Risk Management

Read this article, and pay attention to the section on attitudes toward risk. Think about your industry. Is it risk-averse or open to taking smart risks? What about you, personally?

Quantitative risk assessment

Opportunity costing

There are a couple of other accounting terms worth looking at in considering how risk affects budgeting:

  • Sunk cost – this is money already expended that can't be recovered
  • Opportunity cost – this is forecast earnings from the project. This figure may change as we go through the project.

A risk occurring at some point in the project may alter your opportunity cost but it can't affect the money that is already sunk eg, you have invested in developing new courses, buying equipment and appointing new staff expecting to win an NHS contract worth £10 million. The total project cost was expected to be £4 million (making your opportunity cost £6 million) and you have already invested £3 million when the NHS pulls the plug on the deal. You are however offered a contract worth £3 million by a pharmaceutical company. What do you do?


Managing an organisation's budget is a bit like being a fighter pilot – you can't afford to dwell on past mistakes. You may have made a massive mistake in getting to where you are but you need to decide how to move forward. At this point in time your choice is either to stop now and lose £3 million or accept the new contract and invest a further £1 million thus reducing your overall loss at the end of the project to £1 million.


Planning in the real world

Much the same goes for creating real world plans. In planning, perhaps more than in any other project activity, we tend to exhibit an optimism that verges on delusion. After all when was the last time you had a good surprise in a project? Time and time again we see planned deadlines based on an absolute best-case scenario.

A common scenario is that the absolute deadline is set before any scoping work is done. Very often you will be told there is a budget of X for you to deliver by Y then you are left to go away and work out how it can be done. Don't accept this – ask to see the analysis. If you accept the aspiration at this point this is effectively your 'point of commitment'. If you later deliver to more realistic estimates you will be seen as a failure.

Reactive project managers react to 'bad luck'. 'The plan was fine but we kept getting nasty surprises'. This is indicative of a fragile baseline plan that didn't take account of the risks. Proactive project managers create a robust and resilient plan by identifying and planning for risk.

The role of the project manager is to deliver against the plan so it is essential that the baseline, against which you will be judged, is realistic. Again the concept of risk and opportunity management is an important one.

To take another example let's say you have a 40 week plan and have identified a risk that is 80% likely to occur and will delay the project by 10 weeks. What do you do?

The answer is that you must build that delay into the plan. If it is 80% likely you are saying it is almost certain to occur so it would be totally unrealistic to plan as if it would never happen. What you end up with is a 50 week plan and you are giving yourself a 20% opportunity to improve on the baseline. Our organisations are becoming more aware of risk but we are still poor at creating processes to deal with opportunity.

Plans are of course based on estimates. We cover the topic of estimating in our project management guide but it is worth saying a little bit about it here just to draw out the relationship to risk. One way of looking at uncertain tasks is to use three-point estimates. For each uncertain task you estimate:

  • The most optimistic timescale = MO
  • The most likely timescale = ML and
  • The most pessimistic timescale = MP

People using project management software often use this approach. The software can calculate the standard deviation of each of the estimates to show the relative uncertainty in the overall plan. This allows you to come up with statistical confidence limits e.g. you can be 50% certain that the project can finish within 100 days and 85% confident that the project can finish within 130 days etc.

This is not something you are likely to do manually but the concept of three-point estimates can be helpful in identifying bias in team members' estimates. If you ask a range of people how long various tasks will take they may all give different answers. If you then go back and ask for three-point estimates you may be able to tell who consistently goes for the most optimistic figure and who always 'pads' their estimates.

Another feature of many software tools is the ability to run Monte Carlo simulations. This uses three-point estimates for each of the tasks in a plan and assigns a random number of days to each task from within the given distribution. This is then repeated many times. Say a task has values of:

MO = 2

ML = 4

MP = 6

The simulation may estimate three days in the first pass, then four days, then two days, the six days etc, etc. The numbers generated are random but based on the distribution of the actual estimates. Running the model many times gives you an indication of how long the project may take in the real world. What is interesting about such simulations is that the answer equates to the most likely schedule (ML) for the overall project only about one time in 20.

Let's look at why this is:

Say we have tasks A, B and C that are all predecessors to task D. The chances of A, B or C meeting their ML estimate are 50% (one in two) in each case but when we look at the chances of them all being on time to feed into D the figure goes down to 12.5% (1 in 8).


The aim of this is not to encourage you to throw in the towel right now but simply to highlight the issue of overall uncertainty in the plan. The answer to this isn't to 'pad' every task with additional time but once again to allow an overall contingency to be used when required. You also need to be aware that the critical path through your project may change depending in which, if any, of the identified risks occur.