The Identification And Management Of Risk In The Project Environment
By Alan Patching
Place a 30cm wide steel beam on the ground between two 50m high columns positioned thirty metres apart and offer $50,000 to anyone who would walk across it in two minutes or less and you would be swamped with takers. Change the circumstance by just a single factor and you would have little chance of anyone being interested. Why? Not many people would want to attempt the feat for a mere $50,000 if the beam was lifted and secured at the top of those columns, especially if there was no safety net or harness and life line on offer. In fact, without these, you would be hard pressed to find someone to attempt it for many times that amount.
The reason gets down to one factor – RISK.
I suggest with appropriate safety harnesses and nets in use, there would once again be no shortage of adventurers seeking to face the challenge and earn a few dollars in the process. And why not? With risk clearly identified and managed the danger to life and limb in this example is reduced to virtually nil, and so people feel comfortable to proceed with the challenge.
It's much the same with risk associated with major projects. Professionals charged with the task of managing these projects identify all risk involved and put in place measures that give clients virtual certainty concerning project outcomes. Or do they?
While this is the ideal, and while most professionals involved with risk management would probably feel that they cover risk effectively in their management of projects, I wonder if all aspects of risk are examined and addressed effectively. Indeed, I wonder how many project professionals really understand risk in all the forms it can and does affect major projects, and the degree of impact various forms of risk can have.
Let's take a look at risk in the project environment, and examine what methods are used to address it, and what might be the minimum acceptable approach to the management of that risk.
It seems to be the case that the less complex a project is seen to be, the less importance is placed on the management of risk associated with that project. In the construction industry, for example, quite simplistic approaches to risk management are often employed for even projects worth hundreds of millions of dollars, simply because the project, while major, is only another form of office or hotel constructed many times before by the professionals and clients involved. In fact, for many major projects, risk management is limited to a sensitivity analysis at feasibility stage and the inclusion of what is seen to be an appropriate level of contingency fund in the project budget. This might well be an acceptable approach, but only if it is the end result of a detailed analysis of all the risk factors associated with the project. More often than not, I fear that this is not the case.
Risk analysis on construction projects in particular often occurs only during the feasibility phase and in complete isolation from any consideration of the type of delivery system, form of contract or specific contractor's personnel to be employed. This is difficult to understand in light of the fact these elements of a project can contribute significantly to the project risk profile. Risk management should follow the broad principles of cost management. An expansive initial risk profiling approach is to be recommended, and regular review of impact on this profile of various procedures inherent in the project development process should be undertaken. In the construction project example, as a minimum, an analysis of the impact of delivery system, contract type, tendering procedure, tendering period, contract period, contractors being considered and even, at the appropriate time, specific personnel the short-listed contractors intend applying to the project, is recommended.
A key concern with most projects is any analysis of risk undertaken is limited to the quantitative. Such quantitative study can range from simple sensitivity analysis of factors such as construction period and interest rates during feasibility preparation and/or inclusion of contingency sums within project budgets, to complete Monte Carlo simulation of the risks expected to be encountered during project delivery. This is despite the fact qualitative risk factors probably have as much, if not more impact on projects as do the quantitative.
The qualitative factors for the most part involve the human factor, and here projects are exposed to dual risk elements. The first flows from the attitude and professional skill and ability of specific operatives, particularly those in key positions. The second is a function of the person's ability to operate and communicate rationally and effectively in an environment that can be contaminated by issues such as corporate politics and social tensions. On major and/or complex projects, it can often be expected these issues will dominate the technical and contractual aspects of the project in competition for the time and attention of project staff. Consequently, an operative possessing the most finely honed technical proficiency may still need to be regarded as a risk to the project if that person lacks an attitude and level of interpersonal skills appropriate to the specific project environment.
Imagine a professional project manager highly skilled in quantitative risk analysis techniques, but lacking the communication ability to ensure the risks he or she identifies are satisfactorily understood by management. An example of this might be a person in the position of putting a bullet proof point of view, from a project management perspective, to a management committee with no project experience. The project manager with poor communication ability might fail to get the point across if an alternative position was put to the committee by an operator with a vested interest and a smooth and persuasive presentation style, but nil technical competence. Such a simple circumstance could cost the project dearly if risk associated with the lesser position comes to fruition.
A Risk Analysis Model
Modern practitioners of professional risk management tend to analyse risk in both qualitative and quantitative terms. Total Risk is defined as the sum of all risk event scores (often called risk events expected values). Risk score is simply determined by calculating the product of the deterministic and probabilistic aspects of each identified risk event. In other words, the risk management practitioner must determine the impact if a risk event occurs and multiply this by the probability of the risk event eventuating.
The approach sounds simple but is made complex by the fact many risk events are best measured in qualitative terms. Risk events arising from human factors such as those appearing in the list hereunder are very likely to fall into this category
- Social Environmental
- Gender Issues
- Hierarchy issues
- Attitudinal
- Matrix issues
- Acceptance/inclusion
- Corporate politics
- Inter personal
- Stakeholder issues
- Communication
- Political environment
- Values/beliefs
- Corporate culture
When qualitative measurement of risk factor probability and expected impact is necessary, as for example in the case of human factors, it is advisable to convert the identified values to quantitative form if possible.
A common approach is to use a 5 or 7 step qualitative rating in accompaniment with a conversion table. The qualitative ratings of probability and/or impact might be, for example, negligible, low, very low, medium, high, very high or almost certain. These are then converted to numbers using pre-defined numeric values for each qualitative rating category.
The model does not presume to be all encompassing or completely accurate but it does give an indication of the types of issues to be considered in a complete risk factor analysis.
Quantitative Risk Aspects
Deterministic analysis seeks to identify all individual risk factors, and the likely impact on the project to a project if they do occur. This should be a continuous exercise throughout the project delivery cycle and in particular should be done during common project related techniques such as scheduling, estimating and feasibilities preparation, to focus attention on potential areas of risk. For example, a feasibility study might reveal project sensitivity particular to construction period, or to interest rate increases in excess of a certain level. Likewise, a competent Quantity Surveyor would apply awareness of market conditions in preparing estimates, and so might identify limited availability of resources in a particular element or trade of the project as a potential risk event.
Probabilistic analysis is more likely to be applied in analysis of financial risk aspects of the project. Of course, financial performance is a function of effectiveness in many other areas relating to the project, such as various technical methodologies, affect on schedule of weather and industrial action, effect on workers morale of project safety record, and a wide range of minor but related issues. As probabilistic analysis of project finance as a whole will usually presume a normal situation relative to specific project circumstances for these factors, the prudent risk analyser will decide in deterministic analysis whether or not to identify specific items such as those listed above for probabilistic quantification.
In setting budget limits, schedule deadlines, and any number of other project 'limits', management is really establishing key performance indicators against which a project's realisation or avoidance of risk can me measured and evaluated.
I once conducted market research among clients on behalf of the Australian Institute of Quantity Surveyors. There was a common view among major clients and financial institutions that professionals would be providing a higher level of service when they began to issue a 'risk range' with every estimate they prepared for a project. Their concern was confirmed when I followed up with some basic research among clients who had attended project management seminars I had conducted. These people came from a wide range of fields that employ project management techniques including oil and gas, construction, transport, banking and insurance.
The research revealed that most project managers dealing with project estimates believe that only in the order of 68% (maximum- some reported as low as 20%) of the items in the estimate could be regarded as being relatively risk free. Asked to 'firm up' the other items so that the project managers felt that the estimate was virtually risk free, the median response required an increase in the value of the estimate of some 19%. In addition, when I questioned some of the respondents about their estimates after their 'no risk' evaluation, they increased the estimated increase figure they had originally quoted.
I then asked the same folk how much they would reduce their estimates to get the lowest cost they would be comfortable with ( a price for which the project could be delivered even though there was little chance of this happening in reality) presuming that none of the risk factor contingency built into their original estimates eventuated. The median response was 12%.
Let's look at the impact of those responses on a project of a value of, say, $1m. Effectively the responses establish the following range of estimates for the project:
Minimum $880,000
Original expected $1,000,000
Maximum $1,190,000
It is not the purpose of this paper to address specific risk simulation techniques, but rather to identify some aspects of risk that should be considered for every project. However, it is a fact that if the above data were subjected to analysis by any of the recognised risk simulation software packages / techniques available, the result would be a conclusion that there is less than 50 % chance of the project being completed for the estimate originally prepared.
The tragedy lies in the fact that an estimate is nothing more than an expectation of final cost based upon a host of presumptions which are seldom highlighted when the estimate is prepared. Even when they are, they are not often given the full consideration that is due. It is common for focus to be put on exclusions from estimates, rather than risk associated with what is included.
The obvious conclusion is that project management professionals must move beyond simple addition of the traditional 10% contingency for risk to a more pro-active approach involving identification of specific potential risk events for a project, and calculating the risk score in the manner suggested earlier herein. On more complex and expensive projects, Monte Carlo simulation in relation to cost and scheduling aspects is also recommended. In addition, PERT based statistical analysis of schedule and time information is a technique more and more being used to identify the range of creep in these important items that can be expected for a given project with a given risk profile.
Contracting Aspects
One of the most important purposes of a contract is to allocate risk with precision. Unfortunately, despite the best intentions of all involved in the preparation of contract documents, all parties seldom hold the same assessment of 'risk assumed' that the preparing party intended that the contract define. This can be the result of perception differences, or perhaps because of a reluctance to accept risk assigned, or even to understand the extent of risk intended to be accepted by management in entering into a contract.
I recommend that project managers begin all major projects with a contract audit. This involves a review of at least the most material contract provisions, preferably not by those involved in preparing the contract, and clarification by way of dispute resolution or negotiation and deed of amendment where differences of opinion are identified. On a corporate project in Victoria, Australia, this approach identified 113 differences of view regarding contract interpretations, and these were resolved by negotiation (involving those involved with the writing of the contract as well as those charged with responsibility for its administration) prior to commencement of the contract work.
In the construction situation it is the contractor who first nominates by way of offered price, the first firm indication of the value of the completed project. However, in winning the tender, the successful contractor had to make a decision regarding the amount of risk it is prepared to take. Often this is identified in global financial terms with no specificity in identification of risk items. Furthermore, the risk assumed is often not communicated to the field force.
The result in this situation is often a realisation of risk factors by the client occasioned by field staff defending their career positions by claiming all cost in excess of tender against the client for any number of ambit reasons. A better understanding at corporate level of the risk assumed, and a clearer communication of reasonable expectations of senior management regarding risk acceptance, might alleviate such a circumstance.
It is for this technical risk aspect of projects (which manifests itself via the risk factors defined under the qualitative banner–namely, in this example, the contractor's internal personnel's ignorance of risk assumed) that I usually recommend clients adopt a negotiated approach to major project contractor appointments.
Qualitative Risk Aspects
The obvious yet most important conclusion to be drawn from a review of the risk model is that most quantitative risk elements are intrinsic to the project. A typical exception might be interest rates if not locked in.
On the other hand, the majority of qualitative risk factors have little, if anything, to do with the project as defined in the scope definition documents. They are more related factors impacting on the people who will inter-relate, often across a contractual arrangement, to deliver the project. As such these factors are generally described to be extrinsic to the project. More and more clients are coming to realise that 'extrinsic factors' is a dangerous term to use, as people are very much a key factor intrinsic to all projects, and qualitative risk from human aspects manifests as impact in financial terms as surely as does risk of technical origin.
In the simple fully documented lump sum contract arrangements of the sixties and early seventies, a project manager with leadership ability, a construction related qualification and an analytical mind was well equipped for a successful career. The same project manager might be seen as something of a dinosaur today, particularly if attempting to operate using those skills alone on a typical major and complex infrastructure project. Such a project might typically involve a multitude of stakeholders with financial interest, perhaps from both government as well as the private sector, not to mention a high level of public scrutiny if the project is as typically high profile as are many of today's infrastructure deals.
The probability of the 'old skill set' alone being effective reduces even further when one realises that today's complex deals are usually constructed by way of several different contracts prepared by several different lawyers. When this happens, the reality is the chance of all subtle intentions actually being included in documents as intended is about the same as the world suddenly changing its direction of rotation.
The technical skills of early project management days have not been replaced by any modern set exclusive of them. Rather, they must be complemented by the range of 'people skills' that will invariably be called upon on almost a daily basis in the current environment on the type of project described above, and many others of considerably less size and complexity.
The ideal project manager for appointment to a high risk project environment will certainly boast finely honed technical skills and a solid experience base. However, he or she will also possess exceptional negotiation skills, and at least some basic knowledge (preferably from formal training) in a wide range of advanced business communication skills (such as Transactional Analysis, Neuro Linguistic Programming, Listening Skills and Behaviour Style Evaluation). They should also have reached what Canadian author, Ian Percy, describes as the Insight stage of their psychological development, and so be able to entertain, or at the very least, to tolerate the opinions of others, even when these are diametrically opposed to their own or others in the project inner sanctum.
In particular, they will be able to operate in environments typified by a high level of corporate politics, possibly using a mix of rigid assertiveness and frequent personal review to ensure ego is not getting in the way of achievement of project objectives.
Finally, given that "Murphy" has chosen to reside in the project environment, and is never short of creativity in the presentation of project challenges, today's project manager will have well developed 'right brain' skills in lateral thinking and innovation.
In short, such is the emerging risk profile for major projects that projects of the future may well continue to be staffed by well qualified but readily available 'technicians'. However, they will most assuredly be directed and led by a currently much rarer breed of person. One who is capable of managing all aspects of the risk that infest the complex project environment, and one generally undaunted by the increasing encroachment of corporate politics into the project environment.
Furthermore, contractors selected for the projects of the future will not only compete on price but also on the proven track record on similar type projects of the key personnel to be appointed to the project. Contractors that nominate Director level personnel to deal direct with the client whenever a problem is not quickly resolved at the point it arises will quickly establish themselves at the top of their profession. Today's educated clients are quickly becoming aware of this fact.
In Summary
The point of this article has not been to describe specific techniques for the evaluation of risk factors likely to be encountered in the project environment. Rather, it has been been to make readers aware that there is a lot more to the process of risk identification than is addressed by some project professionals. The days of dealing with financial risk by virtue of sensitivity analysis and contingency fund establishment alone are numbered. There will always be a very senior project position for both techniques. However, the application of sensitivity studies must be in the context of a broader risk profiling, and the establishment of contingency can no longer be on the virtually ad hoc basis that has survived for so many years.
Risk allocation via contract will probably continue to evolve as the norm but in the context of a negotiated arrangement in which all parties are very clear on their responsibilities.
Finally, the qualitative aspects of risk analysis will be seen to be as important as they always were despite perhaps not having previously being recognised as such.
The author consents to this article being reprinted for personal use or publication on the condition no changes are made to the topic, content and author's name, and the words "Copyright held by Alan Patching and Associated Pty Ltd. Alan Patching is one of Australia's leading business presenters and inspirational speakers." Are included at the end of the article.
For more information on this and other leadership, management or project management topics, please visit our e-books page.