Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
11 2 RISK MANAGEMENT PROCESS INTRODUCTION Objectives The primary objective of the risk management process, whether at the individual project level or for a program of individual projects, is to optimize project performance (e.g., minimize cost, minimize disruption). As discussed in Chapter 1, problems can arise during a project that lead to undesirable performance. Anticipating the problems up front can lead to management strategies that minimize undesirable performance. For example, delays in property acquisition might delay a project, which in turn might increase project costs, whereas such delays might be avoided through early acquisition. Similarly, opportunities to improve project performance (e.g., reduce cost) might arise during a project. Anticipating these opportunities up front can lead to manage- ment strategies that maximize such desirable performance. For example, reuse of excavated or demolished materials might reduce material and hauling costs but would have to be adequately investigated and approved beforehand. Such opportunities are often the focus of VE, which can be com- bined with risk management. Hence, the primary objective of the risk management process is to anticipate, evaluate, and plan for such potential problems and opportunities in order to optimize project performance. Another objective of the risk management process is to complete the process efficiently while producing ade- quately accurate and defensible results. To achieve this efficiency, it is especially important that, among other aspects, the process be flexible (i.e., that the level of detail Develop and implement a formal, struc- tured, and iterative but flexible and efficient process to ⢠Anticipate and plan for potential project problems and opportunities. ⢠Better understand and control project outcomes. The focus is on individual rapid renewal projects.
12 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS is appropriate and that reasonable approximations are made) and consistent with available information and expert judgment as well as with the needs of the project. Consensus among a broad group of experts helps ensure accuracy and defensibility. For example, such consensus on the process and on the inputs, and thereby on the out- puts (results), can often be achieved through well-planned, facilitated workshops. Such workshops can also help achieve a common understanding, among the project team as well as possibly among other stakeholders, of the important elements of the project. Although there are many approaches to risk management, it is important to estab- lish a relatively formal, structured process, compatible with the overall project man- agement approach. The process described is applicable to individual projects, including rapid renewal projects as well as nonârapid renewal (and even non transportation) projects, and to programs composed of multiple individual projects. However, the focus in this guide is on individual rapid renewal projects. Philosophy and Concepts Project performance can be expressed in specific measures, such as the ultimate project cost or the substantial completion date. Such project performance measures, which are realized in the future, cannot be known with certainty beforehand. However, they can generally be predicted in advance for a specific set of assumptions (e.g., related to as- sumed quantities and unit costs for particular items), but these assumptions might not necessarily turn out to be true. Other conditions might in fact actually occur, resulting in different performance. In this guide, the following terms are used: ⢠Base describes the conditions and related perfor- mance associated with a particular set of assumptions about the planned project. ⢠Risks and opportunities describe the other possible conditions and unplanned events, and their related per- formance changes, depending on whether they degrade or improve performance, respectively. Hence, total performance consists of a base compo- nent, which is related to a specific set of assumptions, and a complementary risk component, which is related to the differences associated with other possible assump- tions. These two components can be estimated separately and then combined appropriately to determine the total. However, in many cases, the risk component will be a function of the base component, so that the base compo- nent must be estimated first. Although conceptually the total performance could be estimated directly, this would generally be difficult to do accurately because of lack of detail and, in any case, would not provide information on the likely sources of poor performance (i.e., risks) for subsequent management action. Total = Base + Risk, combined appropriately For example: Suppose that the base assump- tion for costing and scheduling a task is that suitable materials are on hand. However, there is a chance (e.g., 1 in 4) that suitable materials will not be there when needed, in which case it will cost extra and take extra time to obtain those materialsâthis is a risk. Conversely, if the base assumption is that suit- able materials are not on hand and must be obtained, then there is a chance (e.g., 3 in 4) that suitable materials are already on hand, in which case the time and cost to obtain those materials will have been savedâthis is an opportunity.
13 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Once the base assumptions are established for project performance, a comprehen- sive set of risks and opportunities (i.e., list) can be identified that might lead to changes in that performance. Ideally, to streamline the list and allow for meaningful analyses, the risks and opportunities should be comprehensive and nonoverlapping. Eventually, the items on the list will be prioritized by their severity. The severity of a particular risk (or opportunity) is a combination of two risk factors: ⢠Its set of possible performance impacts if the risk occurs (e.g., changes in project costs if the risk occurs), when the impacts are often uncertain and might be de- scribed in representative scenarios covering the range of possible outcomes; and ⢠The likelihood of those various scenarios actually occurring during various project phases. These risk factors will evolve over time as conditions change and the project devel- ops. Ultimately the risks will either occur with specific impacts or not occur (with no impacts). For example, a design risk will generally occur during the design phase, after which it can no longer occur so that, if it has not happened during design, its chance of occurrence drops to zero and it can be âretiredâ after design. As another example, a design risk might have occurred and been incorporated as a change in the base, in which case it too can no longer happen and it can be retired. The list of risks, including their relevant characteristics, forms the beginning of the project risk register, which the DOT should maintain throughout the project as the risks evolve. Once recognized, the DOT can proactively manage some risks through various actions, aimed either at reducing their chance of occurrence (prevention) or at their impacts if they do occur (mitigation). For example, potential delays, which can result in additional costs, might be avoided by starting preliminary work early, even though that work might not eventually be needed. Presumably, this preliminary work should be done if its cost is less than the potential cost of delay considering its probability of occurring as well the other performance objectives (e.g., minimizing disruption). Such proactive risk management is similar to, and can be combined with, VE, in which opportunities to improve project performance are identified, evaluated, and recommended. Even after such proactive risk management, there will be residual risks, which the DOT must accept and thus accommodate in the budget and schedule. Typically, DOTs do this by establishing and controlling contingencies for cost and for schedule, over and above the base cost and schedule. These contingencies can be established at various levels of conservatism or levels of confidence in their sufficiencyâthe higher the level of conservatism, the higher the chance that they will be sufficient, but also the more funds that must be committed to the project and not made available for other projects. The appropriate level of confidence should be a DOT policy rather than a technical issue, balancing the consequences of going over budget with those of going under budget. For example, many agencies choose an 80% confidence level, for which there is a 20% chance of exceeding budget (without cutting scope). Adequate controls, in the form of procedures, are needed to ensure that the contin- gency does not simply become self-fulfilling, but remains adequate to cover remaining risks throughout the project and surplus contingency is released. However, because
14 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS contingency is established at less than a 100% confidence level, there is a chance that it will not be adequate. In such cases, either additional funding must be found or the scope of work must be reduced in order to complete the project. These constitute con- tingency (or recovery) actions (as opposed to contingency funds or time) and should also be planned beforehand. Hence, once the project risk register has been developed, the DOT should develop and subsequently implement a plan to effectively manage those risks, thereby opti- mizing project performance to the extent possible. This plan consists of management actions to proactively reduce specific high-priority risks, to establish and maintain ade- quate budget and schedule to accommodate remaining risks, and to modify the project as necessary if the established budget or schedule is inadequate despite proactive man- agement actions. Moreover, this plan should establish the procedures and organization necessary to successfully carry out those actions. This plan is called the project risk management plan, which should also be maintained throughout the project as condi- tions and thus risks change. PROCESS OF RISK MANAGEMENT Although the risk management process can be (and in the past has been) done in a vari- ety of ways with various degrees of success, the general process of successful risk man- agement consists of a series of steps, which are applied at various times throughout a project. These steps, which are discussed individually in more detail in subsequent chapters specifically for individual rapid renewal project risk management, are shown in Figure 2.1 and consist of the following: Step 1. Structuring. Before risks can even be identified, much less managed, the DOT must adequately define the base project. This base consists of the planned project scope, strategy, and key conditions, as well as a set of assumptions about those aspects that are not yet known for certain. Base project performance (e.g., project cost, sched- ule) is then determined as a function of these base project elements. Generally, this base project description is developed at a relatively broad level of detail simply via facilitated discussions with the project team. A template that identifies all relevant elements is often used to ensure that they are adequately described at the appropriate level of detail. This step, and the associated template, is subsequently discussed further in Chapter 4. Step 2. Risk Identification. Once the base assumptions have been established and the project has been structured (Step 1), the DOT must adequately identify the risks and opportunities relative to that base. The intent is to identify a comprehensive and nonoverlapping set of risks and opportunities. To help accomplish this, the risks are often categorized; for example, in the context of the project phase in which they might occur. Generally, a combination of techniques, ranging from facilitated group brain- storming to risk checklists, is used, considering all readily available information. As the project develops and conditions change, additional risks might be identified, while some existing risks will be retired. The updated list of risks is maintained in the project risk register. This step is discussed further in Chapter 5.
15 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Step 3. Risk Assessment. Once the DOT has identified risks and opportunities (Step 2), the DOT should adequately assess the relative severity of the risks and oppor- tunities so they can be prioritized for subsequent management (Step 5). If the DOT chooses to quantify uncertainty in project performance through risk analysis (Step 4), then the risk factors must also be adequately quantified, from which their severity and prioritization can be determined. The risk factors (i.e., the impacts if the event occurs and the probability of that event occurring) are assessed, either qualitatively or quan- titatively, using a variety of techniques, ranging from statistical analysis to facilitated expert group opinion, considering all readily available information. As the project develops and conditions change, the risk factors for previously identified risks might change and need to be reassessed, while the factors for any new risks must be assessed. The updated assessments of factors describing the severity of each risk are maintained in the project risk register. This step is discussed further in Chapter 6. Step 4. Risk Analysis. If the risk factors have been assessed quantitatively (Step 3), the DOT can use the risk factors in conjunction with the base performance to determine total project performance. For some performance measures that are additive, such as uninflated costs, this is a relatively simple analysis. However, for other performance measures that are not simply additive, such as schedule (and thus inflated costs), this is a relatively complex analysis. Typically, numerical models are developed to adequately calculate each performance measure as a function of various input factors (e.g., the 12 2014.01.08 R09 03 Guide Chapter 2_final for composition.docx ï· Deciding on whether to implement established contingency plans at various milestones. Hence, as the project develops and the related risk management plan changes, the plan must continue to be effectively implemented. This step is discussed further in Chapter 9. [Insert Figure 2.1] [caption] Figure 2.1. Iterative risk management process. Project Scope/Strategy/ Conditions Structuring Risk Identification Risk Assessment Risk Analysis Risk Management Planning Risk Management Implementation Figure 2.1. Iterative risk management process.
16 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS base and risk). The overall mean value (i.e., probability-weighted average value) of the performance measure can then be approximated by using the mean value of each input factor, which for one risk would simply be its probability times its impact. The uncertainty (expressed by a probability distribution) in a performance measure can be approximated (e.g., typically by Monte Carlo simulation) by using the uncertainty for each input factor, appropriately considering any relationships (correlations) among those input factors. This can be done at various levels of detail and complexity, con- sidering risks explicitly or implicitly; if risks are treated explicitly, their severity can be calculated and used to meaningfully prioritize the risks. As the project develops and the risks (and their factors) change, the project performance must be reanalyzed. This step is discussed in Chapter 7. Note that risk analysis requires specialized skills and experience. Step 5. Risk Management Planning. Once the DOT has evaluated and prioritized the risks (Step 4 and possibly more definitively in Step 5), the DOT should identify and adequately evaluate proactive ways to manage those risks and select those that will be cost-effective, which is a process that is similar to (and possibly combined with) VE. The DOT should then develop adequate plans to accomplish those activities. Budgets and milestones that adequately account for the remaining residual risks must then be established (e.g., through use of contingency and float), based on agency policy on the appropriate level of conservatism. Adequate procedures must be established to control expenditure of that contingency, so that the project does not automatically consume the allocated contingency. Ways to meet budget or milestones if that contingency turns out to be insufficient (e.g., reduction in scope) at various milestones must be identi- fied and adequately evaluated to select those that will be implemented if necessary. Adequate plans and decision criteria must be developed to accomplish those actions. As the project develops and the risks (and their factors) change, these plans must be reviewed and revised as necessary to optimize remaining project performance. The updated plans are maintained in the project risk management plan. This step is dis- cussed further in Chapter 8. Step 6. Risk Management Implementation. Once the DOT has developed the risk management plan (Step 5), it must be adequately implemented. This involves the following: ⢠Implementing and monitoring progress on proactive risk reduction activities; ⢠Monitoring risks and updating the risk register, partly in response to proactive risk reduction activities but also because of other changes in conditions (e.g., changes in the base); ⢠Periodically reanalyzing risks, especially at major milestones or major changes in conditions; ⢠Periodically reviewing and updating the risk management plan; ⢠Monitoring, controlling, and periodically revising contingency as necessary; and ⢠Deciding on whether to implement established contingency plans at various milestones.
17 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Hence, as the project develops and the related risk management plan changes, the plan must continue to be effectively implemented. This step is discussed further in Chapter 9. The appropriate details of the above process depend on each particular projectâs needs and conditions. Like most evaluations, the accuracy and defensibility can vary from very approximate with low defensibility, which can be achieved with relatively little detail, expertise, and thus effort (depending on project conditions), to very accu- rate with high defensibility, which requires significant detail, expertise, and thus effort (again depending on project conditions). The appropriate level of detail and expertise should be selected to achieve the needed level of accuracy and defensibility, considering the effort involved. The actual âhow toâ details of implementing each of the above steps is covered in companion training materials, which are summarized in the Simplified Risk Manage- ment Training document and available online at www.trb.org/Main/Blurbs.168369. aspx. The logistics of implementing the above set of steps (e.g., through facilitated work- shops), as well as when they should be implemented during project development, are discussed in Chapter 10. CONCLUSIONS ON THE RISK MANAGEMENT PROCESS Historically, risks and opportunities have significantly affected projects and thereby program outcomes. This might be especially true in the future for innovative rapid renewal projects, for which there is a more dynamic environment and less experience. However, by adequately anticipating these risks and opportunities, and subsequently evaluating and planning for them, project performance can be improved. Although risk management can be done in a variety of ways with various degrees of success, a formal, structured risk management process, as an integral part of project management, is needed to provide adequate accuracy and defensibility. Risk manage- ment can create a better understanding of possible outcomes and then help to manage those outcomes to the greatest extent possible. This risk management process consists of a series of well-defined steps, which are iterative and applied at various times dur- ing a project or program. The process must be flexible (especially in level of detail and expertise) for efficiency. Although this risk management process is generally applicable at the program or project level, and to nonârapid renewal and even nontransportation projects, the focus in this guide is on application to individual rapid renewal projects.
18 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Example A hypothetical case study by âQDOTâ is used throughout this guide to illustrate the various steps of the risk management process. This case study is presented in Appendix D and includes a risk management plan (RMP) in Appendix E. The basic risk management process discussed in this chapter is used in that example, as sum- marized below. QDOT is planning a significant highway reconstruction and expansion project. The objectives are to minimize cost, schedule, and disruption during construction and maximize longevity of the constructed facility after construction. Recognizing the uncertainty and risk inherent in this project, QDOT decided to conduct risk man- agement planning, followed by implementation of the resulting RMP, to optimize satisfaction of these objectives (as described in general terms in this chapter and spe- cifically for this application in Appendix E, RMP Section 1). However, it was decided not to conduct quantitative risk analysis (e.g., to objectively establish contingencies) at this time. To accomplish this (as described in Chapter 10 and specifically for this application in Appendix E, RMP Section 9), QDOT: ⢠Convened a group of project team staff and independent subject-matter experts from the key project disciplines, facilitated by a qualified risk elicitor and analyst, to conduct risk assessment and risk management planning (consistent with the principles, processes, and guidance described throughout the guide). ⢠Assigned a risk manager (with adequate authority and resources) to implement the resulting risk management plan.
