Practical Project Risk Management, Third Edition: The ATOM Methodology
384
Practical Project Risk Management, Third Edition: The ATOM Methodology
384Paperback
-
SHIP THIS ITEMIn stock. Ships in 6-10 days.PICK UP IN STORE
Your local store may have stock of this item.
Available within 2 business hours
Related collections and offers
Overview
Product Details
| ISBN-13: | 9781523089208 |
|---|---|
| Publisher: | Berrett-Koehler Publishers |
| Publication date: | 11/03/2020 |
| Pages: | 384 |
| Product dimensions: | 7.06(w) x 10.00(h) x 0.75(d) |
About the Author
Peter Simon, BSc, PMP, FAPM, is a Director of Lucidus Consulting Ltd. He has more than 30 years of experience as a project and program management consultant and practitioner across all industries and business sectors. He is a Visiting Fellow at Cranfield School of Management and an Adjunct Professor at ESCP Business School – London.
Read an Excerpt
Practical Project Risk Management
The ATOM Methodology
By David Hillson, Peter Simon
Management Concepts Press
Copyright © 2012 Management Concepts, Inc.All rights reserved.
ISBN: 978-1-56726-366-4
CHAPTER 1
The Challenge of Managing Risk
Few would disagree that life is risky. Indeed, for many people it is precisely the element of risk that makes life interesting. However, unmanaged risk is dangerous because it can lead to unforeseen outcomes. This fact has led to the recognition that risk management is essential, whether in business, projects, or everyday life. But somehow risks just keep happening. Risk management apparently does not work, at least not in the way it should. This book addresses this problem by providing a simple method for effective risk management. The target is management of risks on projects, although many of the techniques outlined here are equally applicable to managing other forms of risk, including business risk, strategic risk, and even personal risk.
The book is divided into three parts, starting with defining the problem in an effort to understand the underlying reasons for the apparent failure of project risk management to deliver the promised or expected benefits. The main body of the book describes a generic risk management process applicable to most projects, focusing on simple guidelines to make risk management work in practice. Finally, the book considers implementation issues, applying the risk management process to different types of projects, and addressing the steps necessary to use risk management effectively.
But before considering the details of the risk management process, there are some essential ideas that must be understood and clarified. For example, what exactly is meant by the word risk?
Risk — The Definition Debate
Some may be surprised that there is any question to be answered here. After all, the word risk can be found in any English dictionary, and surely everyone knows what it means. But in recent years risk practitioners and professionals have been engaged in an active and controversial debate about the precise scope of the word.
Everyone agrees that risk arises from uncertainty, and that risk is about the impact that uncertain events or circumstances could have on the achievement of goals. This agreement has led to definitions combining two elements of uncertainty and objectives, such as, "A risk is any uncertainty that, if it occurs, would have an effect on achievement of one or more objectives." Traditionally risk has been perceived as bad; the emphasis has been on the potential effects of risk as harmful, adverse, negative, and unwelcome. In fact, the word risk has been considered synonymous with threat. But this is not the only perspective.
Obviously some uncertainties could be helpful if they occurred. These uncertainties have the same characteristics as threat risks (i.e., they arise from the effect of uncertainty on achievement of objectives), but the potential effects, if they were to occur, would be beneficial, positive, and welcome. When used in this way, risk becomes synonymous with opportunity.
Risk practitioners are divided into three camps around this debate, as illustrated by Figure 1-1.
One group insists that the traditional approach must be upheld, reserving the word risk for bad things that might happen. This group recognizes that opportunities also exist, but sees them as separate from risks, to be treated differently using a distinct process (row a).
A second group believes that there are benefits from treating threats and opportunities together, broadening the definition of risk and the scope of the risk management process to handle both (row b).
A third group seems unconcerned about definitions, words, and jargon, preferring to focus on "doing the job." This group emphasizes the need to deal with all types of uncertainty without worrying about which labels to use (row c).
While this debate remains unresolved, clear trends are emerging. The majority of official risk management standards and guidelines use a broadened definition of risk, including both upside opportunities and downside threats. Some leading procedural standards, such as A Guide to the Project Management Body of Knowledge (PMBOK® Guide) from the Project Management Institute, and the Association for Project Management's Project Risk Analysis and Management (PRAM) Guide, also reflect this wider definition in their risk management processes, with tools and techniques to identify, assess, and manage both opportunities and threats. Following this trend, increasing numbers of organizations are widening the scope of their risk management approach to address uncertainties with positive upside impacts as well as those with negative downside effects.
Given the increasing popularity of the wider application of risk management to both threats and opportunities, as well as the attraction of using a single process to deal with two related concerns, this book adopts the inclusive position. Using a common process to manage both threats and opportunities has many benefits, including:
• Maximum efficiency, with no need to develop, introduce, and maintain a separate opportunity management process
• Cost-effectiveness (double "bangs per buck") from using a single process to achieve proactive management of both threats and opportunities, resulting in avoidance or minimization of problems, and exploitation and maximization of benefits
• Familiar techniques, requiring only minor changes to current techniques for managing threats so organizations can deal with opportunities
• Minimal additional training, because the common process uses familiar processes, tools, and techniques
• Proactive opportunity management, so that opportunities that might have been missed can be addressed
• More realistic contingency management, by including potential upside impacts as well as the downside, taking account of both "overs and unders"
• Increased team motivation, by encouraging people to think creatively about ways to work better, simpler, faster, more effectively, etc.
• Improved chances of project success, because opportunities are identified and captured, producing benefits for the project that might otherwise have been overlooked.
Having discussed what a risk is ("any uncertainty that, if it occurs, would have a positive or negative effect on achievement of one or more objectives"), it is also important to clarify what risk is not. Effective risk management must focus on risks and not be distracted by other related issues. A number of other elements are often confused with risks but must be treated separately, such as:
• Issues. This term can be used in several different ways. Sometimes it refers to matters of concern that are insufficiently defined or characterized to be treated as risks. In this case an issue is more vague than a risk, and may describe an area (such as requirement volatility, resource availability, or weather conditions) from which specific risks might arise. The term issue is also used (particularly in the United Kingdom) as something that has occurred but cannot be addressed by the project manager without escalation. In this sense an issue may be the result of a risk that has happened, and is usually negative.
• Problems. A problem is also a risk whose time has come. Unlike a risk that is a potential future event, there is no uncertainty about a problem — it exists now and must be addressed immediately. Problems can be distinguished from issues because issues require escalation, whereas problems can be addressed by the project manager within the project.
• Causes. Many people confuse causes of risk with risks themselves. The cause, however, describes existing conditions that might give rise to risks. For example, there is no uncertainty about the statement, "We have never done a project like this before," so it cannot be a risk. But this statement could result in a number of risks that must be identified and managed.
• Effects. Similar confusion exists about effects, which in fact only occur as the result of risks that have happened. To say, "The project might be late," does not describe a risk, but what would happen if one or more risks occurred. The effect might arise in the future (i.e., it is not a current problem), but its existence depends on whether the related risk occurs.
Using Risk Management on Projects
The widespread occurrence of risk in life, business, and projects has encouraged proactive attempts to manage risk and its effects. History as far back as Noah's Ark, the pyramids of Egypt, and the Herodian Temple shows evidence of planning techniques that include contingency for unforeseen events. Modern concepts of probability arose in the 17th century from pioneering work by Pascal and his contemporaries, leading to an improved understanding of the nature of risk and a more structured approach to its management.
Without covering the historical application of risk management in detail here, clearly those responsible for major projects have always recognized the potentially disruptive influence of uncertainty, and they have sought to minimize its effect on achievement of project objectives. Recently, risk management has become an accepted part of project management, included as one of the key knowledge areas in the various bodies of project management knowledge and as one of the expected competencies of project management practitioners.
Unfortunately, embedding risk management within project management leads some to consider it as "just another project management technique," with the implication that its use is optional, and appropriate only for large, complex, or innovative projects. Others view risk management as the latest transient management fad. These attitudes often result in risk management being applied without full commitment or attention, and are at least partly responsible for the failure of risk management to deliver the promised benefits.
To be fully effective, risk management must be closely integrated into the overall project management process. It must not be seen as optional, or applied sporadically only on particular projects. Risk management must be built in, not bolted on if it is to assist organizations in achieving their objectives.
Built-in risk management has two key characteristics:
• First, project management decisions are made with an understanding of the risks involved. This understanding includes the full range of project management activities, such as scope definition, pricing/budgeting, value management, scheduling, resourcing, cost estimating, quality management, change control, and post-project review. These must take full account of the risks affecting the project, giving the project a risk-based plan with the best likelihood of being met.
• Secondly, the risk management process must be integrated with other project management processes. Not only must these processes use risk data, but there should also be a seamless interface across process boundaries. This has implications for the project toolset and infrastructure, as well as for project procedures.
Benefits of Effective Risk Management
Risk management implemented holistically, as a fully integral part of the project management process, should deliver benefits. Empirical research by Terry Cooke-Davies, gathering project performance data from benchmarking networks of major organizations across a variety of industries, shows that risk management is the single most influential factor in project success. Where risk management is well implemented, more projects meet their objectives (using a composite performance measure for schedule and cost, projects in organizations reporting "fully adequate" risk management completed on average at 95 percent of plan). Where risk management is poor, projects fail more often (projects where risk management was rated "not at all adequate" averaged 170 percent of plan). These conclusions are based on detailed examination of characteristics describing risk management approach and deployment. Figure 1-2 presents typical data (in this case for documenting organizational risk management responsibilities in the project).
Unfortunately, despite indications that risk management is very influential in project success, the same research found that risk management is the lowest scoring of all project management techniques in terms of effective deployment and use, suggesting that although many organizations recognize that risk management matters, they are not implementing it effectively. As a result, projects still fail, businesses still struggle, too many foreseeable downside threat-risks turn into real issues or problems, and too many achievable upside opportunity-risks are missed.
There is clearly nothing wrong with risk management in principle. The concepts are clear, the process is well defined, proven techniques exist, tools are widely available to support the process, and there are many training courses to develop risk management knowledge and skills. So where is the problem? If it is not in the theory of risk management, it must be in the practice. Despite the huge promise held out by risk management to increase the likelihood of project and business success by allowing uncertainty and its effects to be managed proactively, the reality is different.
The problem is not a lack of understanding the "why, what, who, or when" of risk management. Lack of effectiveness comes most often from not knowing "how to." Project managers and their teams face a bewildering array of risk management standards, procedures, techniques, tools, books, training courses — all claiming to make risk management work — which raises the questions: How to do it? Which method to follow? Which techniques to use? Which supporting tools?
The main aim of this book is to offer clear guidance on "how to" do risk management in practice. The next chapter discusses common barriers to risk management effectiveness and introduces a number of Critical Success Factors to overcome these barriers. This leads into Chapter 3, which outlines Active Threat and Opportunity Management (ATOM) — a generic risk management methodology, applicable to any type of project of any size in any industry. Implementation of ATOM for the typical project is described in Part II, where each step in the risk process is presented with sufficient detail to make implementation as easy as possible without oversimplifying. Techniques are explained step by step, with underlying theory where appropriate and relevant, and useful templates are contained in two appendices.
Of course not all projects are typical, so ATOM is scalable to fit both the simple and the more complex project. Part III of this book explains how to tailor the generic risk process to both small and large projects to ensure that the process meets the specific risk challenge, as well as discussing how ATOM for projects interfaces with the wider program context.
Undoubtedly risk management has much to offer to both businesses and projects. People following the approach in this book will discover how to capture those promises for themselves, their projects, and their business.
CHAPTER 2Making It Work
Risk management is too important to be left to chance. For risk management to work it must be applied consistently, and this is best achieved using a structured or formal approach that requires a number of components to be in place, including:
• A supportive organization
• Competent people
• Appropriate supporting infrastructure
• A simple to use, scalable, and documented process.
These factors, which are discussed later in this chapter, are often referred to as Critical Success Factors (CSFs), for two reasons:
1. Their absence leads to a failure of risk management to deliver the full benefit to the organization.
2. Their presence increases the chances of risk management being effective and successful.
Putting Critical Success Factors in place may sound simple to achieve, but in practice making risk management work is a real challenge. This chapter explores some of the main reasons for this — not to be negative but to provide possible ways to counteract the most common reasons. Forewarned is forearmed.
(Continues...)
Excerpted from Practical Project Risk Management by David Hillson, Peter Simon. Copyright © 2012 Management Concepts, Inc.. Excerpted by permission of Management Concepts Press.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.
Table of Contents
Foreword to the Third Edition ix
Author's Preface xi
Part I The Problem
1 The Challenge of Managing Risk 3
Risk-The Definition Debate 3
Clarifying Some Confusions 6
Using Risk Management on Projects 7
Benefits of Effective Risk Management 8
2 Making It Work 12
Why Don't We Do It? 14
Turning Negatives into Positives 17
Four Difficult Challenges 20
The Critical Success Factors for Risk Management 21
Conclusion 26
3 Active Threat and Opportunity Management-The ATOM
Risk Process 27
Introducing ATOM 28
Project Sizing 31
ATOM for the Medium-Sized Project 35
Comparison to Existing Standards 37
Conclusion 41
Part II Applying ATOM to a Medium-Sized Project
4 Start at the Beginning (Initiation) 45
Inputs 47
Activities 47
Outputs 61
Summary 64
5 Exposing the Challenge (Identification) 65
Inputs 68
Activities 68
Outputs 77
Summary 77
6 Understand the Exposure (Assessment) 78
Inputs 80
Activities 81
Outputs 89
Summary 91
7 Options and Actions (Response Planning) 92
Inputs 94
Activities 95
Outputs 101
Summary 101
8 Spread the Word (Reporting) 103
Inputs 104
Activities 105
Outputs 106
Summary 108
9 Just Do It (Implementation) 110
Inputs 111
Activities 112
Outputs 116
Summary 116
10 Keep It Alive (Major Reviews) 117
Inputs 120
Activities 120
Outputs 125
Summary 126
11 Ongoing Updates (Minor Reviews) 127
Inputs 128
Activities 129
Outputs 132
Summary 134
12 Learn from Experience (Post-Project Review) 135
Inputs 137
Activities 138
Outputs 141
Summary 142
Part III Variations on a Theme
13 ATOM for Small Projects 145
Less Is More 145
Initiation 146
Identification 150
Assessment 152
Response Planning 153
Reporting 155
Implementation 157
Review 158
Post-Project Review 159
Conclusion 159
14 ATOM for Large Projects 161
Bigger Is Better 162
Initiation 162
Identification 166
Assessment 171
Response Planning 175
Reporting 178
Implementation 181
Review 181
Post-Project Review 183
Conclusion 185
15 Simulating Possible Futures (Quantitative Risk Analysis) 186
Introducing Quantitative Risk Analysis Using
Monte Carlo Simulation 188
Quantitative Risk Analysis in the Project Life Cycle 189
Quantitative Risk Analysis in the ATOM Process 190
Getting Started 190
Analysis 200
Interpreting Outputs 203
Using Results 205
Conclusion 209
16 The ATOM Risk Workshop 210
Variants on the ATOM Risk Workshop 210
Assessment of Probability and Impacts during the Assessment Step 215
Conclusion 218
17 Facilitation in the ATOM Risk Management Process 219
The Facilitation Spectrum 220
People Skills 224
Critical Success Factors for Risk Facilitation 227
Conclusion 228
18 Managing Risk in Programs and Portfolios 229
Aim and Scope of Program and Portfolio Risk Management 230
Managing Risk in Programs and Portfolios 232
Remaining Challenges and the Way Ahead 236
Epilogue: Next Steps 238
Step 1 Appoint an Organizational Risk Sponsor 238
Step 2 Tailor the ATOM Process 238
Step 3 Pilot Application 240
Step 4 Modify Process (If Required) 241
Step 5 Develop Infrastructure 241
Step 6 Train Staff 242
Step 7 Assess Existing Risk Management Capability 242
Step 8 Implementation and Rollout 243
Step 9 Reassess Capability and Refresh Process 243
Conclusion 244
Appendix: Templates and Examples 245
Glossary of Terms and Abbreviations 267
References and Further Reading 275
Acknowledgments 279
Index 281
About the Authors 287