Risk Management

What is risk? uncertainty

Risk

Risk uncertainty Risk

uncertainty

“All risks are uncertain, however, not all

uncertainties are risks”
Risk is UNCERTAINTY THAT MATTERS
Uncertainty is everywhere
• Simple observation is enough to persuade us (if we needed it) that life is uncertain

Not all uncertainty matters

❑ If we tried to count the number of uncertainties in the universe, we’d soon give up.
Uncertainty seems to be limitless. Fortunately, most of the uncertainties in the
universe don’t matter to you or to me. We can safely ignore any uncertainty that
would not affect us in any way, whether it happened or not, whether it was true or
imagined, whether it was large or small.
❑ But how do we know which those uncertainties are? What filter can we use to discard
irrelevant uncertainty and leave only uncertainty that matters?

❑ We defi ne what matters through our objectives. Th ese are the things that we are
trying to achieve, by which we measure success or progress. This focus on objectives
allows us to refi ne our area of interest when we are considering uncertainty
Not all uncertainties that matter are bad
• Clearly, we must be concerned about any uncertainty that has the potential to affect
achievement of our objectives negatively. Such as death, damage to reputation,
reduction in market share, fall in share price, overspend, delay, reduced
competitiveness or diminished stakeholder perception.

• However, if we become aware of an uncertainty that would result in a positive

outcome, assisting us to achieve our objectives, then this too would deserve our
attention and action. Uncertainty that might produce savings, reducing timelines,
improve safety records, enhance reputation, raise market share or share price,
increase competitiveness or heighten stakeholder perception are also important.
 What is risk?
HOW DO YOU KNOW WHAT MATTERS?

Risk connects uncertainty with objectives

Risk is the effect of uncertainty on objectives (ISO 31000)

Two-dimensional risk
Risk has two dimensions:

1. Uncertainty

2. Effect on objectives

“probability”

“impact”
Risk is UNCERTAINTY THAT MATTERS
❑ALL RISKS ARE UNCERTAIN, although not all uncertainties are risks.

❑ALL RISKS MATTER. If they occur, risks will have consequences that
make a difference in some way.

ONE OF THE KEY PRINCIPLES discussed above is that not all

uncertainties that matter are bad. If risk is “uncertainty that matters”,
then it automatically follows that not all risks are bad.
What the risk in this picture ?
 What kind of impact?
“IMPACT” assessed against objectives

❑ But what kind of impact “matters”?

❑ Could be either positive or negative

❑ Uncertainty that helps as well as

uncertainty that harms

❑ Both need managing proactively

 What is risk?
Risk an uncertain event or condition that, if it occurs, has a
positive or negative effect on a project's objectives.(PMI)

RISK INCLUDES BOTH OPPORTUNITIES & THREATS

 Steps of Risk Management
Strategic
Define objectives at risk What are we trying to achieve ? Objectives

1. RISK IDENTIFICATION What might affect us ? IDENTIFY RISKS!

2. RISK ASSESSMENT Which are the most important?

3. PLAN RISK RESPONSES What could we do about the risks?

IMPLEMENT RISK RESPONSES DO IT!!

4. RISK MONITORING AND CONTROL Did it work ? What changed?

 1 RISK IDENTIFICATION

❑ Risk identification is the most important stage of the risk management process. If we don’t identify
a risk, we can’t manage it.

Can we identify all risks? NO

How to expose “all” knowable risks?
THERE ARE SEVERAL REASONS FOR THIS:

Time dependence

Action dependence

Risk –response dependence

Stakeholder dependence
 Techniques for Identifying Risks (Threats)

Past –focused techniques Present –focused

Future –focused techniques
techniques
These techniques are based on Here the focus is on the current These techniques harness the
reviewing previous knowledge or business/project, examining its creativity of the team and other
experience, and then comparing characteristics and parameters to stakeholders to imagine what
what happened before with the expose inherent uncertainties, might happen in the future of the
current business/project to find inconsistencies, contradictions, of business/project.
points of similarity or relevance. conflicts.
❑ Checklist ❑ Assumptions analysis ❑ Brainstorming
❑ Industry Knowledge base ❑ Cause and effect Analysis ❑ Interviews
❑ Post- project reviews ❑ Document review ❑ Futures thinking
❑ Lessons –learned database ❑ Group Discussion ❑ Scenario Analysis
❑ Historical Information ❑ Fault tree analysis ❑ Visualization
 2 RISK ASSESSMENT

❑A. Likelihood of the risk occurring: ❑B. Impact of the risk :

Points Likelihood/ Notes Points Impact Notes
Probability
3 LIKELY This is expected to 3 Critical Impact can make a
happen - ie at least 75% significant difference
chance 2 Impact can make a
Major
2 POSSIBLE Quite possible that it will difference
occur - ie at least 50%
chance 1 Minor/ There is an impact but it is
1 REMOTE Just possible it might manageable small or manageable
happen but very
surprising, to extremely
unlikely - ie less than 50%
chance.
 2 RISK ASSESSMENT
❑ASSESS THE LEVEL OF RISK: How serious is it? How likely is it to happen?
❑C. Overall Impact = Risk Score

Likelihood/ Overall
Probability x Impact = Impact

High Risk SCORE = 7 -9

Medium Risks SCORE 4-6

Lower Risks SCORE 1-3

 3 RISK RESPONSE PLANNING
Four Common Risk Response Strategies :

T TAKE- RISK
ACCEPTANCE 1.Eliminate Uncertainty AVOID

R REDUCE- RISK
REDUCTION
2.Transfer Liability/ownership TRANSFER

A AVOID- RISK
AVOIDANCE
3. Reduce to “acceptable” MITIGATE

P PASS- RISK
TRANSFERENCE
4. Control & manage residual ACCEPT

BUT these are only suitable for threats!

 3 RISK RESPONSE PLANNING
RISK RESPONSE STRATEGIES

NEGATIVE IMPACT POSITVE IMPACT

THREATS OPPORTUNITY

AVOID EXPLOIT

TRANSFER SHARE

REDUCE ENHANCE

ACCEPT ACCEPT
 The structure of the risk register

IMPACT (1-3)
(1-3) H, M, L )
PROBABILITY

RISK SCORE
RESPONSE/MITIGATING
RISK NAME/ DESCRIPTION WHO
ACTION

Implementing Partners lack of capacity to implement activities causing a 2 3 6 MITIGATE – Include a budget Project Manager
delay in project activities. for building the capacity of the
partner.
Rain causes a delay in the installation of the latrines. 2 1 6 AVOID – Planning of the latrine Project Manager
building and installation should
be delayed until after the rainy
season.
Insecurity threatens deliveries of the materials required to build the 2 2 4 TRANSFER – Contract Logistics Officer
latrines, delaying the project or requiring procurement from the local transporters to ensure the
market which may compromise the quality. timely deliver of the materials
Turnover in the local government compromises the ability to implement 1 2 2 ACCEPT – monitor and reassess Project Manager
activities because new approvals will be needed. risk
 4
Risk Monitoring and Control Strategy