Risk Assessment and Mitigation Don Cole Project Management

Risk Assessment and Mitigation Don Cole Project Management for ARA Engineers and Scientists

Overview § How are risks eliminated or mitigated? § Where do you first assess risks? Total Lifetime Costs U = Ui + (1 - Ps) Uf {min U} Ui = Initial System Cost (1 – Ps) Uf = Expected Cost of System Failure Ps* Reliability (Ps) What are some Quality Implications? 2 Copyright 2009. All rights reserved. Applied Research Associates, Inc. • To the project • To the company Economics of Risk Cost (U) § What types of risks are of concern to Project Manager? § How do you identify the risks? § What are the potential impacts?

§ Risk Assessment and mitigation/elimination is a management function § Why include Risk Assessment in proposal response? NO! Your § How to identify and assess risks OTHER left § How to monitor risks as the project proceeds … § How failure to address risks can have serious impacts beyond the quality of the project performance Roswell 250 miles 3 Copyright 2009. All rights reserved. Applied Research Associates, Inc. Desired Learning Objectives

Risk Mitigation is a Management Function § Planning • Identify risk elements • Characterize impact (failure to mitigate) • Eliminate where possible by adjusting approach • Mitigate where elimination is impossible Copyright 2009. All rights reserved. Applied Research Associates, Inc. § Evaluation and Reassessment during execution • Plan revision • Staff supervision Risk Assessment Plan 4

Understanding Risk Four Principal Questions: What can go wrong? How likely is it? What are the consequences? How can the risk be eliminated or mitigated? Copyright 2009. All rights reserved. Applied Research Associates, Inc. 1. 2. 3. 4. 5

Risk Defined • • Low probability and high consequence Frequent events and low consequences Moderate probability and moderate consequences Very low probability and very high consequences What type of risks get the most publicity? What types of risks most often affect project performance? What types of risks are the most demanding to identify for experimental programs? 6 Copyright 2009. All rights reserved. Applied Research Associates, Inc. Example Types of Risks:

Two Categories of Risk § Project Risks • Technical • Financial • Schedule § Company Risks Copyright 2009. All rights reserved. Applied Research Associates, Inc. • Safety • Security • Small Business Requirements 7

Assessing and Mitigating Project Risk § Performance Risk • Is desired outcome clear? • Does customer recognize risk? • What confidence objective can be met? § Cost Risk Copyright 2009. All rights reserved. Applied Research Associates, Inc. • Is the approach in each task clear enough to price with confidence? • Does our approach allow an adequate management reserve? § Schedule Risk • Does PM control all elements effecting the schedule? • Is there adequate lag time before each milestone? 8

Characterizing and Tracking Risks § Identified risks should be assessed in two dimensions • Likelihood of Occurrence ▪ How likely is it that this risk will actually happen? • Impact of Occurrence ▪ How drastically will project be affected if the risk does occur? § Both dimensions typically assessed using high/medium/low categories • Overall assessment determined by combining the two dimensions Overall Risk Assessment Impact of Occurrence Likelihood of Occurrence Low Medium High Low Low Medium High Copyright 2009. All rights reserved. Applied Research Associates, Inc. ▪ Risk with an overall assessment of medium or high should have a risk mitigation plan 9

Elements of a Risk Mitigation Plan • Briefly describe the risk and identify it as one or more types (e. g. cost, schedule, technical, safety, security, etc. ) § Assessment • Identify likelihood of occurrence as high, medium or low ▪ Defend assessment with 1 -2 sentences/bullets § Mitigation Plan • Describe the steps to be taken now that will reduce the likelihood of the risk occurring • Describe the steps to be taken now that will reduce the impact if the risk does occur § Indicator/Observation Plan • Describe key triggers that will indicate the identified risk has occurred or is about to occur § Contingency Plan • Describe the work around to be performed after the risk does occur 10 Copyright 2009. All rights reserved. Applied Research Associates, Inc. § Risk Name & Description

Example: Cost Overrun Risk § Risk name: cost overrun on CPFF effort § Assessment: high • • Effort divided between three divisions and a subcontractor Customer has only vaguely defined expectations § Impact: high • • Customer will have to seek additional funds or reduce requirements Will reduce fee percentage § Mitigation Plan Work with customer to establish expectations within budget Provide clear requirements, budget and schedule to each division and subcontractor Track cost/performance monthly Copyright 2009. All rights reserved. Applied Research Associates, Inc. • • • ▪ Assure separate phase in BST for each performer/task ▪ Establish milestones and associated costs with Task Leaders § Indicator/Observation Plan • Look for significant cost or schedule variance by task § Contingency Plan • Reserve a portion of the budget for contingencies (Management Reserve) 11

Who is Responsible for Risk Reduction Activities? Copyright 2009. All rights reserved. Applied Research Associates, Inc. § What process will you use to periodically assess the status of your proposed risk reduction action plans? § How and how often will you communicate the progress to the customer? Communicate in your proposal how your management approach addresses the cost, schedule and performance risks 12

What are Some Things that Can Go Wrong? § Communication • Large staff, including multiple divisions • Solve the wrong problem (generally task and subtask level) • New project absorbs your key staff, staff turnover • Staff preoccupied with other “higher priority” short-term projects § Underestimate effort needed to develop/use computer models • Using new models • New bugs found in current models • Model needs to be adapted – new code written, integrated and tested 13 Copyright 2009. All rights reserved. Applied Research Associates, Inc. § Staff Changes

What are Some Things that Can Go Wrong? (cont. ) § Equipment breakdowns § Accessibility to site, data, other models § Takes longer than expected to get clearances § Customer • CTR is replaced by new person Copyright 2009. All rights reserved. Applied Research Associates, Inc. ▪ On VERTEC’s ARTS program, 4 CTRs and 5 COs in five years and numerous logistics and engineering POCs changes – increased risk • Requirements change • Customer is non-responsive to needed decisions 14

Assessing and Mitigating Company Risk § Safety Risk • Are personnel or property exposed to hazards? • Can these hazards be avoided by revising approach? • Can remaining hazards be successfully mitigated? § Security Risk Copyright 2009. All rights reserved. Applied Research Associates, Inc. • Are we physically equipped to meet security requirements? • Are our personnel adequately trained? • Do we have a plan for comprehensive review? § Subcontractor Risk • Geographical separation, lack of adequate cost/schedule/performance feedback, lack of timely billing, etc. • Is our approach compatible with contract SB requirements and with company SB plan requirements? 15

Costs to Recover from Major Quality Problems ARA Milestones 1. 2. 3. 4. 4 Project Plan 35% Review 65% Review Deliverables Review 3 Project Team Meetings, Reviews 1 “Kickoff” Meeting 0 20 40 60 80 100% Time Error Detected/Project Period of Performance “Project staff must identify and fix errors, oversights and poor design problems early. ” 16 Copyright 2009. All rights reserved. Applied Research Associates, Inc. Costs to Fix Major Quality Problems 2

Why Include Risk Assessment in Proposal Response? § Often required in large procurements § Demonstrates and understanding of processes necessary to meet procurement requirements • Associated uncertainties that can impact quality, cost and schedule Copyright 2009. All rights reserved. Applied Research Associates, Inc. § Allows incorporation of risk mitigation in technical and management approach • Structure approach to eliminate or minimize significant risks • Include contingencies for conditions beyond control § Allows client recognition of risks and acknowledgement of potential outcomes 17

Summary § Risk assessment/mitigation is a management function § Risks can have impact well beyond the life of a project § Risk assessment and development of mitigation plan at proposal stage provides client confidence you can meet requirements on schedule and within budget Copyright 2009. All rights reserved. Applied Research Associates, Inc. • Allows client recognition of factors beyond control • Affects likely quality of final product § Early risk mitigation provides lowest cost • Importance of milestones 18