Managing Cost, Schedule, & Technical Performance Risk Is The Basis Of Good Project Management.
Risk management is essential to the success of any significant project.
Certain information about key project cost, performance, and schedule attributes are often unknown until the project is underway. The emerging risks that can be identified early in the project that impact the project later are often termed “known unknowns.” These risks can be mitigated with a good risk management process. For risks that are beyond the vision of the project team a properly implemented risk management process can also rapidly quantify the risks impact and provide sound plans for mitigating its effect.
Risk management is concerned with the outcome of future events, whose exact outcome is unknown, and with how to deal with these uncertainties. Outcomes are categorized as favorable or unfavorable, and risk management is the art and science of planning, assessing, handling, and monitoring future events to ensure favorable outcomes. A good risk management process is proactive and fundamentally different than issue management or problem-solving, which is reactive. Risk management is proactive, taking preventative actions rather than taking corrective actions.
Risk management is an important skill that can be applied to all projects. In an era of downsizing, consolidation, shrinking budgets, increasing technological sophistication, and shorter development times, risk management provides valuable insights to help key project personnel plan for risks, alert them of potential risk issues, analyze these issues, and develop, implement, and monitor plans to address risks long before they surface as issues and adversely affect project cost, performance, and schedule.
Hope is Not a Strategy
Hoping that the project will proceed as planned is naïve at best and poor management at worse.
Project Managers constantly seek ways to eliminate or control risk, variance, and uncertainty. This is a hopeless pursuit. Managing “in the presence” of risk, variance, and uncertainty is the key to success. Some projects have few uncertainties –only the complexity of tasks and relationships is important – but most projects are characterized by several types of uncertainty. Although each uncertainty type is distinct, a single project may encounter some combination of four types:
- Variation – comes from many small influences and yields a range of values on a particular activity. Attempting to control these variances outside their natural boundaries is a waste (Muda). Margin is the only response to variation.
- Foreseen Uncertainty – are uncertainties identifiable and understood influences that the team cannot be sure will occur. There needs to be a mitigation plan for these foreseen uncertainties.
- Unforeseen Uncertainty – is uncertainty that can’t be identified during project planning. When these occur, a new plan is needed.
- Chaos – appears with the presence of “unknown unknown.” This notion of UNK UNK needs to be considered with care. Donald Rumsfeld used this as an excuse for not understanding the historical context of invading a foreign country. Had he read The Histories, Herodotus, 440BC, he would have learned that engaging in a ground war in the Middle East was a losing proposition to every invading army since Alexander the Great. So the supposed UNK UNK was actually lack of understanding. The result was knowable - chaos - but it was ignored.
The Plan for the project is the Strategy for its successful completion. This Plan needs to define:
- How the products and services will be “matured” as the project progresses?
- What are the “units of measure” for this increasing maturity?
- At what points in the project will this maturity be assessed to confirm progress is being made?
The answers to each of these questions require making estimates in the presence of uncertainty.
Hope must be replaced with a risk tolerant plan. In this plan, larger variances can be tolerated in the early parts of the project. But as the project proceeds, the tolerance for risk must be reduced. At the end of the project, all the risks must have been retired. This is the basis of the Cone of Uncertainty that is broadly misunderstood by the #NoEstimates community.
If you are not reducing uncertainty as the project proceeds - cost, schedule, and technical uncertainty - then there is little hope of showing up at the needed time, for the needed cost, with the needed value to call the project a success.
No Point Estimate of Cost or Duration can be Correct
The use of point estimates for durations and costs is the first impulse in an organization low on the project management maturity scale. Understanding that cost and durations are actually random variables, drawn from an underlying distribution of possible value is the starting point for managing in the presence of uncertainty.
Understanding that cost and durations are actually random variables, drawn from an underlying distribution of possible value is the starting point for managing in the presence of uncertainty.
In probability theory, every random variable is attributed to a probability distribution. The probability distribution associated with a cost or duration describes the variance of these random variables. A common distribution of probabilistic estimates for cost and schedule random variables is the Triangle Distribution.
The Triangle Distribution is used as a subjective description of a population for which there is limited sample data, and especially where the relationship between variables is known but data is scarce. It is based on the knowledge of the minimum and maximum and a “best guess” of the modal value (the Most Likely). Using the Triangle Distribution for the costs and durations, a Monte Carlo simulation of the network of activities and their costs can be performed. Monte Carlo methods are used to numerically transform and integrate the posterior quantitative risk assessment into a confidence interval.
The result is a “confidence” model for the cost and completion times for the project based on the upper and lower bounds of each distribution assigned to each duration and cost. This approach to estimating provides insight into the behavior of the plan as well as sensitivity between the individual elements of the plan. The notion that project task durations are random variables is the foundation of programmatic risk management. The numeric value of a duration or a cost is actually drawn from a probability distribution.
This distribution represents the range of all possible value of the duration or cost. The shape of the probability distribution describes how many of the possible values will appear when drawn from the distribution. When a “Point Estimate” is used for the duration and cost, this number is only one of all the possible values that could occur. Without an understanding of the statistical nature of these values, there is no understanding of how “confident” we should be in the number.
Without A Model For Risk Management, You’re Driving In The Dark With The Headlights Off
Technical performance is a concept absent from the traditional approaches to risk management. Yet it is the primary driver of risk in many technology intensive projects. Cost growth and schedule slippage often occur when unrealistically high levels of performance are required and little flexibility is provided to degrade performance during the course of the program. Quality is often a cause rather than an impact to the program and can generally be broken down into Cost, Performance, and Schedule components. The framework shown to the left provides:
- Risk management policy.
- Risk management structure.
- Risk Management Process Model.
- Organizational and behavioral considerations for implementing risk management.
- The performance dimension of the consequence of occurrence.
- The performance dimension of Monte Carlo simulation modeling A structured approach for developing a risk handling strategy.
Risk Management Means Risk Communications
An interactive process of exchange of information and opinion among individuals, groups, and institutions; often involves multiple messages about the nature of risk or expressing concerns, opinions, or reactions to risk messages or to legal or institutional arrangements for risk management. Risk communication is the basis of risk mitigation. It serves no purpose to have a risk plan and the defined mitigations in the absence of a risk communication plan. The Risk Management Communications Plan must address:
- Identify risks for project cost and schedule.
- Model the behavior of these risks and their impact on the project.
- Development Risk Handling processes tailored to the business domain.
- Provide oversight, advice, guidance and control systems associated with Programmatic Risk management.
Summary
Risk management is the continuous process applied throughout the project life cycle. It is an organized methodology for continuously identifying and measuring unknowns; developing mitigation options; selecting, planning, and implementing appropriate risk mitigations; and tracking the implementation of the mitigation and planned margins to assure successful risk reduction. Effective risk management depends on risk management planning; early identification and analysis of risk; early implementation of corrective actions; continuous monitoring and reassessment; and communication, documentation, and coordination.
Risk Management is How Adults Manage Projects - Tim Lister
If you're not estimating the risks, the impacts of these risks, the impacts of the mitigations of the risk, you're not managing as an adult - it's that simple.
As peggy Nonnan said in this Saturday's Wall Street Journal, of the new chief of staff, Mr. Kelly has the power of the last available grown-up.