Project Risk Management

Project risk management is not only a tool, it is a behavior which is learned by a project team to promote project success. It encourages project teams to be forward looking and proactive and to engage every member of the team to deliberately prioritize and allocate resources where they are needed most.

MBP’s risk management services take multiple forms, customized to project size and complexity, addressing cost and schedule risks individually and in tandem. Regardless of the risk management tool our clients choose, the overall progress of risk management remains the same:

  1. Plan for risk
  2. Identify risk
  3. Analyze risk
  4. Respond to risk
  5. Monitor and control risk
risk management process

Project Risk Management Planning

To implement project risk management effectively, it is critically important to first develop a Project Risk Management Plan (PRMP). This can be a PRMP for a specific project or for an organization’s entire project portfolio. MBP assists clients to develop PRMPs which map out the risk management processes, team, and tools which will be utilized throughout a project life cycle.  PRMPs allow organizations to carefully consider:

  • Selecting the right members of the Project Risk Management Team
  • Establishing clear and efficient communication protocols
  • Identifying risk parameters for impact, time horizon, and probability
  • Defining the components of the Project Risk Register
  • Determining the appropriate frequency of risk workshops, risk register updates, quantitative risk analyses, and other risk assessments
  • Integrating project risk management processes within the project’s overall project management plan

MBP also provides training to our clients in project risk management which orients them to the fundamentals of project risk management. This training provides a very useful launching point for their risk management planning efforts.

Quantitative Risk Management

The intent of quantitative risk management is to predict, using simulation techniques such as Monte Carlo, a project’s likely duration and cost considering risks and uncertainty anticipated on the project. MBP provides clients with quantitative risk analyses in various forms in order to address their specific questions and concerns:

  • What cost contingencies should be set for my project? Cost Risk Analysis
  • Will my project complete within budget? Cost Risk Analysis
  • What is an appropriate project duration to establish for my project? Schedule Risk Analysis
  • Will my project complete on time? Schedule Risk Analysis
  • All of the above – Integrated Cost-Schedule Risk Analysis

Cost Risk Analysis

Through the use of cost risk analysis, MBP can determine appropriate cost contingencies to allocate for a project during its planning and design stages as well as determine the likely projected cost of the project during construction. Through a collaborative process with our clients, we:

  • Identify risks and their anticipated probabilities and effects to determine cost drivers
  • Model risk and uncertainty with simulation tools
  • Predict likely project cost
  • Assist clients to prioritize risks, establish mitigation plans, and track risks

Schedule Risk Analysis

MBP utilizes schedule risk analysis throughout the project life cycle to assess project duration.  We assist our clients in:

  • Determining an appropriate project duration during planning and design
  • Predicting a level of confidence in meeting planned completion dates once construction is underway
  • Recommending an appropriate schedule time contingency needed to address high priority risks
  • Identifying top schedule risk drivers to be monitored

Our support does not end once we have provided clients with these important metrics. We assist our clients by facilitating risk mitigation workshops where project teams can identify mitigation strategies to lower the probability and impact of identified risks. We also assist our clients to implement project risk management protocols to monitor risks such as consistent and focused risk register updates and workshops.

The U.S. Government Accountability Office (GAO) considers cost and schedule risk analysis an essential element of developing and maintaining reliable schedules. See Schedule Assessment Guide, Best Practices for Project Schedules, GAO-16-89G, December 2015 . For GAO, cost and schedule risk analysis allows its auditors to assess the reliability of program plans and reported dates through an assessment of project schedules.

Valid and reliable scope, schedule, and cost estimates are essential for project success and delivery, and for the integrity of the transit industry, which includes the Federal Transit Administration (FTA). As such, FTA requires its Project Sponsors to develop a Risk and Contingency Management Plan (RCMP) that demonstrates the Sponsor’s project scope, cost estimate, and schedule are reliable over the duration of the project. The FTA has oversight procedures (OP 40b and OP 40c) that its project management oversight (PMO) contractors utilize in reviewing and validating the reliability of the Sponsor’s plan for mitigating and managing project risks.

Integrated Cost Schedule Risk Analysis

The integration of cost risk analysis and schedule risk analysis yields powerful data that our clients use to fully assess the combined cost and schedule impact of risks on their projects. We know that there is a correlation between time and cost. Using cost-loaded project schedules, we can quantify how schedule risk impacts cost risk. MBP works collaboratively with our clients to:

  • Collect risk data – through interviews with project team members and project risk registers
  • Model schedule and cost risk and uncertainty with simulation tools
  • Prioritize schedule and cost risks, noting those with the greatest potential impact
  • Facilitate risk mitigation workshops to address the high priority risks and compile mitigated risk data
  • Model schedule and cost risk using mitigated risk data

Integrated cost risk analysis is an interative process that provides our clients the opportunity to not only identify the high risks but develop mitigation strategies and then predict how those mitigation strategies could improve cost and schedule outcomes.

Qualitative Risk Management

MBP assists clients at multiple stages of their project risk management implementation:

  • Risk planning
  • Risk identification
  • Risk analysis
  • Risk response planning
  • Risk monitoring and control

This comes in the form of facilitated risk workshops so that clients can ensure that risk management is successfully implemented and maintained.

Risk Planning

It is in the Risk Planning phase, that we define scope, team, and strategy for risk management. MBP assists clients to develop project and program-specific PRMPs. These plans provide the framework to identify, analyze, plan responses for, and monitor and control project risks. The Planning phase is also the point at which our clients gather their Project Risk Management Team (PRMT).  It is important that a PRMT be small enough to remain nimble but also have a diverse representation of parties and roles to reflect a spectrum of perspectives and priorities.

Risk Identification

At this step, project teams identify and evaluate risks and document their characteristics. This will be an iterative process because new risks will continuously reveal themselves as the project progresses. MBP assists our clients in the development of a Project Risk Register through a facilitated risk workshop. The outcome of the workshop will be a Register which includes not only the risk itself but also its trigger (symptoms and warning signs), its likelihood and impact.

Risk Analysis

Identifying risks and documenting them in a Risk Register is not enough. The PRMT must actively engage in risk analysis. However, oftentimes, the number of risks in a Risk Register can be voluminous and overwhelming for a PRMT to tackle. For this reason, MBP assists our clients to prioritize their Project Risk Register, sorting the risks by their probability of occurring, their corresponding impact, and time frame. 

Risk Response Planning

When faced with a project risk, there are four strategies to address the risk: transfer, mitigate, accept, or avoid. MBP assists our clients to work with their prioritized Project Risk Register and select the appropriate risk response strategy. More often than not, that risk response strategy is to mitigate risks. MBP facilitates those discussions so that the project team collaboratively arrives at feasible mitigation strategies and assigns an action officer who will be ultimately responsible for the risk.

Risk Monitoring and Controls

It is important to recognize that this last phase of project risk management is critical to the success of the project. The list of risks will change as the project matures: new risks will develop, anticipated risks may not materialize, identified risks may be effectively mitigated and be removed from the list. Risk ratings and prioritization commonly change during a project’s life cycle. A risk’s impact may be greater than expected and the planned mitigation strategy and actions may not be adequate. For these reasons, it is crucial that risk management meetings continue, and the project team repeat the tasks of risk identification, analysis, and response.

MBP assists clients to select an appropriate frequency for risk management meetings so that project teams have the desired level of awareness and control over project risks. We serve as facilitators for these meetings, encouraging candid discussions on risk identification and mitigation, as well as documenting updates and changes in the risk register.