Risk management is the human activity which integrates recognition of risk, risk assessment, developing strategies to manage it, and mitigation of risk using managerial resources. Notwithstanding the domain of activities where they are conducted, projects often entail risks, and risk management has been widely recognized as a success factor in project management. Following a concept clarification on project risk management, this paper presents a generic list steps in the risk management process. Risk analysis is highlighted. I use expected value analysis for quantitative estimation. I propose to determine risk probability using Fishbone-Ishikawa diagrams and I provide an example that illustrates this theory.risk evaluation, project management, risk management, expected value analysis..

Claudiu-George BOCEAN

English

Research Papers in Economics

245 
 
PROJECT RISK MANAGEMENT PHASES 
CLAUDIU-GEORGE BOCEAN 
 
Claudiu-George BOCEAN, PhD, Lecturer 
University of Craiova 
 
Keywords: risk evaluation, project management, risk management, expected value 
analysis. 
 
Abstract: Risk management is the human activity which integrates recognition of risk, risk 
assessment, developing strategies to manage it, and mitigation of risk using managerial 
resources. Notwithstanding the domain of activities where they are conducted, projects often 
entail risks, and risk management has been widely recognized as a success factor in project 
management. Following a concept clarification on project risk management, this paper presents 
a generic list steps in the risk management process. Risk analysis is highlighted. I use expected 
value analysis for quantitative estimation. I propose to determine risk probability using 
Fishbone-Ishikawa diagrams and I provide an example that illustrates this theory. 
 
1. Introduction 
A major aspect of managing projects is the balancing of objectives and constraints 
involving project time, resources, costs, and work scope. These are four key dimensions 
of any project and for each of these elements there is always the risk of missing defined 
target. 
In project management process the quantification of risk must be based on an 
assessment of risk in a similar manner in which the quantification of work is based on a 
project design or a project definition. Assessment of risk has reason to identify areas 
containing high degrees of risk - for instance, those activities associated with new 
research, technical developments. Risk may also be associated with the external 
environment, such as economic conditions, political uncertainties, weather, geography, 
public opinion, or labor-related factors.  
As part of the risk analysis process, it is necessary to identify risks, the probability 
of the risk, and the impact of the risk. As part of the risk mitigation plan, it is necessary 
to identify actions that can be taken to avoid or minimize risks (or the negative effects 
of risks). 
Risk avoidance and minimization assume identification of alternatives and decision 
points (when to consider implementing the alternatives). In many cases, rather than 
allowing for each individual risk, project managers gather risks into natural groups, for 
which they then provide for a collective contingency. These contingencies may involve 
time, resources, money, and even the scope of work. The amount of contingency will 
depend on the degree of risk and the penalties for missing targets. 
Consequently, risk management of a project includes four main activities:  
• Risk identification 
• Risk analysis 
• Risk minimization plans 
• Contingency plans and reserves 
Before applying risk management procedures, many organizations produce a Risk 
Management Plan. This is a document produced at the start of the project which sets 246 
out the strategic requirements for risk assessment and the whole risk management 
procedure. The main contents of a Risk Management Plan are as follows: 
¾  General introduction explaining the need for the risk management process; 
¾  Project description. Only required if it is a stand-alone document and not part 
of the PMP; 
¾  Types of risks. Political, technical, financial, environmental, security, safety, 
program etc.; 
¾  Risk processes. Qualitative and/or quantitative methods; 
¾  Tools and techniques. Risk identification methods, expected value analysis 
computer analysis etc.; 
¾  Risk reports. Updating periods of Risk Register, exception reports, change 
reports etc.; 
¾  Attachments. Important project requirements, dangers, exceptional problems 
etc. 
2. Risk Identification 
Many aspects of projects are unpredictable, despite of best efforts to nail them 
down. Some of the most common areas of uncertainty in project management process 
are:  
o  Scope, 
o  Time, 
o  Cost, 
o  Technology, 
o  Customer expectations, 
o  Resources, 
o  Organizational culture, 
o  Outside Factors. 
From these sources of uncertainty springs risks. There are recommended a 
checklist to help stimulate thinking about potential problems. When manager meet with 
the team he would use this checklist to pass in review as many potential risks as he can, 
practicing brainstorming techniques. 
Each element of a project is assessed for risk, based on the following: 
• Status of technology being utilized, 
• Status of planning, 
• Status of the design (project stage). 
Risk is higher when new or unproven technologies are required. Greater 
uncertainty is also expected when all aspects of a task or project element are not yet 
planned in detail.  
Finally, risk is generally higher during the early stages of a project or task than 
when nearing completion. 
3. Risk Analysis 
In this phase manager shall identify the problems that threaten organization the 
most and therefore demand attention. 
There are a number of methods for shortening the list. One of the most common 
and straightforward consists of making qualitative judgments about two characteristics 
of potential problems probability and impact. Probability is the likelihood that the 
potential problem will occur. Impact is the seriousness of the potential problem in terms 
of the effect on your project. Each risk can then be given a probability rating of HIGH, 
MEDIUM or LOW. In a similar way, by taking into account all the available statistical 247 
data, past project histories and expert opinion, the impact or effect on the project can be 
rated as SEVERE, MEDIUM or LOW. Combining the probability of a risk with impact 
or effect on the project will result gravity of the risk.  
A simple matrix can be drawn up which identifies whether a risk should be taken 
any further. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Fig. 1: Qualitative analysis 
Low 
Severe 
Medium 
Low  Medium  High  
Probability 
I
m
p
a
c
t
 
 
 
Each risk can now be given a risk number, so that it is now possible to draw up a 
simple chart which lists all the risks so far considered. This chart will show the risk 
number, a short description, the risk category, the probability rating, the impact rating 
(in terms of high, medium or low) and the risk owner who is charged with monitoring 
and managing the risk during the life of the project. 
Risk analysis includes a detailed discussion of the risk, including both internal and 
external factors. There are several factors that can influence our response to a risk, 
including but not limited to: 
• Amount and quality of information on the actual hazards that caused the risk 
(descriptive uncertainty); 
• Amount and quality of information on the magnitude of the damage 
(measurement uncertainty); 
• Amount and quality of information on probability of occurrence; 
• Personal benefit to project manager for accepting the risk (voluntary risk); 
• Risk forced upon project manager (involuntary risk); 
• The existence of cost-effective alternatives (equitable risks); 
• The existence of high-cost alternatives or possibly lack of options (inequitable 
risks); 
• Length of exposure to the risk. 
While qualitative analysis is less precise than quantitative analysis, evaluating the 
results is far less expensive in terms of both time and money. The results are good 
enough to indicate the overall risk of the project and identify the high-priority risks in 
order to begin taking some corrective action. Quantitative risk analysis attempts to 248 
attach specific numerical values to the risks. The severity can be assessed from these 
numerical values for impact and probability. 
In my opinion expected value analysis is the best non-computational way to 
determine severity in risks. To do this, we must measure the probability of the risk in 
numbers between 0.0 and 1.0. The values for the impact of the risks are estimated 
monetary value. By evaluating the impact and probability this way, we can multiply the 
two values together and come up with what is called the value of risk severity. This 
value for severity has quantitative meaning. If we were to do this project many times, 
the risk would happen some of the time and not happen some of the time. Adding up the 
severity of the risk each time it occurred and dividing by the number of times the 
project was done would give an average value. This is the expected value. 
The best way to determine risk probability is Fishbone-Ishikawa diagrams (cause-
and effect diagrams). The diagram, illustrated in Figure 2, is a useful way of organizing 
and analyzing a process into its subprocesses. The subprocesses can be further broken 
down into other subprocesses until a level of detail is reached where a small group can 
look into the subprocess in detail and the risks associated with each causes can be easily 
identified. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Fig. 2: Fishbone-Ishikawa diagrams for risk probability 
Risk 
probability
Cause 4 
Probability
Cause 3 
Probability
Cause 2 
Probability
Cause 1 
Probability
Cause 2.1 
Probability 
Cause 2.2 
Probability 
Cause 1.1
Probability 
Cause 1.2
Probability 
Cause 3.1
Probability 
Cause 3.2
Probability 
Cause 4.1 
Probability 
Cause 4.1 
Probability 
Effect 
Cause
 
 
To approximate risk probability I propose a balanced average of subprocesses 
(causes) probabilities. 
 249 
∑
∑
=
= ×
= n
j j
n
j j j Cp
Rp
1
1
ρ
ρ
  (1) 
 
where: 
Rp - risk probability, 
Cpj - causes probabilities, 
ρj - probabilities rank (greatest rank for greatest probability). 
 
To approximate the values of risks impact I use the product among quantity and 
estimated value for quantity. 
 
P Q   Ri × =   (2) 
 
where: 
Ri - risk impact, 
Q - quantitative effect, 
P - unit price. 
 
The risk severity is the product among risk probability and risk impact. Table 1 
shows a sample of values for impact and probability. 
 
Table 1 
Values for risks impact and probability 
  Impact 
P
r
o
b
a
b
i
l
i
t
y
 
   Risk 1  Risk 2  Risk 3 
0,1  2 143  23 
0,2 5 156  24 
0,3  6 162  27 
0,4  7 165  28 
0,5 8 168  33 
0,6  10 172 35 
0,7  11 178 37 
0,8  12 193 39 
0,9  14 195 42 
1,0  17 199 44 
 
The assessment of several risks can be summarized into best-case, worst-
case, and expected-value scenarios as well:  
•  The best-case scenario is the average of first five levels of severity.  
•  The worst-case scenario is the average of last five levels of severity. 
•  Expected-value scenario is the average of all levels of risk severity. 
Table 2 illustrates severity quantification by evaluating the impact and 
probability. 
 
 250 
Table 2 
Best-case, worst-case and expected-value scenarios 
for risks severity 
  Impact 
Probability  Risk 1  Risk 2  Risk 3 
0,1  0,2 14,3 2,3 
0,2  1 15,6  2,4 
0,3  1,8 16,2 2,7 
0,4  2,8 16,5 2,8 
0,5  4 16,8  3,3 
0,6  6 17,2  3,5 
0,7  7,7 17,8 3,7 
0,8  9,6 19,3 3,9 
0,9  12,6 19,5 4,2 
1,0  17 19,9  4,4 
Expected-value 
scenario  6,27 17,31 3,32 
The best-case 
scenario  1,96 15,88 2,7 
The worst-case 
scenario  10,58 18,74 3,94 
 
4. Risk Minimization Plans 
Once the risks to the project have been identified and assessed, strategies are 
needed to minimize those risks. 
Such strategies may include: 
¾  Acceptance. Acceptance of a risk means that the severity of the risk is low 
enough that we will do nothing about the risk unless it occurs. Using the acceptance 
strategy means that the severity of the risk is lower than organization risk tolerance 
level. Once the risk occurs, project manager will fix the problem and move on. Many of 
the project risks will fall into this category. It is the category where the many 
insignificant risks are put.  
There are two kinds of acceptance: 
•  Active, 
•  Passive.  
Acceptance is active when a risk is identified as being acceptable but manager 
decide to make a plan for what to do when and if the risk occurs.  
Acceptance is passive when nothing at all is done to plan for the risk occurrence. 
Many of the identified risks in the project will be passively accepted. These risks are 
simply too small to be of concern. The price of developing a plan and documenting it 
can be higher than the cost of dealing with the risk without preparation. 
¾  Transfer. The transfer strategy in managing risk is to give responsibility for the 
risk to someone outside the project. The risk does not go away; the responsibility of the 
risk is simply given to someone else. This can be done a number of ways: 
•  The refusal of a project deliverable that has a high risk of causing (for 
production risks) 
•  Transfer to a contractor working for the project (for all kind of risks);  251 
•  INCOTERM clause (for transportation risks) 
•  Firm fixed price contract (for commercial risks); 
•  Insurance (for financial and all kind off risks). 
¾  Risk Avoidance. This strategy is used to make the risk cease to be a possibility. 
In risk avoidance, it is completely eliminate the possibility of the risk. The simplest way 
to avoid a risk is to remove it from the project deliverables.  
¾  Mitigation. Mitigation is a strategy where some work is done on 
unacceptable risks to reduce either their probability or their impact to a point 
where their severity falls below the maximum risk tolerance level.  
5. Contingency Plans and Reserves 
Changes in technical performance or schedules imply a new look at cost estimates 
and a reevaluation of contingency reserves. The amount of reserves depends on a 
number of factors, including funds available, overall risk ness of the project, and the 
management approach. 
6. Conclusion 
Risk is a reality in every undertaking. If project manager knew the outcome of 
everything in advance, there would be no risk. Unfortunately, for some undertakings, 
even though project manager do not know the details undertake. Project manager knows 
that he will be able to complete them; he just do not know precisely how much it will 
cost or how long it will take. 
Consequently, he needs to recognize that risk exists. The plans, no matter how well 
conceived, need to acknowledge risk. Risk not only needs to be acknowledged; it needs 
to be managed (assessed and controlled).  
 
 
REFERENCES 
 
18.    Bocean C. G. (2007) - Managementul proiectelor în afaceri, Editura 
Universitaria, Craiova; 
19.    Charvat J. (2002) - Project Management Nation: Tools, Techniques and 
Goals for the New and Practicing IT Project Manager, John Wiley & Sons, Inc., New 
York; 
20.   Dinsmore P. (1993) - Handbook of Project Management, AMACOM Books. 
21.   Davidson Frame (2002) - The New Project Management, John Wiley & Sons 
Inc., San Francisco; 
22.   Heerkens G. (2002) - Project Management, McGraw-Hill, New York; 
23.   Howes N. (2001) - Modern project management: successfully integrating 
project management knowledge areas and processes, netLibrary eBook; 
24.   Kerzner H. (2001) - Project Management - A Systems Approach to Planning, 
Scheduling and Controlling, Seventh Edition, John Wiley & Sons, Inc., New York; 
25.   Lester A. (2003) - Project Planning and Control, Fourth Edition, Elsevier 
Butterworth-Heinemann Linacre House, Jordan Hill, Oxford; 
26.   Levine H. (2002) - Practical project management: tips, tactics, and tools, 
John Wiley & Sons, Inc., New York; 
27.   Marmel E. (2007) - Microsoft Management Project Bible, Wiley Publishing, 
Inc., Indianapolis, Indiana; 
28.   Newell M., Grashina M. (2004) - The Project Management Question and 
Answer Book, AMACOM (Asociatia Americana de Management); 252 
29.  Pritchard Carl L. (2004) - The project management communications toolkit, 
ARTECH HOUSE INC, Norwood; 
30.  Project Management Institute Standards Committee (1996) - A guide to the 
project management body of knowledge, North Carolina, PMI Publishing Division; 
31.  Raz T. S., Aaron J., Dvir D. (2002) - "Risk Management, Project Success, 
and Technological Uncertainty", R&D Management, Vol. 32, pp. 101-109, , available at 
SSRN: http://ssrn.com/abstract=309402; 
32.  Schatteman D., Herroelen W., Van de Vonder S., Boone A. (2006) - "A 
Methodology for Integrated Risk Management and Proactive Scheduling of 
Construction Projects", KU Leuven Working Paper No. KBI 0620, available at SSRN: 
http://ssrn.com/abstract=950903; 
33.  Wysocki R., McGary,  R. (2003) - Effective Project Management, Third 
Edition, John Wiley & Sons, New York; 
34.  *** (1997) - “Project Management Manual”, Harvard Business Review, p. 
697-1034. 
 
 

A guide to the project management body of knowledge, North Carolina,

A Methodology for Integrated Risk Management and Proactive Scheduling of Construction Projects&quot;, KU Leuven Working Paper No. KBI 0620, available at SSRN: http://ssrn.com/abstract=950903;

Effective Project Management, Third Edition,

Handbook of Project Management,

Managementul proiectelor în afaceri,

Microsoft Management Project Bible,

Modern project management: successfully integrating project management knowledge areas and processes, netLibrary eBook;

Practical project management: tips, tactics, and tools,

Project Management - A Systems Approach to Planning, Scheduling and Controlling, Seventh Edition,

Project Management Manual”, Harvard Business Review,

Project Management Nation: Tools, Techniques and Goals for the New and Practicing IT Project Manager,

Project Management,

Project Planning and Control, Fourth Edition, Elsevier Butterworth-Heinemann Linacre House,

Project Risk Management Phases

Abstract

Similar works

Full text

Available Versions

Research Papers in Economics