Managing Risks in Large Projects

Managing risk is inherent to managing projects. In fact, managing project risk could be considered the single most important aspect of project management as all projects have risks and uncertainties that can are the underlying causes of missed deadlines and cost overruns. While all projects face these obstacles, large projects are especially vulnerable due to complexity. As projects grow in scope, they also experience an almost exponential growth in complexity and a concurrent growth in an exposure to risk events and uncertainties and can result in out of control costs and schedule and project failure. It is therefore critical that additional risk management strategies are put in place to give your team the best chance to be successful. Here is our advice on how to augment the standard project risk management steps when you are managing a large project.

Create a Risk Register
There are many standard formats for risk registers and the basic required data should include name, id, date identified, person identifier, description, owner/manager, pre and post mitigation probability and impacts, response, actions and status.
For large projects, you can include additional information that will help you better understand the scale of the risk and how effectively it is being managed. We recommend that you include current probability and impact, sunrise and sunset, proximity, location or facility, risk response effectiveness, and any other information that can help you to effectively assess, monitor, and control your risks.

Identify Risks
Risks can be both threats and opportunities. Each risk has both a probability of occurrence and potential impacts on project objectives. There are many well-known strategies that you can use including subject matter expert (SME) opinions, brainstorming, Delphi, root cause analysis, etc. In all cases, use a Bayesian approach, that uses historical data combined with new or emerging information to identify and assess risks.
For large projects, use a risk breakdown structure (RBS) as the basis for risk identification. Large projects are exposed to risks from multiple sources and the sheer volume can make it easy to overlook them A RBS breaks down the possible sources of risks (eg. Internal vs External) into smaller easier to comprehend blocks and makes the identification easier.

Assess Probability and Impact
Risks have both a probability and impact. Probability is a percentage between 0- 100 that the risk could occur, but it can also be ranges such as 1 in 2 (very likely) to 1-100 (very unlikely). Impacts to major project objectives (risk categories), such as schedule, cost, quality, and performance can also be assessed. Use probability and impact matrixes that outline how risk’s are assessed. For example if you are using the common 1 -5 scoring method, the matrixes should provide guidance what each score for probability or impact means. For impacts, 1 could mean less than 1% of the budget and 5 would equal more than 20%. Alternatively, these could be based on fixed amounts.
For large projects, we recommend Monte Carlo simulation to quantify the impact of risks and uncertainties on your project. The complexity of large projects creates situations where simple subjective assessments cannot accurately capture the possible range of outcomes. The assessment should include not only risks from the risk register, but uncertainties or aleatory risk, which is risk that cannot be managed but must be accounted for.

Plan risk Responses
Risk responses are actions or groups of actions that your project team will perform to reduce the impacts of risks on your schedule. At a high level risk responses are the strategies Avoid, Transfer, Mitigate or Accept. Each strategy should include actions with completion dates and the person responsible. Mitigation activities can be plotted on a Mitigation Waterfall Chart that presents a time phased visualization of how the planned actions will reduce the risk score.
For large projects, prioritize your risk responses based on expected values. Calculate the expected value for the cost of risks including risk response activities. Managing project risks is a trade-off and involves coming up with strategies that spend scarce resources to reduce cost or schedule. The cost of managing some risks may outweigh their costs and your resources could be allocated to managing other risks.

Monitor and Control Risks
Project risk management is a continuous and iterative process. As part of project status meetings, include a review of your risks and update information as required. During project execution, your list of risks and their priority will change. At the beginning of each major phase of the project, have a dedicated session, a risk workshop, to do a thorough revaluation of your risks, including identification, assessment, and responses for new and emerging risks.
For large projects, perform Monte Carlo schedule risk analysis on a regular basis. Small slippages are often the first sign of a project that is in trouble. While Earned Value will provide the basis for linear forecast of your schedule, it cannot account for future risks and uncertainties. In projects that are beginning to experience issues, risks and uncertainties do not remain static, but often trend upwards. Monte Carlo simulation will provide a more realistic forecast and identify some of the key areas that you can address to bring your project back under control.