Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects (2014)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Project Risk Management Implementation P A R T 4 Part 4 Objectives Part 4 addresses the following questions: • What are the characteristics of successful project risk management processes? • How can a risk­based culture be fostered? • How are the appropriate tools and level of rigor integrated into an organization’s project risk management process? Chapter 9. Implementing Project Risk Management ................................................................. 95

95 C H A P T E R 9 All projects delivered in an organization, regardless of size, type, or funding source, can benefit from some level of project risk management activity. The process must make the most efficient use of the limited resources of time, people, and money in the organization. When implementing project risk management, consideration should be given to attributes of the organization such as the organization’s risk tolerance, operational maturity, and time and resources available. The project risk management process must also be scalable and flexible based on the project attributes such as size, type, exposure, and complexity. An effective method to start a new project risk management program in an organization quickly is to simply begin using a risk checklist at the kickoff of every capital or maintenance project regardless of the size, resources, or complexity. The organization can then increase competency by incorporating a probability and impact matrix, add in the project risk management plan, and document actions from all steps in the process in the risk register. 9.1 Characteristics of Successful Project Risk Management Processes Successful project risk management processes will have the following characteristics: • A focus on managing risk through the iterative steps of risk management planning, identifica- tion, analysis, response planning, and monitoring and control—to cost-effectively keep risk exposure at an acceptable level. • A focus on managing opportunities—to lower costs, shorten schedules, or enhance scope and/or quality. • Practical, repeatable, and consistent methods for ease of integration into existing programs and processes. • Flexible, scalable tools that are simple to use and apply to any type of project (construction, maintenance, capital, operating, technology, systems, etc.). • A standard framework that can be scalable to the complexity of specific projects, as well as the organization’s stakeholders, resources, and risk maturity. • Project staff members who demonstrate project risk management processes as part of their daily work activities, however small their contribution might be. • Flexible flow for project risk management steps to add more or reduce risk management if a project’s complexity changes. • Dynamic flow that can be performed iteratively through the life of a project and is adapt- able to an organization’s need to rapidly respond to the changing internal and external environment. Implementing Project Risk Management

96 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects • Inclusion of project standards to trigger response strategies, enable monitoring and control, and provide a basis for evaluation of effectiveness. • Incorporation of process and project lessons learned to drive continuous improvement and build institutional knowledge. 9.2 Fostering a Risk-Based Culture Prior to implementing project risk management and further embedding project risk man- agement into an organization’s standard processes, an organization must assess its current risk culture—the values and behaviors that shape risk decisions. The organization must address weaknesses within its risk culture to create an environment for successful and sustainable project risk management implementation. The signs of a weak risk culture include: • The organization’s risk culture is unknown, unclear, or not demonstrated in decision making; • Risk tolerances are unknown or not communicated at organizational or project levels; • Project teams are frequently surprised by poor project performance, such as project cost or schedule overruns or under runs; • Project risks and opportunities, or their potential impacts on project success, are not understood; • Efforts are undertaken without a clear understanding of short- and long-term consequences; • Project risk management is often skipped or shortchanged due to a perceived lack of time or resources; and • “Fighting fires” is a common practice. Implementing project risk management by embedding it into existing processes in capital and maintenance project management increases the likelihood for sustainability within the organi- zation. Implementing the process by using some of the basic tools and then growing the utiliza- tion of additional tools over time will likely increase the ability to gain buy-in as well as the ability to embed the process in the organization’s project processes. 9.3 Overcoming Implementation Barriers Institutionalizing project risk management provides a means to overcome the challenges of a weak risk culture and promote a more positive approach toward managing project risk. Successful implementation of project risk management may require project team members to assume additional responsibilities and accountability for project performance. This could initially be perceived as a burden to the project team, especially to those members that are not accustomed to documenting their decision processes. A critical element of implementing anything new—project risk management included—is the ability to manage change within the organization to ensure that personnel understand both the need for the change and the benefits it will provide. Senior management can dem- onstrate commitment to the project risk management effort by tailoring traditional change management best practices to the roll-out of project risk management. Table 9.1 adapts the process presented in John Kotter’s seminal work on change management, Leading Change, to the steps needed to integrate project risk management into an airport’s standard procedures (Kotter, 1996). The table presents the actions needed to progress through each step as well as the potential pitfalls that could hinder the initiative. Each of these steps is further described in the following text.

Implementing Project Risk Management 97 Table 9.1. Overcoming barriers to implementing project risk management in an organization. Step Barrier Actions Establish the Need Lack of senior management support or involvement Compare historical project performance to determine if project goals are routinely met versus missed Hold project teams accountable for project performance Develop and Communicate a Vision for Actively Managing Project Risk Lack of a simple and concise vision as to how project risk management can make a difference and help fulfill an airport’s needs Inability to communicate the vision Behaving in ways contrary to the vision (e.g., not providing adequate resources, lack of consideration of existing resource capacity and capability, using poor project performance not as a learning experience but as a weapon) Engage internal and external stakeholders with a compelling message as to why project risk management would help ensure project objectives are met and why it is important to meet project scope, schedule, budget, and quality objectives Ensure that appropriate resource capacity and capability exists Form the Right Implementation Team Failure to get past traditional silos of responsibility (e.g., between design and construction and between construction and maintenance) Failure to tap the right people to develop and champion project risk management Assemble a cross-disciplinary team that understands the full project life cycle and project risk management Clearly define roles and responsibilities of team members Empower Others to Act on the Vision Failure of senior management to remain involved, hold project teams accountable, and/or allocate the necessary resources Underestimating organizational inertia and the difficulty of pushing people out of their comfort zones Remove obstacles that would undermine efforts to implement project risk management Provide adequate resources to those accountable and responsible for managing project risks Review and approve risk management plans developed for individual projects Develop an Action Plan and Include Milestones for Short- Term Achievements Failure to set realistic expectations Failure to adequately account for the learning curve that people must navigate before understanding and mastering a new process or technology Identify and communicate the goals and objectives of the implementation effort Institutionalize Project Risk Management Failure to formalize new procedures Lack of patience related to realizing the benefits of implementing project risk management (some of which may be purely anecdotal) Identify and communicate benefits of actively managing project risks Establish scalable and flexible guidance and templates for managing project risk Conduct training sessions Communicate and document project risk management thinking in decision making Use lessons learned in the project risk management process Start with simple tools and elevate to more complicated tools as the process matures

98 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects 9.4 Flowchart as Project Risk Management Tool Selection Guide Figure 9.1 depicts the different decision points included in the project risk management process and can be used at the planning step to guide the selection of tools to be used based on the complexity of the project. The flowchart can also be referenced at various points Figure 9.1. Project risk management flowchart.

Implementing Project Risk Management 99 throughout the life of the project to ensure that the right amount of project risk management has been applied. Figure 9.2 illustrates a deconstructed view of the project risk management flowchart with each step separated in order to highlight the decision point and the tool that would be selected as a result of the decision. 9.5 Integrating and Maturing Utilization of Tools The tools outlined in this guidebook are flexible for use in most organizations regardless of project risk management process maturity and are also scalable for the size, type, and complexity of the project. The flowchart in Figure 9.1 can guide the selection of various tools to be included in the proj- ect risk management plan. The guidelines outlined in Table 9.2 include the scalability of the tools for low-risk versus high-risk projects. The last column in the table lists additional tools to add to the process as the organization begins to mature the project risk management process. Figure 9.2. Deconstructed project risk management flowchart. (continued on next page)

100 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Figure 9.2. (Continued).

Implementing Project Risk Management 101 Step Low Risk (Simple or Small- Scale Projects) High Risk (Large, Critical, or Complex Projects) Additional Tools and Techniques for Consideration Risk Management Planning Project manager establishes the general approach to risk management that the team will follow. May or may not result in a risk management plan. A formal, written risk management plan is developed and submitted to senior management for review and approval. At predetermined points and as necessary, plan is reviewed to determine if adjustments are necessary. Tool: Risk management plan SWOT analysis Lessons learned Project Risk Identification Conducted by the project manager with input from project team as necessary. Tool: Risk checklist Conducted during a facilitated risk workshop with internal and/or external subject matter experts. Tool: Risk register Affinity diagrams Cause-and-effect maps Retrospective analysis Scenario analysis Expert consensus Root-cause analysis Fishbone Five Whys Cause-and-effect analysis Failure mode and effect analysis Mind mapping Project Risk Analysis Qualitatively assess risks to identify the most critical. Tool: Probability and impact matrix worksheet The team, working collaboratively with independent subject matter experts, reviews and/or validates cost and schedule estimates and identifies, characterizes, and analyzes risks. This process may involve both qualitative and quantitative tools to evaluate and prioritize risks and establish risk-based contingencies. Tool: Updated risk register (based on quantitative and/or qualitative analysis) Probabilistic modeling Failure mode and effects analysis Risk bow tie Decision analysis Table 9.2. Additional tools for project risk management. (continued on next page) 9.6 Aligning Project Risk Management, Project Management, and Enterprise Risk Management Ideally, project risk management should become an integral activity in the overall project management process and should not be performed in isolation from other project management activities. Project risk management can enhance project management by providing a structured approach to managing uncertainty to help ensure that project objectives will be met.

102 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Enterprise Risk Management Establish risk tolerance within the organization. Project Management Establish consistent, repeatable project management activities. Project Risk Management Identify and prepare for threats and opportunities that could impact projects. Figure 9.3. Linkages for risk management. Step Low Risk (Simple or Small- Scale Projects) High Risk (Large, Critical, or Complex Projects) Additional Tools and Techniques for Consideration Project Risk Response Planning Brainstorming session Tool: Updated project plan Existing standard operating procedures Perform cost–benefit analysis to determine the optimal response strategies Tool: Updated risk register Contingency planning Project Risk Monitor and Control Periodic status meetings, as required, including discussion of progress, issues, etc. Regularly monitor and record effectiveness of response strategies using the risk register. Conduct formal after-action review workshop to identify lessons learned and best practices to apply to future project. Tool: Risk register Project management Variance and trend analysis Reserve/contingency analysis Risk audits Table 9.2. (Continued). Actions employed at the enterprise level to limit risk exposure to key organizational concerns such as safety, security, financial liability, and organizational reputation can influence the iden- tification and analysis of risk at the individual project level. Enterprise risk management can pro- vide risk tolerance levels for project risk management to incorporate into activities throughout the process and foster the organization’s risk culture. Figure 9.3 shows the links between these three programs. Staying within the bounds of accepted organizational expectations is good risk management.

103 Ashley, D. B., J. E. Diekmann, and K. R. Molenaar. 2006. Guide to Risk Assessment and Allocation for Highway Con- struction Management. Report No. FHWA-PL-06-032, Federal Highway Administration, U.S. Department of Transportation. October 2006. D’Ignazio, J., M. Hallowell, and K. Molenaar. 2011. Executive Strategies for Risk Management by State Departments of Transportation. Final Research Report for NCHRP Project 20-24(74). Available at http://apps.trb.org/ cmsfeed/TRBNetProjectDisplay.asp?ProjectID=2888. Flyvbjerg, B., N. Bruzelius, and W. Rothengatter. 2003. Megaprojects and Risk: An Anatomy of Ambition. Cambridge University Press, 2003. Kotter, J., 1996. Leading Change. Harvard Business School Press, Watertown, MA. Marsh Risk Consulting, 2012. ACRP Report 74: Application of Enterprise Risk Management at Airports. Transportation Research Board of the National Academies, Washington, D.C. Molenaar, K., S. Anderson, and C. Schexnayder. 2010. NCHRP Report 658: Guidebook on Risk Analysis Tools and Management Practices to Control Transportation Project Costs. Transportation Research Board of the National Academies, Washington, D.C. Parsons Transportation Group, A. Touran, and Golder Associates. 2004. Federal Transit Administration Project Management Oversight Risk Analysis Methodologies and Procedures. Port Authority of New York and New Jersey (PANYNJ). 2011. Guide to Project Risk Management. Project Management Institute. 2008. A Guide to the Project Management Body of Knowledge (PMBOK® Guide). Sangrey, D., W. Roberds, J. Reilly, T. McGrath, and S. Boone. 2003. Cost and Schedule Estimates for Large Trans- portation Projects: A New Approach to Solving an Old Problem. Paper prepared for presentation at the Road- way Improvements – Funding and Benefits Session of the 2003 Annual Conference of the Transportation Association of Canada, St. John’s, Newfoundland, and Labrador. http://conf.tac-atc.ca/english/resource centre/readingroom/conference/conf2003/pdfs/sangrey.pdf. U.S. Department of Defense. 2006. Risk Management Guide for DOD Acquisition. Sixth Edition (Version 1.0). U.S. Department of Energy. 2008. Risk Management Guide. DOE G 413.3-7. Washington State Department of Transportation (WSDOT). 2010. Project Risk Management: Guidance for WSDOT Projects. References

104 Acceptance A risk response strategy that involves a lack of action related to the risk event prior to the event’s occurrence. Avoidance A risk response strategy where the risk event can no longer have an impact on the objective. Avoidance is often accomplished by eliminating the approach to the objective or elimi- nating the root cause. Confidence Level A measure of how reliable a statistical result is, expressed as a percentage that indicates the probability of the result being correct. Contingency The amount of funds, budget, or time needed above estimated amounts to reduce the risk of overruns of project objectives to a level acceptable to the organization; the portion of the project budget that is available for uncertainty within the project scope but outside the scope of the contract. Contingency Reserve Funds or time set aside at a project or departmental level to contend with risks within departmental or project purview. Distribution In statistical analyses, the plotting of data points in a graph to display the relative number of outcomes associated with iterative trials. Enhancement An opportunity response strategy that involves efforts to increase the probability or impact (or both) of the opportunity event. Enterprise Risk Management A holistic approach and process to identify, prioritize, mitigate, manage, and monitor current and emerging risks in an integrated way across the breadth of the enterprise. Expert Judgment Opinions, advice, recommendations, or commentary proffered by a person or persons recognized, either formally or informally, as having specialized knowledge, proficiency, or training in a specific area. Exploitation An opportunity response strategy that involves ensuring that an opportunity (which remains a probabilistic event) will definitely come to pass in the organization’s favor. Impact The severity of the outcome that may occur if a risk event happens. Issue An event that has already occurred. Likelihood The chance that something may happen, measured objectively or subjectively, and expressed either qualitatively or quantitatively. Market Conditions Economic influences that may affect the availability of resources or sup- plies; can include contractors, labor, materials, and supplies. Glossary

Glossary 105 Mitigation A risk response strategy that involves minimizing either the probability of the threat event or the impact (or both). Monitoring Continual checking, supervising, critically observing, or determining status in order to identify change from the performance level required or expected. Opportunity A risk that will have a positive impact on a project objective if it occurs. Oversight Authority A governing body with responsibility to guide and direct the activities of an organization. In an airport environment, the oversight authority may be a city council, board of commissioners, board of directors, or another governing body. Probabilistic Modeling An iterative, simulation-based analysis of project outcomes that gen- erates a probability curve on the overall likelihood of achieving objectives. Probability The likelihood of an event occurring. Probability and Impact Matrix (P-I Matrix) A spreadsheet or graphic view with probability on the y-axis and impact on the x-axis used to highlight those risks (evaluated qualitatively) in the higher zones. Program Risk Management Managing the cumulative risk of all of the projects in a portfolio. Project Risk An uncertain event or condition that, if it occurs, has a positive or negative impact on at least one project objective. Project Risk Management Managing risks associated with a specific project, through the itera- tive steps of identification, analysis, response planning, and monitoring and control. Qualitative Risk Analysis Subjectively analyzing the risks obtained in the risk identification step and prioritizing for further analysis or determining which risks warrant a response. Quantitative Risk Analysis Numerically analyzing the effect of risks obtained in the risk iden- tification step and determining which risks warrant a response. Residual Risk The amount of risk or level of risk impact after the existing control environment has been taken into account. Also referred to as net risk. Response The activity deliverable or process by which an individual risk will be managed. Risk The events with varying degrees of uncertainty that may have a positive or negative influ- ence on the project. Risk Appetite The amount of risk, on a broad level, an entity is willing to accept. Risk Categories Organized groupings of risks by like topics or natural affinities. Risk Culture The values and behaviors present throughout an organization that shape risk decisions. Risk Factor A condition or constraint that makes it more probable that a risk event or oppor- tunity may occur or that can increase the severity of a risk impact. Risk Identification The process of identifying and documenting the uncertainties that could affect project performance; the first component of the risk management process. Risk Management The practice of dealing with risks in a process-oriented fashion to keep risks within organizational tolerances. Risk Management Plan A document outlining the details of risk management approaches, responsibilities, resources, terms, tolerances, timing, and processes.

106 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Risk Model A mathematical representation of a project that can be used as the basis for quan- titative risk analysis. Risk Monitoring and Control Managing the effectiveness of the selected risk handling approaches. Risk Owner An individual with responsibility and authority for overseeing and being account- able for a given risk event. Risk Register Spreadsheet or document providing information about individual risks and their strategies, including event, probability, impact, response, owner, and review dates. Risk Response Planning Determining the best approach for handling identified risks, such as to accept, transfer, mitigate, or avoid. Risk Threshold A measure of the level of risk exposure above which action must be taken to address threats and opportunities proactively and below which risks may be accepted. Risk Tolerance Organizational, project-level, or individual limit beyond which risk events become wholly unacceptable. Risk Trigger A symptom or warning sign that indicates that a risk is becoming a near-certain event and a contingency/response plan should be implemented. Senior Management Senior leadership in the organization that sets policy and governance thresholds, up to and including board members. Sensitivity Analysis A quantitative risk analysis technique used generally within probabi- listic modeling analysis to expose key risk drivers by varying one or more parameters within a risk model and determining the extent of the effect on the overall outcome. Results are usually presented using a tornado chart. Sharing An opportunity response strategy that involves efforts to increase the probability of an opportunity event by shifting some of the risk to a third party. Subject Matter Expert A person who is an expert in a certain area or topic. Tornado Chart An output from a quantitative risk analysis using probabilistic modeling analy- sis that shows the main risk drivers in descending order of importance. A tornado chart is useful for comparing relative importance and impact of variables that have a high degree of uncertainty to those that are more stable. Transfer A risk response strategy that involves shifting the burden of a risk (either in whole or part) to a third party.

107 A P P E N D I X A The taxiway reconstruction project case study includes additional information in the case study material not used in the main portion of the guidebook in order to demonstrate the entire practice of the process of project risk management. Using the following flowchart as an organizer, the taxiway reconstruction example follows the flow of a moderate- to high-risk project and connects the project risk management process to the overall organization prac- tice of project management and program management. By completing a project debrief and lessons-learned review, the organization can complete the cycle of project risk management and embed the lessons learned into institutional knowledge, which completes the project and embeds it into the program. Case Study I: Taxiway Reconstruction

108 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects

Case Study I: Taxiway Reconstruction 109 The project was scheduled to begin design in June, with construction expected to begin 6 months later. The reconstruction project was scheduled in alignment with FAA funding schedules in anticipation of receiving funds in time to begin and conduct construction. The taxiway project was originally scoped for 4,000 ft of asphalt pavement with an estimated $6 million budget funded by the FAA and airport passenger facility charges in a 75/25 ratio. The funding for this project was fixed, so scope and schedule were the areas that were affected by the risks and risk mitigations. The project was managed by an internal airport project manager, designed by consultants, constructed by contractors, and inspected by consultants. For the scope of this project, the design–bid–build construction process was selected. The project risk management process was included in the project management of the project. Many risks were realized through the project duration and will be highlighted at each phase throughout this case study. Project Overview A medium-hub airport was preparing to conduct taxiway reconstruction as defined in the airport’s master plan.

110 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Step 1: Taxiway Reconstruction—Risk Identification Background of Airport The airport was managing multiple construction projects at the same time using a combina- tion of internal and contract staff. The airport operates two runways and receives funding based on medium-hub status. Operations are primarily origination-and-destination traffic. The airfield does not operate at full capacity; however, all maintenance downtime must be carefully scheduled to avoid any air traffic delays. The airport typically outsources construction design to outside experts. The internal procure- ment process works in accordance to federal regulations. Risk Identification Step The project team performed the identification of risks in a risk workshop using an outside facilitator to conduct the session. The entire internal project team was present, along with the contracted resources that would be performing project work. Risks and opportunities identified through this workshop were captured in a risk register. Each risk was assigned an owner who would take responsibility for the risk analysis and response plan and would provide monitoring and control reviews. The risk workshop took approximately 4 hours to complete and included the risk analysis process. The identification of risks took less than 1 hour, from which a list of risks was generated.

Case Study I: Taxiway Reconstruction 111 Step 2: Taxiway Reconstruction—Risk Analysis Risk Analysis Once the risks were identified, analysis was performed using the risk register. A rating of 1–5 was assigned to qualitatively analyze the probability of a risk occurring as well as its impact on the project. The risk rating applied was the product of the probability multiplied by the impact. This equation was used to produce a ranked list of risks for the response planning dis- cussion. The results of this analysis allowed the team to focus on the highest combined impact and probability risks in order to determine actions for responses.

112 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Step 3: Taxiway Reconstruction— Risk Response Planning Risk Response Plan During the risk workshop, after analysis was complete, actions were identified and captured in the risk register to respond to risks according to their perceived severity and the probability of each risk occurring. The response was determined to be either avoidance, transference, mitiga- tion, or acceptance. A clear action to be taken was then documented, along with an estimated cost for the response itself. Status was updated as the response activity occurred throughout the project’s progress.

Case Study I: Taxiway Reconstruction 113 Step 4: Taxiway Reconstruction—Risk Monitoring and Control Risk Monitoring and Control The monitor and control step was managed in daily project progress meetings, with all stake- holders attending. These meetings included risk review and project issues reporting. The results captured in the risk register were solely the risk review items. Project issues were documented and shared with the whole team through project management status reporting. Project progress issues were identified and conflict resolved as much as possible in the meeting. Project monitoring and control followed the project life-cycle phases, and project issues that occurred that were not identified as risks early in the planning process caused a need to revisit the project risk management plan and conduct a brief version of identification, analysis, and response to update the risk register. At the completion of the project, the project manager conducted a final project close-out ses- sion, including discussing lessons learned, where all of the monitoring and control items were reviewed, discussed, and captured in an institutional knowledge database for reference and input to the next project.

114 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Lessons Learned: Taxiway Reconstruction Project Debrief In the project debrief meeting, the data captured in the monitor and control section of the risk register were reviewed. In addition to those items, other discussions included project issues that occurred that were not anticipated. Issue Review and Discussion One of the project issues was that the FAA asphalt requirements to pave a taxiway reduced bid- ding to only one local provider that could meet the requirements. This caused a delay in the bidding process since it caused additional scrutiny by the airport board. The schedule slipped a month due to the delay. Additionally, an FAA requirement change affected taxiway paved shoulder requirements from recommended to required that they be paved. An action the airport project managers took to attempt to mitigate this change was a request for a modification of standards to allow shoul- ders to remain unpaved based on the type of air traffic at the airport, but this was denied. This changed the scope of the taxiway reconstruction because the budget was fixed. The scope of the taxiway reconstruction was reduced to 2,500 ft. Another issue discussed was an FAA turning-radius requirement for the taxiway. The FAA required an increase to the fillet size. The response of the project team was again to change the scope and also the schedule because the budget was fixed. The project needed to add in geo- technical activities and change the design of the taxiway project, which extended the schedule. Another issue debriefed in the project review was the federal government shutdown in 2013. When the government suspended nonessential operations, it delayed the funding for the project, which, in turn, delayed the schedule and the availability of resources. This resulted in a rephasing of the project because air traffic could not be impeded, and the time of year the project was to be performed would have been an issue for deicing pad access. The final project scope was as follows:

Case Study I: Taxiway Reconstruction 115 Lessons Learned • Changed bid process to ask for both asphalt and concrete for all future taxiway projects in order to have multiple bids. • Applied rescoping to all future taxiway projects to include paved shoulders, which has affected original plan of 5 years and $58 million budget, now increased to 9 years and $88.2 million. • Applied seasonal impacts and traffic implications—stop-work order by the FAA.

116 A P P E N D I X B The TSA recently mandated a change to the passenger screening process. In order to accom- modate this mandate, a small-hub airport needed to perform an internal build-out to reconstruct the physical space where staff are located in order to create the required space. This small-hub airport serves commercial air traffic and has 52 employees and a $30 million operating budget. The internal build-out is determined to be an operating project using internal maintenance staff. The changes require minor demolition to existing walls and build-out of two offices with access to the passenger concourse. Scope includes replacement of ceiling tiles, flooring, walls, power lines, data cables, and HVAC adjustments. The area affected is approximately 400 square feet. The maintenance operating budget is $8 million, and this project is one of many in the course of the year that will be performed to maintain functional operations for the staff at the airport. A project of this scope should not exceed $12,000 in material costs and should not involve more than 3 weeks of construction time. The work effort is approximately two full-time resources for the 3 weeks, although the resources will be different talent and expertise over the duration of the project. Internal resources used include maintenance manager, superintendent, electrician, and HVAC, carpentry, and general maintenance staff. The maintenance manager assumed the role of project manager for this project. The project constraints for this office build-out are determined as schedule and budget. The maintenance manager determined that the project was relatively low risk based on the experience of the resources assigned to the project and the scope identified for the build-out. He decided to use a probability–impact matrix with the project team to identify and rank the risks. The maintenance manager conducted a project kickoff session in which the team brainstormed a list of risks, and then ranked and prioritized the risks using the probability–impact matrix in order to determine if more project risk management might be needed. The project kickoff session included the team of internal resources used to perform the project activities. During the discussion, the maintenance manager described the scope of the project, and the whole group reflected on past experiences with the customer as well as the type of work to identify preventative risks and reactive impacts. The following risks were identified: • Customer slow in making decisions about design, which affects schedule. • Competing priorities for project work team will affect schedule and budget. • Unforeseen conditions found in demolition affect scope and may cause redesign. • Need for permits to perform construction activities may affect schedule. • Long lead time for selected materials causes delay in start of project. Case Study II: Office Build­Out

Case Study II: Office Build-Out 117 The risks were plotted on the P-I matrix according to their values, and discussion was held to analyze the overall results. The results of the discussion determined that all of the risks identified could be controlled by managing the schedule of the project very closely. The team determined to plan a schedule with realistic timelines and contingency days included. The maintenance manager also determined that clear communication was needed with the stakeholders of the project to discuss the sched- ule, the realistic timelines, and the risks associated to the project in order to increase awareness up front. The maintenance manager committed to a meeting with stakeholders and to holding regular progress meetings with the team as a result of this risk review. With these activities and commitments determined, no additional project risk management was determined to be neces- sary at this point. Risk Description Summary ProbabilityValue Impact Value Customer slow in making decisions about design, which affects schedule. 4 4 Competing priorities for project work team will affect schedule and budget. 4 2 Unforeseen conditions found in demolition affect scope and may cause redesign. 2 4 Need for permits to perform construction activities may affect schedule. 2 1 Long lead time for selected materials causes delay in start of project. 1 2 The following probability and impact scores were applied:

118 A P P E N D I X C Probabilistic Modeling One of the most widely accepted quantitative analysis techniques is probabilistic modeling, a computer-driven methodology of simultaneously evaluating the impact of all identified risks to arrive at defined probability distribution of the project’s cost, completion date, or other key project inputs or objectives. The overall process is depicted in Figure C-1. Probabilistic modeling simulation generally requires use of specialized risk analysis software packages and possibly outside risk analysts if such expertise is unavailable in-house. However, the associated investment of time and resources can be warranted if: • Enough information is known about the risks to perform the analysis (i.e., the analysis is only as good as the input values), • The project is highly complex or critical, and • Given project conditions and constraints, there is little flexibility or tolerance for cost or schedule overruns. The theory and specific how-to procedures related to performing a probabilistic modeling risk analysis are well established. The general steps involved are described here to provide an indication of both the power of this technique and the level of effort involved. 1. Define the Desired Output from the Analysis. At the outset, the project team should identify the goals of the analysis, bearing in mind that the question to be answered must be well-suited to mathematical modeling for the simulation to be effective. Cost, schedule, and integrated cost/schedule models have been widely used by several organizations, including the Port Authority of New York and New Jersey, the FTA, and various state departments of transpor- tation across the United States, to develop risk-based project contingencies, refine project plans, and prioritize and define optimum risk response plans. 2. Validate the Project Scope, Cost, and Schedule. Before the effects of risk can be evaluated, the project team must have a clear understanding of the project’s base scope, cost, and schedule. If an objective of the quantitative analysis is to develop a transparent, risk-based contingency reserve, the cost and schedule must be carefully reviewed to ensure that no excess reserves remain hidden in the cost or schedule. 3. Prioritize the Identified Risks. Referring to the risk register developed during the risk identi- fication step, identify the main risks and uncertainties that could threaten or enhance project success. Qualitative techniques may be used to support this activity. 4. Build a Base Model. Quantitative risk analysis starts with a model of the project, such as its schedule or cost estimate, depending on the problem to be addressed. As most of the commer- cially available risk analysis software packages act as plug-ins to programs such as Microsoft Excel, it is often best to prepare the model using a spreadsheet. Probabilistic Modeling

Probabilistic Modeling 119 5. Define Input Distributions. Inputs into the schedule or cost models are represented by prob- ability distributions since the actual cost or duration of each item is more accurately repre- sented by a range of values than a single point estimate. Possible probability distributions are summarized in Table C-1; however, the selection of the most appropriate distribution for a given situation is best done with the assistance of a skilled risk analyst with knowledge of the project environment. For each project cost or schedule element, the probability distributions are usually specified in terms of three points: the minimum, most likely, and maximum values. These values are often identified in a workshop setting with input provided by subject matter experts. 6. Run the Simulation. A number of commercially available software packages are available to perform the actual simulation process, which entails iterating the project schedule or cost estimate computation multiple times and randomly drawing duration or cost values for each iteration from the probability distribution inputs. The resulting output of the simulation is a probability distribution function of possible project outputs (e.g., completion dates, project costs) and their likelihood of occurrence. For example, the sample output shown in Figure C-2 indicates that at a 90% confidence level, the project’s finish date will be June 19, 2017 (assuming the identified risks remain unmitigated). (Interestingly, when evaluated using traditional deterministic scheduling techniques, the pro- jected completion date for the project shown in this figure was September 22, 2016, almost 9 months earlier. The risk-based analysis revealed that the project had less than a 1% chance of meeting this date.) 7. Explore Results Using Sensitivity Analysis. The risk model can also be used to determine those tasks that are most responsible for affecting project output (e.g., driving up costs, increasing the overall project schedule) or otherwise positively or negatively affecting project objectives. A popular visual tool used to display such sensitivity analysis results is a tornado diagram, shown in Figure C-3. The diagram can be used to clearly prioritize and communicate those fac- tors whose uncertainty has the largest influence on project success. For example, in the figure, delays in receiving environmental permits drive longer schedules 57% of the time, followed by restricted work hours, at 40%. Identifying the main risk drivers in this manner allows the project team to effectively target its proactive risk response strategies toward the most critical variables. Figure C-1. Simulation inputs and outputs.

120 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects Table C-1. Possible probability distributions. Distribution Type Circumstances for Application You want to describe the number of times an event occurs in a fixed number of events. For each event, only two outcomes are possible. Events are independent of each other. Probability is the same from trial to trial. You have a situation where values are positively skewed, but cannot be negative. The upper limit is unlimited, and the lower limit is zero. Most values are near the lower limit. The mean value is the most likely outcome. Other values appear to be symmetrical around the most likely outcome. Other values are more likely to be closer to the mean. The distribution is defined by the mean and standard deviation. You know the range, and all possible values are equally likely. Minimum value and maximum value are fixed. All values in the range are equally likely to occur. Minimum, maximum, and most likely values are known. High and low thresholds are of equal distance to expected outcome. You know the minimum, maximum, and most likely values. Values are fixed at the minimum and maximum. Pert interprets the minimum, most likely, and maximum values with a smooth curve that places less emphasis on the extremes.

Probabilistic Modeling 121 Figure C-2. Example output of probabilistic modeling simulation.

122 Guidebook for Successfully Assessing and Managing Risks for Airport Capital and Maintenance Projects 9% 11% 14% 17% 31% 32% 40% 57% RD4 - Field inspec ons may show considerable distress on main structure RD1 - Design Package for Design Build may take longer than expected RD3 - Program may not be fully defined by Q1 2012 RD9 - Cash Collec on may not be temporarily stopped in toll lanes RD11 - FHWA Design Excep on for substandard geometry may not be received RD2 - Procurement Process could take longer than 8 months RC20 - Restricted Work Hours may delay construc on REN4 - Environmental permits may not be received by Q1 2012 Figure C-3. Example sensitivity output using a tornado diagram.

Abbreviations and acronyms used without definitions in TRB publications: A4A Airlines for America AAAE American Association of Airport Executives AASHO American Association of State Highway Officials AASHTO American Association of State Highway and Transportation Officials ACI–NA Airports Council International–North America ACRP Airport Cooperative Research Program ADA Americans with Disabilities Act APTA American Public Transportation Association ASCE American Society of Civil Engineers ASME American Society of Mechanical Engineers ASTM American Society for Testing and Materials ATA American Trucking Associations CTAA Community Transportation Association of America CTBSSP Commercial Truck and Bus Safety Synthesis Program DHS Department of Homeland Security DOE Department of Energy EPA Environmental Protection Agency FAA Federal Aviation Administration FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration FRA Federal Railroad Administration FTA Federal Transit Administration HMCRP Hazardous Materials Cooperative Research Program IEEE Institute of Electrical and Electronics Engineers ISTEA Intermodal Surface Transportation Efficiency Act of 1991 ITE Institute of Transportation Engineers MAP-21 Moving Ahead for Progress in the 21st Century Act (2012) NASA National Aeronautics and Space Administration NASAO National Association of State Aviation Officials NCFRP National Cooperative Freight Research Program NCHRP National Cooperative Highway Research Program NHTSA National Highway Traffic Safety Administration NTSB National Transportation Safety Board PHMSA Pipeline and Hazardous Materials Safety Administration RITA Research and Innovative Technology Administration SAE Society of Automotive Engineers SAFETEA-LU Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users (2005) TCRP Transit Cooperative Research Program TEA-21 Transportation Equity Act for the 21st Century (1998) TRB Transportation Research Board TSA Transportation Security Administration U.S.DOT United States Department of Transportation