Ch7 v2 AK

Managing Risk
Aybek Korugan - Boazii University
7. 1
Project Management
What is Risk?
The concept of risk and risk assessment has a long history.
2400 years ago the Athenians offered their capacity of
assessing risks before making decisions:
We Athenians take our decisions in policy and submit them to
proper discussion. The worst thing is to rush into action before
consequences have been properly debated. This is an important
aspect in which we differ from other people.
We are capable of taking risks while assessing them beforehand.
Others are brave out of ignorance; and when they stop to think, they
begin to fear. But the man who can most truly be accounted brave is
he who best knows of what is sweet in life and what is terrible, and
he then goes out undeterred to meet what is to come.
(Pericles Funeral Oration in Thurcydidas History of the
Peloponnesian War)
7. 2
Project Management
What is Risk?
History is full of miscalculated risks:
December 23-29 1914 Sarkam Operation
* Nearly 60.000 troops dead in seven days due to severe weather
conditions
December 18 1941 Operation Barbarossa

* During 1941-1944 nearly %95 of the German forces were lost. 3.9
million troops of axis forces were involved
And well calculated risks:

June 6 1944 D-Day Normandy Landings
April 11-17 1970 Apollo 13
* Oxygen tank explosion and safe return to earth
7. 3
Project Management
What is Risk?
Point of Truth
The risks taken and not taken in Hollywood:
The Blair Witch Project: C 60.000; R 140 mil.
Ishtar: C WarrenBetty+Dustin Hofman + 55 mil,
R 14 mil.
American Graffiti: C<1. mil, R 115 mil
Adventures of Luke Starkiller as taken from the Journal of the
Whills
Universal called it unproducible.
20 Century Fox made it by giving Lucas only 200.000 to write and direct
with the sequel rights
Lucas has an empire of his own now.
7. 4
Project Management
What is Risk?
Risk is a common term, heavily used in daily language. But,
issues/concepts reflected may differ:
May refer to vulnerability/exposure;

May refer to likelihood of occurrence of the event;
May refer to the consequences of the event;
May refer to a measure combining the notions above.
Units deployed to measure Risk may also differ:
Number of fatalities per year (fatalities/year);

Infrastructure damage (down time);
Business losses pear year ($/year);
Combination of the above.
7. 5
Project Management
A Definition of Risk
By Hertz & Thomas
Risk means both uncertainty and the result of uncertainty.
That is, risk refers to a lack of predictability about structure,
outcomes or consequences in a decision or planning
situation. Risk is therefore related to concepts of
change such as the probability of loss or the probability
of ruin.
7. 6
Project Management
What is Risk?: Pascals Wager

Blaise Pascal (June 19, 1623, Clermont-Ferrand August 19, 1662, Paris)
The philosophy uses the following logic (excerpts from Penses, part III, note 233):
1. "God is, or He is not"
2. A game is being played... where heads or tails will turn up.
3. According to reason, you can defend neither of the propositions.
4. You must wager. It is not optional.
5. Let us weigh the gain and the loss in wagering that god is. Let us estimate these
two chances. If you gain, you gain all; if you lose, you lose nothing.
6. Wager, then, without hesitation that He is. (...) There is here an infinity of an
infinitely happy life to gain, a chance of gain against a finite number of chances
of loss, and what you stake is finite. And so our proposition is of infinite force,
when there is the finite to stake in a game where there are equal risks of gain and
of loss, and the infinite to gain.
7. 7
Project Management
A Definition of Risk
Lack of predictability about the structure:
Full knowledge => deterministic structure
=> Predictability without errors => certainty.
Thus, lack of predictability is due to
lack of knowledge.
7. 8
Project Management
What is Risk?
Lack of predictability
(consequences):
about
the
outcomes
Predictions to the future are done with

information from the past and
the knowledge of present.
Finite information and finite knowledge results in prediction
errors.
7. 9
Project Management
What is Risk?
Risk is encountered in decision or planning situations.
(Planning is full of decisions.)
Due to lack of knowledge about the structure, the outcome
of a decision might be unpleasant.
Decisions are about change (whether they mandate or avoid
them.)
Change is not always towards a good outcome.
7. 10
Project Management
Risk is encountered when a decision is made at present time and

state of a system with present knowledge towards the desired future
state(s).
Decision
Present State(s)
Future State(s)
desirable
Risk
undesirable
Lack of Information/Knowledge
7. 11
Project Management
Unforeseen Events
The definition is missing the impact of the
uncontrollable phenomena surrounding the system
where the risk prediction is made.
Uncontrollable events may alter the decision made for
an isolated environment.
When predictions are made the randomness resulting
from the environment has to be taken into account.
7. 12
Project Management
Alternative definitions of risk

Risk is uncertainty about and severity of the consequence of an activity with
respect to something that humans value (Aven and Renn 2008);
Risk is equal to the combination of events/consequences and associated
uncertainties (Aven 2007);
Risk is an uncertain consequence of an event or an activity with respect to
something that humans value (Renn 2005);
Risk equals the expected disutility (Campbell 2005);
Risk is a situation or event where something of human value is at stake and
where the outcome is uncertain (Rossa 2003);
Risk is the combination of probability of an event and its consequences
(ISO 2002);
Risk refers to uncertainty of outcome, of actions and events (Cabinet Office,
UK 2002);
Risk is the probability of an adverse outcome (Graham 1995).
7. 13
Project Management
What is Risk?
Systems are not isolated. They are connected to each
other. The outcome of a system may effect or even
define the outcome of another system.
Prediction of risk is not an easy task. It requires a broad
understanding of interconnected systems.
7. 14
Project Management
What is Risk?
Without a structured approach to dealing with risk (without odds and
probabilities), the natural way of dealing with risk is to appeal to gods or to
fate; risk is wholly a matter of gut.
A key factor in distinguishing modern age is the mastery of risk
The notion that man are not passive before nature;
By understanding, measuring and managing risk, risk-taking has been
converted into one of the prime catalysts that drives modern society;
facilitating economic growth, technological progress and improved quality of
life;
The nature of risk and the art and science of choice lie at the core of modern
market economy;
In any risky environment, negative outcomes from time to time cannot be
avoided; but what is more important from the societys perspective is the long
term outlook.
7. 15
Project Management
The Intellectual Evolution of Risk Assessment

Fortune tellers: Reading: the stars, coffee residue,
behavior of natural elements etc. Consulting the
elderly.
Renaissance and Enlightenment: Probability Theory
Cardano => Calculating Odds
Pascal & Fermat => Theory of Probability.
Forecasts and decisions with the help of numbers.
7. 16
Project Management

=>Trade-off between risk and reward became the
centerpiece of the decision-making process.
(Still not the case for drivers in Istanbul though. Heavy
reliance on mystic elements. Excessive risks taken for
marginal gains.)
1703: Interaction btw. Leibniz and Jakob Bernoulli
result: Law of Large Numbers &
Statistical Inference
7. 17
Project Management

Marine Insurance flourishes in 1730s
De Moivr: Structure of Normal Distribution
standard deviation, measurement of risk.
Daniel Bernoulli. Definition of expected utility.
the utility resulting from any small increase in wealth
will be inversely proportionate to the quantity of goods
previously possessed.
=> risk aversion and the ground works of portfolio
management.
7. 18
Project Management

1754 Bayes Theorem:
better-informed decisions by mathematically blending
new info into old.
Almost all risk management tools in use are discovered
between 1654-1754 except for
1875 Francis Galton: discovery of regression to the
mean
1952 Harry Markowitz: Application of quantified
diversification to portfolio management.
7. 19
Project Management
Managing Risk
Risk: The exposure to the chance of loss; the combination of
the likelihood of an undesirable event (hazard) occurring and the
significance (level) of the consequence of the event occurring.
[Risk Level = Probability X Level of Damage]
Project Risk Management

A proactive attempt to recognize and manage internal events and
external threats that affect the likelihood of a projects success. It aims
at,
* identifying as many risks as possible (what can go wrong);
* minimizing their impacts (what can be done about the events before or
during the project);
* providing contingency funds to cover risk events that actually materialize.
7. 20
Project Management
Project Risks
Technical
New technology or materials. Test failures.
Enviromental
Unforeseen weather/natural conditions.
Operational
New systems and procedures. Training needs.
Cultural
Established customs and beliefs.
Financial
Freeze on capital, bankruptcy of stakeholders. Currency

fluctuations.
Legal
Local laws. Lack of clarity of contract.
Commercial
Change in market conditions or customers.
Resource
Shortage of staff, operatives, materials.
Economic
Slow-down in economy, change in prices.
Political
Change of government or government policy.
7. 21
Project Management
Risk Management Dilemma
7. 22
Project Management
Risk Management Dilemma

The chances of an undesirable event occurring are greatest in the concept,
design, planning and startup phases of a project.
*
*
*
*
*
*
*
Unproven technology (design or technology selection errors);

System complexity
Integration requirements
Physical or chemical requirements
Modeling assumptions and estimation errors
Interfacing with internal and external systems
Operating environment
However, the magnitude of their negative impact is less if the event occurs
earlier rather than later; The opportunity for minimizing the impact or working
around a potential risk exists.
As the project progresses, the chances of undesirable events occurring

decrease, but their potential magnitude increases rapidly.
Reassessment of needs, revitalized competition, newly emerging technologies,
design changes after a prototype has been made.
7. 23
Project Management
Risk Preferences
Individuals attitude to take Risks.
Risk Averse Disinclined (afraid) to take Risks
Preferring a certain environment having a specified damage level, to a
risky environment having the same risk level.
Risk Prone Inclined (seeking) to take Risks

Preferring a risky environment having a specified risk level to a
certainty environment having the same damage level.
People may exhibit risk prone or risk averse behaviour

depending on the circumstances.
Buying insurance (risk averse behaviuor);
Buying lottery tickets; extreme sports (risk prone behaviour).
7. 24
Project Management
Risk Perception
Risk is essentially a cognitive phenomenon.
Social, cultural & professional bias may have considerable
effects on groups or individuals perception of risk.
The current emphasis on security, ecological and IT risks could make
excellent research material for an anthropologist in 200 years.
People respond to hazards that they perceive. If perceptions

are faulty, public or organizational policy will be misdirected.
Laymen s perceptions of risk are more qualitative than
experts.
Individuals have great difficulty in interpreting low probabilities in
making their decisions;
There is evidence that people may not even want data on the
likelihood of an event occurring.
7. 25
Project Management
Risk Perception
Perceived risk is biased by imaginability & memorability of hazard.
Peoples perception of risks are influenced by whether they are told of
likelihood and/or consequences of risk events or whether they personally
experience those disasters.
If risk event has not materialized yet, they underestimate; if an undesirable
realization has occurred they tend to overestimate.
Such behavior is also supported by Inference Theory of Probability.

Consider an urn populated mostly by (unknown number of) black balls and a
few (less than 0.1%) red balls;
Conduct a series of trials where a single ball is drawn randomly, its color
noted and the ball is replaced;
Most trials should end up with black balls (representing non-occurance of
hazards) and each additional black ball drawn does not affect the probability
estimate for the next ball drawn being black (thus taken for granted);
Whenever a red ball is drawn (representing the occurance of an hazard), the
probability estimate for the next ball drawn being red increases dramatically.
7. 26
Project Management
Risk Perception
Availability Heuristic and it will happen/it wont happen to
me belief is what guides individuals recognition of risk.
Many people buy their first set of battery cables only after their car
doesnt start and has to be towed.
Most homeowners purchase earthquake insurance only after
experiencing a quake.
Many drivers still refuse to wear seatbelts. When asked why, they
responded, I wont have an accident.
Past events always look less random then they actually were.
This is called Hindsight Bias.
After the fact, people always find logical and well fitting arguments
to explain why a past event was not as random (or even inevitable).
7. 27
Project Management
Risk Perception
Low probability / High consequence events are often perceived
as impossible until they happen; and then are seen as inevitable
In many cases, these events are ignored because of the underlying
assumptions we have made about our environment;
Some were never envisioned (Bhopal/ World Trade Center);
Some were envisioned but thought to be extremely unlikely (New
Orleans Flooding);
Some were thought likely to occur but would only have minor or
controllable consequences (Exxon Valdez).
Had they been expected, they would not have caused the
damage they did.
Strange to see an event happening and causing great damage precisely
because it was not supposed to happen.
7. 28
Project Management
Perception of Risk in Catastrophic Events

Perceived
risk level
Real risk
level
Realization of the
catastrophic event
7. 29
Time
Project Management
Qualitative Factors in Risk Perception

Risk assumed voluntarily
Risk assumed involuntarily
Risk of death delayed
Risk of death immediate
Risk certain not to be fatal
Risk certain to be fatal
Risk level of exposure known
Risk level of exposure unknown
Personal risk can be controlled
Personal risk cannot be controlled
Risk is old and familiar
Risk is new and unfamiliar
Risk is chronic (one at a time)
Risk is catastrophic (many deaths)
Risk is common
Risk is dreaded
Rist to beneficiaries
Risk to non-beneficiaries
Risks to unidentified persons
Risks to identified individuals
Risks from open activities
Risks from secret activities
Source: Baruch Fischhoff

7. 30
Project Management
Qualitative Factors in Risk Perception

Old/Familiar vs New/Unfamiliar: Traditional food, cosmic radiation versus new food additives or radiation
from nuclear industry.
Chronic/Catastrophic: Concentrated obvious risks (major industrial accidents) versus diffuse risks (such as
equal number of accidents scattered around as a result of a number of smaller scale industrial accidents).
Beneficiaries/Non-beneficiaries: Recipients of radio-therapy versus public exposed to emission from nuclear
power stations.
Unidentified/Identified persons: Those referred in traffic accident statistics versus specific persons trapped in a
sinking ship.
Smoking Cigarettes: Risk is voluntary, old/familiar, delayed; risk level is known.
Eating Meat (undertaking the risk of mad-cow disease): Risk is involuntary, fatal, new and unknown; level of
risk is unknown.
Traveling by Car: Risk is chronic, controllable (to some degree, by safe driving ), usually not fatal.
Traveling by Plane: Risk is catastrophic, uncontrollable, fatal.
Catching a Disease from Banknotes: Risk is voluntary (unintentional), old, known, delayed, not fatal.
Cathing Antrax from Letters: Risk is intentional, new, unknown, unfamiliar, fatal.
An individual may avoid eating beef because of mad-cow disease risks, yet smoke many cigarettes per day
or drink considerable alcohol before driving.
An individuals attitude and behaviour towards a risk may vary over time, even though objective conditions
may not have changed.
7. 31
Project Management
Risk Communication Issues

Perceived accuracy of a Risk Communication is hampered by:
Real or perceived advocacy;

Reputation for deceit, misrepresentation, coercion;
Self serving framing of messages;
Contradictory messages from other sources;
Actual or perceived professional incompetence and impropriety.
It is not uncommon for the public to hear one expert say that
there is nothing to worry about regarding a particular risk,
while at the same time learning from another expert that this
risk should be on your radar screen.
There may be many different reactions to these conflicting
reports. One layperson may decide that they cannot rely on
the judgment of any expert. Another individual may decide to
focus on the expert supporting his or her own view of the risk.
7. 32
Project Management
Risk Communication Issues

Other Issues:
People simplify;
Once peoples minds are made up, it is difficult to change them;
People remember what they see;
People cannot detect incomplete information nor inconsistencies;
People are highly influenced by the behavior and actions of others in
their immediate neighborhood;
People may disagree more about what the risk is (impact) than about
how large it is (probability);
The confusion in nomenclature creates fertile ground for ambiguity &
confusion in risk communication.
A problematic Risk Communication issue: Oversensitive/overregulated Automated Alarm Systems.
Auto alarms (do they really serve a purpose or are they mostly annoyance?)
Alarms in hospital operating rooms;
Role of the automated alarm system in the Deepwater Horizon disaster.
7. 33
Project Management
Some Risk Perception Communication Cases

From Everyday Life
Misperceptions regarding hazard likelihood, hazard consequence;
inadequate safety measures; unsafe practices; unsuccessfull risk
communication.
All the cases described below appeared in the media as unfortunate
accidents. Actually, any harm (let alone death) could easily have been
avoided with a little serious consideration of the risks involved.
(At an engagement ceromony in Dudullu) A balkony collapsed when 50 people tried to squeeze
themselves to the small space. Unfortunately many died in the ensuing accidental balcony
collapse.
Hazard likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication
(Yalkavak - Bodrum) A young man spreyed insect sprey to his bed right before he lied down
and slept. Unfortunately, he was accidentally and fatally effected by the chemical and died.
Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication
(Ali Kirca - at his home in Kurueme) Mr. Krca walked into the void while attepting to step
into the elevetor (which was at another floor).
Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication
7. 34
Project Management
Some Risk Perception Communication Cases

From Everyday Life
(Gztepe - Istanbul) Two nightwachmen operate the turning chairs at the

funfair and board them. Then, since there is nobody else to stop the system,
they remain trapped in the chairs circling at high speed till the next morning.
Unfortunately they both died.
Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull
Risk Communication
(Beyolu - Istanbul) Maintenance crews were replacing a large (180 x 180

cm) glass panel on an 8th floor window in a building on the crowded Istiklal
Caddesi. They accidentally droped the panel which duely fell down,
crashing on the pavement and seriously injuring one pedestrian.
Risk Communication
(Bahelievler - Istanbul) Cleaning crews were cleaning upper storey

windows of a 10 storey building with the aid of a mobile crane. The crew
decided to move the crane to a new positon for further window cleaning,
without lowering the extended ladder (the formal procedure strictly requires
the crane to be immobilized and stabilized on extended legs before the
ladder on which the crew nest resides can be raised). The crane accidentally
tipped over, the extended ladder crashing a passenger car and seriously
injuring wounding two persons.
Risk Communication
7. 35
Project Management
What is Risk Management

Risk Management: The making of public and private decisions
regarding protective policies and actions that reduce the threat to
life, property and the environment posed by hazards.
Risk Management is a set of integrated and coordinated
proactive attempts in an organization to recognize and manage
internal events and external threats that affect occurrence
likelihood, impact level and recovery from technological,
natural or any other hazards. It aims at,
Identifying as many risks as possible (what can go wrong);
Minimizing their impacts;
Providing contingency funds, response and recovery plans to cover risk
events that actually materialize.
It is imperative that top management understand and comprehend the
meaning of risk management.
7. 36
Project Management
What is Risk Management

It is the ability to predict what may happen in the future,
assess associated risks & to choose among alternatives in a
way to minimize potential loss.
It is the process of identifying and prioritizing risks, and then
of developing strategies to reduce risks and deal with
consequences
Few risks are straightforward.
Most of the time there are competing risks to balance, trade-offs to

make.
Failure to do Risk Management properly could result in

recognizing and addressing only a small fraction of the many
risks affecting an organization.
7. 37
Project Management
Managing Risk
Planning for project risks formally addresses identification,
analysis & assessment of potential trouble spots before
implementing a project.
It prepares the PM to take risk when a time, cost and/or
technical advantage is possible.
It is a Proactive rather than Reactive approach;
Reduces surprises and negative consequences;
Prepares the PM to take advantage of appropriate risks;
Provides better control over the future;
Improves chances of reaching project performance objectives within

budget and on time.
7. 38
Project Management
Role of Risk Manager

Setting policy and strategy for risk management;
Primary champion of risk management at strategic &
operational level;
Building a risk aware culture within the organisation including
appropriate education;
Establishing internal risk policy & structures for business units;
Designing and reviewing processes for risk management;
Co-ordinating the various functional activities which advise on
risk management issues within the organisation;
Developing risk response processes, including contingency and
business continuity programmes;
Preparing reports on risk for the board and the stakeholders.
7. 39
Project Management
Managing Risk
Major components of Risk Management Process:
Identifying Sources of Risk;

Analyzing and Assessing Risk;
Risk Response Development;
Contingency Planning & Contingency Reserves;
Risk Response Control.
7. 40
Project Management
The Risk Management Process

Step 1: Risk Identification
Analyze the environment to identify sources of risk
Known risks
Step 2: Risk Assessment

New risks
Assess risks in terms of,

Severity of impact;
Likelihood of hazard occurrence;
Controllability.
Risk assessment
New risks
Step 3: Risk Response Development

Develop strategy to reduce occurance likelihood;
Develop strategy to reduce impact;
Develop contingency plans.
Risk management plan
New risks
Step 4: Risk Response Control & Impl.

Implement risk strategy;
Monitor & adjust plans for new risks;
Trainings and Exercises.
7. 41
Project Management
Managing Risk
Step 1: Identifying Sources of Risk
Risk identification begins with a list of all areas that may cause
project delays or failure & their respective outcomes.
Brainstorming and Risk Profiling is the initial step;
Things that have not been done before are potential trouble spots;
Risk sources depending on specific type of issue at hand:
* Construction; Design; Software; Transportation.
Risk sources orginitaing from the organization:

* Organizational size, structure and culture, resources, financial structure.
Risk Sources external to the organization:

* Inflation; market acceptance; exchange rates; government regulations.
It is better to start with risks associated with the whole project;

Once macro risks are identified, specific areas can be checked.
WBS is an effective tool in identifying specific, technical risks

associated with tasks and deliverables.
7. 42
Project Management
Identifying Sources of Risk

Risk Profiling is a good tool to help identify risks.
It is a list of questions addressing traditional areas of uncertainty;
Good risk profiles are tailored to the type of work/environment under consideration;
Questions are usually developed from previous, similar experiences;

They should recognize/focus on strengths & weaknesses of the organization
They address both technical and management risk;
Some management consulting firms provide/sell risk profiles.
Historical Records are also useful in risk identification.

Simulating all business processes, procedures is a good practice.
Risk Identification process should not be limited to a few persons.
Input from employees, customers, sponsors, subcontractors, vendors should
be solicitude through interviews.
Risk Identification process should be repeated at regular intervals.

The risk landscape constantly evolves and, with it, the risks.
7. 43
Project Management

Partial Risk Profile for Product Development Project
7. 44
Project Management

Risk Breakdown Structure
7. 45
Project Management

Roots of Risk Propensity in Large & Complex Systems
One common mistake that is made early in the risk identification process is
to focus on objectives and not on the events that could produce
consequences. (e.g. failing to meet schedule is a consequence while cause s
can be, poor estimates, adverse weather, shipping delays, etc.).
Concentrate on actual events
Activities that are performed in the system may be inherently risky (e.g.
mining, hazardous material transportation, air transportation);
The technology used may have inherent risks, or exacerbate risk in the
system (e.g. heavy equipment);
Physical environment may be inherently risky,
Susceptibility to natural disasters;
Proximity to and nature of populated areas and other businesses;
Supporting infrastructure (power, telecommunications, water, transportation)
7. 46
Project Management
The product or service provided may have inherent risks,
Potentially dangerous materials, and products or services;

Demographics of customers;
Liability for defective services and products;
Quality issues.
Human & organizational errors can be propagated by organizations &

individuals executing/coordinating tasks, or using technology.
Organizational resources/policies may be inadequate or out of phase.
Financial, manpower, equipment, management and technology resources;
Investments, marketing, strategies, suppliers, customers/partners/markets.
7. 47
Project Management

Roots of Risk Propensity in Large & Complex Systems
Communications channels may be inadequate or prone to failure.
Availability level of formal and informal channels of communication;
Procedures not clearly established nor well understood;
Ability to receive warning signals;
Receptivity and ability to properly interpret warning signals.
Organizational structures may enable risky practices to occur, or may

encourage workers to pursue risky courses of action. For example:
Lack of formal safety reporting systems or departments in organizations;
Organizational standards that are impossible to meet without taking risks.
Organizational cultures may support/encourage risk taking, or fail to

encourage risk aversion. For example:
Cultures that encourage the belief it cant happen here,
Rewarding people for taking warranted/unwarranted risks.
7. 48
Project Management
Managing Risk
Step 2: Analyzing and Assessing Risk
At an individual level, informal risk assessments are more-orless continous cognitive process.
When crossing the road;

Purchasing goods;
Deciding on mode of transport;
Engaging in social interaction;
Gauging job prospects.
The aim of (formal) risk assessment is to provide information

on which decisions may be made about proposed actions, the
adequacy of risk controls and what improvements might be
required.
Not all risks deserve attention.
7. 49
Project Management
Analyzing and Assessing Risk

Risk Assessment focuses on selected potential foreseen risk
events exhibiting high probability of occurrence and/or having a
high consequence of loss.
Typically, such risk assessments focus on scenarios deemed to
be credible and significant by experts.
Risk assessment for an off-shore oil and gas installation may focus on
varios scenarios involving bad weather conditions, ship collision, riser
blow-out and helicopter crash.
Risk assesment for an investment bank may focus on rouge trading,
major bad debts and multiple loss of key executives in an air crash.
One drawback: experts following a rationalistic approach may not give
sufficient emphasis to all pertinent routes to causes of disaster.
* Three Mile Island, World Trade Center cases.
7. 50
Project Management

Risk Assessment is Multi-disciplinary in nature
To Determine:
Vulnerability
Occurance Probability
Forecasting
Built Environment
Damage Potential
Health/ Social Impact
Potential
Economic/Financial
Impact Potential
We Need:
Physical Scientists (seismology, geology, hydrology)
Systems Engineers, Modelers
Engineers (Civil, materials, environmental, transportation)
Health & Social Scientists

(M.D., public health, sociologists)
Economists
7. 51
Project Management

Two broad approaches to Risk Assessment
Heuristic/Rule of Thumb approach, being in general, qualitative &
subjective in nature, relying on individuals collective judgment.
* Expert opinion or gut feeling estimates are the most used, but they carry
serious errors depending on the skill of the persons making the judgment.
* Wishful thinking in forecasting erros (if forecasts involve potential personal
gain) may be a problem.
Scientific approach employing quantitative modeling and generally

requiring formal training in mathematics.
* Quantitative methods, usually require serious data collection and a more
detailed analysis of the facts, while being limited in scope;
* So, they have low acceptance levels by practicing managers.
7. 52
Project Management

Main Risk Assessment Techniques
Semi-Quantitative Approaches:
*
*
*
*
*
Risk Assessment Charts;

P-I Tables;
Risk Assessment Forms & Matrices;
Failure Modes and Effect Analysis (FMEA);
Risk Scoring.
Quantitative Modeling and Analysis:

* Statistical Analysis;
* Dynamic (Simulation) Analysis;
* Decision Trees, Event Trees, Fault Trees.
Scenario Analysis;
Choice depends on risk source, possible outcomes & impacts, and
managements attitude towards risk assessment.
7. 53
Project Management

Risk Assessment Charts
A Simple Risk Assessment Chart
What are the three major risks for this environment?
1.
2.
3.
What is the Probability of the
above risks occurring?
0
to 1.0
None - Very High
What is the Impact if these

risks do occur?
0
to 1.0
None - Very High
Risk 1
above
Risk 2
above
Risk 3
above
Risk 1
above
Risk 2
above
Risk 3
above
Resources Available?
7. 54
Project Management

P-I Tables
A qualitative assessment of the probability (P) of a hazard & the
impacts (I) it would produce are made by assigning descriptions
to the probability & impact of each risk, by assigning
descriptions to the magnitutes of these probabilities & impacts.
The assessor is asked to describe the probability and impact of each risk
by selecting from a predetermined set of phrases
* (such as nil, very low, low, medium, high, very high);
A range of values is assigned to each phrase in order to maintain

consistency between the estimates of each risk.
* These values generally are not evenly spaced (there is a mulpitle difference
between each case (3-10);
* Usually the same multiple is applied to the probability and impact, so that
severity scores will be more meaningful;
* The value ranges can be selected to match the specific risk environment.
7. 55
Project Management

P-I Tables
A table examplifying value ranges that could be associated with qualitative
descriptions of the probabilities and impacts in a particular risk environment
Associated with the successful completion of a new product development project.
Catagory Probability (%)
Cost
Quality
Very high
10-50
> 1000
Failure to meet acceptance criteria
High
5-10
300-1000
Failure to meet >1 important spec.
Medium
2-5
100-300
Failure to meet an important spec.
Low
1-2
20-100
Failure to meet > 1 minor spec.
Very low
<1
< 20
Failure to meet a minor spec.
When the definition of each phrase is made specific to a particular risk

environment, it becomes difficult to perform a combined analysis of the risks
from multiple risk environments that the organization might face.
7. 56
Project Management

P-I Tables
Value ranges can also be selected to reflect the potential effects
of various hazards on the whole organization.
A table examplifying impact descriptions more fitting to the
potential effects of various hazards on the organization as a
whole.
Catagory
Quality
Catastrophic
Jeopardises the existance of the organization.
Major
No longer possible to achieve strategic objectives.
Moderate
Reduces the ability to reach strategic objectives.
Minor
Some short term/tactical disruptions but little effect on strategic objectives.
Insignificant
No impact on tactical operations nor on strategic ojectives.
7. 57
Project Management

P-I Tables
An example description of Likelihoods in a P-I Table.
7. 58
Project Management

P-I Tables
An example description
of Consequence Levels
in a P-I Table.
7. 59
Project Management

P-I Tables
Various types of impacts of each single risk can be individually
defined and quantified.
7. 60
Project Management

P-I Tables
A P-I Table offers a quick way to visualise the relative importance of
all identified risks that pertain to a risk environment.
In the following table, all risks are plotted allowing easy identification of the
most threatening risks as well as providing a general picture of the overall risks.
* Risk numbers 10, 2, 12, 8 are the most thretening in this example.
Combined Impact for Identified Risks
Impact
V. High
10, 2
High
Medium
8
5
4, 9
12
Low
V. Low
11
V. Low
Low
Medium
High
V. High
Probability
7. 61
Project Management

P-I Tables
P-I scores can be used to rank identified risks, by assigning a scaling factor
(such as 1 5) to phrases used to describe each type of probability &
impact.
Impact
In this type of scoring, the base measure is probability x impact;

However, since the catagorization resembles a log scale, for consistancy, severity can be
defined as S = P+I (which leaves severity on a log scale also).
V. High
10
High
Medium
Low
Medium severity
V. Low
Low severity
V. Low
Low
Medium
High
V. High
High severity
Probability
7. 62
Project Management

Risk Assessment Forms and Matrices
Rough estimates are inputted on Risk Assessment Forms/Matrices
Risk Event
Likelihood
Impact
Detect. Diff.
When
Interface Problems
Conversion
System Freezing
Start-up
User Backlash
Post Installation
Hardware Malfunction
Installation
A Risk Assessment Form

5
Some types of Risk Assessment

Matrices used to provide a basis
for prioritizing which risks to
address, resemble P-I tables.
3
2
H
1
7. 63
I: Interface Prob
S: System Freeze
B: User Backlash
H: Hardware Malf.
Project Management

Risk Assessment/Severity Matrices
Some
types of Risk Severity Matrices used to provide a basis

for prioritizing which risks to address, resemble P-I tables.
7. 64
Project Management

Failure Mode and Effects Analysis (FMEA)
Each risk is assessed in term of the score,
Risk Value = Impact x Probability x Detection

Each of the three dimensions is rated along a 5 point scale.
Detection Score (ability to discern that the risk event is imminent) :
1 (spoting very easy) for anybody being able to spot the risk coming;
5 (spoting very hard) discovering after the fact.
Similar anchored scales would be applied to impact severity and
occurrence probability.
The weighting of the risks would be based on their overall score.
A broad range of numerical scores: 1 125
7. 65
Project Management

Risk Scoring
Each risk is assessed in term of the score,
Risk Value = Impact x Probability x Exposure

Impact: Potential consequences of the hazard as presently controlled;
Probability: Probability that the hazard will result in an accident;
Exposure: Typical frequency and duration of peoples exposure to the
hazard.
Each of the three dimensions is rated along a 5 point scale.
1- Very unlikely
2- Unlikely
3- Likely
4- Very likely
5- Inevitable (imminent)
7. 66
Exposure
1- Minor Injury
2- Serious Injury
3- Major Injury
4- Multiple casualties
5- At least one fatality
Probability
Impact Level
Typical Ratings for Impact, Probability and Exposure

1- Rare/never
2- Infrequent (1-3 month)
3- Frequent (weekly)
4- High (daily)
5- Constant
Project Management

Scenario Analysis is a commonly used technique for
analyzing risk. Each risk is investigated in terms of:
The undesirable event;

All the outcomes of the events occurrence;
The magnitude or severity of the events impact;
Chances/probability of the event happening;
When the event might occur;
Interaction with and/or influence on other undesirable
events.
7. 67
Project Management

10 Commandments of Risk Assessment & Analysis
Do your homework with literature, experts and users.

Let the problem drive the analysis;
Make the analysis as simple as possible, but not simpler.
Identify all significant assumptions.
Be explicit about decision criteria and policy strategies.
Be explicit about uncertainties.
Perform systematic sensitivity analysis.
Iteratively refine the problem statement and the analysis.
Document clearly and completely.
Expose to peer review.
7. 68
Project Management
Managing Risk
Step 3: Risk Response Development
The more effort given to risk response planning before an
incident or crisis occurs, the lesser are the surprises. Stress
and confusion when the risk event occurs is reduced.
Reducing Risk: Reducing likelihood and/or impact of a
hazard.
Mitigating Risk: Modifying levels/likelihoods of the impact levels.
Preventing Risk: Changing the probability of occurrence of the hazard.
Avoiding Risk: Affecting environment/action change to eliminate risk.
* Use a tried and tested technology instead of a new one;
* Change the country location of a factory to avoid political instability;
* Scrap the project under consideration.
Modifying Objectives: Reduce or raise performance targets, change
tradeoffs.
7. 69
Project Management
Risk Response Development

Transferring Risk: Passing the risk to another party, without
changing it; usually results in paying a premium for this exemption.
Fixed price contracts;

Insurance;
Penalty clauses for exceeding agreed schedules;
Performance guarantee of product or service.
Sharing Risk: Allocates proportions of risk to different parties

Leads to innovative continuous improvement procedures.
A primary driving principle regarding either risk transfer or risk sharing:

The more the ownership of risks are allocated to those who control them the
better, up to the point where the owner could not reasonably bear the impact
where others can.
*
*
*
*
How big is the risk?

What are the risk drivers?
Who is in control of the risk drivers? Who has experience to control them?
Who can absorb the risk impacts?
7. 70
Project Management

Retaining Risk: It may not be feasible to transfer or reduce risk; so, a
conscious decision is made to retain the risk of an hazard.
Contingency Planing: Set aside resources to provide reactive capability.
Deferment: Delay (defer) choices and commitment.
Acceptance: Accept risk exposure, but do nothing about it.
Monitoring: Collect more data about the probabilities of occurrence,
anticipated impacts, in order to better understand the risk.
Controlling: Applies to high probability, low impact risks normally
associated with repetitive actions, aiming better management through
better internal processes.
Remaining unaware: Ignore the possibility of risk exposure and take no
action.
Increasing: Judging the present course of action as overly cautious and
taking actions to increase the probability of hazard occurance or impact.
7. 71
Project Management

Contingency Planning
Contingency Planning: Planning for an organization's reaction
to potential hazards to ensure the protection of life, safety, health
and the environment, to limit and contain damage to facilities
and equipment, to stabilize operational service and public image
impacts and to manage communications about the event.
Contingency Plan is an alternative plan to be used if a possible
foreseen hazard becomes a reality. It identifies preventive
actions that will mitigate the negative impacts of the hazard. It
includes:
Emergency response plan;

Incident management plan;
Crisis communications plan;
Crisis management team plan.
7. 72
Project Management

Contingency Planning
Contingency Plans should include cost estimates, as well as
identifying and establishing the availability of the necessary
funding, equipment and materials.
Contingency Plans should be transparent and conditions for
activating them should be determined and clearly documented.
The plan and related documentation should be communicated to team
members to minimize surprise and resistance.
All parties effected should agree to the plan and have authority to make
commitments.
Risk events arising from sources external to the project are

more difficult to foresee & tend to cause more disruption.
Contingency plans responding to external events may involve new team
players, unfamiliar to the project and having conflicting goals.
7. 73
Project Management

Contingency Reserves
Contingency funds are established to cover project errors,
omissions, & uncertainties that may materialize as the project
progresses.
Owners are often reluctant to set up contingency funds that
seem to imply that the project plan might be a poor one.
Budget Reserves are allocated to specific segments or deliverables;
the amount is determined by costing out the accepted contingency plan.
Management Reserves are allocated to major, unforeseen, potential

risk associated with the total project.
Time Buffers: Amounts of time used to compensate for unplanned

delays in the project schedule.
7. 74
Project Management

Contingency Fund Estimation
The numbers are in $1,000

TABLE 7.1
7. 75
Project Management
Risk Response Development Example

Risk Event
Response
Type
Response Description
Contingency
Plan
Trigger
Interface
Problems
Reduce
Experimenting with a
prototype of the system
Work around
until help comes
Not solved
within 24 hrs
System
Freezing
Reduce
Experimenting with a
prototype of the system
Reinstall OS; call

expert
Still frozen
after 1 hour
User
Backlash
Reduce
Well designed & flexible

time training sessions
Increase staff
support
Call from top

management
Hardware
Malfunction
Transfer
Reliable supplier with a

strong warranty program
Order different
brand
Replacement
does not work
Risk Response Matrix
First step: Identify whether to reduce, retain, transfer or share risk;

Second step: Set up contingency plans in case risk event still occurs;
Third step: Determine what would trigger implementation of the
contingency plan.
7. 76
Project Management
Automated Processing/Packaging Machine Procurement

Project: Risk Assessment and Response Matrix
Risk Event
Late Delivery
Operators
Adaptation
Problems
Machine not
Confirming to
Specifications
Financial
Problems
Unresolved
Installation
Problems
Chance
Low
Low
Low
Low
Medium
Severity
Medium
Low
High
High
Medium
Detect
Diffty
Low
When
Accept/Reduce
Share/Transfer
Contingency
Plan
Trigger
Event
PreInstltn
Transfer/Accept:
Better contracts with
penalty clauses; better
customs agencies
Having old
machine on
standby for
backup
Delay
exceeding 5
days
Reduce:
PostMedium Instltn On site training before
delivery; Better training
procedures
Reduce:
PostWide communication
Medium
Instltn with order;Pre delivery
on site inspection
Reduce:
Order
Influence top mngmt
Low
Placmn
priorities; obtain self
financing from
t
manufacturer
Medium
PreInstltn
7. 77
Reduce:
Wide communication
with order
Having experts
Prod rate
flown in to
10% below
support local planned after
team
5 days
Having old
machine on
standby for
backup
Acceptance
tests
negative
Having a
leasing plan
ready
Order
delayed by 5
days because
of financing
Have backup Acceptance

location;Have
tests
old machine on
negative
standby;
Project Management

Schedule Risks
Use of Slack: Use of slack moves that activity and all successors
nearer to their late start; managing slack can be an excellent
method for reducing schedule risk.
Imposed Duration Dates: Most project have imposed duration
dates, which is frequently a top-down decision that does not
include bottom-up planning and often understates the normal
time required to complete the project.
Compression of Project Schedules: It is accomplished by
shortening critical activities. This decreases total slack and more
paths become critical or near critical.
The more critical activities there are, the higher the risk of delaying
project completion.
7. 78
Project Management

Cost Risks: Some management decisions increase cost risks.
Time/Cost Dependency: In most activities time and cost do not occur
independently; if one increases the other is also expected to increase.
Cash Flow Decisions: Financial analysts prefer delaying activities to take
advantage of time value of the associated expenditure. The increased risk of
reducing slack is sometimes ignored or underestimated.
Funding Risks:
Changes in funding for the project can seriously affect

the likelihood of implementation or successful completion of a project.
Price Protection Risks: Long duration projects need some contingency for
price hikes (using one lump sum to cover all price risks should be avoided).
Final Cost Forecasts:

Most frequent & dangerous is comparing budget versus actual cost at a
particular point in time, & projecting it to project completion.
A more accurate and reliable approach is the Earned Value concept.
7. 79
Project Management

Technical Risks:
Often associated with new, untried, innovative processes or
products.
Having comprehensive back-up plans is one option.
In addition, PMs need to develop methods to quickly assess
whether technical uncertainties can be resolved.
Sophisticated CAD programs may help resolve design problems;
One should identify high risk technical areas, then build models or
design experiments to resolve the risk as quickly as possible.
Usually, the owner & PM together make the decisions

concerning technical risk.
7. 80
Project Management

Documentation - Risk Registers
A Risk Register is a document or database that lists each risk pertaining to
a project or organization, along with the following information that is useful
for the management of those risks:
Date the register was last modified;

Name and description of the risk;
Description of why it would occur;
Description of factors that would increase or decrease the probability of occurance or size of
impact;
Semi-quantitative estimates of its probability & potential impact (e.g. P-I scores);
Name of owner of the risk (the person who will be responsible for monitoring the risk and
effecting any risk reduction strategies that have been agreed on);
Details of risk reduction strategies that it is agreed to be taken;
Reduced impact and/or probabilty of the risk, given the above agreed risk reduction
strategies have been taken;
Action window: period during which risk reduction strategies must be put in place;
Contingency plans (short description, person responsible, triggers, referenrce to details);
Description of secondary risks that may arise as a result of adopting risk reduction strategies.
7. 81
Project Management
Managing Risk
Step 4: Risk Response Control
Risk Response Control
Risk control
* Execution of the risk response strategy
* Monitoring of triggering events
* Initiating contingency plans
* Watching for new risks
Establishing a Change Management System

* Monitoring, tracking, and reporting risk
* Fostering an open organization environment
* Repeating risk identification/assessment exercises

* Assigning and documenting responsibility for managing risk
7. 82
Project Management

Responsibility for Project Risks
Risk Assignments
Owner/PM
Contractor
Shared
Inflation
Natural disasters
Scope changes
Technical
Schedule
Cost
Safety
Innovation
A key factor in controlling the cost of risks is documenting

responsibility.
If risk management is not formalized, responsibility and
responses to risk will be ignored.
7. 83
Project Management

Change Control Management
Most projects will not exactly materialize as planned;
controlling project changes is a major challenge for PM.
Scope changes (design and additions)
Contingency plan executions leading to cost/schedule changes;
Improvements suggested by team members.
Since change is inevitable, a well defined change control

process should be set up early in the project planning cycle.
Identify proposed changes;

List expected effects of proposed changes on schedule and budget;
Review, evaluate and approve or disapprove changes formally;
Negotiate and resolve conflicts of change, conditions, and cost;
Communicate changes to parties effected;
Assign responsibility for implementing change;
Track all changes that are to be implemented.
7. 84
Project Management

Change Control Management
Benefits of a well organized & established change control system:
Inconsequential changes are discouraged by the formal process;
Cost of changes are maintained in a log; accurate estimation of future
project costs is facilitated;
Integrity of the WBS and performance measures are maintained;
Allocation & use of budget & manag reserve funds are tracked;
Responsibility for implementation is clarified;
Effect of changes becomes visible to all parties involved;
Customer inquiries are better responded.
Implementation of change is monitored.
Scope changes will be quickly reflected in baseline and performance
measures.
7. 85
Project Management

Change Management Control
Since change is inevitable, a well defined change
control process should be set up early in the project
planning cycle.
The Change Control Process
Identify proposed changes.
List expected effects of proposed changes on
schedule and budget.
Review, evaluate, and approve or disapprove of
changes formally.
Negotiate and resolve conflicts of change,
condition, and cost.
Communicate changes to parties affected.
Assign responsibility for implementing change.
Adjust master schedule and budget.
Track all changes that are to be implemented.
7. 86
Project Management
Change Request Form
FIGURE 7.10
7. 87
Project Management
Change
Request Log
FIGURE 7.11
7. 88
Project Management
Managing Risk
Handling Randomness in Activity Durations
In order to manage schedule risks, we have to be
aware that only in rare cases is the exact duration
of a planned activity known in advance. Realistic
estimates of activity durations are prerequisites
for managing risks, since the process of planning
and scheduling a project depends upon time
estimates.
Projects have to be planned before they are
executed and carry an element of uncertainty and
risk regarding the exact duration of activities
which is seldom known with certainty
To gain an understanding of how long it will take
to perform the activity, it is necessary to
construct a frequency distribution.
This information in the frequency distribution
can be summarized by two measures:
Center of the distribution, expected value ( )
Spread of the distribution, standard deviation( )
7. 89
Project Management
Managing Risk
The Expected Value & Standard Deviation of activity duration can be
estimated based on past data.
d1
4
Duration data, di, of past 20 realizations of a particular activity

d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13 d14 d15 d16 d17 d18 d 19 d 20
4
45 4
n
m = di n = 80 /20 = 4;
i=1
When there is no historical data regarding the random duration of a particular

activity, direct estimation of and , based on PMs experience and subjective
evaluation, is possible, but is not very reliable.
Instead an indirect estimation, based on an assumed probability distribution of the
activity duration in question, is preferred.
It is a universally accepted practice to assume that it has Beta Distribution.
7. 90
Project Management
Managing Risk
Extensive research have shown that Beta Distribution almost always
provides a good fit to random activity duration.
For almost all random activity durations associated with real projects,
parameters a1 and a2 can be determined such that a Beta distribution with
these parameters will provide a sufficiently accurate representation of the
randomness involved.
Beta distribution can accomodate data sets that do not fit normal
distribution.
The probability distribution of durations could even be skewed toward the
high or low end of the probability range.
x a1 -1 (1- x )a2 -1
f(x) =
;
G(a1 ,a 2 )
where, G(a 1 ,a 2 ) = x a1 -1 (1- x) a2 -1 dx

0
7. 91
Project Management
Managing Risk
The Beta Distribution
f (x)
2.0
a
a
a
f (x)
2.0
a
a
a
a
1.0
1.0
0.5
1.0
0.5
f (x)
1.0
f (x)
a
2.0
a
a
2.0
1.0
1.0
a
0.5
1.0
0.5
7. 92
1.0
Project Management
Managing Risk
Project Evaluation &Review Technique (PERT)
PERT is specifically developed to address uncertainties in
activity time estimates.
It assumes the duration of each activity is randomly distributed
according to a Beta Distribution , whose parameters are known.
Beta distribution is flexible & can accommodate many different types
of empirical data.
With Beta distribution estimation of 3 factors is sufficient to

compute, expected value, , and standard deviation, , of the
activity duration.
a = An optimistic estimate for the activity duration;
b = A pessimistic estimate for the activity duration;
m = Most likely estimate for the activity duration;
m = a + 4m+b
6
7. 93
Project Management
Managing Risk
a1
b1
a2
b1 - a1 = 3.2 x s
b2
b2 - a2 = 6.0 x s
a1 and b1 correspond to 5 and 95 percentile points respectively

of the displayed probability distribution;
a2 and b2 correspond to 1 and 99 percentile points respectively
of the displayed probability distribution.
7. 94
Project Management
Managing Risk
Once, expected duration of each activity is computed, they are treated like
deterministic parameters & estimates for ES,EF,LS, LF, SL of all activities
are computed as in CPM.
Expected project completion time, TP, is similarly determined.
TP =
mi
all critical path activities, i
Variances of activities on the critical path are summed up to give an

estimate for the variance of project duration, P:
s 2P =
si
all critical path activities , i
Then, the probability distribution of the project duration is assumed to be

normally distributed, and its expected value and variance are deployed to
give reliable probability estimates for completing the project by specified
times, TS.
7. 95
Project Management
Managing Risk
PERT Example
Activity
Activity Times and Variances

2
a
m
b
A
B
C
D
E
F
17
6
16
13
2
2
29
12
19
16
5
5
47
24
28
19
14
8
30
13
20
16
6
5
b - a 2
s =
a + 4m + b
m =
;
6
25
9
4
1
4
1
TP =
mi
= 64
all critical path activities, i
s 2P =
si
= 36
all critical path activities , i

7. 96
Project Management
Managing Risk
PERT Example
67 - 64
= P {Z 0.5} = 0.69
P{Pr oject Duration TS = 67} = P{ T 67} = P Z
60 - 64
= P {Z -0.67} = 0.26
P{Pr oject Duration TS = 60} = P{ T 60} = P Z
T is a random variable representing project duration;

T is assumed to be normally distributed.
TS is a user specified (external) scheduled completion time;

Z is a random variable having standard normal distribution
By definition:
Z=
T - TP
sP
Values realizable by Z ranges in the interval {-3, +3};

P{Z k}, can be obtained from statistical tables, for all k in interval {-3,3}
7. 97
Project Management
Managing Risk
PERT Example
Possible Project Duration

FIGURE A7.3
7. 98
Project Management
Standard Normal
Distribution Table
Area between 0 and z value
P{ Z 0.5} = 0.5 + 0.19

= 0.69
P{ Z -0.67} = P{ Z 0.67}
1- P{ Z 0.67} = 1- (0.5 + 0.24)
= 0.26
0.0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
3.0
0.00
0.0000
0.0398
0.0793
0.1179
0.1554
0.1915
0.2257
0.2580
0.2881
0.3159
0.3413
0.3643
0.3849
0.4032
0.4192
0.4332
0.4452
0.4554
0.4641
0.4713
0.4772
0.4821
0.4861
0.4893
0.4918
0.4938
0.4953
0.4965
0.4974
0.4981
0.4987
0.01
0.0040
0.0438
0.0832
0.1217
0.1591
0.1950
0.2291
0.2611
0.2910
0.3186
0.3438
0.3665
0.3869
0.4049
0.4207
0.4345
0.4463
0.4564
0.4649
0.4719
0.4778
0.4826
0.4864
0.4896
0.4920
0.4940
0.4955
0.4966
0.4975
0.4982
0.4987
0.02
0.0080
0.0478
0.0871
0.1255
0.1628
0.1985
0.2324
0.2642
0.2939
0.3212
0.3461
0.3686
0.3888
0.4066
0.4222
0.4357
0.4474
0.4573
0.4656
0.4726
0.4783
0.4830
0.4868
0.4898
0.4922
0.4941
0.4956
0.4967
0.4976
0.4982
0.4987
7. 99
0.03
0.0120
0.0517
0.0910
0.1293
0.1664
0.2019
0.2357
0.2673
0.2967
0.3238
0.3485
0.3708
0.3907
0.4082
0.4236
0.4370
0.4484
0.4582
0.4664
0.4732
0.4788
0.4834
0.4871
0.4901
0.4925
0.4943
0.4957
0.4968
0.4977
0.4983
0.4988
0.04
0.0160
0.0557
0.0948
0.1331
0.1700
0.2054
0.2389
0.2704
0.2995
0.3264
0.3508
0.3729
0.3925
0.4099
0.4251
0.4382
0.4495
0.4591
0.4671
0.4738
0.4793
0.4838
0.4875
0.4904
0.4927
0.4945
0.4959
0.4969
0.4977
0.4984
0.4988
0.05
0.0199
0.0596
0.0987
0.1368
0.1736
0.2088
0.2422
0.2734
0.3023
0.3289
0.3531
0.3749
0.3944
0.4115
0.4265
0.4394
0.4505
0.4599
0.4678
0.4744
0.4798
0.4842
0.4878
0.4906
0.4929
0.4946
0.4960
0.4970
0.4978
0.4984
0.4989
0.06
0.0239
0.0636
0.1026
0.1406
0.1772
0.2123
0.2454
0.2764
0.3051
0.3315
0.3554
0.3770
0.3962
0.4131
0.4279
0.4406
0.4515
0.4608
0.4686
0.4750
0.4803
0.4846
0.4881
0.4909
0.4931
0.4948
0.4961
0.4971
0.4979
0.4985
0.4989
0.07
0.0279
0.0675
0.1064
0.1443
0.1808
0.2157
0.2486
0.2794
0.3078
0.3340
0.3577
0.3790
0.3980
0.4147
0.4292
0.4418
0.4525
0.4616
0.4693
0.4756
0.4808
0.4850
0.4884
0.4911
0.4932
0.4949
0.4962
0.4972
0.4979
0.4985
0.4989
0.08
0.0319
0.0714
0.1103
0.1480
0.1844
0.2190
0.2517
0.2823
0.3106
0.3365
0.3599
0.3810
0.3997
0.4162
0.4306
0.4429
0.4535
0.4625
0.4699
0.4761
0.4812
0.4854
0.4887
0.4913
0.4934
0.4951
0.4963
0.4973
0.4980
0.4986
0.4990
0.09
0.0359
0.0753
0.1141
0.1517
0.1879
0.2224
0.2549
0.2852
0.3133
0.3389
0.3621
0.3830
0.4015
0.4177
0.4319
0.4441
0.4545
0.4633
0.4706
0.4767
0.4817
0.4857
0.4890
0.4916
0.4936
0.4952
0.4964
0.4974
0.4981
0.4986
0.4990
Project Management
Managing Risk
A Critique of PERT
In PERT analysis only one critical path is taken into
consideration in assessing the probabilistic behavior of project
duration. Furthermore,
Near critical paths are disregarded;
Possible correlation among activity realizations is ignored;
Normality assumption may not be justified.
PERT results could be misleading when,

Number of critical / near critical paths is large;
Probabilistic dependency among activities cannot be ruled out;
Number of activities on the considered critical path are few.
PERT usually under-estimates the true project duration.

7. 100
Project Management
Managing Risk
PERT Example
A more accurate approach is to identify each sequence of activities that lead from
the start node to the finish event and then to calculate separately the probability
that the activities that compose each sequence will be completed by a given date.
It is assumed that central limit theorem holds for activities on each sequence
Furthermore it is assumed that the sequences themselves are statistically
independent (i.e.time to traverse each path in the network is independent of what
happens on the other paths).
Then the probability of completing the project by a given date is set equal to the
product of the individual probabilities that each sequence is finished by that date.
Given n sequences with completion time X1, X2,..., Xn and
X = max {X1, X2,..., Xn };
P( X
) P( X 1
) P( X 2
7. 101
)....... P( X n
Project Management
Managing Risk
PERT Example
A
8,2
9,3
10,3
Activity durations are normally

distributed with the given
means and standard deviations
6,1.5
Length(A-B) = X1 ~ N (17, 3.61)

Length(C-D) = X2 ~ N (16, 3.35)
Length(S-T) = X
7. 102
Project Management
Managing Risk
PERT Example
Performance time distribution for the two sequences
7. 103
Project Management
Managing Risk
PERT Example
The project can end in 17 weeks only if both A-B and C-D are completed
within that time.
P X1
P X2
17
17
P Z
17 17
3.61
PZ
P Z
17 16
3.35
PZ
0.299
0 .5
0.62
Thus the probability that the project will finish by week 17 is

approximately 31%
PX
17
P X1 17 * P X 2
7. 104
17
0.5 * 0.62
Project Management
Managing Risk
PERT Example
The previous analysis is accurate if
the sequences are independent. This
is not the case when one or more
activities are members of two or
more sequences.
8,2
9,3
3,4
Here activity E is a member of the

C
two sequences that connect the start

of the project to its termination.
10,3
Sequence
Expected Length
A-B-E
8+9+3=20
C-D-E
10+6+3=19
Standard Deviation
42
32
22
42 32 1.52
7. 105
6,1.5
5.39
5.22
Project Management
Managing Risk
PERT Example
The probability that the sequence A-B-E will be completed in 17 days is calculated as
P XA
B E
17
17 20
5.39
P Z
PZ
0.5565
0.29
The probability that the sequence C-D-E will be completed in 17 days is calculated
as
P XC
D E
17
P Z
17 19
5.22
PZ
0.383
0.35
The probability of completing the project in 17 days is calculated to be 10%

assuming that the sequences are independent.
P X
17
P XC
D E
17 * P X C
D E
17
0.29 * 0.35
The true probability completing the project in 17 days is between 10% and 29%!!
7. 106
Project Management
Managing Risk
PERT Simulation
Computer Simulation is a more laborous, but reliable way of assessing the
probabilistic behaviour of projet duration.
The process of random activity duration/cost generation, and schedule
determination based on the given probability distributions of activity durations
and costs is called a simulation run.
Simulation runs are repeated many times (hundreds of times) to assemble a
large set of project schedule, duration and cost realizations.
The data set obtained from the simulation runs forms a basis for a reliable,
probabilistic assessment of project duration and cost, and potential resource
conflicts
Risk retention or transfer decisions can be made using time, cost and
schedule information gained from simulation runs.
Computer simulation is especially useful in large, complex projects that
include a great deal of uncertainty, while having reasonably accurate time
estiumates for activities.
7. 107
Project Management
References:
Larson E. W and Gray C. F., Project Management:
The Managerial Process, 5th ed. Mc Graw Hill/Irwin,
NY, USA, 2011
Original slides courtesy of Prof. Ilhan Or.
Aybek Korugan - Bogazii University
7. 108
Project Management

Ch7 v2 AK

Diunggah oleh

Informasi Dokumen

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Ch7 v2 AK

Diunggah oleh

Hak Cipta:

Format Tersedia

Managing Risk

Aybek Korugan - Boazii University

December 18 1941 Operation Barbarossa

And well calculated risks:

May refer to vulnerability/exposure;

Units deployed to measure Risk may also differ:

Number of fatalities per year (fatalities/year);

Aybek Korugan - Boazii University

What is Risk?: Pascals Wager

Predictions to the future are done with

Risk is encountered when a decision is made at present time and

Alternative definitions of risk

Aybek Korugan - Boazii University

The Intellectual Evolution of Risk Assessment

The Intellectual Evolution of Risk Assessment

The Intellectual Evolution of Risk Assessment

The Intellectual Evolution of Risk Assessment

[Risk Level = Probability X Level of Damage]

Project Risk Management

Aybek Korugan - Boazii University

New technology or materials. Test failures.

Unforeseen weather/natural conditions.

New systems and procedures. Training needs.

Established customs and beliefs.

Freeze on capital, bankruptcy of stakeholders. Currency

Local laws. Lack of clarity of contract.

Change in market conditions or customers.

Shortage of staff, operatives, materials.

Slow-down in economy, change in prices.

Change of government or government policy.

Aybek Korugan - Boazii University

Risk Management Dilemma

Aybek Korugan - Boazii University

Risk Management Dilemma

Unproven technology (design or technology selection errors);

As the project progresses, the chances of undesirable events occurring

Aybek Korugan - Boazii University

Risk Prone Inclined (seeking) to take Risks

People may exhibit risk prone or risk averse behaviour

Aybek Korugan - Boazii University

People respond to hazards that they perceive. If perceptions

Such behavior is also supported by Inference Theory of Probability.

Aybek Korugan - Boazii University

Perception of Risk in Catastrophic Events

Qualitative Factors in Risk Perception

Risk assumed involuntarily

Risk of death delayed

Risk of death immediate

Risk certain not to be fatal

Risk certain to be fatal

Risk level of exposure known

Risk level of exposure unknown

Personal risk can be controlled

Personal risk cannot be controlled

Risk is old and familiar

Risk is new and unfamiliar

Risk is chronic (one at a time)

Risk is catastrophic (many deaths)

Risks to unidentified persons

Risks to identified individuals

Risks from open activities

Risks from secret activities

Source: Baruch Fischhoff