Risk management in projects and megaprojects: About a dozen tools

Project management, large-scale projects, megaprojects differs from other areas of management in its tactical work with uncertainty. Practical risk management tools are in demand to increase the likelihood of successful project completion.

In this article, I have compiled a dozen risk management tools that PMC contractors use in projects and megaprojects. Although the list is not complete. The need to sort out methods of dealing with uncertainty is associated with the notorious "mitigation" of risks, which in most companies is presented as a panacea.

Fig. 1 Map of risk management tools

The tools are reviewed from simple to complex.

Reserves

Reservations based on budget and deadlines are a legacy of the Soviet practice of state-owned companies, for which results and quality were important. Widely used as an effective measure for dealing with uncertain risks. Cannot replace coordination and proactive risk management.

The commercial contracts that accompany projects are more stringent and generally do not allow unreasonable reservations. Goldratt's 30% reservation in terms of timing remains a "blue" dream for many project and megaproject managers.

Patterns

Companies that learn from failed projects gain experience and structured risk information. Those "rakes" and "bumps" that were encountered in real projects become "diamonds" for future projects. Risk typification is most often formed in the form of a risk catalog or a hierarchical risk structure.

The owner of the lessons learned should be the company's project office. Therefore, before creating a passport for a program, project, or megaproject, welcome to the project office for templates and templates.

Expert judgments

One of the most effective and inexpensive ways to identify project risks. Formats: brainstorming, focus group, Delphi method and other options. Allows you to take into account the opinions of stakeholders and, at the same time, capture the motivation and expert power of the employees invited to the assault. For greater convergence, it requires the "average temperature in the hospital."

From the practice of a PMC contractor: experts prepared for the assault easily formulate several dozen risks in a 15-minute session.

Prioritization

For many Russian companies, qualitative risk analysis is the "ceiling" of risk management. Allows you to rank threats and concentrate efforts on "high" or "medium" or "close" risks.

From the observations of a PMC contractor: the customer's maturity in the field of risk management is proportional to the complexity of the qualitative "Probability-Consequence" matrix. We encountered options with ranks from 1 to 5 on both axes, that is, the risk rank can vary from 1 to 25 (the product of the "Probability" and "Consequences" ranks).

Symptom management

Symptoms or risk triggers are events that remind you of the proximity of a risk and the need to accelerate/include measures to respond to the risk. A separate observation field for the project management group. Alexander Sergeevich Kutuzov, PME - leader of PM Excellence - often compares the project manager to a yacht lookout who notices a floating log in time and maneuvers to avoid damage to the propeller.

Requires the connection of analysts and monitoring of the project environment. A similar approach is actively used to monitor the risks of socio-economic development by the project office of the Government of the Russian Federation.

Cause and Effect Diagrams

If you face a recurring risk, cosmetic mitigation measures are unlikely to be effective. It is important to get to the bottom of the reason! Here, risk management adopts quality management tools, mainly the Ishikawa (fishbone) diagram.

Risk management in this aspect acts as a tool for the Total Quality Management (TQM) system.

Monetization

By monetization I mean a quantitative risk analysis, which allows you to calculate the amount of potential losses in monetary terms. And as a result, an adequate cost of measures to respond to the risk. This is the "heavy artillery" for most Russian companies, and it is usually entrusted to automation and artificial intelligence. Graphs and decision trees sometimes appear at the stage of choosing a megaproject development option.

A classic example on this topic. The risk of fire in the reconstruction project of the Cathedral of Notre-Dame de Paris was estimated after the fact (when the cathedral burned down) at 5 million euros. In relation to the budget of the cathedral reconstruction project of 130 million euros, this is a huge amount that must be perceived as a loss. If, to compensate for potential losses, you spend an amount that is an order of magnitude smaller than the risk, i.e. 500 thousand euros, then the probability of risk will decrease to almost zero.

A systems approach to response

For flexible risk management, it is effective to use combinations of strategies, and in some cases, dual risk response strategies. Despite the costs, the cumulative reduction in incidental costs of risk management is beneficial.

From the practice of a PMC contractor. A large federal company must insure all contracts for the supply of materials and equipment, despite the presence of penalties for late delivery. In effect, it transfers the risk of late delivery to the insurance company.

Simulation

This is not so much about drawing up a schedule network model of the project, but about using appropriate risk response models. The popular numerical Monte Carlo method (not roulette) requires a large number of implementations of random variables, that is, similar projects, which is not always available.

Limitations of the Monte Carlo method:

1) works only if there is a schedule network model taking into account physical volumes and resources

2) does not work if there are no statistics and expert assessments

3) applicable only to risks independent of each other.

Automation systems and artificial intelligence

Over the past five years, quite a few risk management automation systems have appeared on the market. Among Western developments I would like to mention SAP GRC, @RISK Industrial, Oracle Primavera Risk Analysis, SAS EPM. Among Russian developments, I would like to note the Risk Gap system, which can be integrated with Primavera and MS Project Server.

In connection with the active development of artificial intelligence (AI), I see the following forecast for the use of AI in risk management. For example, AI generates a ranked register of risks for a project based on an analysis of the project's immediate environment, the status of stakeholders, and BIG DATA. For each risk, triggers and trends are formed, and response measures are proposed. Risk monitoring is carried out 24/7. AI excludes a project from the portfolio when threshold values ​​of possible risks are reached. Plans "B" are formed as a reaction to possible options for the implementation of risks.
The project manager monitors the coordination of the risk management policy and the risk appetite of the main project stakeholders, approves the AI results at the Project Committee.

Conclusion

As a summary: the richer the risk management arsenal, the

1. you can set more ambitious goals;
2. the better protected you are in ongoing projects.

Naturally, a combination of instruments is welcome.

In conclusion, I note that approaches to risk management are very similar in different project management methodologies (PMI, IPMA, P2M, MSF, SCRUM) and, rather, depend on subjective factors. I will devote a separate article to this.