Project Risk Analysis and Management: Mini Guide
Project Risk Analysis and Management: Mini Guide
2. What is PRAM?
In this guide, the term ‘PRAM’ encompasses processes, techniques and methods that
“Dealing with risks in projects is enables the analysis and management of the risks associated with a project. Properly
different from situations where undertaken, it will increase the likelihood of successful completion of a project to cost,
there is sufficient data to adopt time and performance objectives.
an actuarial approach”
Risk has two aspects: downside risk or threats, which if they occurred would adversely
affect project objectives, and upside risk or opportunities, which if pursued would
positively affect the project objectives. This guide focuses on the downside threats, which
for the sake of brevity of this guide are called risks. The threats and opportunities are
discussed in more detail in the APM PRAM Guide.
Risks for which there is ample data can be assessed statistically. However, no two projects
are the same. Often things go wrong for reasons unique to a particular project, industry or
working environment. Dealing with risks in projects is therefore different from situations
where there is sufficient data to adopt an actuarial approach. Because projects invariably
involve a strong technical, engineering, innovative or strategic content, a systematic
process has proven preferable to an intuitive approach. PRAM has been developed to
meet this requirement.
1
PRAM published by APM, ISBN 978-1-903494-12-7
Risk analysis
This stage of the process is generally split into two ‘sub-stages’: a qualitative analysis ‘sub-
stage’ that focuses on identification and subjective assessment of risks, and a quantitative
analysis ‘sub-stage’ that focuses on an objective assessment of the risks.
Qualitative analysis
A qualitative analysis allows the main risk sources or factors to be identified. This can be
“A sound aim is to identify the key done, for example, with the aid of checklists, interviews or brainstorming sessions. This
risks, which are then analysed is usually associated with some form of assessment that could be the description of each
and managed in more detail”
risk and its impacts or a subjective labelling of each risk (for example, high/low) in terms of
both its impact and its probability of occurrence.
A sound aim is to identify the key risks, perhaps between five and 10, for each project (or
part-project on large projects), which are then analysed and managed in more detail.
INITIATE
IDENTIFY
MANAGE PROCESS
ASSESS
PLAN RESPONSES
IMPLEMENT RESPONSES
Quantitative analysis
A quantitative analysis often involves more sophisticated techniques, usually
“An initial qualitative analysis is requiring computer software. To some people, this is the most formal aspect of
essential. It brings considerable
the whole process requiring:
benefit in terms of understanding
the project and its problems” n measurement of uncertainty in cost and time estimates;
n probabilistic combination of individual uncertainties.
Such techniques can be applied with varying levels of effort ranging from modest to
extensively thorough. It is recommended that new practitioners start slowly, perhaps
even ignoring this ‘sub-stage’, until a climate of acceptability has been developed for
project risk analysis and management in the organisation.
An initial qualitative analysis is essential. It brings considerable benefit in terms of
understanding the project and its problems irrespective of whether or not a quantitative
analysis is carried out. It may also serve to highlight possibilities for risk ‘closure’, ie the
development of a specific plan to deal with a specific risk issue.
Experience has shown that qualitative analysis – identifying and assessing risks – usually
leads to an initial, if simple, level of quantitative analysis. If, for any reason – such as time
or resource pressure or cost constraints – both a qualitative and quantitative analysis are
impossible, it is the qualitative analysis that should remain.
It should be noted that procedures for decision-making would need to be modified if risk
analysis is adopted. An example that illustrates this point is the sanction decision for clients,
where estimates of cost and time will be produced in the form of ranges and associated
probabilities rather than single value figures.
Benefits
The benefits gained from using PRAM techniques and methods serve not only the project,
“The benefits gained from but also other parties, such as the organisation and its stakeholders. Some examples of the
using PRAM techniques and
main benefits are:
methods serve not only the
project, but also other parties” n project risks can be actively managed to enhance the performance of the project against
its key objectives;
n an independent view of the project risks, which can help to justify decisions and enable
more efficient and effective management of the risks;
n an increased understanding of the project, which in turn leads to the formulation of
more realistic plans, in terms of both cost estimates and timescales;
n an increased understanding of the risks in a project and their possible impact that can
lead to the minimisation of risks for a party and/or the allocation of risks to the party best
able to handle them;
n an understanding of how risks in a project can lead to the use of a more suitable type
of contract;
n knowledge of the risks in a project, which allows assessment of contingencies that
actually reflect the risks and which also tends to discourage the acceptance of financially
unsound projects;
n a contribution to the build-up of statistical information of historical risks that will assist in
better modelling of future projects;
n facilitation of greater, but more rational, risk taking, thus increasing the benefits that can
be gained from risk taking;
n assistance with the distinction between good luck and good management, and bad luck
and bad management.
Time
The time taken to carry out a risk analysis is partially dependent upon the availability of
“A detailed cost and time information. A detailed cost and time risk analysis usually requires anywhere from one
risk analysis usually requires to three months depending on the scale and complexity of the project, and the extent of
anywhere from one to planning and cost preparation already carried out. However, as indicated above, a useful
three months”
analysis can take as little as one or two days.
Resources
The minimum resource requirement is obviously just one person within an organisation
with experience of using PRAM techniques. However, if expertise does not exist within
the organisation, it can be readily acquired from outside consultants. It is likely that once
PRAM has been introduced to an organisation, in-house expertise will develop rapidly.
As stated in Section 3, PRAM is relevant to all projects and is an integral part of project
management. This can make it very difficult to separate the costs of performing it. Some
organisations treat these costs as an overhead to the organisation, and not to the project.
10
11
All of the above methods are greatly enhanced by the use of checklists, which can
either be generic in nature, ie applicable to any project or specific to the type of project
being analysed.
Probability scale
Probability ratings Ranking index values
values
Almost Certain 5 5 10 20 40 80
Likely 4 4 8 16 32 64
Possible 3 3 6 12 24 48
Unlikely 2 2 4 8 16 32
Rare 1 1 2 4 8 16
12
Initial responses should be planned for risks that have been assessed as high relative
“A secondary risk may result significance and/or require urgent attention. The analysis may be terminated during this
from a planned response to a risk
phase if the assessment immediately suggests a way in which many identified risks can
and might therefore lead to the
be mitigated.
response being unsuccessful”
It may be necessary to revisit the identification phase after the assessment phase to see if
any consequential ‘secondary’ risks can be identified: a secondary risk may result from a
planned response to a risk and might therefore lead to the response being unsuccessful.
The necessity of doing this will largely be dependent on the size and/or complexity of
the project.
Planned responses should be reviewed for cost-effectiveness and, once approved, should
be included in the project schedule.
13
100
% Change in IRR
50
0 x x x x x x x x
-50
-100
-40% -20% 0% 20% 40%
% Change in Variables
Demand for product Cost of raw materials
Revenue from product x Energy costs
n Probabilistic analysis specifies a probability distribution for each risk and then considers
the effect of risks in combination. This is perhaps the most common method of
performing a quantitative risk analysis and is the one most people consider, incorrectly,
to be synonymous with the whole PRAM process. In fact, as this guide illustrates, it is
but one facet of that process.
The most common form of probabilistic analysis uses ‘sampling techniques’, usually
referred to as ‘Monte Carlo simulation’. This method relies on the random calculation of
values that fall within a specified probability distribution often described by using three
estimates: minimum or optimistic, mean or most likely, and maximum or pessimistic. The
overall outcome for the project is derived by the combination of values selected for each
one of the risks. The calculation is repeated a number of times, typically 1,500 depending
on the capabilities of the sampling software and organisational preferences, to obtain the
probability distribution of the project outcome.
It is usual to carry out a probabilistic time analysis with the aid of a critical path method
(CPM) network to model the project schedule. The results of the simulation can be used to
compare the effects of risks in a schedule with the qualitative assessment of the risks. For
example, a risk with a high impact on a task that is not on the critical path may be treated
ahead of a risk with a relatively low impact that is impacting on a critical path item.
14
The tornado chart can also be used to evaluate the cost-effectiveness of planned responses
by comparing the assessed effect of risks with the planned effect together with the cost of
the planned responses.
The same method can be used for probabilistic cost analysis, especially when the cost
“If an independent cost estimate can be broken down into the same categories or activities as the schedule and
analysis is undertaken, then when cost risks are related to time risks. If an independent cost analysis is undertaken, then
it may be appropriate to use
it may be appropriate to use a spreadsheet method. Figure 5 (page 16) shows an example
a spreadsheet method”
of a histogram and cumulative curve derived from a probabilistic time analysis using a
model based on a CPM network.
15
5 100
Based on 100 trials
Mean = 29 Jun 90
Standard deviation = 25 days
4 Each bar represents 3 days 80
% Cumulative
% Frequency
3 60
2 20
1 10
0 0
31 Mar 90 30 Apr90 31 May 90 29 Jun 90 29 Jul 90 28 Aug 90
Period ending
Figure 5. Time probability histogram and s-curve for a new oilfield development
This diagram shows the distribution of finish dates from an example project for the
achievement of first oil. It is based on 1,000 iterations using Monte Carlo sampling.
The actual finish date of this particular project was achieved within two days of the mean.
100%
85% – upper limit £22.1m 70% Confidence interval
80%
60%
54% – expected cost £17.4m
40%
41% – unadjusted cost £16.1m
0%
Unallocated provision
£ Million
Accuracy range
+ve -ve
16
Risk management
Risk management uses the information collected during the risk analysis phase to make
“Risk management uses the decisions on how to improve the probability of the project achieving its cost, time and
information collected during performance objectives. This is done by reducing the risk where it is advantageous to do
the risk analysis phase” so, and monitoring and managing the risk that remains.
The project manager uses the information at his/her disposal to choose between the
feasible responses to risks assessed during the qualitative phase. This may involve
amending the project plans to reduce the risk, for example, moving high-risk activities
off the critical path, developing contingency plans to allow rapid response if certain risks
occur, or setting up monitoring procedures for critical areas in order to get early warning
of risks occurring.
There are three types of response to risk: changing the project scope; proactive response;
and reactive response, which can be described as follows:
n change project scope: an alteration to the project plan such that the risks are avoided;
n proactive response: planned and implemented responses undertaken to reduce the
likelihood of the risk and/or the adverse consequences if the risk materialises;
n reactive response: a provision in the project plan for a course of action that will only
be implemented should the adverse consequences of the identified risk materialise.
17
18
19