Risk Management

It's time to get down to hard facts now – risks cost money and we need to be able to plan for this and set realistic budgets. We introduce a little bit of accounting jargon in this section but it contains some useful ideas that could save your career.

In the education environment it is often the case that time delays are viewed less seriously than obvious cost increases. It is of course possible to put a cost figure on a time delay simply by calculating the cost of staff working on the project for the extra time.

The argument that 'We have the staff anyway' retains little credibility these days. If the time delay was unacceptable you may also need to think about the cost of overtime or extra staff to get the project back on track.

Let's look at an example of how this might affect project cost. Say you have a project budget of £10k and the project is due to last 10 weeks. Just to keep things simple we'll say that the only cost of this project to the organisation is staff time amounting to £1k per week. Suppose there is a 50/50 chance of a risk occurring that will delay your project by two weeks. What will this project cost?

The answer is that it will cost either £10k or £12k and if you aren't ready to spend £12k then you aren't ready to do the project.

Expected Monetary Value (EMV)

An accountant may give a slightly different answer to the previous question by looking at the 'actuarial' cost of the project using the Expected Monetary Value (EMV) of the risk. EMV is a mathematical formula that can help make comparisons between a range of uncertain outcomes.

EMV = probability x outcome

For example a risk has a 75% chance of occurring and may cost £1k.

The EMV of the risk is 0.75 x £1,000 = £750

Using the concept of EMV for comparative purposes, suppose someone were to offer you two envelopes. Envelope A contains £1,000 and envelope B has a 50/50 chance of containing £2,500. Which would you choose?

Looking at the EMV of each:

A is 100% certain so has a probability of 1 therefore, EMV (A) = 1 x £1,000 = £1,000

B has only a 50% chance of occurring therefore, EMV (B) = 0.5 x £2,500 = £1,250

In theory you should take envelope B as the EMV is higher. In practice your decision will depend on how badly you need the £1,000 and whether you are prepared to take a gamble. This goes back to the concept of utility we discussed earlier.

Going back to our earlier example of the 10 week project, an accountant might say the expected cost of the project was Project budget + EMV of risk.

Hence the project would cost £10k (project budget) plus (0.5 x £2,000 = £1,000) (EMV) i.e. a total of £11k.

This is fine in theory but in practice, if the risk occurred and you had a budget of £11k, you still wouldn't have enough to meet the cost of the risk.

Spending to save

The concept of EMV becomes more useful when you consider the fact that you could spend some money to remove the risk. Suppose the risk is that another organisation is supplying you with some data but they can't guarantee to deliver on time.

Let's say you could pay that organisation £500 and they would guarantee to deliver. You would now need a budget of £10.5k which would save you £500 on the actuarial cost of the project and £1.5k on the potential cost if you did nothing about the risk. This is about spending to save.

You do of course need to be confident in your assessment that the risk is 50% likely and will cause a 2 week delay in order to justify the spend. If you've gone through a generic risk checklist and just ticked off 'low, medium, high' you won't be able to do this. If you've done a thorough analysis of the real risks to your project you will be well equipped to set a budget that is realistic and justifiable.

To take another example suppose you have identified a risk (75% likely) that your key technical person will leave because you aren't paying market rates. This could cause a three-month delay whilst you recruit to the post and will incur recruitment costs and cost in terms of decreased productivity and delay to the project.

Offering the person a bonus to stay till the end of the project or offering staff development incentives eg, an expensive training course or conference could be cost effective in the long run. In order to justify this you will have to cost the consequential impact of the risk.

Calculating contingency

The concepts of EMV and actuarial cost really come into their own when you start to plan for the risks that fall into your green or acceptable category. You won't have a detailed response plan for each of the individual risks but you will need a contingency sum set aside to deal with those risks that do occur.

Suppose you have 10 green risks identified and each is 50% likely to occur and each will cost £2k if it does occur:

The EMV of each risk = 0.5 x £2,000 = £1k so the total for 10 risks = £10k

The project needs a contingency of £10k to cover these risks.

Of course EMV doesn't equal reality what it is saying is that half of the time you will need £2k per risk and the other half won't occur. Looked at another way the £10k contingency will only be enough to cover costs half of the time. You can be 50% confident that the project can cover its risks.

Contingency for high impact risks

Let's look at another example. Suppose you have a risk that is only 5% likely to occur but if it does it will cost you £250k:

EMV = 0.05 x £250,000 = £12,500

It is pointless having £12.5k in your contingency if this risk actually occurs. A risk with this level of impact would have to be viewed individually and the necessary contingency would need to exist at the organisational, rather than project, level.

At the risk of stating the obvious, averages only work with a range of numbers. EMV is useful for looking at groups of similar risks. EMV doesn't make sense if you are looking at a single risk with high impact or probability.

Contingency for high probability risks

Let's say you have 5 risks each with an 80% probability of occurring and they will each cost you £4k:

EMV = 5 x 0.8 x £4,000 = £16k

Rather than ask for the £16k EMV you should ask for the full £20k that is needed should all of the risks occur. With a probability of 80% you are saying that it is much more likely than not that the risks will occur – so plan for them. What this is really giving you is an opportunity to make savings against a realistic budget. If only 3 of the risks occur you will have saved £8k.

In summary actuarial cost based on the EMV of groups of similar risks can give you a guide as to how much contingency a project requires. Not all of the risks will occur but the contingency should cover those that do. Special arrangements will need to be made where a single risk could have a very high impact. Unless the probability of such a risk is very low it may undermine the business case for the project.

This technique can also be useful in helping you plan your budget when you are bidding for a research or other contract. Contingency is not a 'slush fund' or 'padding' to cover for poor project management: it should be justifiable and reviewable. The contingency is there for specific risks and should only be released if a risk occurs. The project steering board or its equivalent should authorise the release of contingency funds.

Budgeting in the real world

Having calculated the cost of both red and green risks the project budget can be seen to be made up of:

A project with all of these elements in the budget is funded to survive in the real world. If the project manager only gets A then the organisation is accepting the possibility that it will ultimately meet the full cost of all the unfactored risks. (NB. Factored risk exposure is the estimate based on average EMV. Unfactored risk exposure is the worst-case scenario if all the risks happen). This isn't just theory it's the real world.

Failure to include risk response costs and contingency for risk in the project budget is a failing at the most senior level. This spend always occurs but in immature organisations it is either invisible or appears as project overspend.

It is usually the case that spending money up front to address the risks results in lower overall cost. However many organisations can't cope with spending money now to save in future and simply take their chances when the risks occur.

You can see from this that a lot of work has to go into setting a realistic budget. You can't work it out on the back of an envelope ten minutes after you've been given a rough brief. You may be able to give an indicative budget at an early stage when the business case for the project is being considered but there is much more work to be done as part of the project initiation before a detailed budget can be prepared.

At this stage you may need to revisit the business case if analysis shows the project to be riskier and more costly than first thought.