business or business-wide risk management guidelines (including risk tolerance level).
• Available resources (staff, budget).
• Popular reporting and communication systems; and
• Organizational strategic objectives.

Strategic and planning activities include:

• Assigning roles and responsibilities related to risk management activities.
• identify and describe the needs of project participants in relation to risk management activities.
• Establish common risk categories for identified risks. Categories can be depleted based on common industry risks or organizational risk categories (e.g., construction, finance, jobs, governance, etc.); and
• Improving the risk matrix and allocating risk measurements to identify risk. The risk matrix should define risk estimates based on potential and impact by considering the risk tolerance of the organization.

Risk Identification

Risk identification to identify all potential risks that may have a negative or positive impact on a project. It is important in the risk assessment process to solicit feedback from all project stakeholders including those outside the core project team. Potential contributors to risk identification include:

• Project team members (planners, engineers, architects, contractors etc.).
• Members of the risk management team.
• Topics specialists (IT, Safety, Legal etc.).
• Customers (internal and external).
• End users; and
• Organizational management and leadership.

Successfully managing all project risks increases with regular communication and feedback between team members and stakeholders. These interviews should try to identify errors, inconsistencies, and speculations about the job. The result of these working hours should be the first list of identified risks.

From the first list of identified hazards, a risk register or log can be completed to ensure that all hazards are analysed, prioritized, and monitored. Risk registers should usually include the following areas:

• Type of risk.
• Definition.
• Cost effect.
• Opportunities.
• Risk level.
• Possible answers: and
• The owner of the action.

Analysis

The analysis phase determines the feasibility and impact of each identified risk and prioritizes risk for management to consider. Successful risk analysis requires direct thinking and input from those most familiar with the affected area due to potential risk. Analysis is usually two steps:

Step 1 - Quality analysis

In order to analyse quality, the project team assigns an important level (eg high, medium, low) to each risk. The critical level must be in line with the organization's risk management plan, risk tolerance level and other organizational goals. Critical standards can be used to mitigate risks in the disaster register and develop effective response systems that focus on priorities. It is important to identify all potential risks that will need to be tracked by the project team.

Step 2 - Volume analysis

To analyse the quantity, the project team provides the amount of costs that are most likely to be incurred for each of the identified risks. This figure considers both the probability and the potential impact of a catastrophic event. Determining the probability and impact can result from a variety of exercises including:

• Conversations - collecting impact data and opportunities for a series of situations (e.g., optimistic, highly probable, and hopeless)
• Decision trees - comparing the risks and rewards between different decisions
• Modelling models - performing project evaluations to measure potential impacts on a project.

Response Planning

Response planning is the stage at which a project team develops response actions and other options to reduce project risk. Project teams use response planning to determine in advance how to deal with potential risks and how to avoid, transfer, mitigate or accept project risks. Response planning should consider the available resources and potential consequences of response systems. The goal of response planning is to harmonize risk with appropriate response based on risk and cost, liability and potential considerations. Planning a risk response includes:

Assign responsibility for identified risks to eligible project team members or stakeholders. It is important for the assignment to consider the individual's ability to deal with certain hazardous areas. Giving a risk to someone with little or no knowledge of a hazardous environment is not an effective way to plan a risk.

Develop a response system to address the identified risk. This process should be repeated and include all stakeholders involved in the risk. Common response options include:

• Avoidance - adjusting a project plan to avoid a potential situation or occurrence
• Transfer - to change the consequences and obligations associated with a third-party risk (usually achieved by contractual agreement)
• Mitigation - taking preventative measures to reduce the chances of being at risk or impact on a project
• Acceptance - continuing as planned and accepting the outcome of an accident.

Completion and document the various risk responses identified by each responsible person. The plan should clearly define the agreed response to the risk, the liability side, your results in both the analysis and quality and the budget and the time frame for responding to the risk.

Monitoring and Control

The final step in risk management is monitoring and control. This process should be established to monitor potential risks, oversee the implementation of risk plans, and evaluate the effectiveness of risk management processes. Monitoring and control should take place throughout the life cycle of the project and help develop and direct the entire risk management process. This step should:

• Empower management and project team to make informed decisions about risk.
• Assessing the effectiveness of risk response actions; and
• Identify the risk factors that appear to have changed from what was listed in the previous diagnostic and analysis sections.

Monitoring and control are essential to maintaining effective and efficient disaster management, it is a measure of how well your risk management plan is designed. If monitoring and control pose a particular risk that is not minimized or avoided as planned, then adjustments can be made to the response system. Similarly, if monitoring and control indicate that the identified risk is less likely to occur, the system can be adjusted to prioritize risk at a lower level.

Potential Benefits of Risk Management

Although a well-designed and well-designed risk management process can significantly reduce the risk of failure, the benefits of conducting comprehensive risk assessments can be costly and burdensome for small projects with limited complexity. As noted at the beginning of this paper, risk management procedures should be commensurate with the size and complexity of the organizational or project plan. To achieve this, the organization should consider defining a set of basic processes to be applied to all projects and a solid set of high-quality, complex project processes.

Embedding risk management into day-to-day activities

Effective risk management is often achieved when an organization makes an effective commitment to integrating disaster risk management into project agreements and controls. The main ideas for the organization to establish a working system include:

• Provide appropriate resources for risk management activities.
• Creating an environment that integrates and promotes disaster risk management and actively promotes and pursues risk management at all levels of the organization; and
• Explaining and training staff on risk management.

A well-defined risk management approach can help maximize the success of a project and program. However, risk management has been neglected and considered by many complex project management areas. At a minimum, organisations with significant capital expenditures should clearly define their procedures and expectations for risk management, communicate its importance, adequately train its personnel, and monitor high risk projects for compliance with risk management procedures.

TPRI's Risk Advisory Services is an objective, technical approach to managing multiple risks associated with major changes: risks involving complexity, technology, governance, selection and management of vendors and partners, implementation solutions and acceptance of change across the organization.

TPRI utilizes leading concepts and procedures, supported by: Experienced physicians, best known practices, Practical tools and simulations, international standards, Transfer of built-in information. TPRI Risk Advisory Services can help organizations make significant cost savings by reducing incorrect selection decisions, cost overruns, inconsistencies in business needs, poor quality delivery and failed projects.