The Capital Project Risk Management Process, described in this handbook, is intended to result in the effective management of project risks and opportunities. The project manager, project sponsor, and project team members jointly develop a written plan that enables them to identify, assess, quantify, prepare a response to, monitor, and control capital project risks.
Definition
Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on a project objective. A risk has a cause and, if it occurs, a consequence.
Risk management is the systematic process of planning for, identifying, analyzing, responding to, and monitoring project risk. It involves processes, tools, and techniques that will help the project manager maximize the probability and consequences of positive events and minimize the probability and consequences of adverse events. Project risk management is most effective when first performed early in the life of the project and is a continuing responsibility throughout the project.
Objective
The project risk management process helps project sponsors and project teams to make informed decisions regarding project alternatives. Risk management encourages the project team to take appropriate measures to minimize:
- Adverse impacts to project scope, cost, and schedule
- Management by crisis
Risk Management Planning
Before starting project studies, the project manager establishes a PDT in accordance with Department policy. For details, see the “PDT Formation” sub-section of the Project Development Procedures Manual
As part of workplan development, project development team (PDT) members assign project team members to create a project risk management plan.
At this point, the assigned project team members begin to create the risk management plan. The risk management plan identifies and establishes in the project plan the activities of risk management for the project.
If the project will undergo a value analysis (VA), the VA team assists in preparing the risk management plan. If the risk management plan is prepared with a VA study, the risk management plan is included in the VA study report.
To prepare the risk management plan, the assigned project team members use a spreadsheet that shows the risks and responses in an abbreviated form. For a sample of what this spreadsheet might contain, see “Appendix B: Sample Risk Management Plan Spreadsheet” on page 22. An electronic version of the sample spreadsheet is available on the project management guidance Web site at http://www.dot.ca.gov/hq/projmgmt/guidance.htm
Risk Identification
Risk identification involves identifying potential project risks and documenting their characteristics. Risk identification results in a deliverable — the project risk list.
The assigned team members identify the potential risks and opportunities, using:
- The sample risk list provided on page 18
- Their own knowledge of the project
- Consultation with others who have significant knowledge of the project or its environment
The team considers:
- Risks — what might go wrong
- Opportunities — better methods of achieving the project’s purpose and need
- Triggers — symptoms and warning signs that indicate whether each risk is likely to occur
Qualitative Risk Analysis
Qualitative risk analysis assesses the importance of the identified risks and develops prioritized lists of these risks for further analysis or direct mitigation. The team assesses each identified risk for its probability of occurring and its impact on project objectives. Sometimes experts or functional units assess the risks in their respective fields and share these assessments with the team.
Team members sort the identified risks into high, moderate, and low risk categories for each project objective (time, cost, scope). They rank risks by degrees of probability and impact, and include their assessment rationale. For more information and a sample, see “Appendix C: Risk Probability Ranking” on page 25.
Team members revisit qualitative risk analysis during the project’s lifecycle. When the team repeats qualitative analysis for individual risks, trends may emerge in the results. These trends can indicate the need for more or less risk management action on particular risks, or whether a risk mitigation plan is working.
Quantitative Risk Analysis
Quantitative risk analysis is a way of numerically estimating the probability that a project will meet its cost and time objectives. Quantitative analysis is based on a simultaneous evaluation of the impact of all identified and quantified risks. The result is a probability distribution of the project’s cost and completion date based on the risks in the project.
Quantitative risk analysis involves statistical techniques that are most easily used with specialized software. The Department has specialists trained in these techniques and equipped with the necessary software. A specialist is assigned to assist each value analysis team. The team provides the specialist with the data needed to perform the analysis.
When to Use Quantitative Analysis
The Department does not require quantitative analysis for projects; however, it strongly recommends that projects requiring VA, or those projects with an extremely high risk identified from the qualitative analysis, undergo quantitative risk analysis.
Deputy District Directors for Project and Program Management are responsible for identifying which of their projects will undergo VA during the following fiscal year, and for submitting a list of these projects to the District VA Coordinator. Project managers must arrange for appropriate resources through the functional mangers, consultants, and design centers, and must include VA in the project schedules.
For more information about implementing VA, see the following Web site. http://www.dot.ca.gov/hq/oppd/pdpm/chap_htm/chapt19/chapt19.htm
Risk Response Planning
Risk response planning focuses on the high-risk items evaluated in the qualitative and/or quantitative risk analysis. It identifies and assigns parties to take responsibility for each risk response. This process ensures that each risk requiring a response has an owner.
The project manager and the PDT identify which strategy is best for each risk, and then design specific actions to implement that strategy. These strategies and actions include:
- Avoidance. The team changes the project plan to eliminate the risk or to protect the project objectives from its impact. The team might achieve this by changing scope, adding time, or adding resources (thus relaxing the so-called “triple constraint”). These changes may require a PCR.
- Transference. The team transfers the financial impact of risk by contracting out some aspect of the work. Transference reduces the risk only if the contractor is more capable of taking steps to reduce the risk and does so.
- Mitigation. The team seeks to reduce the probability or consequences of a risk event to an acceptable threshold. They accomplish this via many different means that are specific to the project and the risk. Mitigation steps, although costly and time-consuming, may still be preferable to going forward with the unmitigated risk.
- Acceptance. The project manager and the project team decide to accept certain risks. They do not change the project plan to deal with a risk, or identify any response strategy other than agreeing to address the risk if and when it occurs.
Risk monitoring and control keeps track of the identified risks, residual risks, and new risks. It also ensures the execution of risk response plans, and evaluates their effectiveness.
Risk monitoring and control continues for the life of the project. The list of project risks changes as the project matures, new risks develop, or anticipated risks disappear.
Periodic project risk reviews repeat the tasks of identification, analysis, and response planning (see previous tasks). The project manager regularly schedules project risk reviews, and ensures that project risk is an agenda item at all PDT meetings. Risk ratings and prioritization commonly change during the project lifecycle.
If an unanticipated risk emerges, or a risk’s impact is greater than expected, the planned response may not be adequate. The project manager and the PDT must perform additional response planning to control the risk.
Risk control involves:
- Choosing alternative response strategies
- Implementing a contingency plan
- Taking corrective actions
- Re-planning the project