Just like as death and taxes are the only certainties in our lives, the only certainty in a life of a project is the occurrence of one or more risks. In this chapter we will try to see how we could guard against these risks in a project by anticipation, right assessment and detailed strategy for handling them as and when they occur.

What are risks?

Risks are typically unforeseen events, which can cause adverse impact to any project. Risks can happen to any one of the major parameters of a project namely its schedule, scope, resources and quality. Risks are the ones, which give credence to all the Murphy's laws you hear and generally make the life of a project manager interesting.

Are they a certainty?

Yes. They are. If things can grow wrong, they will. When they go wrong they seem to go wrong absolutely! All experienced project managers would vouch for the certainty of risks in projects.

Is there a way to plan for managing risks?

Yes. Planning for a risk includes the following activities:

Anticipate and identify all potential risks, which can happen
Associate a probability with each of the identified risk
Make an impact assessment if the identified risks were to happen
Have a mitigation / contingency plan for each of the identify risks
Watch out for the early signs
Understand the effectiveness of the contingency plan and refine accordingly
Update risk database as unanticipated risks happen

How does one anticipate and identify risks in a project ?
Risk anticipation comes with experience. But even a novice project manager can anticipate risks in a project. Some of the risks which normally occur in a in a project are:

People may leave the project mid way (attrition)
Complexity of a task is under estimated
Customer may cancel the order
An Earthquake may happen which can have a telling effect

And the list goes on. One of the things a project manager needs to do is to associate the risks with a specific parameter of a project. For instance employee attrition is a resource risk. But it is likely to have an impact on schedule and even the scope of the project if the risk is not handled. Release of a competitor's product ahead of schedule is a schedule risk for your project, which again may impact the scope of your project and might necessitate a manager to add more resources.

In planning for risks, experience is the best teacher. One of the things a project manager can do is to find out similar projects done in the past and import their risk database to his/her project. This way (S) he could leverage from the experience of other projects and project managers. Smartworks - Project Planner has the following option, which allows you to do this with ease. To do this the project manager needs to export the risk database of a similar project as shown below

Fig1.1: Exporting risk database of a project

The risk database of a project is saved usually with a .rsk extension Now you log in to your current (new) project and import the risk database as shown below.

Fig1.2: Importing the Exported risk database of a project

In case if you are not able to find a similar project you need not despair. Smartworks Project Planner comes with a default risk database which can be used in your project.

Fig1.3: Default risk database

How does one arrive at a probability of occurrence for the risks we have identified?

While there can be thousands of risks which can happen to a project not all risks are likely to happen. Some risks have a higher probability than others. For instance earthquake is a risk which when happens may have a deadly impact on a project but is less likely to happen compared to attrition in a project. (May be if the location is prone to earth quakes then this might not be true!)

In general the following risks are likely to have a high probability of happening in any project which spans for a year or more.

Employee takes unplanned vacation (falls sick). - Resource risk
Customer adds new requirements after they are frozen. - Scope risk
Marketing wants you to release the product ahead of schedule - Schedule risk

Following are some of the risks which may have a low probability of occurrence

New invention/technology renders the product obsolete
Political instability in a supplier's country affects supply of raw materials
All the project members meet with an accident during a company vacation

And there are hundreds of risks which have a medium probability of occurrence. It should be borne in mind that probability of risk occurrence is not static and it can change depending on situations. For instance a medium probability risk " Supplier delays shipping raw materials" becomes a high probability risk when an associated risk "Political instability in a supplier's country affects supply of raw materials" really happens. This also illustrates how the risks themselves are related to each other.

A project manager needs to arrive at the risks and associate a probability of occurrence to each of the risks. The probability thus arrived at needs to be revisited periodically and updated.

Project manager needs to be bothered with the risks, which have a higher probability of occurrence. Once high probability risks are arrived at then the project manager needs to study the impact of each of these risks if they were to happen. Based on the probability and the impact of the risks the project manager needs to come up with the mitigation / contingency plans for each of these risks.

SmartWorks Project Planner currently lets the user classify the probability of risks into 3 categories namely high , medium and low. This can be done by the project manager by performing the following operations.

Fig1.4: Dialog box which shows how probability of a risk can be edited by manager

How can we assess the impact of each of the identified risks in our project ?

Each of the risk has an impact (usually adverse) in a project. Some of the risks have a much higher impact on the project health than the other ones. Some of the risks which has a high impact in a project are

Attrition of a critical person mid way in a project
The schedule of a project gets compressed by 25% due to market pressure Budget exceeded for the project

The above risks , when they occur have a telling impact on project's health. While in some cases they may result in the total cancellation of the project , it might at least affect the scope and the quality of the final deliverables to the customer.

There are other risks in a project which may have a lower impact . Some of them could be

Employee reports sick for a day
Customer makes a minor modification to scope
Marketing wants the product to be released 1 week ahead of planned schedule.

Not all the risks, which may have high impact, are necessary to be worried at. For example when a tornado strikes the impact is going to be high but if you are not in tornado prone areas that risk is as good as not there. So what is really important is the combination of the probability of a risk and the impact of it rather than the impact of the risks alone.

Smartworks Project Planner currently lets the user classify the impact of risks into 3 categories namely high , medium and low. This can be done by the project manager by performing the following operations.

Fig1.5: Importing the Exported risk database of a project

How can one make an effective contingency or mitigation plan for identified risks?

Project manager needs to have a plan to handle risks whenever they happen. These plan needs to be planned in advance and not when the risks happen as the manager will not have any time to react to the situation. For instance a project manager needs to have extra people in the team to handle attrition in a project. If this plan was not there in the first place and if he has to recruit a person to handle any attrition as and when it happens the project would be in disarray soon.

Let us see some examples of contingency plan:

a) Risk name: There is a possibility of more non RSVPed invitees turning in for the party
Contingency plan : Ensure that there are 10% more seats available and the caterer can handle 10% overflow of guests for the party.

b) Risk name : There is only one person identified for evaluation due to resource constraints.
Contingency plan : Make developers aware of this fact and let them take the responsibility for unit testing including writing unit test plans. Identify one of the developer who finishes his/her task early in the team to join the evaluation team during formal evaluation phase

As you can see a risk has to be anticipated in advance in order to effectively handle it. These contingency plans do not prevent a risk from happening but soften the blow when it comes.

Fig1.6: Risk database of the dream house project

The major challenges faced by the project manager during this phase are staffing (getting the right people would ensure the success of the project) and predicting potential risks and coming with the appropriate back up strategies for risk mitigation.

How does one watch out for the early signs of risks in a project?

This is one question which stumps even the more experienced project managers. It is essential for the project manager to actively look for signals and interpret them accordingly. It is not very different from listening to seismic activities in a region and predicting potential earth quakes in advance. ( and it is as effective!).

For instance if an employee takes more frequent leaves and changes the incoming out going time then he/she is a sending a signal to the manager. It is the responsibility of the project manager to catch this signal and do an analysis and some times confront the situation.

The faculty of catching and interpreting various signals comes with experience.

How do we know the effectiveness of a contingency plan?

Contingency plans exist to soften the blow. If it does not do that then the contingency plan is not an effective one. For example let us consider the following:

You have a supplier A who usually supplies you the raw material required for making your product. As a backup plan let us assume that you have Supplier B who could supply you the raw materials in case if supplier a is not able to meet your requirements. So your risk and contingency plan would some what look like this:

risk : Supplier A is not able to meet our total requirements
contingency plan: Identify an alternate Supplier B who could fulfill your requirements and intimate him to supply the materials required as soon as you sense this risk.

Let us assume that supplier A is not able to supply your entire demand and hence you are forced to kick in your contingency plan. It is possible that supplier B whom you have identified as a back up supplier fails to meet your requirements in terms of turn around time, quality or both. In this case your contingency plan has proved to be ineffective. In such cases you need to declare that the contingency plan is ineffective (and possibly communicate to the higher ups to prevent such reoccurrence) and come up with another contingency plan which could prove to better.

In what ways of the project do risks usually occur?

This is a easy question to answer. They occur in all the phases of the projects. However risks occurring during the early stages of a project is always easier to handle than the ones which occur during the later stages of the project.

What risk are common during project planning phase?

Some of the risks which can happen during the project planning phase are:

a) Activities are not broken down to manageable tasks. If task duration exceeds 3 weeks then it is a candidate for further break down. A task, which has a long duration, has the inherent capability of throwing up surprises to the manager at the end of the task duration. Recovering from a task slippage becomes more difficult when the task duration is more than two to three weeks. It is recommended that project managers try to have a task whose duration is with in a week. That way they would know about the progress or lack of it in the status report.

b) Assigning multiple owners for a task. Even though practically no project manager nowadays makes this mistake, it could be deadly if the project manager by a poor communicates ends up with situation.

c) Not using risk databases of previously executed projects when starting a similar project. Using risk databases is the best way of leveraging other's experience in your project. Otherwise the project manager would be in a situation where he will be condemned to repeat the mistakes made elsewhere in the company.

d) Not setting the project calendar to reflect reality. Project managers often forget company holidays and planned vacations of team members while making the plan for the project. In addition to that some allowance needs to be given for sick leaves by the manager. Failing to set the project calendar with all the holidays/leaves/vacation can put enormous strain on the schedule at a later time during the project execution

e) Coming up with the no or poor contingency plan for the risks in a project. A risk database is useful only when it is complete in all aspects. The most important part of the risk database is the contingency plan, which the project manager needs to have for each of the anticipated risk. A poorly thought contingency plan would be ineffective in the event of a risk happening.

f) Not using historical data for estimating tasks duration. When planning for activities a project manager needs to use historical data to have picture, which is closer to reality. There are times when an activity may not have a historical data associated with it. In such cases it would be prudent for the manager to have Delphi estimates for the tasks.

What risk are common during analysis & design phase of a project?

Some of the risks which can happen during this phase are:

a) Not having the right expertise. This phase depends on experts who have adequate technical knowledge in the project domain. Not having experts can be devastating to the project. Several project managers have issues in involving external experts during this phase of the project even if they do not have any local experts. But this would prove costly during the later stage of the project. It is important for the project manager to have the right experts (with proper credentials) to participate actively during this phase of the project.

b) Not enough time allocated for reviewing which results in improper review. Review is a critical aspect during any phase of the project. However it assumes more significance during this phase of the project as the blue print of the whole project is generated during this phase. Improper review during this phase spells doom for the project.

c) Not listening to devil's advocate. Project managers sometime end up finalizing a design without a complete analysis. Project managers and most of the team members want to move over to the implementation phase of the project as quickly as possible due to the fear of slipping schedule. When they have this mind set they are not open to a critical review of the design where in major flaws are pointed out. Failure to listen to comments from such devil's advocates can jeopardize the success of the project.

What risks are common during implementation phase of a project?

Some of the risks which can happen during this phase are:

a)Poor monitoring of progress: Project managers some times tend to spend most of their time in planning activity and surprisingly very less time in following up whether the implementation is following the plan. A proactive report generated by Smartworks-Project planner can really help the project manager to know whether the tasks are progressing as per the plan.

Fig1.7: Sample Project Summary report

During this phase a project manager is likely to get many alerts whenever a task slippage occurs. It is important for the project manager to understand the reason for slippage and take corrective actions. For instance smartworks project planner provides such alert notifications through emails. A sample alert for a task slippage would be some what like this:

Fig1.8: Sample email alert report

In addition to the reports and alerts you may use SmartWorks project planner's gantt chart and project graphs to get a better picture of the project.

b)Not handling risks: Risks have an uncanny habit of appearing at the least expected time. In spite of the best efforts of a project manager they are bound to happen. Risks need immediate and focused attention. Delay in dealing with risks cause the problem to aggravate and has negative consequences for the project.

c)Poor cost management: A manager's success is measured by the amount of cost optimization done for a project. Managers frequently do all the cost optimization during the planning stages but fail to follow through during the rest of the stages of the project. The cost graphs in the Smartworks- Project planner can help a manager to get a heads up in project cost overflow. The cost variance (The difference between approved cost and the projected cost should be always in the minds of the project managers).

Fig1.9: Sample project Cost Graph

What risk are common during project end phase

Some of the risks which can happen during this phase are:

a)Not having immediate post mortems: Some of the project managers want to solve current problems. A post mortem essentially focuses on past problems. Hence they fell that it is not important and often do not hold them in the first place or even if they hold it they ensure that every body knows that it is only a ritual. While post mortem indeed talk about past problems in a project they are the best places to identify unsolved critical problems and potential future problems which is going to have a telling effect on other projects

b) Not getting customer feedback: It is vital for project managers to get a feedback from the customer once the project is completed. Typically this should happen when the customer has really started using the deliverables from the project. Getting this feedback provides the managers with a user's perspective which is the most important (s) he would ever get about the project's success. Some of the project managers do not get feedback and lose the immense benefit it can bring to future projects.