Ch7-v2-AK

7/26/2019 Ch7-v2-AK

1/108

7. 1 Project ManagementAybek Korugan - Boazii University

Managing Risk

7/26/2019 Ch7-v2-AK

2/108


What is Risk?

The concept of risk and risk assessment has a long history.

2400 years ago the Athenians offered their capacity of

assessing risks before making decisions: We Athenians take our decisions in policy and submit them to

proper discussion. The worst thing is to rush into action before

consequences have been properly debated. This is an important

aspect in which we differ from other people.

We are capable of taking risks while assessing them beforehand.

Others are brave out of ignorance; and when they stop to think, they

begin to fear. But the man who can most truly be accounted brave is

he who best knows of what is sweet in life and what is terrible, andhe then goes out undeterred to meet what is to come.

(Pericles Funeral Oration in Thurcydidas History of the

Peloponnesian War)

7/26/2019 Ch7-v2-AK

3/108

7. 3 Project Management

What is Risk?

History is full of miscalculated risks:

December 23-29 1914 SarkamOperation

* Nearly 60.000 troops dead in seven days due to severe weather

conditions

December 18 1941 Operation Barbarossa* During 1941-1944 nearly %95 of the German forces were lost. 3.9

million troops of axis forces were involved

And well calculated risks:

June 6 1944 D-Day Normandy Landings April 11-17 1970 Apollo 13

* Oxygen tank explosion and safe return to earth

Aybek Korugan - Boazii University

7/26/2019 Ch7-v2-AK

4/108


What is Risk?

Point of Truth

The risks taken and not taken in Hollywood:

The Blair Witch Project: C 60.000; R 140 mil.

Ishtar: C WarrenBetty+Dustin Hofman + 55 mil,

R 14 mil.

American Graffiti: C

7/26/2019 Ch7-v2-AK

5/108


What is Risk?

Risk is a common term, heavily used in daily language. But,issues/concepts reflected may differ: May refer to vulnerability/exposure;

May refer to likelihoodof occurrence of the event;

May refer to the consequencesof the event;

May refer to a measure combiningthe notions above.

Units deployed to measure Risk may also differ: Number of fatalities per year (fatalities/year);

Infrastructure damage (down time);

Business losses pear year ($/year);

Combination of the above.

7/26/2019 Ch7-v2-AK

6/108


By Hertz & Thomas

Risk means both uncertainty and the result of uncertainty.That is, risk refers to a lack of predictability about structure,outcomes or consequences in a decision or planningsituation. Risk is therefore related to concepts ofchangesuch as the probability of lossor the probability

of ruin.

A Definition of Risk

7/26/2019 Ch7-v2-AK

7/108


What is Risk?: Pascals Wager

Blaise Pascal(June 19, 1623, Clermont-FerrandAugust 19, 1662, Paris)

The philosophy uses the following logic (excerpts from Penses, part III, note 233):

1. "God is, or He is not"

2. A game is being played... where heads or tails will turn up.

3. According to reason, you can defend neither of the propositions.

4. You must wager. It is not optional.5. Let us weigh the gain and the loss in wagering that god is. Let us estimate these

two chances. If you gain, you gain all; if you lose, you lose nothing.

6. Wager, then, without hesitation that He is. (...) There is here an infinity of aninfinitely happy life to gain, a chance of gain against a finite number of chances

of loss, and what you stake is finite. And so our proposition is of infinite force,when there is the finite to stake in a game where there are equal risks of gain andof loss, and the infinite to gain.
http://en.wikipedia.org/wiki/Clermont-Ferrandhttp://en.wikipedia.org/wiki/Parishttp://en.wikipedia.org/wiki/Pens%C3%A9eshttp://en.wikipedia.org/wiki/Pens%C3%A9eshttp://en.wikipedia.org/wiki/Parishttp://en.wikipedia.org/wiki/Clermont-Ferrandhttp://en.wikipedia.org/wiki/Clermont-Ferrandhttp://en.wikipedia.org/wiki/Clermont-Ferrand

7/26/2019 Ch7-v2-AK

8/108


A Definition of Risk

Lack of predictability about the structure:

Full knowledge => deterministic structure

=> Predictability without errors => certainty.

Thus, lack of predictability is due to

lack of knowledge.

7/26/2019 Ch7-v2-AK

9/108


What is Risk?

Lack of predictability about the outcomes(consequences):

Predictions to the future are done with

information from the pastand

the knowledge of present.

Finite information and finite knowledge results in predictionerrors.

7/26/2019 Ch7-v2-AK

10/108


What is Risk?

Risk is encountered in decision or planning situations.(Planning is full of decisions.)

Due to lack of knowledge about the structure, the outcome

of a decision might be unpleasant.

Decisions are about change (whether they mandate or avoidthem.)

Change is not always towards a good outcome.

7/26/2019 Ch7-v2-AK

11/108


Risk is encountered when a decision is made at present time andstate of a system with present knowledge towards the desired future

state(s).

Present State(s) Future State(s)desirable

undesirableRisk

Lack of Information/Knowledge

Decision

7/26/2019 Ch7-v2-AK

12/108


Unforeseen Events

The definition is missing the impact of theuncontrollable phenomena surrounding the systemwhere the risk prediction is made.

Uncontrollable events may alter the decision made foran isolated environment.

When predictions are made the randomness resultingfrom the environment has to be taken into account.

7/26/2019 Ch7-v2-AK

13/108


Alternative definitions of risk

Risk is uncertainty about and severity of the consequence of an activity withrespect to something that humans value (Aven and Renn 2008);

Risk is equal to the combination of events/consequences and associateduncertainties (Aven 2007);

Risk is an uncertain consequence of an event or an activity with respect tosomething that humans value (Renn 2005);

Risk equals the expected disutility (Campbell 2005);

Risk is a situation or event where something of human value is at stake andwhere the outcome is uncertain (Rossa 2003);

Risk is the combination of probability of an event and its consequences(ISO 2002);

Risk refers to uncertainty of outcome, of actions and events (Cabinet Office,UK 2002);

Risk is the probability of an adverse outcome (Graham 1995).

7/26/2019 Ch7-v2-AK

14/108


What is Risk?

Systems are not isolated. They are connected to eachother. The outcome of a system may effect or evendefine the outcome of another system.

Prediction of risk is not an easy task. It requires a broadunderstanding of interconnected systems.

7/26/2019 Ch7-v2-AK

15/108


What is Risk?

Without a structured approach to dealing with risk (without odds andprobabilities), the natural way of dealing with risk is to appeal to gods or to

fate; risk is wholly a matter of gut.

A key factor in distinguishing modern age is the mastery of risk

The notion that man are not passive before nature;

By understanding, measuring and managing risk, risk-taking has been

converted into one of the prime catalysts that drives modern society;facilitating economic growth, technological progress and improved quality of

life;

The nature of risk and the art and science of choice lie at the core of modern

market economy;

In any risky environment, negative outcomes from time to time cannot be

avoided; but what is more important from the societys perspective is the longterm outlook.

7/26/2019 Ch7-v2-AK

16/108


The Intellectual Evolution of Risk Assessment

Fortune tellers: Reading: the stars, coffee residue,behavior of natural elements etc. Consulting theelderly.

Renaissance and Enlightenment: Probability Theory

Cardano => Calculating Odds

Pascal & Fermat => Theory of Probability.

Forecasts and decisions with the help of numbers.

7/26/2019 Ch7-v2-AK

17/108



=>Trade-off between risk and reward became thecenterpiece of the decision-making process.

(Still not the case for drivers in Istanbul though. Heavyreliance on mystic elements. Excessive risks taken formarginal gains.)

1703: Interaction btw. Leibniz and Jakob Bernoulli

result: Law of Large Numbers &Statistical Inference

7/26/2019 Ch7-v2-AK

18/108



Marine Insurance flourishes in 1730s

De Moivr: Structure of Normal Distribution

standard deviation, measurement of risk.

Daniel Bernoulli. Definition of expected utility.the utility resulting from any small increase in wealthwill be inversely proportionate to the quantity of goods

previously possessed.

=> risk aversion and the ground works of portfoliomanagement.

7/26/2019 Ch7-v2-AK

19/108



1754 BayesTheorem:

better-informed decisions by mathematically blendingnew info into old.

Almost all risk management tools in use are discoveredbetween 1654-1754 except for

1875 Francis Galton: discovery of regression to themean

1952 Harry Markowitz: Application of quantifieddiversification to portfolio management.

7/26/2019 Ch7-v2-AK

20/108


Managing Risk

Risk: The exposure to the chance of loss; the combination ofthe likelihood of an undesirable event (hazard) occurring and thesignificance (level) of the consequence of the event occurring.

[Risk Level = Probability X Level of Damage]

Project Risk Management A proactive attempt to recognize and manage internal events and

external threats that affect the likelihood of a projects success. It aims

at,* identifying as many risks as possible (what can go wrong);

* minimizing their impacts (what can be done about the events before or

during the project);* providing contingency funds to cover risk events that actually materialize.

7/26/2019 Ch7-v2-AK

21/108


Technical New technology or materials. Test failures.Enviromental Unforeseen weather/natural conditions.

Operational New systems and procedures. Training needs.

Cultural Established customs and beliefs.

Financial Freeze on capital, bankruptcy of stakeholders. Currencyfluctuations.

Legal Local laws. Lack of clarity of contract.

Commercial Change in market conditions or customers.

Resource Shortage of staff, operatives, materials.

Economic Slow-down in economy, change in prices.

Political Change of government or government policy.

Project Risks

7/26/2019 Ch7-v2-AK

22/108


Risk Management Dilemma

7/26/2019 Ch7-v2-AK

23/108


Risk Management Dilemma

The chances of an undesirable event occurring are greatest in the concept,design, planning and startup phases of a project.

* Unproven technology (design or technology selection errors);

* System complexity

* Integration requirements

* Physical or chemical requirements

* Modeling assumptions and estimation errors

* Interfacing with internal and external systems* Operating environment

However, the magnitude of their negative impact is less if the event occursearlier rather than later; The opportunity for minimizing the impact or workingaround a potential risk exists.

As the project progresses, the chances of undesirable events occurring

decrease, but their potential magnitude increases rapidly. Reassessment of needs, revitalized competition, newly emerging technologies,

design changes after a prototype has been made.

7/26/2019 Ch7-v2-AK

24/108


Risk Preferences

Individualsattitude to take Risks. Risk AverseDisinclined (afraid) to take Risks

Preferring a certain environment having a specified damage level, to arisky environment having the same risk level.

Risk ProneInclined (seeking) to take RisksPreferring a risky environment having a specified risk level to acertainty environment having the same damage level.

People may exhibit risk prone or risk averse behaviourdepending on the circumstances.

Buying insurance (risk averse behaviuor);Buying lottery tickets; extreme sports (risk prone behaviour).

7/26/2019 Ch7-v2-AK

25/108


Risk Perception

Risk is essentially a cognitive phenomenon. Social, cultural & professional bias may have considerable

effects on groups or individuals perception of risk. The current emphasis on security, ecological and IT risks could make

excellent research material for an anthropologist in 200 years.

People respond to hazards that they perceive. If perceptionsare faulty, public or organizational policy will be misdirected.

Laymen s perceptions of risk are more qualitative than

experts. Individuals have great difficulty in interpreting low probabilities in

making their decisions; There is evidence that people may not even want data on the

likelihood of an event occurring.

7/26/2019 Ch7-v2-AK

26/108


Risk Perception

Perceived risk is biased by imaginability & memorability of hazard. Peoples perception of risks are influenced by whether they are told of

likelihood and/or consequences of risk events or whether they personallyexperience those disasters.

If risk event has not materialized yet, they underestimate; if an undesirablerealization has occurred they tend to overestimate.

Such behavior is also supported by Inference Theory of Probability. Consider an urn populated mostly by (unknown number of) black balls and a

few (less than 0.1%) red balls;

Conduct a series of trials where a single ball is drawn randomly, its colornoted and the ball is replaced;

Most trials should end up with black balls (representing non-occurance of

hazards) and each additional black ball drawn does not affect the probabilityestimate for the next ball drawn being black (thus taken for granted);

Whenever a red ball is drawn (representing the occurance of an hazard), theprobability estimate for the next ball drawn being red increases dramatically.

7/26/2019 Ch7-v2-AK

27/108


Risk Perception

Availability Heuristicand it will happen/it wont happen tomebelief is what guides individualsrecognition of risk. Many people buy their first set of battery cables only after their car

doesnt start and has to be towed.

Most homeowners purchase earthquake insurance only afterexperiencing a quake.

Many drivers still refuse to wear seatbelts. When asked why, theyresponded, I wont have an accident.

Past events always look less random then they actually were. This is called Hindsight Bias.

After the fact, people always find logical and well fitting arguments

to explain why a past event was not as random (or even inevitable).

7/26/2019 Ch7-v2-AK

28/108


Risk Perception

Low probability / High consequence events are often perceivedas impossible until they happen; and then are seen as inevitable In many cases, these events are ignored because of the underlying

assumptions we have made about our environment;

Some were never envisioned (Bhopal/ World Trade Center);

Some were envisioned but thought to be extremely unlikely (NewOrleans Flooding);

Some were thought likely to occur but would only have minor orcontrollable consequences (Exxon Valdez).

Had they been expected, they would not have caused the

damage they did. Strange to see an event happening and causing great damage precisely

because it was not supposed to happen.

7/26/2019 Ch7-v2-AK

29/108


Perception of Risk in Catastrophic Events

Perceived

risk level

Real risk

level

TimeRealization of the

catastrophic event

7/26/2019 Ch7-v2-AK

30/108


Qualitative Factors in Risk Perception

Risk assumed voluntarily Risk assumed involuntarilyRisk of death delayed Risk of death immediate

Risk certain not to be fatal Risk certain to be fatal

Risk level of exposure known Risk level of exposure unknown

Personal risk can be controlled Personal risk cannot be controlled

Risk is old and familiar Risk is new and unfamiliar

Risk is chronic (one at a time) Risk is catastrophic (many deaths)

Risk is common Risk is dreaded

Rist to beneficiaries Risk to non-beneficiaries

Risks to unidentified persons Risks to identified individuals

Risks from open activities Risks from secret activities

Source: Baruch Fischhoff

7/26/2019 Ch7-v2-AK

31/108


Qualitative Factors in Risk Perception

Old/Familiar vs New/Unfamiliar: Traditional food, cosmic radiation versus new food additives or radiationfrom nuclear industry.

Chronic/Catastrophic: Concentrated obvious risks (major industrial accidents) versus diffuse risks (such as

equal number of accidents scattered around as a result of a number of smaller scale industrial accidents).

Beneficiaries/Non-beneficiaries: Recipients of radio-therapy versus public exposed to emission from nuclear

power stations.

Unidentified/Identified persons: Those referred in traffic accident statistics versus specific persons trapped in a

sinking ship.

Smoking Cigarettes: Risk is voluntary, old/familiar, delayed; risk level is known.Eating Meat(undertaking the risk of mad-cow disease): Risk is involuntary, fatal, new and unknown; level of

risk is unknown.

Traveling by Car: Risk is chronic, controllable (to some degree, by safe driving ), usually not fatal.

Traveling by Plane: Risk is catastrophic, uncontrollable, fatal.

Catching a Disease from Banknotes: Risk is voluntary (unintentional), old, known, delayed, not fatal.

Cathing Antrax from Letters: Risk is intentional, new, unknown, unfamiliar, fatal.

An individual may avoid eating beef because of mad-cow disease risks, yet smoke many cigarettes per day

or drink considerable alcohol before driving.

An individuals attitude and behaviour towards a risk may vary over time, even though objective conditions

may not have changed.


7/26/2019 Ch7-v2-AK

32/108


Risk Communication Issues

Perceived accuracy of a Risk Communication is hampered by: Real or perceived advocacy; Reputation for deceit, misrepresentation, coercion; Self serving framing of messages; Contradictory messages from other sources; Actual or perceived professional incompetence and impropriety.

It is not uncommon for the public to hear one expert say thatthere is nothing to worry about regarding a particular risk,while at the same time learning from another expert that thisrisk should be on your radar screen.

There may be many different reactions to these conflicting

reports. One layperson may decide that they cannot rely onthe judgment of any expert. Another individual may decide tofocus on the expert supporting his or her own view of the risk.

7/26/2019 Ch7-v2-AK

33/108


Risk Communication Issues

Other Issues: People simplify; Once peoplesminds are made up, it is difficult to change them; People remember what they see; People cannot detect incomplete information nor inconsistencies; People are highly influenced by the behavior and actions of others in

their immediate neighborhood; People may disagree more about what the risk is (impact) than abouthow large it is (probability);

The confusion in nomenclature creates fertile ground for ambiguity &confusion in risk communication.

A problematic Risk Communication issue: Oversensitive/over-

regulated Automated Alarm Systems. Auto alarms(do they really serve a purpose or are they mostly annoyance?) Alarms in hospital operating rooms; Role of the automated alarm system in the Deepwater Horizon disaster.

7/26/2019 Ch7-v2-AK

34/108


Some Risk Perception Communication Cases

From Everyday Life

Misperceptions regarding hazard likelihood, hazard consequence;inadequate safety measures; unsafe practices; unsuccessfull risk

communication.

All the cases described below appeared in the media as unfortunate

accidents. Actually, any harm (let alone death) could easily have been

avoided with a little serious consideration of the risks involved.

(At an engagement ceromony in Dudullu) A balkony collapsed when 50 people tried to squeeze

themselves to the small space. Unfortunately many died in the ensuing accidental balcony

collapse.Hazard likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication

(Yalkavak- Bodrum) A young man spreyed insect sprey to his bed right before he lied down

and slept. Unfortunately, he was accidentallyand fatally effected by the chemical and died.Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication

(Ali Kirca - at his home in Kurueme)Mr. Krcawalked into the void while attepting to step

into the elevetor (which was at another floor).Hazard Likelihood, Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull Risk Communication


7/26/2019 Ch7-v2-AK

35/108



From Everyday Life

(Gztepe - Istanbul) Two nightwachmen operate the turning chairs at the

funfair and board them. Then, since there is nobody else to stop the system,

they remain trapped in the chairs circling at high speed till the next morning.

Unfortunately they both died.Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication

(Beyolu - Istanbul) Maintenance crews were replacing a large (180 x 180

cm) glass panel on an 8th floor window in a building on the crowded Istiklal

Caddesi. They accidentally droped the panel which duely fell down,

crashing on the pavement and seriously injuring one pedestrian.Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication

(Bahelievler - Istanbul) Cleaning crews were cleaning upper storey

windows of a 10 storey building with the aid of a mobile crane. The crew

decided to move the crane to a new positon for further window cleaning,

without lowering the extended ladder (the formal procedure strictly requires

the crane to be immobilized and stabilized on extended legs before theladder on which the crew nest resides can be raised). The crane accidentally

tipped over, the extended ladder crashing a passenger car and seriously

injuring wounding two persons.Hazard Likelihood; Hazard Consequence; Inadequate Safety Measures; Unsafe Practices; Unsuccessfull

Risk Communication

7/26/2019 Ch7-v2-AK

36/108


What is Risk Management

Risk Management: The making of public and private decisionsregarding protective policies and actions that reduce the threat tolife, property and the environment posed by hazards.

Risk Management is a set of integrated and coordinatedproactive attempts in an organization to recognize and manage

internal events and external threats that affect occurrencelikelihood, impact level and recovery from technological,natural or any other hazards. It aims at, Identifying as many risks as possible (what can go wrong);

Minimizing their impacts;

Providing contingency funds, response and recovery plans to cover risk

events that actually materialize. It is imperative that top management understand and comprehend the

meaning of risk management.


7/26/2019 Ch7-v2-AK

37/108


What is Risk Management

It is the ability to predict what may happen in the future,assess associated risks & to choose among alternatives in away to minimize potential loss.

It is the process of identifying and prioritizing risks, and thenof developing strategies to reduce risks and deal with

consequences Few risks are straightforward.

Most of the time there are competing risks to balance, trade-offs tomake.

Failure to do Risk Management properly could result in

recognizing and addressing only a small fraction of the manyrisks affecting an organization.


7/26/2019 Ch7-v2-AK

38/108


Managing Risk

Planning for project risks formally addresses identification,analysis & assessment of potential trouble spots before

implementing a project.

It prepares the PM to take risk when a time, cost and/or

technical advantage is possible.

It is a Proactiverather than Reactiveapproach;

Reduces surprises and negative consequences;

Prepares the PM to take advantage of appropriate risks;

Provides better control over the future;

Improves chances of reaching project performance objectives withinbudget and on time.

7/26/2019 Ch7-v2-AK

39/108


Role of Risk Manager

Setting policy and strategy for risk management; Primary champion of risk management at strategic &

operational level;

Building a risk aware culture within the organisation includingappropriate education;

Establishing internal risk policy & structures for business units; Designing and reviewing processes for risk management;

Co-ordinating the various functional activities which advise onrisk management issues within the organisation;

Developing risk response processes, including contingency andbusiness continuity programmes;

Preparing reports on risk for the board and the stakeholders.


7/26/2019 Ch7-v2-AK

40/108


Managing Risk

Major components of Risk Management Process: Identifying Sources of Risk;

Analyzing and Assessing Risk;

Risk Response Development;

Contingency Planning & Contingency Reserves; Risk Response Control.

Th Ri k M t P

7/26/2019 Ch7-v2-AK

41/108


Step 1: Risk Identification

Analyze the environment to identify sources of risk

Step 2: Risk AssessmentAssess risks in terms of, Severity of impact; Likelihood of hazard occurrence; Controllability.

Step 3: Risk Response Development Develop strategy to reduce occurance likelihood;

Develop strategy to reduce impact;

Develop contingency plans.

Step 4: Risk Response Control & Impl. Implement risk strategy;

Monitor & adjust plans for new risks;

Trainings and Exercises.

New risks

New risks

New risks

Known risks

Risk assessment

Risk management plan

The Risk Management Process

M i Ri k

7/26/2019 Ch7-v2-AK

42/108


Risk identification begins with a list of all areas that may causeproject delays or failure & their respective outcomes.

Brainstorming and Risk Profiling is the initial step;

Things that have not been done before are potential trouble spots;

Risk sources depending on specific type of issue at hand:* Construction; Design; Software; Transportation.

Risk sources orginitaing from the organization:* Organizational size, structure and culture, resources, financial structure.

Risk Sources external to the organization:* Inflation; market acceptance; exchange rates; government regulations.

It is better to start with risks associated with the whole project;

Once macro risks are identified, specific areas can be checked. WBS is an effective tool in identifying specific, technical risks

associated with tasks and deliverables.

Managing RiskStep 1: Identifying Sources of Risk

7/26/2019 Ch7-v2-AK

43/108


Risk Profiling is a good tool to help identify risks. It is a list of questions addressing traditional areas of uncertainty; Good risk profiles are tailored to the type of work/environment under consideration;

Questions are usually developed from previous, similar experiences; They should recognize/focus on strengths & weaknesses of the organization They address both technical and management risk;

Some management consulting firms provide/sell risk profiles. Historical Records are also useful in risk identification.

Simulating all business processes, procedures is a good practice.

Risk Identification process should not be limited to a few persons. Input from employees, customers, sponsors, subcontractors, vendors should

be solicitude through interviews. Risk Identification process should be repeated at regular intervals.

The risk landscape constantly evolves and, with it, the risks.

Identifying Sources of Risk

Id tif i S f Ri k

7/26/2019 Ch7-v2-AK

44/108


Identifying Sources of RiskPartial Risk Profile for Product Development Project


7/26/2019 Ch7-v2-AK

45/108


Identifying Sources of RiskRisk Breakdown Structure


7/26/2019 Ch7-v2-AK

46/108


Identifying Sources of RiskRoots of Risk Propensity in Large & Complex Systems

One common mistake that is made early in the risk identification process is

to focus on objectives and not on the events that could produce

consequences. (e.g. failing to meet schedule is a consequence while cause s

can be, poor estimates, adverse weather, shipping delays, etc.).

Concentrate on actual events

Activities that are performed in the system may be inherently risky (e.g.

mining, hazardous material transportation, air transportation);

The technology used may have inherent risks, or exacerbate risk in the

system (e.g. heavy equipment);

Physical environment may be inherently risky, Susceptibility to natural disasters;

Proximity to and nature of populated areas and other businesses; Supporting infrastructure (power, telecommunications, water, transportation)

7/26/2019 Ch7-v2-AK

47/108


The product or service provided may have inherent risks, Potentially dangerous materials, and products or services; Demographics of customers;

Liability for defective services and products;

Quality issues.

Human & organizational errors can be propagated by organizations &individuals executing/coordinating tasks, or using technology.

Organizational resources/policies may be inadequate or out of phase. Financial, manpower, equipment, management and technology resources;

Investments, marketing, strategies, suppliers, customers/partners/markets.



7/26/2019 Ch7-v2-AK

48/108


Identifying Sources of RiskRoots of Risk Propensity in Large & Complex Systems

Communications channels may be inadequate or prone to failure.Availability level of formal and informal channels of communication;

Procedures not clearly established nor well understood;

Ability to receive warning signals;

Receptivity and ability to properly interpret warning signals.

Organizational structures may enable risky practices to occur, or may

encourage workers to pursue risky courses of action. For example:Lack of formal safety reporting systems or departments in organizations;

Organizational standards that are impossible to meet without taking risks.

Organizational cultures may support/encourage risk taking, or fail to

encourage risk aversion. For example:

Cultures that encourage the beliefit can

t happen here

,

Rewarding people for taking warranted/unwarranted risks.

Managing Risk

7/26/2019 Ch7-v2-AK

49/108


At an individual level, informal risk assessments are more-or-less continous cognitive process.

When crossing the road;

Purchasing goods;

Deciding on mode of transport;

Engaging in social interaction; Gauging job prospects.

The aim of (formal) risk assessment is to provide informationon which decisions may be made about proposed actions, theadequacy of risk controls and what improvements might be

required.

Not all risks deserve attention.

Managing RiskStep 2: Analyzing and Assessing Risk

A l i d A i Ri k

7/26/2019 Ch7-v2-AK

50/108


Risk Assessment focuses on selected potential foreseen riskevents exhibiting high probability of occurrence and/or having ahigh consequence of loss.

Typically, such risk assessments focus on scenariosdeemed tobe credible and significant by experts.

Risk assessment for an off-shore oil and gas installation may focus onvarios scenarios involving bad weather conditions, ship collision, riser

blow-out and helicopter crash.

Risk assesment for an investment bank may focus on rouge trading,major bad debts and multiple loss of key executives in an air crash.

One drawback: experts following a rationalistic approach may not givesufficient emphasis to all pertinent routes to causes of disaster.* Three Mile Island, World Trade Center cases.

Analyzing and Assessing Risk

A l i d A i Ri k

7/26/2019 Ch7-v2-AK

51/108


Risk Assessment is Multi-disciplinary in natureTo Determine: We Need: Vulnerability Physical Scientists (seismology, geology, hydrology)

Occurance Probability Systems Engineers, ModelersForecasting

Built Environment Engineers (Civil, materials, environmental, transportation)

Damage Potential Health/ Social Impact Health & Social Scientists

Potential (M.D., public health, sociologists)

Economic/Financial EconomistsImpact Potential


A l i d A i Ri k

7/26/2019 Ch7-v2-AK

52/108


Two broad approaches to Risk Assessment Heuristic/Rule of Thumb approach, being in general, qualitative &subjective in nature, relying on individualscollective judgment.

* Expert opinionor gut feelingestimates are the most used, but they carryserious errors depending on the skill of the persons making the judgment.

* Wishful thinking in forecasting erros (if forecasts involve potential personal

gain) may be a problem. Scientific approach employing quantitative modeling and generally

requiring formal training in mathematics.* Quantitative methods, usually require serious data collection and a more

detailed analysis of the facts, while being limited in scope;

* So, they have low acceptance levels by practicing managers.


A l i d A i Ri k

7/26/2019 Ch7-v2-AK

53/108


Main Risk Assessment Techniques Semi-Quantitative Approaches:

* Risk Assessment Charts;

* P-I Tables;

* Risk Assessment Forms & Matrices;

* Failure Modes and Effect Analysis (FMEA);

* Risk Scoring. Quantitative Modeling and Analysis:

* Statistical Analysis;

* Dynamic (Simulation) Analysis;

* Decision Trees, Event Trees, Fault Trees.

Scenario Analysis;

Choice depends on risk source, possible outcomes & impacts, and

managements attitude towards risk assessment.



7/26/2019 Ch7-v2-AK

54/108


y g gRisk Assessment Charts

A Simple Risk Assessment Chart

Risk 1

aboveRisk 2above

Risk 3above

What is the Probability of the

above risks occurring?

0 to 1.0

None - Very High

What is the Impact if these

risks do occur?

0 to 1.0

None - Very High

Risk 1above

Risk 2

aboveRisk 3above

3.

2.

1.

What are the three major risks for this environment?

Resources Available?


7/26/2019 Ch7-v2-AK

55/108


A qualitative assessment of the probability (P) of a hazard & theimpacts (I) it would produce are made by assigning descriptionsto the probability & impact of each risk, by assigningdescriptions to the magnitutes of these probabilities & impacts. The assessor is asked to describe the probability and impact of each risk

by selecting from a predetermined set of phrases* (such as nil, very low, low, medium, high, very high);

A range of values is assigned to each phrase in order to maintain

consistency between the estimates of each risk.* These values generally are not evenly spaced (there is a mulpitle difference

between each case (3-10);

* Usually the same multiple is applied to the probability and impact, so thatseverity scores will be more meaningful;

* The value ranges can be selected to match the specific risk environment.

y g gP-I Tables


7/26/2019 Ch7-v2-AK

56/108


A table examplifying value ranges that could be associated with qualitativedescriptions of the probabilities and impacts in a particular risk environment

Associated with the successful completion of a new product development project.

When the definition of each phrase is made specific to a particular risk

environment, it becomes difficult to perform a combined analysis of the risksfrom multiple risk environments that the organization might face.

Catagory Probability (%) Cost Quality

Very high 10-50 > 1000 Failure to meet acceptance criteria

High 5-10 300-1000 Failure to meet >1 important spec.Medium 2-5 100-300 Failure to meet an important spec.

Low 1-2 20-100 Failure to meet > 1 minor spec.

Very low < 1 < 20 Failure to meet a minor spec.

y g gP-I Tables


7/26/2019 Ch7-v2-AK

57/108


Value ranges can also be selected to reflect the potential effectsof various hazards on the whole organization.

A table examplifying impact descriptions more fitting to thepotential effects of various hazards on the organization as awhole.

Catagory Quality

Catastrophic Jeopardises the existance of the organization.

Major No longer possible to achieve strategic objectives.

Moderate Reduces the ability to reach strategic objectives.

MinorSome short term/tactical disruptions but little effect on strategic objectives.

Insignificant No impact on tactical operations nor on strategic ojectives.

y g gP-I Tables


7/26/2019 Ch7-v2-AK

58/108


y g gP-I Tables

An example description ofLikelihoods

in a P-I Table.


7/26/2019 Ch7-v2-AK

59/108


y g gP-I Tables

An example description

of Consequence Levelsin a P-I Table.


7/26/2019 Ch7-v2-AK

60/108


Various types of impacts of each single risk can be individuallydefined and quantified.

P-I Tables


7/26/2019 Ch7-v2-AK

61/108


A P-I Table offers a quick way to visualise the relative importance ofall identified risks that pertain to a risk environment.

In the following table, all risks are plotted allowing easy identification of themost threatening risks as well as providing a general picture of the overall risks.

* Risk numbers 10, 2, 12, 8 are the most thretening in this example.

Combined Impact for Identified Risks

Impact

V. High 6 10, 2

High 8 12

Medium 5 4, 9 1

Low

V. Low 11 7 3

V. Low Low Medium High V. High

Probability

P-I Tables


7/26/2019 Ch7-v2-AK

62/108


P-I scores can be used to rank identified risks, by assigning a scaling factor(such as 1 5) to phrases used to describe each type of probability &impact.

In this type of scoring, the base measure is probability x impact;

However, since the catagorization resembles a log scale, for consistancy, severity can bedefined as S = P+I(which leaves severity on a log scale also).

Impact

V. High 6 7 8 9 10

High 5 6 7 8 9

Medium 4 5 6 7 8

Low 3 4 5 6 7

V. Low 2 3 4 5 6

V. Low Low Medium High V. High

Probability

High severity

Medium severity

Low severity

P-I Tables

Analyzing and Assessing Riski A i

7/26/2019 Ch7-v2-AK

63/108


Rough estimates are inputted on Risk Assessment Forms/Matrices

A Risk Assessment Form

Risk Event Likelihood Impact Detect. Diff. When

Interface Problems 4 4 4 Conversion

System Freezing 2 5 5 Start-up

User Backlash 4 3 3 Post Installation

Hardware Malfunction 1 5 5 Installation

5

4 B I

3

2 F

1 H

1 2 3 4 5

I: Interface Prob

S: System Freeze

B: User Backlash

H: Hardware Malf.

Risk Assessment Forms and Matrices

Some types of Risk Assessment

Matrices used to provide a basis

for prioritizing which risks toaddress, resemble P-I tables.

Analyzing and Assessing RiskRi k A t/S it M t i

7/26/2019 Ch7-v2-AK

64/108


Risk Assessment/Severity Matrices

Some types of Risk Severity Matrices used to provide a basisfor prioritizing which risks to address, resemble P-I tables.

Analyzing and Assessing RiskFailure Mode and Effects Analysis (FMEA)

7/26/2019 Ch7-v2-AK

65/108


Failure Mode and Effects Analysis (FMEA)

Each risk is assessed in term of the score,Risk Value = Impact x Probability x Detection

Each of the three dimensions is rated along a 5 point scale.

Detection Score (ability to discern that the risk event is imminent) :

1 (spoting very easy) for anybody being able to spot the risk coming;

5 (spoting very hard) discovering after the fact. Similar anchored scales would be applied to impact severity and

occurrence probability.

The weighting of the risks would be based on their overall score.

A broad range of numerical scores: 1125

Analyzing and Assessing RiskRisk Scoring

7/26/2019 Ch7-v2-AK

66/108


Risk Scoring

Each risk is assessed in term of the score,

Risk Value = Impact x Probability x Exposure

Impact: Potential consequences of the hazard as presently controlled;

Probability: Probability that the hazard will result in an accident;

Exposure: Typical frequency and duration of peoples exposure to thehazard.

Each of the three dimensions is rated along a 5 point scale.

1- Minor Injury

2- Serious Injury

3- Major Injury4- Multiple casualties

5- At least one fatalityImpact

Level 1- Very unlikely

2- Unlikely

3- Likely4- Very likely

5- Inevitable (imminent)Probability 1- Rare/never

2- Infrequent (1-3 month)

3- Frequent (weekly)4- High (daily)

5- ConstantExposure

Typical Ratings for Impact, Probability and Exposure


7/26/2019 Ch7-v2-AK

67/108


Scenario Analysis is a commonly used technique foranalyzing risk. Each risk is investigated in terms of:

The undesirable event;

All the outcomes of the events occurrence;

The magnitude or severity of the events impact;

Chances/probability of the event happening;

When the event might occur;

Interaction with and/or influence on other undesirableevents.

y g g


7/26/2019 Ch7-v2-AK

68/108


10 Commandments of Risk Assessment & Analysis Do your homework with literature, experts and users. Let the problem drive the analysis;

Make the analysis as simple as possible, but not simpler.

Identify all significant assumptions.

Be explicit about decision criteria and policy strategies.

Be explicit about uncertainties.

Perform systematic sensitivity analysis.

Iteratively refine the problem statement and the analysis.

Document clearly and completely. Expose to peer review.

y g g

Managing RiskSt 3 Ri k R D l t

7/26/2019 Ch7-v2-AK

69/108


The more effort given to risk response planning before anincident or crisis occurs, the lesser are the surprises. Stressand confusion when the risk event occurs is reduced.

Reducing Risk: Reducing likelihood and/or impact of a

hazard.

Mitigating Risk: Modifying levels/likelihoods of the impact levels. Preventing Risk:Changing the probability of occurrence of the hazard.

Avoiding Risk:Affecting environment/action change to eliminate risk.* Use a tried and tested technology instead of a new one;

* Change the country location of a factory to avoid political instability;

* Scrap the project under consideration.

Modifying Objectives: Reduce or raise performance targets, changetradeoffs.

Step 3: Risk Response Development

Risk Response Development

7/26/2019 Ch7-v2-AK

70/108


Transferring Risk: Passing the risk to another party, withoutchanging it; usually results in paying a premium for this exemption.

Fixed price contracts;

Insurance;

Penalty clauses for exceeding agreed schedules;

Performance guarantee of product or service.

Sharing Risk: Allocates proportions of risk to different parties Leads to innovative continuous improvement procedures. A primary driving principle regarding either risk transfer or risk sharing:

The more the ownership of risks are allocated to those who control them thebetter, up to the point where the owner could not reasonably bear the impactwhere others can.

* How big is the risk?* What are the risk drivers?

* Who is in control of the risk drivers? Who has experience to control them?

* Who can absorb the risk impacts?

p p


7/26/2019 Ch7-v2-AK

71/108


Retaining Risk: It may not be feasible to transfer or reduce risk; so, aconscious decision is made to retain the risk of an hazard.

Contingency Planing: Set aside resources to provide reactive capability.

Deferment: Delay (defer) choices and commitment.

Acceptance: Accept risk exposure, but do nothing about it.

Monitoring: Collect more data about the probabilities of occurrence,

anticipated impacts, in order to better understand the risk. Controlling: Applies to high probability, low impact risks normally

associated with repetitive actions, aiming better management through

better internal processes.

Remaining unaware: Ignore the possibility of risk exposure and take no

action. Increasing: Judging the present course of action as overly cautious and

taking actions to increase the probability of hazard occurance or impact.

p p

Risk Response DevelopmentContingency Planning

7/26/2019 Ch7-v2-AK

72/108


Contingency Planning: Planning for an organization's reaction

to potential hazards to ensure the protection of life, safety, health

and the environment, to limit and contain damage to facilities

and equipment, to stabilize operational service and public image

impacts and to manage communications about the event.

Contingency Plan is an alternative plan to be used if a possibleforeseen hazard becomes a reality. It identifies preventive

actions that will mitigate the negative impacts of the hazard. It

includes: Emergency response plan;

Incident management plan; Crisis communications plan;

Crisis management team plan.

Contingency Planning

Risk Response DevelopmentContingency Planning

7/26/2019 Ch7-v2-AK

73/108


Contingency Plans should include cost estimates, as well asidentifying and establishing the availability of the necessary

funding, equipment and materials.

Contingency Plans should be transparent and conditions for

activating them should be determined and clearly documented.

The plan and related documentation should be communicated to teammembers to minimize surprise and resistance.

All parties effected should agree to the plan and have authority to make

commitments.

Risk events arising from sources external to the project are

more difficult to foresee & tend to cause more disruption. Contingency plans responding to external events may involve new team

players, unfamiliar to the project and having conflicting goals.

Contingency Planning

Risk Response DevelopmentContingency Reserves

7/26/2019 Ch7-v2-AK

74/108


Contingency funds are established to cover project errors,

omissions, & uncertainties that may materialize as the project

progresses.

Owners are often reluctant to set up contingency funds that

seem to imply that the project plan might be a poor one.

Budget Reservesare allocated to specific segments or deliverables;

the amount is determined by costing out the accepted contingency plan.

Management Reserves are allocated to major, unforeseen, potentialrisk associated with the total project.

Time Buffers: Amounts of time used to compensate for unplanneddelays in the project schedule.

Contingency Reserves

Risk Response DevelopmentC ti F d E ti ti

7/26/2019 Ch7-v2-AK

75/108


TABLE 7.1

Contingency Fund Estimation

The numbers are in $1,000

Risk Response Development Example

7/26/2019 Ch7-v2-AK

76/108


First step: Identify whether to reduce, retain, transfer or share risk;

Second step: Set up contingency plans in case risk event still occurs;

Third step: Determine what would trigger implementation of thecontingency plan.

Risk EventResponse

TypeResponse Description

Contingency

PlanTrigger

InterfaceProblems

ReduceExperimenting with a

prototype of the systemWork arounduntil help comes

Not solvedwithin 24 hrs

SystemFreezing

ReduceExperimenting with a

prototype of the systemReinstall OS; callexpert

Still frozenafter 1 hour

UserBacklash

ReduceWell designed & flexibletime training sessions

Increase staffsupport

Call from topmanagement

HardwareMalfunction

Transfer Reliable supplier with astrong warranty program

Order differentbrand

Replacementdoes not work

Risk Response Matrix

Automated Processing/Packaging Machine Procurement

Project: Risk Assessment and Response Matrix

7/26/2019 Ch7-v2-AK

77/108


Risk Event Chance SeverityDetectDiffty

WhenAccept/ReduceShare/Transfer

ContingencyPlan

TriggerEvent

Late Delivery Low Medium LowPre-

Instltn

Transfer/Accept: Better contracts with

penalty clauses; bettercustoms agencies

Having oldmachine onstandby for

backup

Delayexceeding 5

days

OperatorsAdaptationProblems

Low Low MediumPost-

Instltn

Reduce:

On site training beforedelivery; Better training

procedures

Having expertsflown in to

support localteam

Prod rate10% below

planned after5 days

Machine notConfirming toSpecifications

Low High MediumPost-

Instltn

Reduce:Wide communication

with order;Pre deliveryon site inspection

Having oldmachine onstandby for

backup

Acceptancetests

negative

FinancialProblems

Low High LowOrder

Placmnt

Reduce:Influence top mngmtpriorities; obtain self

financing frommanufacturer

Having aleasing plan

ready

Orderdelayed by 5days becauseof financing

UnresolvedInstallationProblems

Medium Medium MediumPre-

Instltn

Reduce:Wide communication

with order

Have backuplocation;Have

old machine onstandby;

Acceptancetests

negative


7/26/2019 Ch7-v2-AK

78/108


Schedule Risks Use of Slack: Use of slack moves that activity and all successors

nearer to their late start; managing slack can be an excellentmethod for reducing schedule risk.

Imposed Duration Dates: Most project have imposed duration

dates, which is frequently a top-down decision that does notinclude bottom-up planning and often understates the normaltime required to complete the project.

Compression of Project Schedules: It is accomplished byshortening critical activities. This decreases total slack and more

paths become critical or near critical. The more critical activities there are, the higher the risk of delaying

project completion.


7/26/2019 Ch7-v2-AK

79/108


Cost Risks: Some management decisions increase cost risks. Time/Cost Dependency: In most activities time and cost do not occur

independently; if one increases the other is also expected to increase.

Cash Flow Decisions: Financial analysts prefer delaying activities to takeadvantage of time value of the associated expenditure. The increased risk ofreducing slack is sometimes ignored or underestimated.

Funding Risks: Changes in funding for the project can seriously affectthe likelihood of implementation or successful completion of a project.

Price Protection Risks: Long duration projects need some contingency forprice hikes (using one lump sum to cover all price risks should be avoided).

Final Cost Forecasts:

Most frequent & dangerous is comparing budget versus actual cost at aparticular point in time, & projecting it to project completion.

A more accurate and reliable approach is the Earned Value concept.


7/26/2019 Ch7-v2-AK

80/108


Technical Risks:

Often associated with new, untried, innovative processes orproducts.

Having comprehensive back-up plans is one option.

In addition, PMs need to develop methods to quickly assess

whether technical uncertainties can be resolved. Sophisticated CAD programs may help resolve design problems;

One should identify high risk technical areas, then build models ordesign experiments to resolve the risk as quickly as possible.

Usually, the owner & PM together make the decisions

concerning technical risk.

Risk Response DevelopmentDocumentation - Risk Registers

7/26/2019 Ch7-v2-AK

81/108


ARisk Register is a document or database that lists each risk pertaining to

a project or organization, along with the following information that is usefulfor the management of those risks: Date the register was last modified;

Name and description of the risk;

Description of why it would occur;

Description of factors that would increase or decrease the probability of occurance or size of

impact;

Semi-quantitative estimates of its probability & potential impact (e.g. P-I scores);

Name of owner of the risk (the person who will be responsible for monitoring the risk and

effecting any risk reduction strategies that have been agreed on);

Details of risk reduction strategies that it is agreed to be taken;

Reduced impact and/or probabilty of the risk, given the above agreed risk reduction

strategies have been taken;

Action window: period during which risk reduction strategies must be put in place; Contingency plans (short description, person responsible, triggers, referenrce to details);

Description of secondary risks that may arise as a result of adopting risk reduction strategies.

Managing RiskStep 4: Risk Response Control

7/26/2019 Ch7-v2-AK

82/108


Risk Response Control

Risk control

* Execution of the risk response strategy

* Monitoring of triggering events

* Initiating contingency plans

* Watching for new risks

Establishing a Change Management System

* Monitoring, tracking, and reporting risk

* Fostering an open organization environment

* Repeating risk identification/assessment exercises

* Assigning and documenting responsibility for managing risk

Risk Response ControlResponsibility for Project Risks

7/26/2019 Ch7-v2-AK

83/108


A key factor in controlling the cost of risks is documenting

responsibility.

If risk management is not formalized, responsibility and

responses to risk will be ignored.

p y j

Risk AssignmentsOwner/PM Contractor SharedInflation Schedule Safety

Natural disasters Cost InnovationScope changesTechnical


Change Control Management

7/26/2019 Ch7-v2-AK

84/108


g g

Most projects will not exactly materialize as planned;controlling project changes is a major challenge for PM. Scope changes (design and additions)

Contingency plan executions leading to cost/schedule changes;

Improvementssuggested by team members.

Since change is inevitable, a well defined change controlprocess should be set up early in the project planning cycle.

Identify proposed changes;

List expected effects of proposed changes on schedule and budget;

Review, evaluate and approve or disapprove changes formally;

Negotiate and resolve conflicts of change, conditions, and cost;

Communicate changes to parties effected; Assign responsibility for implementing change;

Track all changes that are to be implemented.


Change Control Management

7/26/2019 Ch7-v2-AK

85/108


Benefits of a well organized & established change control system:

Inconsequential changes are discouraged by the formal process;

Cost of changes are maintained in a log; accurate estimation of future

project costs is facilitated;

Integrity of the WBS and performance measures are maintained;

Allocation & use of budget & manag reserve funds are tracked; Responsibility for implementation is clarified;

Effect of changes becomes visible to all parties involved;

Customer inquiries are better responded.

Implementation of change is monitored.

Scope changes will be quickly reflected in baseline and performancemeasures.

Since change is inevitable a well defined change

Risk Response ControlChange Management Control

7/26/2019 Ch7-v2-AK

86/108


Since change is inevitable, a well defined changecontrol process should be set up early in the project

planning cycle.

The Change Control Process

Identify proposed changes.

List expected effects of proposed changes onschedule and budget.

Review, evaluate, and approve or disapprove ofchanges formally.

Negotiate and resolve conflicts of change,condition, and cost.

Communicate changes to parties affected.

Assign responsibility for implementing change.

Adjust master schedule and budget.

Track all changes that are to be implemented.

7/26/2019 Ch7-v2-AK

87/108


FIGURE 7.10

Change Request Form

7/26/2019 Ch7-v2-AK

88/108


FIGURE 7.11

Change

Request Log

Managing RiskHandling Randomness in Activity Durations

In order to manage schedule risks we have to be

7/26/2019 Ch7-v2-AK

89/108


In order to manage schedule risks, we have to beaware that only in rare cases is the exact durationof a planned activity known in advance. Realisticestimates of activity durations are prerequisitesfor managing risks, since the process of planningand scheduling a project depends upon timeestimates.

Projects have to be planned before they areexecuted and carry an element of uncertainty andrisk regarding the exact duration of activities

which is seldom known with certainty To gain an understanding of how long it will take

to perform the activity, it is necessary toconstruct a frequency distribution.

This information in the frequency distributioncan be summarized by two measures:

Center of the distribution, expected value ( )

Spread of the distribution, standard deviation( )


Th E t d V l & St d d D i ti f ti it d ti b

7/26/2019 Ch7-v2-AK

90/108


When there is no historical data regarding the random duration of a particularactivity, direct estimation of and , based on PMs experience and subjectiveevaluation, is possible, but is not very reliable.

Instead an indirect estimation, based on an assumed probability distributionof theactivity duration in question, is preferred.

It is a universally accepted practice to assume that it has Beta Distribution.

=

dii=1

n

n =

80/20=

4;

Duration data, di, of past 20 realizations of a particular activity

d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 d12 d13 d14 d15 d16 d17 d18 d 19 d 204 4 4 3 5 4 4 2 5 4 4 1 4 4 6 4 5 4 5 4

The Expected Value & Standard Deviation of activity duration can be

estimated based on past data.


E tensi e research ha e sho n that Beta Distrib tion almost al a s

7/26/2019 Ch7-v2-AK

91/108


Extensive research have shown that Beta Distribution almost always

provides a good fitto random activity duration.

For almost all random activity durations associated with real projects,

parameters a1and a2can be determined such that a Beta distribution with

these parameters will provide a sufficiently accurate representation of the

randomness involved.

Beta distribution can accomodate data sets that do not fit normal

distribution.

The probability distribution of durations could even be skewed toward the

high or low end of the probability range.

f(x) =

xa 1(1 x)a 1

G (a 1,a 2 ) ; where,G (a 1,a 2 )= x

a 1 1

(1 x)a 2 1

dx0

1

Managing RiskThe Beta Distribution

7/26/2019 Ch7-v2-AK

92/108


1.00.5

1.0

2.0

1.00.5

1.0

2.0

x

f (x)

1.00.5

1.0

2.0

x

f (x)

x

f (x)

1.00.5

1.0

2.0

x

f (x)

a a a a

a a

a a

a a

a a

a a

a a

a aa a

a a

a a

a a a a

a a

Managing RiskProject Evaluation &Review Technique (PERT)

7/26/2019 Ch7-v2-AK

93/108


PERT is specifically developed to address uncertainties in

activity time estimates. It assumes the duration of each activity is randomly distributed

according to a Beta Distribution, whose parameters are known.

Beta distribution is flexible & can accommodate many different typesof empirical data.

With Beta distribution estimation of 3 factors is sufficient tocompute, expected value, , and standard deviation, , of theactivity duration.

a = An optimistic estimate for the activity duration;

b = A pessimistic estimate for the activity duration;

m= Most likely estimate for the activity duration;

= a+4m+b

6 ;

Managing RiskProject Evaluation &Review Technique (PERT)

7/26/2019 Ch7-v2-AK

94/108


a1and b1correspond to 5 and 95 percentile points respectively

of the displayed probability distribution;

a2and b2correspond to 1 and 99 percentile points respectively

of the displayed probability distribution.

a1 b1m

b1 a1 = 3.2 x s

a2 b2m

b2 a2 = 6.0 x s

Managing Risk

Project Evaluation &Review Technique (PERT)

7/26/2019 Ch7-v2-AK

95/108


Once, expected duration of each activity is computed, they are treated like

deterministic parameters & estimates for ES,EF,LS, LF, SL of all activitiesare computed as in CPM.

Expected project completion time, TP, is similarly determined.

Variances of activities on the critical path are summed up to give an

estimate for the variance of project duration, P:

Then, the probability distribution of the project duration is assumed to be

normally distributed, and its expected value and variance are deployed to

give reliable probability estimates for completing the project by specifiedtimes, TS.

TP = iallcriticalpathactivities, i

s P2

= s i2

all critical path activities , i

Managing RiskPERT Example

7/26/2019 Ch7-v2-AK

96/108


Activity Times and Variances

Activity a m b 2

A 17 29 47 30 25

B 6 12 24 13 9

C 16 19 28 20 4D 13 16 19 16 1

E 2 5 14 6 4

F 2 5 8 5 1

= a + 4m +b

6 ;

s

2=

b -a

6

2

TP = iallcriticalpathactivities , i

= 64

s P2

= s i2

all critical path activities , i = 36


P Pr oject Duration TS = 67{ } = P T 67{ } = P Z67 64

= P Z 0 5{ } = 0 69

7/26/2019 Ch7-v2-AK

97/108


T is a random variable representing project duration;

T is assumed to be normally distributed.

TSis a user specified (external) scheduled completion time;

Z is a random variable having standard normal distribution

By definition:

Values realizable by Zranges in the interval {-3, +3};

P{Zk}, can be obtained from statistical tables, for all k in interval {-3,3}

P Pr oject Duration TS 67{ } P T 67{ } P Z 6

P Z 0.5{ } 0.69

P Pr oject Duration TS = 60{ } = P T 60{ } = P Z

60 64

6

= P Z 0.67{ } = 0.26

Z=T TP

s P


7/26/2019 Ch7-v2-AK

98/108


Possible Project Duration

FIGURE A7.3

0.00 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.090.0 0.0000 0.0040 0.0080 0.0120 0.0160 0.0199 0.0239 0.0279 0.0319 0.0359

0.1 0.0398 0.0438 0.0478 0.0517 0.0557 0.0596 0.0636 0.0675 0.0714 0.0753

0.2 0.0793 0.0832 0.0871 0.0910 0.0948 0.0987 0.1026 0.1064 0.1103 0.1141

0.3 0.1179 0.1217 0.1255 0.1293 0.1331 0.1368 0.1406 0.1443 0.1480 0.1517

0.4 0.1554 0.1591 0.1628 0.1664 0.1700 0.1736 0.1772 0.1808 0.1844 0.1879

0.5 0.1915 0.1950 0.1985 0.2019 0.2054 0.2088 0.2123 0.2157 0.2190 0.2224

0 6 0 2257 0 2291 0 2324 0 2357 0 2389 0 2422 0 2454 0 2486 0 2517 0 2549

Standard Normal

Distribution Table

7/26/2019 Ch7-v2-AK

99/108


0.6 0.2257 0.2291 0.2324 0.2357 0.2389 0.2422 0.2454 0.2486 0.2517 0.2549

0.7 0.2580 0.2611 0.2642 0.2673 0.2704 0.2734 0.2764 0.2794 0.2823 0.2852

0.8 0.2881 0.2910 0.2939 0.2967 0.2995 0.3023 0.3051 0.3078 0.3106 0.31330.9 0.3159 0.3186 0.3212 0.3238 0.3264 0.3289 0.3315 0.3340 0.3365 0.3389

1.0 0.3413 0.3438 0.3461 0.3485 0.3508 0.3531 0.3554 0.3577 0.3599 0.3621

1.1 0.3643 0.3665 0.3686 0.3708 0.3729 0.3749 0.3770 0.3790 0.3810 0.3830

1.2 0.3849 0.3869 0.3888 0.3907 0.3925 0.3944 0.3962 0.3980 0.3997 0.4015

1.3 0.4032 0.4049 0.4066 0.4082 0.4099 0.4115 0.4131 0.4147 0.4162 0.4177

1.4 0.4192 0.4207 0.4222 0.4236 0.4251 0.4265 0.4279 0.4292 0.4306 0.4319

1.5 0.4332 0.4345 0.4357 0.4370 0.4382 0.4394 0.4406 0.4418 0.4429 0.4441

1.6 0.4452 0.4463 0.4474 0.4484 0.4495 0.4505 0.4515 0.4525 0.4535 0.4545

1.7 0.4554 0.4564 0.4573 0.4582 0.4591 0.4599 0.4608 0.4616 0.4625 0.4633

1.8 0.4641 0.4649 0.4656 0.4664 0.4671 0.4678 0.4686 0.4693 0.4699 0.4706

1.9 0.4713 0.4719 0.4726 0.4732 0.4738 0.4744 0.4750 0.4756 0.4761 0.4767

2.0 0.4772 0.4778 0.4783 0.4788 0.4793 0.4798 0.4803 0.4808 0.4812 0.4817

2.1 0.4821 0.4826 0.4830 0.4834 0.4838 0.4842 0.4846 0.4850 0.4854 0.4857

2.2 0.4861 0.4864 0.4868 0.4871 0.4875 0.4878 0.4881 0.4884 0.4887 0.4890

2.3 0.4893 0.4896 0.4898 0.4901 0.4904 0.4906 0.4909 0.4911 0.4913 0.4916

2.4 0.4918 0.4920 0.4922 0.4925 0.4927 0.4929 0.4931 0.4932 0.4934 0.4936

2.5 0.4938 0.4940 0.4941 0.4943 0.4945 0.4946 0.4948 0.4949 0.4951 0.4952

2.6 0.4953 0.4955 0.4956 0.4957 0.4959 0.4960 0.4961 0.4962 0.4963 0.4964

2.7 0.4965 0.4966 0.4967 0.4968 0.4969 0.4970 0.4971 0.4972 0.4973 0.49742.8 0.4974 0.4975 0.4976 0.4977 0.4977 0.4978 0.4979 0.4979 0.4980 0.4981

2.9 0.4981 0.4982 0.4982 0.4983 0.4984 0.4984 0.4985 0.4985 0.4986 0.4986

3.0 0.4987 0.4987 0.4987 0.4988 0.4988 0.4989 0.4989 0.4989 0.4990 0.4990

P Z 0.67{ } =P Z 0.67{ }

1 P Z 0.67{ } =1 (0.5 + 0.24)

= 0.26

P Z 0.5{ } = 0.5+ 0.19

= 0.69

Area between 0 and z value

Managing Risk

A Critique of PERT

7/26/2019 Ch7-v2-AK

100/108


In PERT analysis only one critical path is taken into

consideration in assessing the probabilistic behavior of projectduration. Furthermore,

Near critical paths are disregarded;

Possible correlation among activity realizations is ignored;

Normality assumption may not be justified.

PERT results could be misleading when,

Number of critical / near critical paths is large;

Probabilistic dependency among activities cannot be ruled out;

Number of activities on the considered critical path are few.

PERT usually under-estimates the true project duration.


A more accurate approach is to identify each sequence of activities that lead from

7/26/2019 Ch7-v2-AK

101/108


pp y qthe start node to the finish event and then to calculate separately the probability

that the activities that compose each sequence will be completed by a given date. It is assumed that central limit theorem holds for activities on each sequence

Furthermore it is assumed that the sequences themselves are statisticallyindependent (i.e.time to traverse each path in the network is independent of whathappens on the other paths).

Then the probability of completing the project by a given date is set equal to the

product of the individual probabilities that each sequence is finished by that date. Given n sequences with completion time X1, X2,..., Xn andX = max {X1, X2,..., Xn };

)().......()()( 21 XPXPXPXP n


7/26/2019 Ch7-v2-AK

102/108


A

C D

B

ST

8,2 9,3

10,3 6,1.5

Activity durations are normally

distributed with the given

means and standard deviations

Length(A-B) = X1~ N(17, 3.61)

Length(C-D) = X2~ N(16, 3.35)

Length(S-T) = X


7/26/2019 Ch7-v2-AK

103/108


Performance time distribution for the two sequences


The project can end in 17 weeks only if both A-B and C-D are completed

7/26/2019 Ch7-v2-AK

104/108


within that time.

Thus the probability that the project will finish by week 17 is

approximately 31%

62.0299.035.3

1617

172 ZPZPXP

62.0*5.017*1717 21 XPXPXP

5.0061.3

1717171 ZPZPXP

Managing Risk

PERT Example

The previous analysis is accurate if

7/26/2019 Ch7-v2-AK

105/108


A

C D

B

SE

8,2 9,3

10,3 6,1.5

3,4

The previous analysis is accurate if

the sequences are independent. Thisis not the case when one or more

activities are members of two or

more sequences.

Here activity E is a member of thetwo sequences that connect the start

of the project to its termination.

39.5234 222

22.55.134 222 10+6+3=19C-D-E

8+9+3=20A-B-E

Standard DeviationExpected LengthSequence


The probability that the sequence A-B-E will be completed in 17 days is calculated as

7/26/2019 Ch7-v2-AK

106/108


The probability that the sequence C-D-E will be completed in 17 days is calculated

as

The probability of completing the project in 17 days is calculated to be 10%

assuming that the sequences are independent.

The true probability completing the project in 17 days is between 10% and 29%!!

29.05565.039.5

201717 ZPZPXP

EBA

35.0383.022.5

191717 ZPZPXP EDC

35.0*29.017*1717EDCEDC

XPXPXP

Computer Simulation is a more laborous but reliable way of assessing the

Managing RiskPERT Simulation

7/26/2019 Ch7-v2-AK

107/108


Computer Simulation is a more laborous, but reliable way of assessing the

probabilistic behaviour of projet duration. The process of random activity duration/cost generation, and schedule

determination based on the given probability distributions of activity durationsand costs is called a simulation run.

Simulation runs are repeated many times (hundreds of times) to assemble alarge set of project schedule, duration and cost realizations.

The data set obtained from the simulation runs forms a basis for a reliable,probabilistic assessment of project duration and cost, and potential resourceconflicts

Risk retention or transfer decisions can be made using time, cost andschedule information gained from simulation runs.

Computer simulation is especially useful in large, complex projects that

include a great deal of uncertainty, while having reasonably accurate timeestiumates for activities.

References:

Larson E. W and Gray C. F., Project Management:

The Managerial Process, 5th ed. Mc Graw Hill/Irwin,

7/26/2019 Ch7-v2-AK

108/108


The Managerial Process , 5 ed. Mc Graw Hill/Irwin,

NY, USA, 2011

Original slides courtesy of Prof. Ilhan Or.

Aybek Korugan - Bogazii University

Documents

Ch7-v2-AK