Description
Risk management is the identification, assessment, and prioritization of risks (defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative) followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events[1] or to maximize the realization of opportunities.
Project Risk
Management
Guidance for WSDOT Projects
July 2010
Americans with Disabilities Act (ADA) Information
Materials can be provided in alternative formats by calling the ADA Compliance Manager
at 360-705-7097. Persons who are deaf or hard of hearing may contact that number via the
Washington Relay Service at 7-1-1.
Title VI Notice to Public
It is the Washington State Department of Transportation’s (WSDOT) policy to assure that
no person shall, on the grounds of race, color, national origin, or sex, as provided by Title VI
of the Civil Rights Act of 1964, be excluded from participation in, be denied the benefts of,
or be otherwise discriminated against under any of its federally funded programs and activities.
Any person who believes his/her Title VI protection has been violated, may fle a complaint
with WSDOT’s Offce of Equal Opportunity (OEO). For Title VI complaint forms and advice,
please contact OEO’s Title VI Coordinator at 360-705-7098 or 509-324-6018.
To get the latest information for WSDOT administrative and engineering manuals, sign up for in-
dividual manual e-mail updates at www.wsdot.wa.gov/publications/manuals.
Washington State Department of Transportation
Administrative and Engineering Publications
PO Box 47304
Olympia, WA 98504-7304
Phone: 360-705-7430
E-mail: [email protected]
Internet: www.wsdot.wa.gov/publications/manuals
Project Risk Management Guidance for WSDOT Projects Page iii
July 2010
Foreword
Inaccurate cost estimating has dogged transportation projects for years. B.
Flyvbjerg’s noted study on the results of transportation project estimating
found that for the past 70 years, the cost of transportation projects has
been consistently underestimated in many parts of the world, including
the U.S.
The future is uncertain, but it is certain that there are two questions
will be asked about our projects: (1) How much will it cost? (2) How
long will it take? And of course the obvious follow-up question: Why?
(Why that much and why that long?)
These questions are posed in the future tense, and we are being asked
to predict an uncertain future. Because the future is uncertain the
fundamental answers to these questions is that an estimate is more
accurately expressed not as a single number but as a range. To determine
an accurate estimate range for both cost and schedule, risk and uncertainty
must be quantifed.
Estimates are comprised of two components: the base cost component and
the risk (or uncertainty) component. Base cost is defned as the likely cost
of the planned project if no signifcant problems occur. Once the base cost
is established, a list of uncertainties is created of both opportunities and
threats, called a “risk register.” The risk assessment replaces general and
vaguely defned contingency with explicitly defned risk events and with
the probability of occurrence and the consequences of each potential risk
event. Scope control is of course necessary for project management and
estimating. Cost estimates are to be reviewed and validated, and a base
cost for the project is determined.
Project risk management is a scalable activity and should be
commensurate with the size and complexity of the project under
consideration. Simpler projects may utilize simple qualitative analysis as
found in the Project Management Online Guide in the Risk Management
Plan spreadsheet. Larger more complex projects may wish to use more
robust analysis techniques via Monte-Carlo simulation models.
This guidance has been developed by the Strategic Assessment and
Estimating Offce (SAEO) in alignment with the goals of the Statewide
Program Management Group (SPMG). This document would not have
been possible with the contributions of dozens of key WSDOT people
who participated in the development and review of these guidelines.
DRAFT
FirstName LastName
WSDOT State Design Engineer
“What gets us in trouble is
not what we don’t know. It’s
what we know for sure that
just ain’t so.” Mark Twain
Page iv Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page v
July 2010
Comment Form
NOTE: This document is a working draft – your feedback and input is greatly appreciate.
From: Date:
Phone:
To: WSDOT – Headquarters Design
Strategic Analysis and Estimating Offce Mailstop 47330
PO Box 47330
310 Maple Park AVE SE
Olympia WA 98501-7330
Subject: Project Risk Management Guide Comment
Preserve this original for future use submit copies only
Acknowledgement: Author/Editor Mark Gabel, P.E.
WSDOT Strategic Analysis Estimating Offce
Page vi Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page vii
July 2010
Contents
Foreword iii
Comment Form v
Purpose ix
Defnitions of Selected Terms xi
The Value of Risk Management xiii
Project Risk Management Process xvii
Maximum Effort = Reduced Risk xix
Statement of Policy xxi
Chapter 1 Risk Management Planning 1
Chapter 2 Risk Identifcation 11
Chapter 3 Qualitative Risk Analysis 23
Chapter 4 Quantitative Risk Analysis 33
Chapter 5 Risk Response 43
Chapter 6 Risk Monitoring and Control 53
Appendix A Project Risk Management Plan Template 63\
Page viii Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page ix
July 2010
Purpose
This document provides information to project managers and
project teams that will help with their risk management efforts in the
following ways:
• Provide a consistent methodology for performing project risk
management activities.
*
• Provide techniques and tools for project risk management.
• Identify data requirements for risk analysis input and for output
(CPMS data requirements).
• Provide information on how project risk management fits into the
overall project management process at WSDOT.
• Provide guidance on how to proactively respond to risks.
Understanding of project risks will better enable project teams to
contribute to the fulfllment of public service through assessing project
risk and uncertainty to aide in making decisions regarding project
development and delivery. These decisions contribute to public safety and
the projects we deliver add value to Washington State on many levels.
Estimating the cost of transportation projects is a fundamental
responsibility of the Washington State Department of Transportation
(WSDOT). In recognition of the fundamental and strategic importance
of cost estimating these guidelines provide consistent practices across
the agency to enhance methods for meeting this responsibility. These
guidelines were developed by the Strategic Analysis and Estimating Offce
with contributions from a number of specialists in cost estimating and
project development.
Estimators must be shielded from pressures to prepare estimates that
match some preconceived notion of what a project should cost. Estimators
need to prepare estimates based on the scope of the project, the schedule
of the project and the bidding conditions that are anticipated.
* The methodology is consistent with the Project Management Institute (PMI) per the Project
Management Body Of Knowledge (PMBOK).
“No construction project
is risk free. Risk can be
managed, minimized,
shared, transferred,
or accepted. It cannot be
ignored.”
Sir Michael Latham, 1994
Page x Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page xi
July 2010
Base Cost Estimate – The Base Cost represents the cost which can
reasonably be expected if the project materializes as planned. The base
cost estimate is ubbiased and neutral- it is not optimistic and it is not
conservative. The base cost estimate includes the standard WSDOT
4% construction contingency described in the Plans Preparation
Manual M 22-31. It dose not include any signifcant risks (threats or
opportunities).
Note:
1. refer to WSDOT Plans Preparation Manual M 22-31 Section
800.03(2)
“Contingency percentages’ are setup to handle unforeseen changes in a
project during construction, including additional work, quantity over-
runs, and additional items. Contingencies are currently limited to 4%
of the total contract amount for all WSDOT contracts.”
2. The Base Cost typically falls in the 20% to 40% confdence level in
the Risk Based.
Construction Phase (CN) – The activities associated with the
administration of a contract for specifed services and physical
infrastructure. Primarily, the construction phase includes change
management, assurance that safety and associated impacts to the traveling
public are mitigated, payment for work completed, and the documentation
of physically constructed elements, certifcation and documentation of
quality.
Estimator – “One who assesses the extent of work and/or components
of the work (i.e. materials, equipment and labor) to be done to complete
a project, or a strictly defned part of the project, and state a likely or
approximate quantity in generally accepted units of measurement and cost
for the project.”
Preliminary Engineering Phase (PE) – The effort (budget/cost) of taking
a project through the planning, scoping, and design phases. Planning
and scoping typically have separate budgets but are encompassed under
Preliminary Engineering. The terms “Design” or “Design Phase” are
sometimes used interchangeably with PE.
Project Cost Estimate – total project cost estimate includes
PE + RW + CN
Defnitions of Selected Terms
Page xii Project Risk Management Guidance for WSDOT Projects
July 2010
Right-Of-Way Phase (R/W) – This effort includes the revision of existing
plans or the preparation of new plans detailing the need for new Right
of Way defned during the design phase. It also includes the appraisal,
negotiation, and purchase of new Right of Way by the Real Estate Services
offce. The right-of-way phase can begin during scoping, after design
completion, or anytime in between. The phase end is when the RW is
certifed, but this may not have a direct relationship to the construction
phase, except that CN cannot begin unless the RW is certifed. Except
under rare circumstances, all new Right-of-Way must be acquired before
the project can go to Ad. NOTE: Preparation of R/W Plans is paid for
with PE dollars and is part of the design effort; Negotiation, Purchase and
Acquisition of R/W is performed by the Real Estate Services offce and
comprises the cost of R/W.
Risk – The combination of the probability of an uncertain event and its
consequences. A positive consequence presents an opportunity; a negative
consequence poses a threat.
Risk Management –Refers to the culture, processes, and structures that
are directed toward effective management of risks –including potential
opportunities and threats to project objectives.
Risk-Based Estimate – Involves simple or complex modeling based
on inferred and probabilistic relationships among cost, schedule, and
events related to the project. It uses the historical data and/or cost based
estimating techniques and the expert’s best judgment to develop a Base
Cost or the cost of the project if the project proceeds as planned. Risk
elements (opportunities or threats) are then defned and applied to the Base
Cost through modeling to provide a probable range for both project cost
and schedule.
A comprehensive glossary can be found at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/workshop.htm
Project Risk Management Guidance for WSDOT Projects Page xiii
July 2010
Project risk management delivers the following values:
• Contributes to project success;
• Recognizes uncertainty and provides forecasts of possible outcomes;
• Produces better business outcomes through more informed decision-
making;
• Is a positive influence on creative thinking and innovation;
• Offers better control –less overhead and less time wasted, greater focus
on benefits;
• Helps senior management to understand what is happening with the
project and the challenges the project has to overcome.
Project risk management is an integral component of project management
and found at the heart of WSDOT’s Project Management processes.
Risk management is also a key component of project cost estimating
and scheduling, as noted in the National Cooperative Highway Research
Program in NCHRP Report 574, which is available at the WSDOT
library along with other publications on project management and risk
management.
Figures 1 and 2, on the following pages, depict Project Risk Management
through Project Development and Balanced Risk Management.
“The problem with the
future is that more things
might happen than will
happen” (Plato). With
effective risk management,
as an integral and
required part of project
management, we can
not only predict possible
future outcomes, we can
take action to shift the
odds for project success
in our favor.
The Value of Risk Management
Page xiv Project Risk Management Guidance for WSDOT Projects
July 2010
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
t
h
r
o
u
g
h
P
r
o
j
e
c
t
D
e
v
e
l
o
p
m
e
n
t
a
n
d
C
o
n
s
t
r
u
c
t
i
o
n
F
i
g
u
r
e
1
H
ig
h
w
a
y
S
y
s
t
e
m
P
la
n
C
a
p
it
a
l
I
m
p
r
o
v
e
m
e
n
t
&
P
r
e
s
e
r
v
a
t
io
n
P
r
o
g
r
a
m
(
C
I
P
P
)
&
B
ie
n
n
ia
l
P
r
o
g
r
a
m
A
w
a
r
d
C
o
n
c
e
p
t
u
a
l
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
p
o
t
e
n
t
i
a
l
f
u
n
d
s
n
e
e
d
e
d
&
p
r
i
o
r
i
t
i
z
e
n
e
e
d
s
f
o
r
h
i
g
h
w
a
y
s
y
s
t
e
m
p
l
a
n
S
c
o
p
i
n
g
E
s
t
i
m
a
t
i
n
g
S
e
t
b
a
s
e
l
i
n
e
c
o
s
t
f
o
r
p
r
o
j
e
c
t
a
n
d
p
r
o
g
r
a
m
p
r
o
j
e
c
t
(
C
I
P
P
a
n
d
b
i
e
n
n
i
a
l
p
r
o
g
r
a
m
)
D
e
s
i
g
n
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
f
o
r
C
o
s
t
M
a
n
a
g
e
m
e
n
t
P
S
&
E
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
c
o
n
s
t
r
u
c
t
i
o
n
c
o
s
t
s
t
o
o
b
l
i
g
a
t
e
f
u
n
d
s
&
c
o
m
p
a
r
e
w
i
t
h
b
i
d
s
P
l
a
n
n
i
n
g
a
n
d
P
r
o
j
e
c
t
D
e
v
e
l
o
p
m
e
n
t
P
h
a
s
e
s
P
r
o
g
r
a
m
(
p
r
o
j
e
c
t
)
s
c
o
p
e
(
c
a
t
e
g
o
r
y
,
c
o
n
c
e
p
t
s
,
s
c
h
e
m
a
t
i
c
s
&
l
o
c
a
t
i
o
n
)
N
e
e
d
s
/
d
e
f
i
c
i
e
n
c
i
e
s
C
o
s
t
E
s
t
i
m
a
t
e
s
(
R
e
c
y
c
l
e
l
o
o
p
)
P
r
o
g
r
a
m
(
p
r
o
j
e
c
t
)
c
o
s
t
e
s
t
i
m
a
t
e
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
P
l
a
n
n
i
n
g
P
r
o
j
e
c
t
s
c
o
p
e
(
s
c
h
e
m
a
t
i
c
s
,
t
y
p
e
,
(
P
o
r
I
)
,
p
r
e
l
i
m
i
n
a
r
y
p
l
a
n
s
,
a
l
t
e
r
n
a
t
i
v
e
s
,
l
o
c
a
t
i
o
n
B
a
s
e
l
i
n
e
c
o
s
t
e
s
t
i
m
a
t
e
P
r
o
j
e
c
t
s
c
o
p
e
(
d
e
s
i
g
n
,
d
e
v
e
l
o
p
m
e
n
t
,
e
g
,
p
l
a
n
s
f
o
r
a
p
p
r
o
v
a
l
,
e
t
c
)
P
e
r
i
o
d
i
c
c
o
s
t
e
s
t
i
m
a
t
e
u
p
d
a
t
e
s
P
r
o
j
e
c
t
s
c
o
p
e
(
f
i
n
a
l
p
l
a
n
s
/
s
p
e
c
s
a
n
d
b
i
d
d
o
c
u
m
e
n
t
s
)
E
n
g
i
n
e
e
r
’
s
E
s
t
i
m
a
t
e
P
S
&
E
A
d
v
e
r
t
i
s
e
a
n
d
B
i
d
C
o
n
s
t
r
u
c
t
i
o
n
S
c
o
p
i
n
g
D
e
s
i
g
n
Pre - constructionphases
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
T
A
K
E
A
C
T
I
O
N
-
I
M
P
L
E
M
E
N
T
R
I
S
K
R
E
S
P
O
N
S
E
P
L
A
N
C
U
R
R
E
N
T
P
r
o
j
e
c
t
M
g
m
t
P
l
a
n
S
c
o
p
e
S
c
h
e
d
u
l
e
E
s
t
i
m
a
t
e
s
D
o
c
u
m
e
n
t
a
t
i
o
n
U
p
d
a
t
e
P
r
o
j
e
c
t
M
g
m
t
P
l
a
n
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
n
i
n
g
R
i
s
k
m
a
n
a
g
e
m
e
n
t
i
s
a
t
t
h
e
h
e
a
r
t
o
f
p
r
o
j
e
c
t
m
a
n
a
g
e
m
e
n
t
a
n
d
i
s
a
n
o
n
g
o
i
n
g
a
c
t
i
v
i
t
y
u
n
t
i
l
t
h
e
p
r
o
j
e
c
t
i
s
c
o
m
p
l
e
t
e
d
.
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
D
o
c
u
m
e
n
t
a
n
d
r
e
c
o
r
d
C
h
a
n
g
e
O
r
d
e
r
s
a
n
d
t
h
e
e
f
f
e
c
t
o
n
p
r
o
j
e
c
t
s
c
o
p
e
,
s
c
h
e
d
u
l
e
a
n
d
c
o
s
t
.
R
i
s
k
A
n
a
l
y
s
i
s
R
i
s
k
I
d
e
n
t
i
f
i
c
a
t
i
o
n
(
d
e
t
e
r
m
i
n
e
a
n
d
d
o
c
u
m
e
n
t
r
i
s
k
c
h
a
r
a
c
t
e
r
i
s
t
i
c
s
P
r
o
d
u
c
e
P
r
e
l
i
m
i
n
a
r
y
R
i
s
k
R
e
g
i
s
t
e
r
)
Q
u
a
l
i
t
a
t
i
v
e
Q
u
a
n
t
i
t
a
t
i
v
e
P
r
e
-
R
e
s
p
o
n
s
e
A
n
a
l
y
s
i
s
R
i
s
k
R
e
s
p
o
n
s
e
P
l
a
n
n
i
n
g
P
o
s
t
-
r
e
s
p
o
n
s
e
A
n
a
l
y
s
i
s
R
e
s
u
l
t
s
O
f
R
i
s
k
R
e
s
p
o
n
s
e
A
c
t
i
o
n
s
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
c
d
ef
h
r
Project Risk Management Guidance for WSDOT Projects Page xv
July 2010
B
a
l
a
n
c
e
d
R
i
s
k
M
a
n
a
g
e
m
e
n
t
(
R
i
s
k
T
o
l
e
r
a
n
c
e
)
F
i
g
u
r
e
2
S
p
e
n
d
r
e
s
o
u
r
c
e
s
o
n
“
f
i
r
e
-
f
i
g
h
t
i
n
g
”
I
n
a
d
e
q
u
a
t
e
r
e
s
o
u
r
c
e
s
f
o
r
r
i
s
k
p
r
o
c
e
s
s
S
t
r
e
n
g
t
h
e
n
r
i
s
k
p
r
o
c
e
s
s
R
i
s
k
p
r
o
c
e
s
s
b
e
c
o
m
e
s
b
u
r
d
e
n
s
o
m
e
U
n
d
e
r
-
i
n
v
e
s
t
i
n
r
i
s
k
m
a
n
a
g
e
m
e
n
t
O
v
e
r
-
i
n
v
e
s
t
i
n
r
i
s
k
m
a
n
a
g
e
m
e
n
t
E
f
f
e
c
t
s
o
f
r
i
s
k
-
a
v
e
r
s
e
a
p
p
r
o
a
c
h
E
f
f
e
c
t
s
o
f
r
i
s
k
-
s
e
e
k
i
n
g
a
p
p
r
o
a
c
h
I
n
e
f
f
e
c
t
i
v
e
r
i
s
k
m
a
n
a
g
e
m
e
n
t
T
h
r
e
a
t
s
m
a
t
e
r
i
a
l
i
z
e
O
p
p
o
r
t
u
n
i
t
i
e
s
a
r
e
m
i
s
s
e
d
R
i
s
k
m
a
n
a
g
e
m
e
n
t
b
e
c
o
m
e
s
l
e
s
s
c
o
s
t
e
f
f
e
c
t
i
v
e
R
e
s
o
u
r
c
e
s
s
p
e
n
t
o
n
l
o
w
p
r
i
o
r
i
t
y
i
t
e
m
s
B
a
l
a
n
c
e
d
R
i
s
k
M
a
n
a
g
e
m
e
n
t
A
p
p
r
o
a
c
h
A
p
p
r
o
p
r
i
a
t
e
R
i
s
k
M
a
n
a
g
e
m
e
n
t
M
a
t
c
h
e
s
E
n
t
e
r
p
r
i
s
e
R
i
s
k
T
o
l
e
r
a
n
c
e
P
r
o
-
A
c
t
i
v
e
r
e
s
p
o
n
s
e
s
t
o
r
i
s
k
s
R
e
s
o
u
r
c
e
s
a
l
l
o
c
a
t
e
d
e
f
f
e
c
t
i
v
e
l
y
Page xvi Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page xvii
July 2010
Risk management, as an integral part of project management, occurs on
a daily basis. With pro-active risk management we look at projects in a
comprehensive manner and assess and document risks and uncertainty.
The steps for risk management are provided below.
Risk Management Steps
WSDOT Project Management Online Guide (PMOG) risk management
steps:
1) Risk
Management
Planning
Risk Management Planning is the systematic process
of deciding how to approach, plan, and execute risk
management activities throughout the life of a project.
It is intended to maximize the benefcial outcome of the
opportunities and minimize or eliminate the consequences
of adverse risk events. (WSDOT PMOG)
2) Identify Risk
Events
Risk identifcation involves determining which risks might
affect the project and documenting their characteristics. It
may be a simple risk assessment organized by the project
team, or an outcome of the CEVP®/CRA workshop process.
3) Qualitative
Risk Analysis
Qualitative risk analysis assesses the impact and likelihood
of the identifed risks and develops prioritized lists of these
risks for further analysis or direct mitigation. The team
assesses each identifed risk for its probability of occurrence
and its impact on project objectives. Project teams may elicit
assistance from subject matter experts or functional units to
assess the risks in their respective felds.
4) Quantitative
Risk Analysis
Quantitative risk analysis is a way of numerically estimating
the probability that a project will meet its cost and time
objectives. Quantitative analysis is based on a simultaneous
evaluation of the impacts of all identifed and quantifed risks.
5) Risk
Response
Planning
Risk response strategy is the process of developing options
and determining actions to enhance opportunities and reduce
threats to the project’s objectives. It identifes and assigns
parties to take responsibility for each risk response. This
process ensures that each risk requiring a response has an
“owner” . The Project Manager and the project team identify
which strategy is best for each risk, and then selects specifc
actions to implement that strategy.
6) Risk
Monitoring &
Control
Risk Monitoring and Control tracks identifed risks, monitors
residual risks, and identifes new risks—ensuring the
execution of risk plans, and evaluating their effectiveness
in reducing risk. Risk Monitoring and Control is an ongoing
process for the life of the project.
The remainder of this document includes more detail on the steps listed
above.
Project Risk Management Process
Page xviii Project Risk Management Guidance for WSDOT Projects
July 2010
Table 1 provides a helpful comparison between risk and objectives for
various types of risk management. For this document we are interested in
Project risk management.
Type of risk
management
Description Sample objectives
Generic Risk: any uncertainty that, if
it occurs, would affect one or
more objectives
-
Project risk
management
Project Risk: any
uncertainty that, if it occurs,
would affect one or more
project objectives
Time, cost, performance,
quality, scope, client
satisfaction.
Business risk
management
Business Risk: any
uncertainty that, if it occurs,
would affect one or more
business objectives
Proftability, market share,
competitiveness, Internal Rate
of Return (IRR), reputation,
repeat work, share price.
Safety risk
management
Safety Risk: any uncertainty
that, if it occurs, would affect
one or more safety objectives
Low accident rate, minimal
lost days, reduced insurance
premiums, regulatory
compliance.
Technical risk
management
Technical Risk: any
uncertainty that, if it occurs,
would affect one or more
technical objectives
Performance, functionality,
reliability, maintainability.
Security risk
management
Technical Risk: any
uncertainty that, if it occurs,
would affect one or more
security objectives
Information security, physical
security, asset security,
personnel security.
Credit: David Hillson, Effective Opportunity Management for Projects
Relationship between Risk and Objectives
Table 1
Project Risk Management Guidance for WSDOT Projects Page xix
July 2010
Description
The power of risk management is fully realized when a project manager
takes action to respond to identifed risks based on the risk analysis, with
effort being directed toward those risks that rank the highest in terms of
signifcant impact to project objectives.
Inputs
Project scope, schedule, and estimate package. The estimate package
should include the most current versions of the following items:
• Project Summary
• Detailed scope of work (commensurate to the level of development)
• Project Cost Estimate (with basis of cost estimate completed)
– PE cost estimate
– ROW cost estimate
– Construction cost estimate
• Previous risk analyses (if applicable)
• Project Management Plan
• Project Schedule
– Overall project schedule
– Detailed construction schedule (commensurate to the level
of development)
• Additional information as necessary
Techniques and Tools
WSDOT provides a number of techniques and tools to assist in project risk
management. These tools and techniques provide scalability and fexibility
so that project teams can match the tool with the specifc needs of their
projects. Often times the appropriate tool is determined by the size and
complexity of the project. These tools include:
• Project Management Online Guide (PMOG)
– Project Management Plan (fundamental for all project
management)
– The PMOG provides a risk matrix suitable for smaller simpler
projects
– Risk planning and risk management are an integral element
of project management
Maximum Effort = Reduced Risk
Page xx Project Risk Management Guidance for WSDOT Projects
July 2010
• Risk Management Plan spreadsheet template (found on
SAEO website)
• Self-Modeling tool for quantitative risk analysis
• CRA workshops for all projects between $25M and $100M
• CEVP workshops for all projects over $100M
Output
CPMS data requirements per in Instructional Letter (IL) 4071.00; Project
teams must provide specifc data to the region program management offce
for inclusion into CPMS and the Transportation Executive Information
System (TEIS). The required data is:
1. Project scheduling data for the following milestone dates:
• Project defnition completion date
• Date for the beginning of preliminary engineering
• Completion date for the environmental document
• Start date for the acquisition of right of way
• Date of right of way certifcation
• Project advertisement date
• Date project is operationally complete (substantially complete)
2. Estimated Project Cost Data (in Current Year Dollars, CY$)
• Date of estimate basis (i.e., “2007 $”)
• Design cost estimate
• Right of way cost estimate
• Construction cost estimate
3. Midpoint for construction phases using the project award date and the
operationally complete date.
Project Risk Management Guidance for WSDOT Projects Page xxi
July 2010
Project Risk Management and Risk Based Estimating
It is the policy of the Washington State Department of Transportation
(WSDOT) to conduct risk based estimating workshops for all projects over
$10 Million (PE, R/W and Const). These workshops provide information
to project managers that can help them control scope, cost, schedule, and
manage risks for all projects. This policy reaffrms the requirement that a
risk management plan is a component of every project management plan.
Levels of risk based estimating, in support of risk management (E 1053.00):
Project Size ($)
Required Process
(project managers can use a higher level process if desired)
Less than $10 M Qualitative Spreadsheet in the Project Management
Online Guide
1
$10 M to $25 M In-formal workshop using the Self-Modeling Spreadsheet
1, 3
$25 M to $100 M Cost Risk Assessment (CRA) Workshop
1, 2
Greater than
$100 M
Cost Estimate Validation Process (CEVP®) Workshop
2
1 In some cases it is acceptable to combine the Value Engineering Study and Risk
Based Estimating Workshop.
2 Projects $25 Million and over should use the self-modeling spreadsheet in the
scoping phase risk based estimating process, followed up by the more formal CRA
or CEVP® process during the design phase.
3 An informal workshop is comprised of the project team (or key project team
members), other participants may be included as the project manager/project team
deem necessary.
A general comparison of a few typical characteristics for CRA and CEVP®
CRA CEVP®
Workshop length 1 – 2 days 3 – 5 days
Subject Matter
Experts
Internal and local. Internal and external.
Timing (when to
hold workshop)
Anytime. Typically updated
when design changes or
other changes to the project
warrant an updated CRA.
Best to start early in the
process, major projects are
typically updated as needed.
General An assessment of risks with
an evaluation and update
of costs and schedule
estimates.
An intense workshop
that provides an external
validation of cost and
schedule estimates and
assesses risks.
Note: Workshops are orchestrated by the Cost Risk Estimating Management (CREM)
unit of the Strategic Analysis and Estimating Offce in HQ in collaboration with the
project manager. The project manager submits a workshop request and works with
the CREM unit to ascertain the type of workshop required and candidate participants.
See WSDOT Guidelines for CRA-CEVP workshops for more details.
Statement of Policy
Page xxii Project Risk Management Guidance for WSDOT Projects
July 2010
“It must be recognized that even the fnal construction estimate is of
limited accuracy and that it bears little resemblance to the advance
determination of the production costs of mass-produced goods.
Construction estimating is a relatively crude process. The absence of any
appreciable standardization together with a myriad of unique site and
project conditions make the advance computation of exact construction
expenditures a mater more of accident than design. Nevertheless, a skilled
and experienced estimator, using cost accounting information gleaned
from previous construction work of a similar nature, can do a credible job
of predicting construction disbursements despite the project imponderables
normally involved. The character of location of a construction project
sometimes presents unique problems, but some basic principle for which
there is precedent almost always apply.”
Construction Project Management 5th Edition, Sears and Clough 2008
Project Risk Management Guidance for WSDOT Projects Page 1
July 2010
Chapter 1 Risk Management Planning
Good risk management planning begins with sound project management
practices including review of organizational policies and guidance, Project
Initiation and Team Alignment, and Project Planning steps as provided
for in the WSDOT Project Management Online Guide. Risk Management
must commence early in the project development process and proceed as
project knowledge evolves and project information increases in quantity
and quality. Monitoring project development and risk exposure continues
formal risk assessments of risk may occur several times through the
life of the project. People and resources involved in the project, project
management plan development, and risk management plan development
must consider the resources needed for project risk management and build
it into their project development budget and schedule. Risk management
activities, including risk workshops (such as CRA, CEVP or other
meetings) should be part of the Project Workplan and built into the project
schedule and budget.
As the project develops and moves through scoping and early design
phases, more knowledge about the project becomes available, see
Figure 1-1. With the rising knowledge about a project’s scope comes an
understanding that contending with some elements of the project will
require signifcant additional resources. Such elements could be related
to scope, environmental mitigation and permitting, rising cost of right-of-
way as corridors develop in advance of the project, utilities, seismic and
other considerations. Traditional estimating practices tend to produce “the
number” for a project. But the single number masks the critical uncertainty
inherent in a particular project. It implies a sense of precision beyond what
can be achieved during planning, scoping or early design phases. WSDOT
has come to the understanding that an estimate is more accurately
expressed not as a single number but as a range.
To determine an accurate estimate range for both cost and schedule,
risk must be measured. Formerly, WSDOT measured risk based on the
estimator’s experience and best judgment, without explicitly identifying
the project’s uncertainties and risks. That has changed. Estimates now
comprise two components: the base cost component and the risk (or
uncertainty) component. The Base Cost represents the cost which
can reasonably be expected if the project materializes as planned. .
The base cost does not include contingencies. Once the base cost is
established, a list of risks is created of both opportunities and threats,
called a “risk register.” The risk assessment replaces general and vaguely
defned contingency with explicitly defned risk events. Risk events are
characterized in terms of probability of occurrence and the consequences
of each potential risk event.
Page 2 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
In Executive Order E 1038.00 WSDOT establishes, as policy, to
proactively assess and respond to any risks that may affect the
achievement of WSDOT’s strategic performance based objectives and
their intended outcomes. It further goes on to direct employees to support
the department’s efforts to identify, share and manage risk across all
organizations and functions. Risk reviews are an integral part of budget
development, and the intent is for the department to make informed
decisions about risk tolerance. In can be inferred that determined
Enterprise Risk Management will require comprehensive Project Risk
Management, and Project Risk Management is also a key component of a
Project Management Plan, which is required for all WSDOT projects.
We then, as stewards of the public trust, must endeavour to inform
decision-makers of the uncertainty and risk associated with the projects we
develop. We must understand risk tolerance and we must weigh the value
of project decisions with risks associated with the project.
WSDOT Project Risk Management – “How to guide” 1 Risk Management Planning rev 2009-April
2 of 9
Chapter 1 Risk Management Planning
We then, as stewards of the public trust, must endeavour to inform decision-makers of the
uncertainty and risk associated with the projects we develop. We must understand risk tolerance
and we must weigh the value of project decisions with risks associated with the project.
Figure 1-1 Evolution of Project Knowledge through Project Development
In Chapter 5 of the book “Risk, Uncertainty and Government”, it notes “…lawyers and
economists are accustomed to think of contracts for future performance as devices for allocating
risks of future events”. In order for us to understand this allocation of risk -projects must be
examined and the uncertainty and risks must be documented and characterized.
Components of Uncertainty
P
o
r
t
i
o
n
o
f
P
r
o
j
e
c
t
C
o
s
t
(
w
h
a
t
i
s
k
n
o
w
n
a
n
d
u
n
k
n
o
w
n
?
)
Unrecognized
Unknown - Unknowns
Known but not Quantified
Known - Unknowns
Known and Quantifiable
Known - Knowns
Conservative Estimate w/Allowance
Deterministic Estimate
(conservative est. w/allowance + contingency)
Contingency
Project Development Phase
Planning Programming Scoping Design/P&E Ad/Bid/Award Construct
D
e
s
ig
n
A
llo
w
a
n
c
e
s
Engineer’s
Estimate at Ad
Components of Uncertainty
P
o
r
t
i
o
n
o
f
P
r
o
j
e
c
t
C
o
s
t
(
w
h
a
t
i
s
k
n
o
w
n
a
n
d
u
n
k
n
o
w
n
?
)
Unrecognized
Unknown - Unknowns
Known but not Quantified
Known - Unknowns
Known and Quantifiable
Known - Knowns
Conservative Estimate w/Allowance
Deterministic Estimate
(conservative est. w/allowance + contingency)
Contingency
Project Development Phase
Planning Programming Scoping Design/P&E Ad/Bid/Award Construct
D
e
s
ig
n
A
llo
w
a
n
c
e
s
Engineer’s
Estimate at Ad
Evolution of Project Knowledge through Project Development
Figure 1-1
In Chapter 5 of the book “Risk, Uncertainty and Government”, it notes
“…lawyers and economists are accustomed to think of contracts for future
performance as devices for allocating risks of future events”. In order for
us to understand this allocation of risk -projects must be examined and the
uncertainty and risks must be documented and characterized.
Project Risk Management Guidance for WSDOT Projects Page 3
July 2010
Chapter 1 Risk Management Planning
WSDOT Project Risk Management – “How to guide” 1 Risk Management Planning rev 2009-April
3 of 9
Chapter 1 Risk Management Planning
We can think of risk management as depicted above, the two pillars of risk management are
“IDENTIFY and ANALYZE” the risks then, as depicted in the second pillar “RESPOND,
MONITOR and CONTROL” project risk.
Unless we incorporate the second pillar we are not realizing the full value of risk management.
When preparing our project management plan and work activities for our project, we must
include both pillars of risk management in our plan.
Risk Management
Identify
Analyze
Respond
Monitor/Control
Risk Management
Identify
Analyze
Respond
Monitor/Control
We can think of risk management as depicted above, the two pillars of risk
management are “IDENTIFY and ANALYZE” the risks then, as depicted
in the second pillar “RESPOND, MONITOR and CONTROL” project
risk.
Unless we incorporate the second pillar we are not realizing the full
value of risk management. When preparing our project management plan
and work activities for our project, we must include both pillars of risk
management in our plan.
Page 4 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Risk Management Planning
“ How to”
Project Risk Management Guidance for WSDOT Projects Page 5
July 2010
Chapter 1 Risk Management Planning
How to Plan for Project Risk Management
Do you plan to manage risk for your project? YES! Then include risk
management in your project management plan.
#1 Determine the Level of Risk Assessment for your Project (see Table
1.1).
#2 Incorporate risk management activities into the project schedule (see
Table 1.2 and Figures).
#3 Make Risk Management an agenda item for regularly scheduled
project meetings.
#4 Communicate the importance of risk management to the entire project
team.
#5 Establish the expectation that risk will be managed, documented and
reported.
Helpful Hints for Risk Management Planning
• Risk assessment should begin early, but there must be enough known
about the project to understand what is being assessed. This will
of course be to varying levels of detail depending on the point in
project development at which the risk assessment is conducted
(planning, scoping, design/ps&e) –hence schedule risk assessments
at appropriate times.
• Allow time in the schedule for prep activities, this includes review and
QA/QC of project schedules and cost estimates at appropriate times.
• Allow budget for risk assessment, risk management and risk response
activities.
• Report on status of Project Risk in regularly scheduled project
meetings.
• Know the organization’s tolerance for risk. –are project managers (and
upper management) risk averse or risk seeking? How much risk is the
organization will to accept? Knowing the answers to these questions
will help with risk management and contribute to the decision-making
process when determining risk-response actions.
Page 6 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Project
Size ($M)
Risk Assessment Level Notes
L
e
s
s
F
o
r
m
a
l
R
i
s
k
A
s
s
e
s
s
m
e
n
t
0 to 10
Project Team Risk Assessment
Project Management
Online Guide (PMOG) Risk
Management Plan
Qualitative Tool
The Project team assesses each identifed
risk for its probability of occurrence and its
impact on project objectives. Project teams
may request assistance from subject matter
experts or functional units to assess the risks
in their respective felds. The self-modeling
spreadsheet can be used for any project.
10 to 25
Project Team Risk Assessment
Self-Modeling Spreadsheet
Quantitative Tool
M
o
r
e
F
o
r
m
a
l
R
i
s
k
A
s
s
e
s
s
m
e
n
t
(
W
o
r
k
s
h
o
p
s
)
25 to 100
Cost Risk Assessment
(CRA) Workshop
Quantitative Tool
The team, working collaboratively with
independent subject matter experts, reviews
and/or validates cost and schedule estimating
and identifes, characterizes and analyzes
risks. Accomplished in a structured workshop
setting. Modeling can be accomplished with off
the shelf software or using the self-modeling
spreadsheet.
Over 100
Cost Estimate Validation
Process (CEVP) Workshop
Quantitative Tool
Determine the Level of Risk Assessment
Table 1-1
Less Formal Risk Assessment
(does not require a Formal Workshop)
Milestones include:
Formal Workshop (CRA/CEVP)
Milestones include:
• Project Scope, Schedule and Estimate are
complete (apt for the level of development)
• Prep meeting (initial review of areas of
concern, determine tool qualitative or self-
modeling)
• Risk Meeting (risks are identifed and
characterized)
• Risk Response Actions Developed
• Risk Response Actions Implemented
• Workshop Request Form submitted
• Project Scope, Schedule and Estimate are
complete (apt for the level of development)
• Prep Session (fowchart project; determine
subject matter experts; additional prep items)
• Workshop
• Preliminary Results Presented
• Draft Report
• Final Report
Include Risk Management Milestones in the project schedule.
Table 1-2
Project Risk Management Guidance for WSDOT Projects Page 7
July 2010
Chapter 1 Risk Management Planning
S
i
m
p
l
i
f
e
d
W
o
r
k
s
h
o
p
T
i
m
e
l
i
n
e
F
i
g
u
r
e
1
-
2
Page 8 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Project Risk Management Guidance for WSDOT Projects Page 9
July 2010
Risk Management Schedule
(with workshop activities and post workshop activities)
Figure 1-3
WSDOT Project RiskManagement – “How to guide” 1 Risk Management Planning rev 2009-April
8 of 9
Chapter 1RiskManagement Planning
Figure1-3 Risk Management Schedule(with workshop activities and post workshop activities)
Page 10 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page 11
July 2010
Chapter 2 Risk Identifcation
Risk identifcation occurs through each of the four phases of project
development:
1. Planning
2. Scoping
3. Design/Plans, Specifcations and Estimate (Engineer’s Estimate)
4. Construction
As projects evolve through project development so too the risk profle
evolves project knowledge and understanding grows; hence previously
identifed risks may change and new risks identifed throughout the life of
the project.
Risk Identifcation: Inputs, Tools and Techniques, Outputs
Risk Identifcation Inputs
The frst and most important input is a defned project. In order to
fully understand and assess the risks that our projects are exposed to
we must frst insure that there is a mutual understanding of the project
under evaluation. This means that when we embark to meaningfully and
deliberately focus on the risks and uncertainties our project will face, we
must frst be able to defne the project in terms of scope, schedule and
estimate -commensurate with the level of project development at the time
of risk analysis.
Projects tend to develop in small steps; this incremental process of project
development is termed, by some, progressive elaboration. “Progressive
elaboration means developing in steps, and continuing by increments. For
example, the project scope will be broadly described early in the project
and made more explicit and detailed as the project team develops a better
and more complete understanding of the objectives and deliverables.
Progressive elaboration should not be confused with scope creep.”
PMBOK
Risk Identifcation Tools and Techniques
Try to identify as many risks as possible that may affect project objectives.
State the assumptions for risk identifcation and analysis and delineate
thresholds for risks. For example a project team may want to describe
all cost risks below $100,000 as minor and all schedule risks less than
2 weeks as minor thereby not spending inordinate amounts of time
on those risks and allowing them to focus on more signifcant risks
(assumptions and thresholds for risk assessment will be infuenced by the
size and complexity of the project, project environment, and the owners’
Page 12 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
tolerance for risk). There are a wide variety of techniques used for risk
identifcation. Some common techniques, used at WSDOT are provided
below.
Documentation Reviews
Peer level reviews of project documentation, studies, reports, preliminary
plans, estimates and schedules are a common and early method to help
identify risks that may affect project objectives.
Information Gathering
• Brainstorming Formal and informal brainstorming sessions with
project team members and extended project team members such as
specialty groups, stakeholders and regulatory agency representatives
is a technique for risk identification.. This technique can be scaled
for use on the simplest to the most complex projects. This technique
can also be tailored to specific areas of interest for the project risk,
for example if a project manager is most concerned about Geotech
conditions a brainstorming session on Geotech can be convened, and
so forth.
• Lessons Learned Database Searching for lessons learned using key-
words in the WSDOT lessons learned database that are relevant to
your project can provide an abundance of information on projects that
may have faced similar risks.
• Other methods There are many techniques, some common techniques
include: questionnaires and surveys, interviewing, checklists, and
examination of the Work Breakdown Structure for the project with
appropriate specialty groups, asking “what-if’ questions, for example
“what-if we miss the fsh window?” or “what-if our environmental
documentation is challenged and we have to prepare an EIS?” etc.
Risk Identifcation Outputs
An expected deliverable from Risk Identifcation includes a preliminary
“risk register” which documents the following information:
Identifcation # for each risk identifed
A unique number is assigned to each risk for tracking purposes. If
available this can be done utilizing an established Risk Breakdown
Structure (RBS); the WSDOT RBS is provided in the appendix of this
document.
Date and phase of project development when risk was identifed
Document the date the risk was identifed and which project development
phase (planning, scoping, design/PS&E, construction).
Project Risk Management Guidance for WSDOT Projects Page 13
July 2010
Chapter 2 Risk Identifcation
Name of Risk (does the risk pose a threat or present an opportunity?)
Each identifed risk should have an appropriate name, for example
“NEPA Delay” or “Reduction in Condemnation”; the nature of the risk
with respect to project objectives (threat or opportunity) should also be
documented. This can be done using the Risk Breakdown Structure (RBS)
for naming conventions.
Detailed Description of Risk Event
The detailed description of the identifed risk; the description must be
provide information that is Specifc, Measurable, Attributable (a cause is
indicated), Relevant, and Time bound (SMART). The description must
be clear enough and thorough enough so that others reading about the
description of the risk will understand what it means.
Risk Trigger
Each identifed risk must include the risk trigger(s). Risks rarely just
suddenly occur; usually there is some warning of imminent threat
or opportunity. These warning signs should be clearly described and
information about the risk trigger should be documented. For example
“NEPA Approval Date” may be considered a risk trigger on a project that
has a risk of a legal challenge, or other as appropriate.
Risk Type
Does the identifed risk affect project schedule, cost, or both?
Potential Responses to Identifed Risk
Document, if known, possible response actions to the identifed risk
–can the identifed threat be avoided, transferred, mitigated or is it to
be accepted? Can the identifed opportunity be exploited, shared or
enhanced?
Comments about Risk Identifcation
Risk Management is an iterative process; risks should be reviewed
regularly and as new risks are identifed they should be documented and
assessed. The resulting risk register should only be considered preliminary
until the completion of additional and appropriate activities that may
include any or all of the techniques listed above and/or more robust
processes such as Cost Risk Assessment and Cost Estimate Validation
Process (CRA/CEVP) workshops. More detail about the WSDOT
workshops for CRA/CEVP is offered later in this document, and at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/
Page 14 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Identify Risk Events
How to Identify Risk
#1 Determine risk thresholds for the project (establish a minimum dollar
amount and time duration considered signifcant for the project under
evaluation).
#2 Focus on identifying large signifcant risks which affect project
objectives.
#3 Carefully document and describe risks in a risk register.
HELPFUL HINTS FOR RISK IDENTIFICATION
• Determine, for your project, what constitutes “significant” risk.
• Thoroughly describe the risk – there is a form in the following pages
to help with this or you may create your own.
• Include specialty groups and/or other persons who may have
meaningful input regarding the challenges the project may face.
• Determine who “owns” the risk and who will develop a response.
Brainstorming - is an effective method. Brainstorming can range from a small informal project team
effort for simpler projects to a full-blown CEVP workshop. Effective brainstorming requires a skilled
facilitator, working together with the project team and specialists who can bring additional expertise.
Checklists and/or Questionnaires to `specialty groups - checklists/questionnaires are a quick
and easy-to-use technique but limited in nature; they only deal with the items on the list. Each project
is unique; hence a standard list will often not capture the project specifc risks of most concern.
Nonetheless a checklist/questionnaire can spark thinking prior to a more formal brainstorming process.
Examination of past similar projects - lessons learned from past projects help us to avoid repeating
mistakes; using past examples requires prudent and objective judgment, since a previous project may
be similar but is nonetheless different because each new project has unique requirements and features,
including uncertainties and risks.
WSDOT Lessons Learned website:
http://eefmapps.wsdot.wa.gov/fmi/xsl/Lessons/Main.xsl?-db=DebriefReport&-lay=LessonWebForm&Mo
nthlyHighlight=Yes&-fnd
Combination of above methods and/or others - It is quite likely that for most projects a combination
of the above methods will be used to identify risks. The important thing is that once identifed the risks
are properly documented.
Figure 2-1 Blank template for documenting identifed risks (tailor to your needs).
Figure 2-2 Example of how template is used.
Figure 2-3 Risk Breakdown Structure for categorizing and organizing risks.
Figure 2-4 Example of risk identifcation using spreadsheet from Project Management Online
Guide found at: http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-
Construction/Pre-Construction_fles/slide0001.htm
Risk Identifcation
Table 2.1
Project Risk Management Guidance for WSDOT Projects Page 15
July 2010
Chapter 2 Risk Identifcation
P
r
e
-
m
i
t
i
g
a
t
e
d
E
X
A
M
P
L
E
O
N
L
Y
R i s k #
S t a t u s
D e p e n d e n c y
P r o j e c t P h a s e
S
u
m
m
a
r
y
D
e
s
c
r
i
p
t
i
o
n
T
h
r
e
a
t
a
n
d
/
o
r
O
p
p
o
r
t
u
n
i
t
y
D
e
t
a
i
l
e
d
D
e
s
c
r
i
p
t
i
o
n
o
f
R
i
s
k
E
v
e
n
t
(
S
p
e
c
i
f
ic
,
M
e
a
s
u
r
a
b
l
e
,
A
t
t
r
i
b
u
t
a
b
le
,
R
e
le
v
a
n
t
,
T
im
e
b
o
u
n
d
)
[
S
M
A
R
T
]
R
i
s
k
T
r
i
g
g
e
r
T y p e
P r o b a b i l i t y
C o r r e l a t i o n
(
1
)
(
2
)
(
3
)
(
5
)
(
6
)
(
7
)
(
8
)
(
9
)
(
1
0
)
[
1
0
a
]
(
1
1
)
T
h
r
e
a
t
M
I
N
0
.
5
0
$
M
M
A
X
7
.
0
0
$
M
M
o
s
t
L
ik
e
l
y
1
.
5
0
$
M
0
M
a
s
t
e
r
D
u
r
a
t
i
o
n
R
i
s
k
M
I
N
1
.
0
M
o
M
A
X
6
.
0
M
o
T
h
r
e
a
t
M
o
s
t
L
ik
e
l
y
2
.
0
M
o
R
i
s
k
I
m
p
a
c
t
(
$
M
o
r
M
o
)
A c t i v e
C o n s t r u c t i o n
A
l
t
h
o
u
g
h
s
i
g
n
i
f
i
c
a
n
t
p
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
s
a
r
e
t
o
b
e
c
o
n
d
u
c
t
e
d
t
h
e
r
e
i
s
s
t
i
l
l
s
o
m
e
r
i
s
k
o
f
u
n
d
i
s
c
o
v
e
r
e
d
s
u
b
s
u
r
f
a
c
e
c
o
n
t
a
m
i
n
a
n
t
s
i
n
t
h
i
s
p
r
o
j
e
c
t
.
I
f
t
h
e
s
e
c
o
n
t
a
m
i
n
a
n
t
s
a
r
e
d
i
s
c
o
v
e
r
e
d
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
i
t
c
a
n
i
m
p
a
c
t
b
o
t
h
c
o
s
t
a
n
d
s
c
h
e
d
u
l
e
.
B
e
c
a
u
s
e
o
f
t
h
e
n
a
t
u
r
e
o
f
t
h
e
p
r
o
j
e
c
t
c
o
r
r
i
d
o
r
t
h
e
a
r
e
a
o
f
g
r
e
a
t
e
s
t
c
o
n
c
e
r
n
i
s
i
n
t
h
e
l
a
t
t
e
r
h
a
l
f
o
f
t
h
e
p
r
o
j
e
c
t
,
h
e
n
c
e
o
u
r
e
x
p
o
s
u
r
e
i
s
p
r
i
m
a
r
i
l
y
d
u
r
i
n
g
t
h
e
s
e
c
o
n
d
y
e
a
r
o
f
c
o
n
s
t
r
u
c
t
i
o
n
.
D
u
r
i
n
g
C
o
n
s
t
r
u
c
t
i
o
n
-
d
i
s
c
o
v
e
r
y
o
f
s
u
b
s
u
r
f
a
c
e
H
a
z
a
r
d
o
u
s
M
a
t
e
r
i
a
l
s
S c h e d u l e
R
I
S
K
T
R
I
G
G
E
R
D
e
t
a
i
l
s
(
a
n
d
d
u
r
a
t
i
o
n
o
f
e
x
p
o
s
u
r
e
t
o
t
h
i
s
r
i
s
k
)
:
T
h
e
t
r
i
g
g
e
r
f
o
r
t
h
i
s
r
i
s
k
i
s
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
u
c
t
i
o
n
.
O
u
r
p
r
o
j
e
c
t
i
s
o
v
e
r
4
m
i
l
e
s
i
n
l
e
n
g
t
h
,
t
h
e
a
r
e
a
o
f
m
o
s
t
c
o
n
c
e
r
n
,
f
o
r
e
x
p
o
s
u
r
e
t
o
u
n
k
n
o
w
n
s
u
b
s
u
r
f
a
c
e
m
a
t
e
r
i
a
l
s
,
i
s
i
n
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
;
t
h
i
s
c
o
n
s
t
r
u
c
t
i
o
n
i
s
e
x
p
e
c
t
e
d
t
o
o
c
c
u
r
i
n
t
h
e
f
i
n
a
l
1
2
m
o
n
t
h
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
(
~
M
a
r
c
h
2
0
1
5
t
o
M
a
r
c
h
2
0
1
6
)
.
R
i
s
k
M
a
t
r
i
x
N
O
T
E
S
:
T
h
i
s
r
i
s
k
h
a
s
b
e
e
n
d
i
s
c
u
s
s
e
d
f
o
r
s
o
m
e
t
i
m
e
a
n
d
o
u
r
c
o
n
c
e
r
n
s
a
r
e
k
n
o
w
n
b
y
m
a
n
a
g
e
m
e
n
t
a
n
d
r
e
g
i
o
n
a
l
s
t
a
k
e
h
o
l
d
e
r
s
.
P
O
S
S
I
B
L
E
R
E
S
P
O
N
S
E
S
T
R
A
T
E
G
I
E
S
T
O
E
X
P
L
O
R
E
:
(
1
)
e
v
e
n
t
h
o
u
g
h
a
t
h
o
r
o
u
g
h
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
i
s
p
l
a
n
n
e
d
w
e
m
a
y
w
a
n
t
t
o
g
o
a
b
o
v
e
a
n
d
b
e
y
o
n
d
,
p
a
r
t
i
c
u
l
a
r
l
y
w
h
e
n
i
n
v
e
s
t
i
g
a
t
i
n
g
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
t
h
i
s
p
r
o
j
e
c
t
;
(
2
)
i
n
v
e
s
t
i
g
a
t
e
t
h
e
u
s
e
o
f
G
r
o
u
n
d
P
e
n
e
t
r
a
t
i
o
n
R
a
d
a
r
;
(
3
)
l
o
o
k
a
t
s
t
r
a
t
e
g
i
e
s
f
o
r
r
e
d
u
c
i
n
g
p
r
o
j
e
c
t
f
o
o
t
p
r
i
n
t
s
o
a
s
t
o
m
i
n
i
m
i
z
e
a
r
e
a
w
e
a
r
e
d
i
s
t
u
r
b
i
n
g
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
.
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
C o s t
3
0
%
C N S 4 0
V
H
HML
V
L
V
L
L
M
H
V
H
I
m
p
a
c
t
P r o b a b i l i t y
S
Þ
L
C
I
I
I
C
Þ
r
o
v
l
d
e
a
w
e
l
l
w
r
l
L
L
e
n
d
e
L
a
l
l
e
d
d
e
s
c
r
l
p
L
l
o
n
o
f
L
h
e
8
l
s
k
L
v
e
n
L
.
W
h
a
L
l
s
L
h
e
s
p
e
c
l
f
l
c
l
s
s
u
e
o
f
c
o
n
c
e
r
n
?
M
L
A
S
U
k
A
8
L
L
Þ
r
o
b
a
b
l
l
l
L
y
o
f
8
l
s
k
L
v
e
n
L
C
c
c
u
r
l
n
g
?
C
o
n
s
e
q
u
n
c
e
l
f
l
L
d
o
e
s
C
c
c
u
r
?
(
l
m
p
a
c
L
L
o
c
o
s
L
a
n
d
s
c
h
e
d
u
l
e
)
A
1
1
k
I
8
U
1
A
8
L
L
W
h
a
L
w
l
l
l
L
r
l
g
g
e
r
(
c
a
u
s
e
)
L
h
l
s
r
l
s
k
?
P
o
w
d
o
w
e
k
n
o
w
?
W
h
o
o
w
n
s
L
h
l
s
r
l
s
k
?
k
L
L
L
V
A
N
1
W
h
y
l
s
L
h
l
s
r
l
s
k
l
m
p
o
r
L
a
n
L
L
o
o
u
r
p
r
o
[
e
c
L
?
W
l
l
l
l
L
l
m
p
a
c
L
p
r
o
[
e
c
L
o
b
[
e
c
L
l
v
e
s
?
l
s
l
L
c
r
l
L
l
c
a
l
?
1
I
M
L
8
C
U
N
D
8
l
s
k
s
h
a
v
e
a
"
s
h
e
l
f
l
l
f
e
"
-
L
h
a
L
l
s
o
u
r
p
r
o
[
e
c
L
l
s
n
o
L
e
x
p
o
s
e
d
L
o
s
p
e
c
l
f
l
c
r
l
s
k
e
v
e
n
L
s
l
n
d
e
f
l
n
L
e
l
y
-
w
h
e
n
a
r
e
w
e
a
L
r
l
s
k
?
Þ
C
1
L
N
1
I
A
L
k
L
S
Þ
C
N
S
L
A
C
1
I
C
N
S
?
l
f
p
o
L
e
n
L
l
a
l
m
l
L
l
g
a
L
l
o
n
s
L
r
a
L
e
g
l
e
s
a
r
e
m
e
n
L
l
o
n
e
d
b
e
s
u
r
e
L
o
c
a
p
L
u
r
e
L
h
e
m
s
o
L
h
e
y
c
a
n
b
e
m
o
r
e
f
u
l
l
y
e
x
p
l
o
r
e
d
l
a
L
e
r
.
Page 16 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
?
?
P
r
e
-
m
i
t
i
g
a
t
e
d
E
X
A
M
P
L
E
O
N
L
Y
R i s k #
S t a t u s
D e p e n d e n c y
P r o j e c t P h a s e
S
u
m
m
a
r
y
D
e
s
c
r
i
p
t
i
o
n
T
h
r
e
a
t
a
n
d
/
o
r
O
p
p
o
r
t
u
n
i
t
y
D
e
t
a
i
l
e
d
D
e
s
c
r
i
p
t
i
o
n
o
f
R
i
s
k
E
v
e
n
t
(
S
p
e
c
i
f
i
c
,
M
e
a
s
u
r
a
b
l
e
,
A
t
t
r
i
b
u
t
a
b
l
e
,
R
e
l
e
v
a
n
t
,
T
i
m
e
b
o
u
n
d
)
[
S
M
A
R
T
]
R
i
s
k
T
r
i
g
g
e
r
T y p e
P r o b a b i l i t y
C o r r e l a t i o n
(
1
)
(
2
)
(
3
)
(
5
)
(
6
)
(
7
)
(
8
)
(
9
)
(
1
0
)
[
1
0
a
]
(
1
1
)
T
h
r
e
a
t
M
I
N
0
.
5
0
$
M
M
A
X
7
.
0
0
$
M
M
o
s
t
L
i
k
e
l
y
1
.
5
0
$
M
0
M
a
s
t
e
r
D
u
r
a
t
i
o
n
R
i
s
k
M
I
N
1
.
0
M
o
M
A
X
6
.
0
M
o
T
h
r
e
a
t
M
o
s
t
L
i
k
e
l
y
2
.
0
M
o
R
I
S
K
T
R
I
G
G
E
R
D
e
t
a
i
l
s
(
a
n
d
d
u
r
a
t
i
o
n
o
f
e
x
p
o
s
u
r
e
t
o
t
h
i
s
r
i
s
k
)
:
T
h
e
t
r
i
g
g
e
r
f
o
r
t
h
i
s
r
i
s
k
i
s
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
u
c
t
i
o
n
.
O
u
r
p
r
o
j
e
c
t
i
s
o
v
e
r
4
m
i
l
e
s
i
n
l
e
n
g
t
h
,
t
h
e
a
r
e
a
o
f
m
o
s
t
c
o
n
c
e
r
n
,
f
o
r
e
x
p
o
s
u
r
e
t
o
u
n
k
n
o
w
n
s
u
b
s
u
r
f
a
c
e
m
a
t
e
r
i
a
l
s
,
i
s
i
n
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
;
t
h
i
s
c
o
n
s
t
r
u
c
t
i
o
n
i
s
e
x
p
e
c
t
e
d
t
o
o
c
c
u
r
i
n
t
h
e
f
i
n
a
l
1
2
m
o
n
t
h
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
(
~
M
a
r
c
h
2
0
1
5
t
o
M
a
r
c
h
2
0
1
6
)
.
R
i
s
k
M
a
t
r
i
x
N
O
T
E
S
:
T
h
i
s
r
i
s
k
h
a
s
b
e
e
n
d
i
s
c
u
s
s
e
d
f
o
r
s
o
m
e
t
i
m
e
a
n
d
o
u
r
c
o
n
c
e
r
n
s
a
r
e
k
n
o
w
n
b
y
m
a
n
a
g
e
m
e
n
t
a
n
d
r
e
g
i
o
n
a
l
s
t
a
k
e
h
o
l
d
e
r
s
.
P
O
S
S
I
B
L
E
R
E
S
P
O
N
S
E
S
T
R
A
T
E
G
I
E
S
T
O
E
X
P
L
O
R
E
:
(
1
)
e
v
e
n
t
h
o
u
g
h
a
t
h
o
r
o
u
g
h
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
i
s
p
l
a
n
n
e
d
w
e
m
a
y
w
a
n
t
t
o
g
o
a
b
o
v
e
a
n
d
b
e
y
o
n
d
,
p
a
r
t
i
c
u
l
a
r
l
y
w
h
e
n
i
n
v
e
s
t
i
g
a
t
i
n
g
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
t
h
i
s
p
r
o
j
e
c
t
;
(
2
)
i
n
v
e
s
t
i
g
a
t
e
t
h
e
u
s
e
o
f
G
r
o
u
n
d
P
e
n
e
t
r
a
t
i
o
n
R
a
d
a
r
;
(
3
)
l
o
o
k
a
t
s
t
r
a
t
e
g
i
e
s
f
o
r
r
e
d
u
c
i
n
g
p
r
o
j
e
c
t
f
o
o
t
p
r
i
n
t
s
o
a
s
t
o
m
i
n
i
m
i
z
e
a
r
e
a
w
e
a
r
e
d
i
s
t
u
r
b
i
n
g
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
.
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
C o s t
3
0
%
C N S 4 0
S c h e d u l e
A c t i v e
C o n s t r u c t i o n
A
l
t
h
o
u
g
h
s
i
g
n
i
f
i
c
a
n
t
p
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
s
a
r
e
t
o
b
e
c
o
n
d
u
c
t
e
d
t
h
e
r
e
i
s
s
t
i
l
l
s
o
m
e
r
i
s
k
o
f
u
n
d
i
s
c
o
v
e
r
e
d
s
u
b
s
u
r
f
a
c
e
c
o
n
t
a
m
i
n
a
n
t
s
i
n
t
h
i
s
p
r
o
j
e
c
t
.
I
f
t
h
e
s
e
c
o
n
t
a
m
i
n
a
n
t
s
a
r
e
d
i
s
c
o
v
e
r
e
d
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
i
t
c
a
n
i
m
p
a
c
t
b
o
t
h
c
o
s
t
a
n
d
s
c
h
e
d
u
l
e
.
B
e
c
a
u
s
e
o
f
t
h
e
n
a
t
u
r
e
o
f
t
h
e
p
r
o
j
e
c
t
c
o
r
r
i
d
o
r
t
h
e
a
r
e
a
o
f
g
r
e
a
t
e
s
t
c
o
n
c
e
r
n
i
s
i
n
t
h
e
l
a
t
t
e
r
h
a
l
f
o
f
t
h
e
p
r
o
j
e
c
t
,
h
e
n
c
e
o
u
r
e
x
p
o
s
u
r
e
i
s
p
r
i
m
a
r
i
l
y
d
u
r
i
n
g
t
h
e
s
e
c
o
n
d
y
e
a
r
o
f
c
o
n
s
t
r
u
c
t
i
o
n
.
D
u
r
i
n
g
C
o
n
s
t
r
u
c
t
i
o
n
-
d
i
s
c
o
v
e
r
y
o
f
s
u
b
s
u
r
f
a
c
e
H
a
z
a
r
d
o
u
s
M
a
t
e
r
i
a
l
s
R
i
s
k
I
m
p
a
c
t
(
$
M
o
r
M
o
)
V
H
HM
L
V
L
V
L
L
M
H
V
H
I
m
p
a
c
t
P r o b a b i l i t y
Project Risk Management Guidance for WSDOT Projects Page 17
July 2010
Chapter 2 Risk Identifcation
Blank Template For Documenting Identifed Risks (Tailor to Your Needs)
Figure 2-1
Project Title: CN Duration Estimate Risk ID Sheets.xls
Project Manager: PE Estimate
Date Risk Identified: RW Estimate
CN Estimate
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN
MAX
Most Likely
0Master Duration Risk
MIN
MAX
Threat Most Likely
Supplemental notes about this risk event
Risk Trigger Details: Risk Matrix
Risk Owner:
Risk Breakdown Structure # (RBS#)
Work Breakdown Stucture # (WBS#)
Critical Path (yes or no)
Response Actions (action to be taken)
Action by date:
Status review date:
Status review date:
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Risk Impact
($M or Mo)
1
R
e
t
i
r
e
d
S
c
h
e
d
u
l
e
C
o
n
s
t
r
u
c
t
i
o
n
C
o
s
t
VH
H
M
L
VL
VL L M H VH
P
r
o
b
a
b
i
l
i
t
y
Impact
Page 18 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Example of How Template is Used
Figure 2-2
Project Title: Risk Management Guide Example CN Duration Estimate 10.0Mo Risk ID Sheets.xls
Project Manager: Scott Adams PE Estimate 2.0 $M
Date Risk Identified: 1-Feb-29 RW Estimate 8.0 $M
CN Estimate 30.0 $M
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN 0.25$M
MAX 2.00$M
Most Likely 0.50$M
0Master Duration Risk
MIN 1.0Mo
MAX 8.0Mo
Threat Most Likely 5.0Mo
Supplemental notes about this risk event
Risk Trigger Details: Should know by the ides of March. Risk Matrix
Risk Owner: Mr. Ule Givens
Risk Breakdown Structure # (RBS#) ENV 30.1
Work Breakdown Stucture # (WBS#) PC-18
Critical Path (yes or no) yes
Response Actions (action to be taken)
One of the best tools we have to avoid this risk is a concerted, committed & sustained effort
to address env. permits upfront & thoroughly. Including verification of jurisdictions
and parties of concern and clarify understanding and expectations of all parties.
To this end we will form a team to puruse this effort with appropriate representatives from
each permitting authority with review dates and commitments.
Action by date: February 30, 2929
Status review date: March 32, 2929
Status review date: April 31, 2929
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Communication with parties. Project Mgr NOW
Succession plan for staff changes. Business Mgr 2929-Feb
Decisions ASAP on design elements. Executive Oversight 2929-March
Risk Impact
($M or Mo)
1
R
e
t
i
r
e
d
70%
Permits and
Permit Appeals
S
c
h
e
d
u
l
e
P
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
Complex project, might require additional time (longer than
average) to review. Potential agency staff changes. Tribal
issues includefishingrights, effects on fish and habitat, and
other environmental concerns.
Appeals can bemadeon any of themajor permits, whether
based on actual issues with thepermits or not. Thefollowing
specific issues werehighlighted:
• Shoreline permits from various jurisdictions are of particular
concern shorelinepermits areeasy to challengeand typically
result in significant delays. Thereis aprocess to weed out
frivolous appeals.
• New NPDES outfalls (appealable)
• HPA issues with WDFW
Coast Guard permits for THE channel.
Determination
decisions by several
agencies.
Revisions to our
estimated areas of
impact.
C
o
s
t
VH
H $,Mo
M
L
VL
VL L M H VH
Impact
P
r
o
b
a
b
i
l
i
t
y
Project Risk Management Guidance for WSDOT Projects Page 19
July 2010
Chapter 2 Risk Identifcation
Risk Breakdown Structure
Figure 2-3a
Level 1 Project Risk
--------------------
----
Level 2
Environmental &
Hydraulics
Structures & Geotech Design / PS&E Right-of-Way (including
Access and Acquisition)
Utilities Railroad Partnerships and
Stakeholders
Management / Funding Contracting and
Procurement
Construction
ENV STG DES ROW UTL RR PSP MGT CTR CNS
--------------------
----------
ENV 10
NEPA/SEPA Documentation
Completion (incl. Section 4f,
etc.)
----------------
NEPA/SEPA Challenges
STG 10
Potential Changes to
Structures Design (Bridge
Superstructure, Retaining
Walls)
DES 10
Potential Changes to roadway design
(including vertical and/or horizontal
alignment, earthwork, pavement,
etc.)
ROW 10
Issues Associated with
Development of ROW Plan
UTL 10
Utility Design Coordination
and Agreements
RR 10
Railroad Design
Coordination and
Agreements
PSP 10
Tribal Issues
MGT 10
Change in Project Managers
and/or other key Leadership
CTR 10
Change in Project Delivery
Method
CNS 10
Traffic Control and Staging
Issues (MOT/WZTC)
ENV 20
ESA Issues (incl.
consultation, Biologic
Assessments/Biological
Opinions, Fish Passage)
STG 20
Potential Changes to
Geotechnical Design
Foundations, Liquefaction,
Mitigation, etc.
------------------ Challenging
Geotech Conditions
DES 20
Approval of Design Deviations
----------------
Changes to roadway design criteria
(i.e. shoulder width, sight distance,
etc.)
ROW 20
Uncertainty in Future ROW
Escalation Rate (Project-
Specific, including change in
land use, urbanization, etc.)
UTL 20
Utility relocations and
conflicts
RR 20
Railroad Coordination during
construction (flagging, work
restrictions, work windows,
etc.)
PSP 20
Public Involvement Issues
-------------------------
Other Interagency
Agreements (i.e. Sound
Transit, USFS, cities,
counties, etc.)
MGT 20
Delayed Decision Making
CTR 20
Issues Related to Contract
Language (Contract
Packaging, Warranties,
Liquidated Damages, DBE,
Insurance/Bonding, etc.)
CNS 20
Construction Permitting
Issues (incl. work
restrictions)
ENV 30
Environmental Permitting
(incl. Appeals)
STG 30
Changes to Structural
Design Criteria (e.g.,
seismic)
DES 30
Changes to Architectural, CSS,
Landscape Design
ROW 30
Limited Access (Interchange
Justification Report - IJR,
Access Hearing, etc.)
RR 30
Contractor Right of Entry
Requirements
PSP 30
Additional Scope in
Response to Third Party
Concerns (e.g., artwork,
shared-use pathways,
intersection improvements,
etc.)
MGT 30
Availability of Funding / Cash
Flow Restrictions
CTR 30
Delays in Ad/Bid/Award
Process (Addenda, Protests,
etc.)
CNS 30
Work Windows (Weather,
Fish, etc.)
ENV 40
Archaeological/Cultural
Discoveries, historic property
impacts & mitigation
(Section 106)
DES 40
Projects by other agencies affected
by or affecting this project (design
coordination)
ROW 40
Managed Access (Appeal
Hearing, etc.)
MGT 40
Political/Policy Changes
CTR 40
Market Conditions (non-
competitive bidding
environment)
Lack of Qualified Bidders
CNS 40
Construction Schedule
Uncertainty (general,
including timing of award)
ENV 50
Hazardous Materials
Groundwater and Soil
Contamination (PE,
RW, CN)
DES 50
Potential Changes to Design of
Permanent Traffic Items (ITS,
Illumination, Intersection, etc.)
ROW 50
ROW Acquisition Issues
(condemnation, relocations,
demolitions, etc.)
MGT 50
State Workforce Limitations
CTR 50
Delays in Procurement of
Specialty Materials or
Equipment and associated
cost premiums
CNS 50
Marine/ Over Water
Construction Issues
ENV 60
Wetlands / Stream / Habitat
Mitigation
DES 60
Design / PS&E Reviews
----------------
Additional Scope Driven by Internal
Considerations (e.g., Maintenance,
Traffic Projections, Tolling, extend
project terminii, change to purpose
and need, etc.)
ROW 60
Additional ROW is required
(including full vs partial
takes): Temporary and
Permanent Access Breaks -
FHWA approval
-----------------
Construction / Subterranean
Easements
CTR 60
Contractor Non-
Performance
CNS 70
Earthwork Issues (re-use,
haul, disposal, etc.)
ENV 70
Stormwater, Potential
Changes to Flow Control or
Runoff Treatment/Hydraulic
Requirements
CTR 70
Availability of Specialty
Labor/Labor and/or
Productivity Disruptions
CNS 80
Coordination with Adjacent
Projects During Construction
ENV 80 Environmental
Impacts during Construction
(includng water quality,
TESC etc.)
CNS 90
Contractor Access / Staging
Coordination and
Constructability Issues
ENV 90
Permanent Noise Mitigation
CNS 100
Construction Accidents
ENV 900
Other Environmental Issues
STR 900
Other STR Issues
DES 900 Other
Design Issues
ROW 900
Other ROW Issues
UTL 900
Other UTL Issues
RR 900
Other RR Issues
PSP 900
Other PSP Issues
MGT 900
Other MGT Issues
CTR 900
Other CTR Issues
CNS 900
Other Construction Issues
(including unanticipated
change orders/claims)
-------------
L
e
v
e
l 3
Page 20 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Risk Breakdown Structure (Example of use)
Figure 2-3b
The RBS provides several functions and benefits to the project team and to management, including:
1) Consistency with taxonomy (wording);
2) Organizes risk events into common categories;
3) Helps to identify trends with respect to common usage of risk event categories & event types along with their probability and impact values;
4) Helps to identify common risk events among projects that the Region and HQ offices should be aware of due to their potential cumulative effects; e.g. negotiating agreements with agencies or other municipalities;
5) Provides a basis to work from for risk elicitors during CEVP workshops;
6) Provides a basis for development of independent risk surveys for those that are unable to attend a CEVP workshop.
This RBS serves as a starting point in assessing project risks in CEVP and CRA workshops; and also for smaller projects that may not conduct a formal workshop.
RBS CODE PROBABILITY
IMPACT
($) (TIME)
ENV 10.01 As a result of… 70% Ï$5M 8 weeks
ENV 10.02 Because of… 10% Ï$0.1M 6 months
ENV 10.03 Due to… 10% Ï$0.1M 4 months
public pressure and internal reviews
a challenge to the level of environmental documentation may
occur,
resulting in the need to prepare an EIS, adding scope and
cost and lengthening the schedule.
reviews by WSDOT Environmental
the design information may be deemed inadequate for
NEPA/SEPA approval
leading to additional design work, added cost, and schedule
delays.
the public involvement process a challenge to the NEPA/SEPA document may occur which would delay delivery of the EA document.
RISK TRIGGER
(CAUSE or PRECIPITATING EVENT)
RISK EVENT
CONSEQUENCE
(effect on project objectives)
Project Risk Management Guidance for WSDOT Projects Page 21
July 2010
Chapter 2 Risk Identifcation
Spreadsheet from Project Management Online Guide
Figure 2-4
Page 22 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Project Risk Management Guidance for WSDOT Projects Page 23
July 2010
Chapter 3 Qualitative Risk Analysis
Qualitative Risk Analysis assesses the impact and likelihood of the
identifed risks and develops prioritized lists of these risks for further
analysis or direct mitigation.
The team assesses each identifed risk for its probability of occurrence
and its impact on project objectives. Project teams may elicit assistance
from subject matter experts or functional units to assess the risks in their
respective felds. (WSDOT PMOG)
Qualitative analysis is often used as…
• an initial screening or review of project risks;
• when a quick assessment is desired;
• the preferred approach for some simpler and smaller projects where
robust and/or lengthy quantitative analysis is not necessary.
Qualitative - observations that do not involve measurements and numbers.
EXAMPLE the risk of a heavy rainstorm affecting our erosion control is
“Very High”.
Qualitative assessment - An assessment of risk relating to the qualities and
subjective elements of the risk –those that cannot be quantifed accurately.
Qualitative techniques include the defnition of risk, the recording of risk details
and relationships, and the categorization and prioritization of risk relative to
each other. SOURCE: Project Risk Analysis and Management Guide, 2004
APM Publishing
Qualitative analysis provides a convenient and “user-friendly” way to
identify, describe and characterize project risks.
Risk identifcation, as mentioned in the previous chapter, results in the
generation of a risk register. The risk register can be sizeable and it is
necessary to evaluate and prioritize the risk events identifed in the risk
register. Evaluation and prioritization is typically an iterative process and
can take place at various points in project development.
A thoroughly developed register of risks, that may affect project
objectives, is helpful. We sometimes fnd ourselves in situations where
moving forward is diffcult because of indecision. Identifying, describing,
and assessing project risks allow us to prioritize risks. Prioritization can
free us from indecision by providing specifc, documented risk events that
we can act on to shift the odds in favor of project success. Prioritizing
risks, which present the highest potential for signifcantly affecting project
objectives, gives project managers the information necessary to focus
project resources. Prioritization helps us make decisions in an uncertain
environment and address project risk in a direct and deliberate manner.
Page 24 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
Qualitative analysis utilizes relative degrees of probability and
consequence of each identifed project risk event in descriptive non-
numeric terms; see Figure 3-1 and Figure 3-2 for examples of qualitative
risk matrices. Qualitative analysis can provide a prioritized list of risks to
work on.
Project Risk Management Guidance for WSDOT Projects Page 25
July 2010
Chapter 3 Qualitative Risk Analysis
Qualitative Risk
Analysis
“ How to”
Page 26 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
How to perform Qualitative Risk Analysis
Once a risk is identifed, including a thorough description of the risk and
risk triggers, it can be characterized in terms of probability of occurrence
and the consequence if it does occur.
#1 Gather the project team and appropriate persons to discuss project
risk. Establish which of the qualitative risk matrices you intend to
use, defne the terms you plan to use (Very High, High, Medium,
Low…. Etc.).
#2 Review the risk information from the risk identifcation step.
#3 Discuss the risk with the group.
#4 Evaluate the likelihood of the risk occurring by asking the group “How
likely is it that this risk will occur?” Record the result that the group
agrees on.
#5 Evaluate the consequences if the risk does occur by asking the group
“What will be the impacts if this risk does occur?” Record the result
that the group agrees on.
#6 Prioritize the risks based on the results of the qualitative analysis.
If it is desirable the risks can also be group by category (i.e.
Environmental, Structures/Geotech) and ranked within each category.
HELPFUL HINTS FOR QUALITATIVE RISK ANALYSIS
• Invite appropriate participants (not too many not too few).
• Define terms.
• Stay focused – put a time limit on discussion if necessary.
• Record the results.
• Prioritize the risks based on the results.
Something to consider: those relatively new to risk analysis sometimes
claim, in exasperation, “This is nothing more than guessing”. This does
not represent the full actuality that assigning values for probability and
impact relies on the expertise and professional judgment of experienced
participants.
The determination of a value for the probability of occurrence and its
consequence to project objectives, if it occurs, is for many a new activity
and can seem strange at frst. In any feld, with experience, professionals
develop intuition and an ability to understand projects to a greater degree
than those not involved with project development and delivery. This
experience and intuition is extremely valuable –in a risk workshop forum
we surround ourselves with “wise counsel” to seriously and thoroughly
discuss the project. It might be helpful to examine the word “guess” and
compare it to other words such as ‘discernment’ and ‘judgment’ that more
appropriately describe risk assessment. The defnitions in the following
table come from the Merriam-Webster Online Dictionary/Thesaurus (with
edits).
Project Risk Management Guidance for WSDOT Projects Page 27
July 2010
Chapter 3 Qualitative Risk Analysis
Discernment
1: The quality of being able to grasp and comprehend what is obscure
: skill in discerning (insight and understanding); the process of
forming an opinion or evaluation by discerning and comparing
b: an opinion or estimate so formed; the capacity for judging;
the exercise of this capacity.
Synonyms Perception, Penetration, Insight, Acumen, Perception,
Penetration, Insight, and Acumen mean a power to see what is not
evident to the average mind. DISCERNMENT stresses accuracy;
PERCEPTION implies quick discernment; PENETRATION implies
a searching mind that goes beyond what is obvious or superfcial;
INSIGHT suggests depth of discernment coupled with understanding;
ACUMEN implies characteristic penetration combined with keen
practical judgment.
Judgment
a: The process of forming an opinion or evaluation by discerning and
comparing
b: An opinion or estimate so formed; a formal utterance of an
authoritative opinion; a position arrived at after consideration; an
idea that is believed to be true or valid without positive knowledge;
an opinion on the nature, character, or quality of something
Guess
To form an opinion from little or no evidence
Synonyms assume, conjecture, presume, speculate, suppose, surmise,
suspect, suspicion
Related Words gather, infer; hypothesize, theorize; believe, conceive,
expect, imagine, reckon
Decision
The act or process of deciding b: a determination arrived at after
consideration : <make a decision>; report of a conclusion
A position arrived at after consideration <after much deliberation, we
made a decision about what to use for an estimated unit price>
Synonyms conclusion, determination, diagnosis, judgment, resolution,
verdict.
Related Words mandate, fnding, ruling, sentence; choice, option,
selection
Page 28 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
EXAMPLES
ONLY
EXAMPLE (depicts a simple list of risks evaluated and ranked qualitatively)
Qualitative Risk List
count T/O RBS # Risk Title Probability Impact
a T ENV 30.1 Permits and Permit Appeals Medium High
b T UTL 20.1 Unidentifed Utility Conficts High Very High
c T STG 20.4 Change to Substructure Assumptions Very Low Low
d T ROW 40.1 Managed Access challenge Very High Low
WSDOT Project Risk Management – “How to guide” 3 Qualitative Risk Analysis rev 2009-April
6 of 10
Chapter 3 Qualitative Risk Analysis
EXAMPLE (depicts a simple list of risks evaluated and ranked qualitatively)
Qualitative Risk List
count
T/O RBS # Risk Title Probability Impact
a T ENV 30.1 Permits and Permit Appeals Medium High
b T UTL 20.1 Unidentified Utility Conflicts High Very High
c T STG 20.4 Change to Substructure Assumptions Very Low Low
d T ROW 40.1 Managed Access challenge Very High Low
Probability
(Likelihood)
Synonyms
Approximate
%
Very high Almost certain Very Sure >90%
High Likely Pretty Sure 70% - 90%
Medium Possible Maybe 30% - 70%
Low Unlikely Seldom 10% - 30%
Very Low Rare Improbable <10%
Consequence
(Impact)
Synonyms
Approximate
%
Very high Very Critical Very Strong >90%
High Critical Strong 70% - 90%
Medium Moderate Average 30% - 70%
Low Slight Mild 10% - 30%
VH
H
M
L
VL
VL L M H VH
Impact
Probability and Impact Matrix
Very Low Very Little Very Mild <10%
Figure 3-1 Probability Impact Matrix (5 X 5)
Qualitative Risk List (ranked based on qualitative risk analysis)
rank count
T/O RBS # Risk Title Probability Impact
2 a T ENV 30.1 Permits and Permit Appeals Medium High
1 b T UTL 20.1 Unidentified Utility Conflicts High Very High
4 c T STG 20.4 Change to Substructure Assumptions Very Low Low
3 d T ROW 40.1 Managed Access challenge Very High Low
a
b
c
d
Probability
(Likelihood)
Synonyms
1
Approximate %
Very high Almost certain Very Sure >90%
High Likely Pretty Sure 80%
Medium Possible Maybe 50%
Low Unlikely Seldom 20%
Very Low Rare Improbable <10%
Consequence
(Impact)
Synonyms
1
Approximate %
of Phase
(PE, RN, CN)
Very high Very Critical Very Strong >10%
High Critical Strong 8%
Medium Moderate Average 4%
Low Slight Mild 2%
Very Low Very Little Very Mild <1%
1
Suggested percentages; project teams may adjust if they desire.
Probability Impact Matrix (5 X 5)
Figure 3-1
EXAMPLES ONLY
Project Risk Management Guidance for WSDOT Projects Page 29
July 2010
Chapter 3 Qualitative Risk Analysis
EXAMPLES
ONLY
Qualitative Risk List (ranked based on qualitative risk analysis)
rank count T/O RBS # Risk Title Probability Impact
2 a T ENV 30.1 Permits and Permit Appeals Medium High
1 b T UTL 20.1 Unidentifed Utility Conficts High Very High
4 c T STG 20.4 Change to Substructure Assumptions Very Low Low
3 d T ROW 40.1 Managed Access challenge Very High Low
Qualitative Risk List (threats and opportunities)
count T/O RBS # Risk Title Probability Impact
A T ENV 30.1 Permits and Permit Appeals Medium High
B T UTL 20.1 Unidentifed Utility Conficts High High
C T STG 20.4 Change to Substructure Assumptions Low Low
D T ROW 40.1 Managed Access challenge High Low
E O CNS 30.1 Negotiate Better Work Windows Low Medium
F O CNS 50.1 Able to salvage some material for $ Medium Medium
G O DES 10.1 Opportunity to switch to ACP (HMA) High High
P
R
O
B
A
B
I
L
I
T
Y
HI D B G HI
P
R
O
B
A
B
I
L
I
T
Y
MED A F MED
LO E LO
VLO C VLO
VLO LO MED HI HI MED LO VLO
NEGATIVE IMPACT POSITIVE IMPACT
Probability Impact Matrix (Double 4 X 4)
Figure 3-2
EXAMPLES ONLY
Page 30 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
A simple matrix, provided below, suitable for smaller, less complex or routine projects, it also
appears in the Project Management Online Guide.
P
r
o
b
a
b
i
l
i
t
y
H
L
L H
Impact
High (probability): more likely than not to happen.
High (impact): Substantial impact on cost, schedule, or technical. Substantial action
required to alleviate issue.
Low (probability): less likely than not to happen.
Low (impact): Minimal impact on cost, schedule, or technical. Normal management
oversight is suffcient.
Project Management Online Guide is found at:
http://www.wsdot.wa.gov/projects/projectMgmt/Process
Project Risk Management Guidance for WSDOT Projects Page 31
July 2010
Simplifed Risk Management Plan Spreadsheet with 2×2 Probability Impact Matrix
Figure 3-3
Project Title EXAMPLE for Risk Management Document
Project PIN # #######
Date Feb 31, 2929
Project Mngr Mgr Name Telephone Number (xxx) xxx-xxxx
Status ID #
Date Identified
Project Phase
Risk Event
(threat/opportunity) SMART Column Risk Trigger
Impact
Area
Affected MDL/WBS
Level 2 process Probability Impact
Risk
Owner
Strategy
ACTION TO BE TAKEN
(include advantages and disadvantages)
Status Interval
or Milestone
Check Date, Status and Review Comments
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (13) (14) (15) (16) (17)
In
s
tr
u
c
tio
n
s
Active=actively monitored
& controlled
Dormant=risk is not
currently a high priority,
but may become active in
the future.
Retired=no longer a
threat to project
objectives.
E1 For example:
6/30/99
Scoping
Risk is an uncertain event or
condition that, if it occurs, has a
positive (opportunity) or negative
(threat) on a project.
For example; Wetland Mitigation
requires additional R/W.
Detailed description of the risk.
Includes information on the risk
that is Specific, Measureable,
Attributable, Relevant and
Timebound. Describe the
consequences of the risk to
scope, schedule, budget or
quality.
Triggers are indications that a risk
has occurred or is about to occur.
Used to determine when to
implement the Risk Response
Strategy.
For example: Wetland impact is
greater than 1/2 acre.
Is the
primary
impact to
the scope,
schedule,
or budget?
Which WBS
element will be
modified as part of
the response
strategy? For
example:
PC-19
Environmental
Permits
Assessment of
the likelihood
of occurrence.
Valid entries
are Low or
High.
The severity
of the risk's
effect on the
projects
objectives.
Valid entries
are Low or
High.
Name of the
person or
office
responsible for
managing the
risk event.
Avoidance
Transferance
Mitigation
Acceptance
(See PM Online
Guide for strategy
definitions.)
Develop options and determine actions to
be taken in response to the risk event.
Immediate action may be required at the
time of identification. Estimate value of
risk and estimate cost to respond.
For example:
Completion of
wetland
delineation
expected:
2/28/00
For example: Last status update
4/30/00. Wetland delineation
completed 3/15/00. Over 1 acre of
wetland was delineated, action is
being taken to expedite meetings with
regulatory agencies & expedite the
effort to provide appropriate wetland
mitigation & attain project permits.
H
L
X
L H
H
X
L
L H
H
L
X
L H
EXAMPLE OF QUALITATIVE ANALYSIS
WITH A 2X2 RISK MATRIX
Monitoring and Control Risk Identification
Scope
WBS 185
Prepare Base
Maps and
Plan Sheets
Low Low
P
r
o
b
a
b
i
l
i
t
y
Mr. History Acceptance
Numerous construcion work in
and around the area has
occurred in the past. No
artifacts have been found.
Supplmenta
l Field
investigatio
n report
due:
11/1/2008
Analysis is
due
9/30/2008
Design/PS&
E
Impact
mm/dd/yyyy
Threat - Cultural
Resources may be
encountered on D Island
During clearing and
grubbing there is a
potential for finding
historical artifacts,
particularly on the
northside of D Hill near
the water.
Trigger during Design:
Archival and/or field
investigation reveals
artifacts on site. Trigger
during CN: Discovery of
indicator items and/or
artifacts during
clearing/grubbing.
Constructio
n
Impact
High
Risk-Response Strategy
High
P
r
o
b
a
b
i
l
i
t
y
Mr.
Noiseman
Mitigation
Press for results of noise
analysis ASAP. This is a high
probability/high impact threat.
Carry design as if the noise wall
is going to be built (to minimize
future rush design work).
(12)
Ms. Eunice
Utility
P
r
io
r
ity
Active
UTL
20.1
PROJECT RISK MANAGEMENT PLAN
Threat - Unknown utility
impacts
(MP 14.7 to MP 19.4).
Next check
is at QPR
on
11/20/2008
Mitigation
Begin subsurface utility
investigations immediately.
Assign team member to this
issue full time until we are
confident all utilities have been
identifed.
May be required to buid a
permanent noise wall
pending results of Type 1
Analysis.
Resutls of Type 1 Analysis
will indicate the level of
Noise mitigation required.
Scope
WBS 165
Perform
Environmental
Studies and
Prepare Draft
Environmental
Document
(DED)
WBS 185
Prepare Base
Maps and
Plan Sheets
Multiple Triggers: If found
toward the end of design
phase may require
additional design work
and/or R/W acquisition. If
found during construction
could potentially stop
work.
mm/dd/yyyy
Scope
Design/PS&
E
Risk Matrix
Qualitative Analysis
High: Substantial impact
on cost, schedule, or
technical. Substantial
action required to
alleviate issue.
Low: Minimal impact on
cost, schedule, or
technical. Normal
management oversight is
ffi i t
P
r
o
b
a
b
i
l
i
t
y
Low
Active
Active
ENV
90.3
ENV
40.4
High
Areas outside of WSDOT
R/W have not been
investigated for utilities
conflicts; Additional work
is required for
sewer/stormwater for
Smalltown, additional
investigation required for
water, gas, power, fiber
optic, telecommunications,
etc.
Impact
mm/dd/yyyy
Threat - Noise Wall
http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-Construction/PC_Plan_the_Work/PC_Plan_Risk.htm
Page 32 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
Simplifed Risk Management Plan Spreadsheet with 5x5 Probability Impact Matrix
Figure 3-4
Project Title EXAMPLE for Risk Management Document
Project PIN # #######
Date Feb 31, 2929
Project Mngr Mgr Name Telephone Number (xxx) xxx-xxxx
Status ID #
Date Identified
Project Phase
Risk Event
(threat/opportunity) SMART Column Risk Trigger
Impact
Area
Affected MDL/WBS
Level 2 process Probability Impact
Risk
Owner
Strategy
ACTION TO BE TAKEN
(include advantages and disadvantages)
Status Interval
or Milestone
Check Date, Status and Review Comments
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (13) (14) (15) (16) (17)
In
s
tru
c
tio
n
s
Active=actively monitored
& controlled
Dormant=risk is not
currently a high priority,
but may become active in
the future.
Retired=no longer a
threat to project
objectives.
E1 For example:
6/30/99
Scoping
Risk is an uncertain event or
condition that, if it occurs, has a
positive (opportunity) or negative
(threat) on a project.
For example; Wetland Mitigation
requires additional R/W.
Detailed description of the risk.
Includes information on the risk
that is Speci fi c, Measureable,
Attributable, Rel evant and
Ti mebound. Describe the
consequences of the risk to
scope, schedule, budget or
quality.
Triggers are indications that a risk
has occurred or is about to occur.
Used to determine when to
implement the Risk Response
Strategy.
For example: Wetland impact is
greater than 1/2 acre.
Is the
primary
impact to
the scope,
schedule,
or budget?
Which WBS
element will be
modified as part of
the response
strategy? For
example:
PC-19
Environmental
Permits
Assessment of
the likelihood
of occurrence.
Valid entries
are Low or
High.
The severity
of the risk's
effect on the
projects
objectives.
Valid entries
are Low or
High.
Name of the
person or
office
responsible for
managing the
risk event.
Avoidance
Transferance
Mitigation
Acceptance
(See PM Online
Guide for strategy
definitions.)
Develop options and determine actions to
be taken in response to the risk event.
Immediate action may be required at the
time of identification. Estimate value of
risk and estimate cost to respond.
For example:
Completion of
wetland
delineation
expected:
2/28/00
For example: Last status update
4/30/00. Wetland delineation
completed 3/15/00. Over 1 acre of
wetland was delineated, action is
being taken to expedite meetings with
regulatory agencies & expedite the
effort to provide appropriate wetland
mitigation & attain project permits.
VH
H
M
L $
VL
VL L M H VH
Impact
P
r
o
b
VH
H $
M
L
VL
VL L M H VH
Impact
P
r
o
b
VH
H
M
L $
VL
VL L M H VH
Impact
EXAMPLE OF QUALITATIVE ANALYSIS
WITH A 5X5 RISK MATRIX
High
Areas outside of WSDOT
R/W have not been
investigated for utilities
conflicts; Additional work
is required for
sewer/stormwater for
Smalltown, additional
investigation required for
water, gas, power, fiber
optic, telecommunications,
etc.
mm/dd/yyyy
Threat - Noise Wall
ENV
90.3
ENV
40.4
Active
Active
Risk Matrix
Qualitative Analysis
High: Substantial impact on cost,
schedule, or technical. Substantial
action required to alleviate issue.
Low: Minimal impact on cost,
schedule, or technical. Normal
management oversight is sufficient.
Low
P
r
o
b
a
b
ility
mm/dd/yyyy
Scope
Design/PS&
E
May be required to buid a
permanent noise wall
pending results of Type 1
Analysis.
Resutls of Type 1 Analysis
will indicate the level of
Noise mitigation required.
Scope
WBS 165
Perform
Environmental
Studies and
Prepare Draft
Environmental
Document
(DED)
WBS 185
Prepare Base
Maps and
Plan Sheets
Multiple Triggers: If found
toward the end of design
phase may require
additional design work
and/or R/W acquisition. If
found during construction
could potentially stop
work.
P
r
io
r
ity
Active
UTL
20.1
PROJECT RISK MANAGEMENT PLAN
Threat - Unknown utility
impacts
(MP 14.7 to MP 19.4).
Next check
is at QPR
on
11/20/2008
Mitigation
Begin subsurface utility
investigations immediately.
Assign team member to this
issue full time until we are
confident all utilities have been
identifed.
Risk-Response Strategy
High
Mr.
Noiseman
Mitigation
Press for results of noise
analysis ASAP. This is a high
probability/high impact threat.
Carry design as if the noise wall
is going to be built (to minimize
future rush design work).
(12)
Ms. Eunice
Utility
Analysis is
due
9/30/2008
Design/PS&
E
mm/dd/yyyy
Threat - Cultural
Resources may be
encountered on D Island
During clearing and
grubbing there is a
potential for finding
historical artifacts,
particularly on the
northside of D Hill near
the water.
Trigger during Design:
Archival and/or field
investigation reveals
artifacts on site. Trigger
during CN: Discovery of
indicator items and/or
artifacts during
clearing/grubbing.
Constructio
n
High
Scope
WBS 185
Prepare Base
Maps and
Plan Sheets
Low Low Mr. History Acceptance
Numerous construcion work in
and around the area has
occurred in the past. No
artifacts have been found.
Supplmenta
l Field
investigatio
n report
due:
11/1/2008
Risk Identification Monitoring and Control
http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-Construction/PC_Plan_the_Work/PC_Plan_Risk.htm
Figure3-4 Simplified Risk Management Plan Spreadsheet with 5x5 Probability Impact Matrix
Project Risk Management Guidance for WSDOT Projects Page 33
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative Risk Analysis is a way of numerically estimating
the probability that a project will meet its cost and time objectives.
Quantitative analysis is based on a simultaneous evaluation of the impacts
of all identifed and quantifed risks.
(WSDOT PMOG)
The Strategic Analysis and Estimating Offce at WSDOT offers several
tools for quantitative analysis of risk. These tools are described in
Executive Order 1053.00 December 10, 2008 and summarized in
Table 4.1 below.
Project Size ($)
Required Process
(project managers can use
a higher level process if desired)
$10 M to $25 M In-formal workshop using the Self-Modeling Spreadsheet
1, 3
Quantitative $25 M to $100 M Cost Risk Assessment (CRA) Workshop
1, 2
Greater than $100 M Cost Estimate Validation Process (CEVP®) Workshop
2
1 In some cases it is acceptable to combine the Value Engineering Study and Risk Based Estimating
Workshop.
2 Projects $25 Million and over should use the self-modeling spreadsheet in the scoping phase risk based
estimating process, followed up by the more formal CRA or CEVP® process during the design phase.
3 An informal workshop is comprised of the project team (or key project team members), other participants may
be included as the project manager/project team deem necessary.
NOTE: For Projects less than $10M qualitative analysis is suffcient, although a higher level may be used if desired.
Levels of risk based estimating, in support of risk management:
Tabel 4.1
Quantitative techniques, such as Monte Carlo simulation, can be a
powerful tool for analysis of project risk and uncertainty. This technique
provides project forecasts with an overall outcome variance for estimated
project cost and schedule. Probability theory allows us to look into the
future and predict possible outcomes.
Use of quantitative analysis, while very powerful, also can be misleading
if not used properly. WSDOT provides a comprehensive guide for
risk workshops that, if followed, help insure a consistent process and
safeguards against biased and/or misleading results. The comprehensive
set of workshop guidelines are posted at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/workshop.htm
The following caution comes from a paper titled: “Top Down Techniques
for Project Risk Management” by Martin Hopkinson presented at the 2006
PMI Conference in Madrid.
But to us, probability is the
very guide of life. – Bishop
Joseph Butler (1756)
“Poor modeling can
produce an output
that looks convincing
to managers but is so
fawed that the results
are dangerously
misleading. On
a project with
unrealistically tight
targets, poor risk
analysis may thus
become a tool that
fosters management
delusions about
the prospects for
success.”
Page 34 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Project Risk Management is an integral component of ongoing Project
Management.
Project Managers sometimes ask “when is the best time to conduct a CRA
or CEVP workshop?” This is answered by reviewing the status of Project
Development. When a Project Management Plan is being developed and
is kept current (appropriate to the level of project development) with a
well-written scope that can be communicated and comprehended, along
with the associated schedule and cost estimate a project team can begin in
earnest preparing for their risk management workshops.
When preparing materials and planning for a workshop that includes
quantitative analysis be sure to contact the Strategic Analysis and
Estimating Offce of WSDOT, CREM Unit and they can help guide
you through the process, including scheduling consultants and WSDOT
resources to effect the completion of a quantitative analysis, either through
the workshop process or use of the self-modeling spreadsheet.
When a project team prepares for a workshop much of the work that is
performed on a daily or regular basis becomes the input for the analysis.
This includes scope or work, schedule estimate (with backup and
assumptions), cost estimate – including the basis of estimate, assumptions
and backup information. Estimates are used to make fnancial decisions
hence in order to facilitate this materials should be developed that result in
and informed decision-making process; CPMS data requirements are listed
in Table 4-1.
Project teams must provide specifc data to the region program
management offce for inclusion into CPMS and the Transportation
Executive Information System (TEIS). The required data is:
1. Project scheduling data for the following milestone dates:
• Project defnition completion date
• Date for the beginning of preliminary engineering
• Completion date for the environmental document
• Start date for the acquisition of right of way
• Date of right of way certifcation
• Project advertisement date
• Date project is operationally complete (substantially complete)
2. Estimated Project Cost Data (in Current Year Dollars, CY$)
• Date of estimate basis (i.e., “March 2008 $”)
• Design cost estimate
• Right of way cost estimate
• Construction cost estimate
3. CPMS will be modifed to calculate the midpoint for construction
phases using the project award date and the operationally complete date.
CPMS Data Requirements
Table 4-1
Project Risk Management Guidance for WSDOT Projects Page 35
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative
Risk
Analysis
“ How To”
Page 36 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
How to perform Quantitative Risk Analysis
General Process
Once risks are identifed and have been screened via qualitative analysis,
they can be analyzed quantitatively. Recall that identifcation includes
a thorough description of the risk and risk triggers. With quantitative
analysis the probability of occurrence and consequence if the risk event
occurs must also be documented. Figure 4-1 depicts the workshop process.
Tools and Techniques
1 Gather and Represent Data
• Interviews – can be formal or informal settings, such as smaller
group meetings and/or larger formal workshops.
• Subject Matter Expert input – participating collaboratively with
the project team and cost-risk team can participate in interviews or
contribute opinions in other ways such as surveys (questionnaires).
• Represent data in terms of probability and impact, impacts can be
represented using discrete distributions or continuous distributions.
2 Quantitative Risk Analysis and Modeling
• Project simulation using Monte Carlo technique to generate a
probability distribution of project cost and schedule based on
uncertainty and risk effects.
Quantitative Risk Analysis Outputs
1 Risk Register – the risk register begins during Risk Identifcation and
is further developed during analysis (qualitative and/or quantitative);
the risk register is a key component of the project management plan.
• Prioritized list of quantifed risks – those risks that have the most
signifcant impact (threats or opportunities) to project objectives.
(tornado diagrams, expected values, decision trees)
• Probabilistic analysis of the project. Estimated cost and
completion dates and associated confdence levels.
• Quantitative analyses can be conducted several times throughout
project development; trends can be identifed, mitigation strategies
can be implemented and monitored, the risk profle of a project
evolves and changes as the project is developed and knowledge is
gained and design changes occur.
Informal Workshop (Meeting)
For smaller projects an informal workshop comprised of the project team
and/or key project team members, and other participants (such as specialty
groups involved with critical items) may suffce.
Project Risk Management Guidance for WSDOT Projects Page 37
July 2010
Chapter 4 Quantitative Risk Analysis
Workshop Process for CRA or CEVP
Figure 4-1
Page 38 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Risk management is ongoing and iterative, periodically workshop
members can regroup to evaluate the project and associated uncertainty
and risks, workshops typically occur for a project every 12 to 24
months or at key project milestones. Project risks and mitigation
efforts should be discussed at regular project meetings, make changes
as appropriate and following those changes re-run the risk model. Value
is gained when action is taken to respond to risks resulting in a cost and
schedule savings to the project.
In order to fully understand our project we must determine what we
know and what we do not know about a project. In our industry, Civil
Engineering – Transportation, we have devoted a good deal of resources
to clearly explain what is known of a project, we have many specialty
offces that gather and provide data in support of project delivery,
including: aerial photography, surveying, site investigations, bid
histories, real estate services, right-of-way, access management, utilities,
environmental, hydraulics, structures, geotech, railroad, tribal liaison
offce, planning and programming, ad/bid/award, construction, tolling,
economic, programming external resource agencies and stakeholders,
public interest groups, and others. J ust as important is to devote some
energy and resources to assess what is not known and/or is uncertain
about a project, one tool for accomplishing this is intentional, thoughtful
and deliberate project risk management –as part of an overall project
management plan.
Risk assessment is not a measure of estimate accuracy:
The project team must examine each critical item and predict its possible
extreme values considering all risks, including compounding effects. It is
important to understand that the range,as considered in this method, is not
the expected accuracy of each item. This is a key issue. Risk analysis is
not an analysis of estimate accuracy. Accuracy is dependent upon estimate
deliverables and estimate maturity.
AACE International Recommended Practice No. 41R-08
RISK ANALYSIS AND CONTINGENCY
DETERMINATION USING RANGE ESTIMATING
TCM Framework: 7.6 – Risk Management
June 25, 2008
Project Risk Management Guidance for WSDOT Projects Page 39
July 2010
Chapter 4 Quantitative Risk Analysis
Risk management must be partnered with a well-organized and properly
documented project base cost estimate. Risk management introduces
reality into our project management process by recognizing that every
project has a risk of cost overrun –this does not mean cost overrun is
inevitable –it means it is possible.
In the book titled “Project Risk Management” by Chris Chapman
and Stephen Ward there is an acronym presented to describe a Risk
Management Process framework for projects, the acronym is SHAMPU
which refers to: Shape, Harness, And Manage Project Uncertainty. There
are some helpful ideas expressed via this acronym and they are presented
here from page 58 of the above referenced book.
Detailed steps of process Mid level portrayal Simplest portrayal
defne the project
focus the process
clarify the basis of analysis shape the project strategy
identify the issues
structure the issues
clarify ownership
execute the qualitative analysis
estimate variability
evaluate implications
execute the quantitative
analysis
harness the plans harness the plans harness the plans
manage implementation manage implementation manage implementation
SHAMPU process in 3 levels of detail
Table 4-3
Figure 4-2 is a schematic of how an estimate range emerges from a risk
based estimating process. The frst estimate, or “plan value”, provided by
the project team often will contain contingencies (explicit and/or implicit)
within the estimate; the frst step is to review the estimate and remove
the contingencies and making any needed corrections that are identifed.
Figure 4-3 depicts the regions of an estimate.
Page 40 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
PLAN VALUE
(includes contingency)
RAW ESTIMATE
(no contingency)
validated base
subtract
contingency
BEST CASE WORST CASE
subtract
opportunity impacts
add
threat impacts
subtract
opportunity
contingency ?
add
threat
contingency ?
OPINION
OF COST
(most likel y)
probabilistic cost range
PLAN VALUE
(includes contingency)
RAW ESTIMATE
(no contingency)
validated base
subtract
contingency
BEST CASE WORST CASE
subtract
opportunity impacts
add
threat impacts
subtract
opportunity
contingency ?
add
threat
contingency ?
OPINION
OF COST
(most likel y)
probabilistic cost range
Credit: David Hillson, Effective Opportunity Management for Projects
Credit: David Hillson, Effective Opportunity Management for Projects
Creating a probabilistic estimate
Figure 4-2
WSDOT Project Risk Management – “How to guide” 4 Quantitative Risk Analysis
9 of 9
Chapter 4 Quantitative Risk Analysis
Opini on
of
Cost
Mean
Regions of an estimate.
Min Max
(Most likel y)
Potential opportunity Potential threat
Area of estimating
uncertainty
“Base uncertainty”
Opini on
of
Cost
Mean
Regions of an estimate.
Min Max
(Most likel y)
Potential opportunity Potential threat
Area of estimating
uncertainty
“Base uncertainty”
Credit: David Hillson, Effective Opportunity Management for Projects
Regions of an estimate
Figure 4-3
Project Risk Management Guidance for WSDOT Projects Page 41
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative analysis is a natural activity that fts into our standard project management process,
and unfolds something like this:
Initiate
and
Align
Plan
the
Work
Endorse
the
Plan
Work
the
Plan
Transition
and
Closure
• Project Description
• Team Mission/Assignment
• Major Milestones
• Boundaries
• Team Identification
• Roles/Responsibilities
• Measures of Success
• Operating Guidelines
• Work Breakdown Structure
• Task Planning & Scheduling
• Budget
• Risk Planning
• Communication Plan
• Change Management Plan
• Quality (QA/QC) Plan
• Transition and Closure Plan
• Manage SSB
• Manage Risks
• Manage Change
• Communicate
-Progress
-Issues
-Lessons Learned
• Implement
Transition Plan
• Review Lessons
Learned
• Reward &
Recognize
• Archive
• Project Team
Commitment
• Management
Endorsement
Initiate
and
Align
Plan
the
Work
Endorse
the
Plan
Work
the
Plan
Transition
and
Closure
• Project Description
• Team Mission/Assignment
• Major Milestones
• Boundaries
• Team Identification
• Roles/Responsibilities
• Measures of Success
• Operating Guidelines
• Work Breakdown Structure
• Task Planning & Scheduling
• Budget
• Risk Planning
• Communication Plan
• Change Management Plan
• Quality (QA/QC) Plan
• Transition and Closure Plan
• Manage SSB
• Manage Risks
• Manage Change
• Communicate
-Progress
-Issues
-Lessons Learned
• Implement
Transition Plan
• Review Lessons
Learned
• Reward &
Recognize
• Archive
• Project Team
Commitment
• Management
Endorsement
IDENTIFY and ANALYZE Risk RESPOND, MONITOR and CONTROL Risk
Project Description: subject of the risk
assessment
Risk Management is an integral component of
day-to-day project management. Project teams
implement and continuously upgrade the Risk
Management Plan throughout the project. Primary
Risk Management functions include:
• Monitor risks (threats and opportunities)
• Identify new risks
• Evaluate/update probability of occurrence and
potential impacts
• Devise and implement response strategies
• Evaluate and document effectiveness of
response
• Report to Management and Stakeholders
Task Planning &
Scheduling Budget
This produces a project
estimate and schedule.
Risk Planning:
The project team, as part of their normal project
development and project management activities
needs to include activities for risk management in
its work plan.
----
The team prepares a project estimate based on
what is known about the project at that time; the
estimate refects the project if things go per the
project plan. Uncertainty and risk events are
identifed and characterized.
Risk Management, a part of Project Management
Figure 4–4
Page 42 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Project Risk Management Guidance for WSDOT Projects Page 43
July 2010
Chapter 5 Risk Response
Take action in response to identifed risks. Following identifcation and
analysis of project risks project managers and project teams must take
action in response to the identifed project risks, focusing on risks of most
signifcance, in order to shift the odds in favor of project success.
Early in project development, activities and information can seem chaotic
and comes to us from multiple directions and multiple sources, risk
management provides a structured and disciplined way to document the
information, evaluate and analyze the information, and emerge with a
well-organized and prioritized list of project risks. This prioritization
rescues us from indecision with information we can use to direct our
project risk management resources.
In order to maximize the benefts of project risk management we must
incorporate the project risk management activities into our project
management plan and work activities. This means building risk
management activities into our Work Breakdown Structure (WBS);
WSDOT has a ready made WBS in the form of its Master Deliverables
List (MDL) to help insure our project workplans are comprehensive,
consistent and complete. Recall the Risk Management steps include: Risk
Management Planning, Risk Identifcation, Qualitative Risk Analysis,
Quantitative Risk Analysis, Risk Response, Risk Monitoring and Control.
Risk Response requires effort to develop and implement response actions;
we must plan for expending this effort following the results of our
risk analysis. To this end we have a number of tools readily available,
including the Risk Management Planning Spreadsheet found at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/
Descriptions of risk response actions follow:
Actions in response to risks: Threats Opportunities
1. Avoid 1. Exploit
2. Transfer 2. Share
3. Mitigate 3. Enhance
4. Accept
Risk Response: Actions
AVOID (threats)
Avoidance actions include: change project management plan to eliminate
a threat, to isolate project objectives from the risk’s impact, or to relax the
project objective that is in jeopardy, such as extending schedule or reducing
scope. Some risks that arise early in the project can be avoided by clarifying
requirements, obtaining information, improving communication, or acquiring
expertise
PMBOK
Action taken to insure the
probability or impact of a
threat is eliminated.
Page 44 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Two types of action 1) remove the cause of the risk (risk trigger); 2) execute
project in different way while still aiming to achieve project objectives. Not all
risks can be avoided or eliminated, and for others this approach may be too
expensive or time-consuming, but this should be the frst strategy considered for
each risk.
Effective Opportunity Management for Projects by David Hillson
EXPLOIT (opportunities)
Opposite of avoid – this strategy is to insure a positive impact, an opportunity is
realized. Taking action to make the opportunity defnitely happen, such response
actions include: assigning more talented resources to a project to reduce time to
completion, and/or to provide better quality than originally planned.
PMBOK
Eliminate the uncertainty associated with a particular upside risk. An opportunity
is defned as a risk event that if it occurs will have a positive effect on
achievement of project objectives. Avoid and Exploit is the most aggressive of
the response strategies and should be reserved for those “golden opportunities”
with high probability and impacts.
Effective Opportunity Management for Projects by David Hillson
TRANSFER (threats)
Transferring a threat does not eliminate it; the threat still exists however it is
owned and managed by another party. Transferring risk can be an effective
way to deal with fnancial risk exposure. Transferring project risk almost always
involves payment of a risk premium to the party taking the risk, examples include:
insurance, performance bonds, warranties, etc. Contracts may be used to
transfer specifed risks to another party.
PMBOK
Transferring risk involves fnding another party who is willing to take responsibility
for its management, and who will bear the liability of the risk should it occur. The
aim is to ensure that the risk is owned and managed by the party best able to
deal with it effectively. Risk transfer usually involves payment of a premium, and
the cost-effectiveness of this must be considered when deciding whether to adopt
a transfer strategy.
Effective Opportunity Management for Projects by David Hillson
SHARE (opportunities)
Sharing a positive risk involves allocating ownership to a third party who is best
able to capture the opportunity for the beneft of the project. Examples of sharing
actions include forming risk-sharing partnerships, teams, or joint ventures, which
can be established with the express purpose of managing opportunities.
PMBOK
Allocating risk ownership for an opportunity to another party who is best able
to handle it, in terms of maximizing probability of occurrence and increasing
potential benefts if it does occur. Transferring threats and sharing opportunities
are similar in that a third party is used, those to whom threats are transferred
take on the liability and those to whom opportunities are allocated should also be
allowed to share in the potential benefts.
Effective Opportunity Management for Projects by David Hillson
Action taken to insure the
beneft of an opportunity
is realized.
Action to allocate
ownership for more
effective management of
a threat.
Action to share with a third
party; enhance/exploit
opportunity.
Project Risk Management Guidance for WSDOT Projects Page 45
July 2010
Chapter 5 Risk Response
MITIGATE – or reduce (threats)
Risk mitigation implies a reduction in the probability and/or impact of an adverse
risk event to an acceptable threshold. Taking early action is often more effective
to repair than trying to repair the damage after the risk has occurred. Examples
of mitigation strategies include: adopting less complex processes, conducting
more tests and/or feld investigations, developing a prototype; measures to
address impact include: targeting linkages that determine the severity, such as
designing redundancy into a subsystem may reduce the impact from a failure of
the original component.
PMBOK
Mitigation or acceptance or the strategies most often used since the number
of threats that can be addressed by avoidance or transfer are usually limited.
Preventive responses are better than curative responses because they are more
pro-active and if successful can lead to risk avoidance. Preventive responses
tackle the causes of the risk; where it is not possible to reduce probability a
mitigation response should address the adverse impact, targeting the drivers that
determine the extent of the severity.
Effective Opportunity Management for Projects by David Hillson
ENHANCE (opportunities)
This response modifes the “size” of an opportunity by increasing probability
and/or impact. Seeking to facilitate or strengthen the cause of the opportunity,
and proactively targeting and reinforcing its trigger conditions. Impact drivers
can also be targeted, seeking to increase the project’s susceptibility to the
opportunity.
PMBOK
This response aims to modify the “size” of the positive risk. We enhance the
opportunity by increasing the probability and/or impact of an opportunity thereby
maximizing benefts realized for the project. If the probability can be increased to
100% this is effectively an exploit response.
Effective Opportunity Management for Projects by David Hillson
ACCEPT
The term “accept” refers to risks that remain after response actions and/or for
which response is not cost effective are accepted; risks that are uncontrollable
(no response actions are practical) are also accepted.
Effective Opportunity Management for Projects by David Hillson
Ultimately it is not possible to eliminate all threats or take advantage of all
opportunities –we can document them and at least provide awareness that
these exist and have been identifed, some term this ‘passive acceptance’. In
some cases, in some industries, a contingency reserve is established to deal
with the aggregate residual risk that has been accepted, some term this ‘active
acceptance’.
As we continue through project development the project risk profle will
change. Typically as we successfully respond to risks and our project
knowledge increases our risk exposure will diminish. In effect we can
retire risk reserve as risk events are successfully avoided or mitigated
or we have passed the time during which the risk is active and it
becomes retired.
Action taken to reduce the
probability and/or impact of
a threat.
Action to enhance
opportunity.
Action taken to document
the acceptance of the risk.
Page 46 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Risk Response
“ How to”
Project Risk Management Guidance for WSDOT Projects Page 47
July 2010
Chapter 5 Risk Response
Risk Management Planning Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/)
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
5 of 11
Chapter 5 Risk Response
Risk Management Planning Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Risk Identification Risk Analysis Risk Response Monitor and Control
(description/trigger) (quantitative/qualitative) (actions, owner, date) (status, updates, results)
Next page zooms in
on this section.
IN THIS CHAPTER WE FOCUS ON RESPONSE
IN THIS CHAPTER WE FOCUS ON RESPONSE
Risk Management & Planning Spreadsheet
Figure 5-1
Page 48 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Type of Response action
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
6 of 11
Chapter 5 Risk Response
Type of Response action
Threats Opportunities
Avoid
Transfer
Mitigate
Exploit
Share
Enhance
Accept
Detailed description of
response action that
will be taken; the
response action should
be reflected in project
management plan and
work activities.
Name of person who
owns the risk and is
responsible for
implementing the
responseactions.
J ournal entries for date
and status of risk –
track effectiveness of
response action.
Risk response requires
an effort and
investment of
resources – enter the
planned cost of the
response here.
RMP Spreadsheet: Response
Figure 5-2
Project Risk Management Guidance for WSDOT Projects Page 49
July 2010
Chapter 5 Risk Response
Risk Response Tools and Techniques
After we have identifed and analyzed the risks we know where to focus
our efforts. The output from the analysis provides a ranked risk register
with the risks of greatest signifcance to project objectives determined.
Apt response actions to signifcant risks must be cost effective and
realistic.
Critical risks must be met with vigorous response actions, lower
ranking risks should receive response actions commensurate with their
signifcance.
Documentation of Response Actions
Document the response action by describing the action, which work
activities it will affect and the cost of the response action. Identify the
person(s) responsible for successful implementation of the response
action. Also consider the time impacts of the response action and how the
risk response may affect the overall project and/or other risks.
Planning Risk Response Actions
• Select a response action - the action selected is influence by the level
of the risk consider the figure below:
High impact and high probability
risks require aggressive
responses (threats should
be avoided and opportunities
exploited if possible).
P
r
o
b
a
b
i
l
i
t
y
H
i
g
h
Transfer
(share)
Avoid
(exploit)
L
o
w
Accept
Mitigate
(Enhance)
Low High
Impact
Simple Response Matrix
Figure 5-3
The next two fgures on the following pages depict typical response
actions for threats and for opportunities depending on the region of
probability and impact the risk resides.
Page 50 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
8 of 11
Chapter 5 Risk Response
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition
as part of the base.
2. Risks (threats) with high impacts, can over a given limit, wreck a project; these risks must be
avoided.
3. Insignificant risks can be accepted, passive response.
4. Between avoidance and acceptance we can take other actions such as mitigation or for risks with
low probabilities we may want to transfer them.
5. For risks (threats) above a certain probability we may choose to accept actively by mitigating
and/or preparing contingency plans in the event of its occurrence.
6. All risks (threats) should be mitigated where practical and cost-effective.
Typical Risk Response Planning Chart for Threats
Risk Response Planning: Selecting the Right Strategy Piney (2002)
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition as part
of the base.
2. Risks (threats) with high impacts, can over a given limit, wreck a project; these risks must be avoided.
3. Insignifcant risks can be accepted, passive response.
4. Between avoidance and acceptance we can take other actions such as mitigation or for risks with low
probabilities we may want to transfer them.
5. For risks (threats) above a certain probability we may choose to accept actively by mitigating and/or preparing
contingency plans in the event of its occurrence.
6. All risks (threats) should be mitigated where practical and cost-effective.
Typical Risk Response Planning Chart for Threats
Risk Response Planning: Selecting the Right Strategy Piney (2002)
Figure 5-4
Project Risk Management Guidance for WSDOT Projects Page 51
July 2010
Chapter 5 Risk Response
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
9 of 11
Chapter 5 Risk Response
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition
as part of the base.
2. Risks (opportunities) with high impacts; these risks should be exploited.
3. Insignificant risks can be accepted, passive response.
4. Between exploit and accept we can take other actions such as enhance and/or share opportunity
risks.
5. Risks (opportunities) above a certain probability we may choose to accept actively by preparing
plans in the event of its occurrence –how will we take advantage of a fortunate occurrence?
6. All risks (opportunities) should be enhanced where practical and cost-effective.
Typical Risk Response Planning Chart for Opportunities
Risk Response Planning: Selecting the Right Strategy Piney (2002)
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition as part of the
base.
2. Risks (opportunities) with high impacts; these risks should be exploited.
3. Insignifcant risks can be accepted, passive response.
4. Between exploit and accept we can take other actions such as enhance and/or share opportunity risks.
5. Risks (opportunities) above a certain probability we may choose to accept actively by preparing plans in the
event of its occurrence –how will we take advantage of a fortunate occurrence?
6. All risks (opportunities) should be enhanced where practical and cost-effective.
Typical Risk Response Planning Chart for Opportunities
Risk Response Planning: Selecting the Right Strategy Piney (2002)
Figure 5-5
Page 52 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Recall the Identifed Risk (compare pre-mitigated to mitigated)
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
10 of 11
Chapter 5 Risk Response
Recall the Identified Risk (compare pre-mitigated to mitigated)
Project Title: CN Duration Estimate Risk ID Sheets.xls
Project Manager: PE Estimate
Date Risk Identified: RW Estimate
CN Estimate
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN
MAX
Most Likely
0Master Duration Risk
MIN
MAX
Threat Most Likely
Supplemental notes about this risk event
Risk Trigger Details: Risk Matrix
Risk Owner:
Risk Breakdown Structure # (RBS#)
Work Breakdown Stucture # (WBS#)
Critical Path (yes or no)
Response Actions (action to be taken)
Action by date:
Status review date:
Status review date:
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Communication with parties.
Succession plan for staff changes.
Decisions ASAP on design elements.
S
c
h
e
d
u
l
e
C
o
n
s
t
r
u
c
t
i
o
n
C
o
s
t
1
R
e
t
i
r
e
d
Risk Impact
($M or Mo)
VH
H
M
L
VL
VL L M H VH
P
r
o
b
a
b
i
l
i
t
y
Impact
Risk ID Sheet
Figure 5-6
Project Risk Management Guidance for WSDOT Projects Page 53
July 2010
Chapter 6 Risk Monitoring and Control
“Control is an illusion.” Some of us may have heard this phrase before;
and we may have had experiences when we have felt this phrase to be
very apropos –however this phrase does not tell the whole story. We may
have little or no control over the external environment but we do have
control over how we interact with it. We do have control over our state
of readiness, we can look ahead and improvise and adapt. We can control
the robustness of our response to identifed risk events and the quality of
our documentation. We have control over how earnestly we integrate risk
management into our project management plans.
Risk Monitoring and Control
As we continue through project development the project risk profle will
change. Typically as we successfully respond to risks and our project
knowledge increases our risk exposure will diminish. In effect we can
retire risk reserve as risk events are successfully avoided or mitigated
or we have passed the time during which the risk is active and it
becomes retired.
Risk Monitoring and Control Tools and Techniques
After we have implemented response actions, we must track and record
their effectiveness and any changes to the project risk profle. Did the
response actions have a positive or negative effect on achieving project
objectives? If so explain how and why in the risk management plan.
Documentation of Response Actions
This section is devoted to measuring project risk management per
performance, and determining whether a project is tracking to plan or
deviating in a negative manner. This will require a blend of qualitative
judgments and quantitative measures to determine the “health” of the
project. Document the response action by describing the action, the
work activities it will affect and the cost of the response action. Identify
the person(s) responsible for successful implementation of the response
action. Also consider the time impacts of the response action and how the
risk response may affect the overall project and/or other risks.
Determining the appropriate metrics for the project, ensuring they are
not burdensome and affect behavior. Too often, metrics change behavior
to provide better metrics not better performance. Set the amounts
and conditions for use of the project risk reserves. Establish the fnal
objectives of the project with stakeholders to improve the chances of
project success. Confrm endorsement of team members and stakeholders
as the project plan evolves.
Page 54 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Monitoring and Controlling Project Risk
The project manager and project team apply their project management
plan through project development and completion of their deliverables.
Monitor the project status looking for trends that can indicate variations
(good and bad) in the project execution. Results of the analysis need to
be communicated and adjustments made through a change management
and/or issue resolution process. The ability to describe the history of the
project and how it evolved is essential to developing lessons learned for
the future.
Helpful Hints
• Be thorough and tenacious in gathering status update information for risks.
• Monitor status and trends continuously (scope, schedule, cost estimates, quality of product, et al).
• Address problems and issues immediately –in fact anticipate and discuss in advance if possible.
• Communicate.
Project Risk Management Guidance for WSDOT Projects Page 55
July 2010
Chapter 6 Risk Monitoring and Control
Risk
Monitoring and Control
“ How to”
Page 56 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Risk Management Planning (RMP) Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Figure 6-1 depicts the RMP spreadsheet; this easy to use spreadsheet provides an effective and
convenient way to summarize project risk management activities for projects that have conducted
a quantitative risk analysis. The spreadsheet is typically used for the most signifcant risks as
determined via the quantitative risk analysis, some term these risks “candidates for mitigation”.
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
4 of 9
Chapter 6 Risk Monitoring and Control
Risk Management Planning (RMP) Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Figure 6-1 depicts the RMP spreadsheet; this easy to use spreadsheet provides an effective and
convenient way to summarize project risk management activities for projects that have conducted a
quantitative risk analysis. The spreadsheet is typically used for the most significant risks as
determined via the quantitative risk analysis, some term these risks “candidates for mitigation”.
Risk Identification Risk Analysis Risk Response Monitor and Control
(description/trigger) (quantitative/qualitative) (actions, owner, date) (status, updates, results)
FIRST PILLAR OF RISK MANAGEMNENT
Identify and Analyze
SECOND PILLAR OF RISK MANAGEMENT
Response, Monitor and Control
Notice that the spreadsheet is conveniently arranged into four sections: 1) risk identification; 2) risk
analysis; 3) risk response; and 4) monitor and control. In this chapter we focus on monitor and
control.
Risk Management Plan spreadsheet
Figure 6-1
Notice that the spreadsheet is conveniently arranged into four sections: 1) risk identifcation; 2)
risk analysis; 3) risk response; and 4) monitor and control. In this chapter we focus on monitor
and control.
Project Risk Management Guidance for WSDOT Projects Page 57
July 2010
Chapter 6 Risk Monitoring and Control
Figure 6-2 zooms in on the second pillar of risk management, as recorded in the RMP
spreadsheet, and indicates how to use the entries to document the risk response actions and their
effectiveness in the monitoring and control portion of the spreadsheet.
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
5 of 9
Chapter 6 Risk Monitoring and Control
Figure 6-2 zooms in on the second pillar of risk management, as recorded in the RMP spreadsheet,
and indicates how to use the entries to document the risk response actions and their effectiveness in
the monitoring and control portion of the spreadsheet.
Figure 6-3 provides an example of a completed RMP spreadsheet, and the following pages, describe
how to use the Risk Management Plan spreadsheet to monitor and control project risk.
Name of person who
owns the risk and is
responsible for
implementing the
responseactions.
J ournal entries for date and
status of risk – track
effectiveness of response
action.
What happened after the risk response
actions were implemented? How
much was spent? What did it save us?
Figure 6-2
Figure 6-3 provides an example of a completed RMP spreadsheet, and the following pages,
describe how to use the Risk Management Plan spreadsheet to monitor and control project risk.
Page 58 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
s
p
r
e
a
d
s
h
e
e
t
(
c
o
m
p
l
e
t
e
d
)
F
i
g
u
r
e
6
-
3
W
S
D
O
T
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
–
“
H
o
w
t
o
g
u
i
d
e
”
6
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
r
e
v
2
0
0
9
-
A
p
r
i
l
6
o
f
9
C
h
a
p
t
e
r
6
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
F
i
g
u
r
e
6
-
3
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
s
p
r
e
a
d
s
h
e
e
t
(
c
o
m
p
l
e
t
e
d
)
h
t
t
p
:
/
/
w
w
w
.
w
s
d
o
t
.
w
a
.
g
o
v
/
p
r
o
j
e
c
t
s
/
p
r
o
j
e
c
t
m
g
m
t
/
r
i
s
k
a
s
s
e
s
s
m
e
n
t
/
Project Risk Management Guidance for WSDOT Projects Page 59
July 2010
Chapter 6 Risk Monitoring and Control
Notice the frst 15 columns in the risk management plan spreadsheet are
devoted to Identify and Analyze – the frst pillar of risk management. The
remaining columns (16 thru 25) are devoted to the second pillar of risk
management – RESPONSE, MONITOR and CONTROL.
In Chapter 5 we reviewed in some detail risk response actions, in
this chapter we follow-up and follow-through with monitoring and
control. The way we “monitor and control” risk is regularly review the
effectiveness of the response. Are the response actions working? Are
things getting better? Are we more confdent about our ability to meet
project objectives after the response actions have been implemented?
In effect response, monitor and control is a natural component of our day-
to-day project management activities, communicate with the project team
and ascertain how things are going. Make note in the risk management
plan and document the results.
Notice that Figure 6-1 only lists 5 risks – most will agree this is not too
many to manage, but is it enough to make a difference for our project.
The answer is a resounding YES and it is demonstrated in the example
provided. Figure 6-4 below depicts the bottom of the RMP Spreadsheet
under column 11, notice that for these 5 risks there is an expected value of
$7.1 M.
It should also be recognized that this project identifed over 50 risks, 23
of which were deemed signifcant enough to warrant inclusion in the
quantitative risk analysis model. These fve emerged as the top ranked
risks after the analysis and provided the project manager a prioritized list
of risks to manager. The other 40+ risks were not simply ignored, they
provided “issues awareness” for various specialty groups and were dealt
with as each specialty group deemed appropriate for relevant risks; these
additional risks also acted as a “watch list” for the project.
Total Estimated Cost Impacts of
top 5 risks for the example project
Figure 6-4
The following page depicts a performance measure for the effectiveness of
risk management on this project (Figure 6-5).
Page 60 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Performance Measure of Risk Management for this project
Figure 6-5
When reporting on the risk management efforts for this project we can
summarize as follows:
“The total dollar amount planned for response actions was $0.6M, to
achieve reduced project risk exposure by an estimated $3.8M (expected
value of risk reduction). After implementing the response actions we
found the total cost of the response actions were $0.7M which avoided an
estimated $3.7M in project costs.”
This example illustrates an excellent return on the dollar for risk
management efforts. Other benefts, less quantifable, included: improved
communication among team members and externally to stakeholders and
the public; identifed areas of concern for each specialty group as they
helped develop the risk register during risk elicitation; greater confdence
by the project manager and project team during project development;
upper management was informed of the issues and there were fewer
surprises; the information gleaned from the overall risk workshop and risk
management effort resulted in more informed decision-making.
Project Risk Management Guidance for WSDOT Projects Page 61
July 2010
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management
efforts, including:
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our state of readiness
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our commitment to looking ahead, and being prepared to
improvise and adapt
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
The robustness of our risk response actions
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
The quality of our documentation
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
How earnestly we integrate risk management into our project
management plan
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Keeping our RMP up-to-date, including the RMPS spreadsheet
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our preparedness to provide the following performance data
regarding our risk management efforts:
• Number of risks identifed
• Number of signifcant risks, as determined through quantitative
analysis
• Dollar value of signifcant risks
• Estimated cost of planned response actions
• Estimated value of costs avoided through risk management
• Actual cost of response actions
• Estimated Actual value of costs avoided through risk
management
• Estimated amount of delay (months) avoided through risk
management
Page 62 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Project Risk Management Guidance for WSDOT Projects Page 63
July 2010
Appendix A Project Risk Management Plan Template
A project risk management plan describes how a project team will incorporate the risk
management process into its project management plan. Particular emphasis should be given
to how a project team will respond to risks and monitor and control risk throughout the life
of the project. By identifying and analyzing risks, and then responding to risk aggressively and
monitoring the effectiveness of the response, project teams can improve the odds of meeting
project objectives.
This template is a convenient tool for project teams wishing to develop a detailed risk
management plan document; typically this is more common for highly complex project and/
or projects with signifcant risk.
The template presents an organized approach and is meant as a starting point only;
project teams must tailor the document to meet the needs for the risk management plan
for their project.
Page 64 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
Project Risk Management Plan
Offcial Project Title:
SR ###, MP limits:
Project Manager:
Risk Manager:
WIN:
PIN:
L#:
Introduction
This document is the Risk Management Plan for this project; it is a plan of action that describes how
this project team will deal with uncertainty and risk. Project risk management is an ongoing and integral
part of project management and is performed throughout the life of the project. The Project Manager is
responsible for reviewing and maintaining the Risk Management Plan to ensure that risk is appropriately
dealt with by the project team.
Project Manager Review
Initial and date after each review and update of this risk management plan:
Year Quarter 1 Quarter 2 Quarter 3 Quarter 4
2009
2010
2011
Project Risk Management Guidance for WSDOT Projects Page 65
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Plan
1
A formal project risk management plan is: a detailed plan of action for the management of
project risk. Project risk planning involves the thoughtful development, implementation, and
monitoring of appropriate risk response strategies. It is the process to develop and document an
organized, comprehensive, and interactive risk management strategy; determine the methods to
be used to execute a risk management strategy; and plan for adequate resources. The project risk
management plan may be specifc in some areas and general in others. The key to this tool is
its scalability. Every project should have a formal risk management plan, but the level of detail
varies with the project complexity.
What is a project risk management plan?
It is a document that gives a summary of the project and outlines the steps of the risk
management process and how the project manager and project team is approaching them.
The risk management plan employed will vary based on the complexity of the project, but most
project risk management plans should include an outline similar to the following:
1. Introduction 4. Organization and roles 7. Risk assessment and analysis
2. Summary 5. Risk management strategy/approach 8. Risk response actions/allocation
3. Defnitions 6. Risk identifcation 9. Risk monitoring and control
Why use a project risk management plan?
It explains how a project manager and project team manages risk for their project. It provides
guidance and requirements, and serves as a communication tool for those who wish to be
informed of a project’s risk management approach. The plan formalizes the ideas presented
during the risk management process and may clarify some of the assumptions the project team
has regarding the risk management process.
What does a project risk management plan do?
It provides specifc guidance for the project team members in all steps of the risk management
process for their project. The risk management plan documents the processes to use throughout
the project for identifying, assessing, and managing risk.
When to develop and use a project risk management plan?
The formal plan should be developed during the Planning and Scoping Process and updated
during subsequent project development phases.
How to use a project risk management plan?
The risk management plan is developed early in the project by collaboration with as many
members of the team as possible. It should be consulted and revised throughout the project
development process to guide the project through to completion.
1 (from NCHRP 8-60 review draft –with edits)
Page 66 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
Duties
Project Manager
• Approve the project risk management plan.
• Approve and insure implementation of response actions to identifed risks,
particularly signifcant risks that emerge as prospects for risk response.
• Confrm who will carry-out response actions and when action will be taken,
incorporate into work plan.
• Monitor effectiveness of response actions.
• Regularly review and update the project risk management plan.
• Promote aggressive risk management for this project.
• Actively participate in risk workshops.
• Communicate to senior management the risk and uncertainty the project is
exposed to and the action be taken to address it.
Project Team
Member
• Pro-actively identify risks and their characteristics in terms of probability of
occurrence and impact.
• Pro-actively respond to risks within specialty area.
• Document actions and report to project manager for inclusion in risk
management updates.
• Monitor effectiveness of response actions.
• Communicate with project manager with regard to risk management
actions and changing project risk profle (addition of new risks or retirement
of old risks –as appropriate).
Project Risk
Manager
• Prepare and update the project risk management plan.
• Develop a schedule for key check-in milestones for review and update of
the risk management plan.
• Determine when risk workshops will be needed and that appropriate
preparation is accomplished prior to the workshop.
• Collaborate with the Strategic Analysis and Estimating Offce, CREM
unit to coordinate pre-workshop, workshop and post-workshop activities,
including the need for consultants and/or other participants –both internal
and external.
• Oversee and manage day-to-day risk management process for the project.
• Ensure quality of risk data.
• Track and monitor effectiveness of response actions.
• Promote risk management activities within the project team and with
stakeholders.
• Communicate with project manager on all matters related to risk
management.
Risk Owner
(Action Owner)
• Implement agreed response actions.
• Report on effectiveness of the risk actions to the project manager/risk
manager and affected project team members.
• Identify new risks that may emerge after response actions.
• Communicate with project manager regularly, including the need for other
risk response actions if needed.
Project Risk Management Guidance for WSDOT Projects Page 67
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Process
This project complies with all WSDOT directional documents and
guidance for project risk management, including:
WSDOT Project Risk Management References
Project Management Online Guide (pre-construction) http://www.wsdot.wa.gov/Projects/
ProjectMgmt/Process.htm
Project Risk Management Guidance for WSDOT Projects
(Draft Working Document)
http://www.wsdot.wa.gov/Projects/
ProjectMgmt/Process.htm
WSDOT Guidelines for CRA-CEVP Workshops
Risk Management Plan Spreadsheet
Reference materials on the topic of risk management and risk
workshops at WSDOT.
WSDOT Directional Documents relating to Project Risk Management
IL 4071.00
Infation and Market Conditions Applied to Base Estimates
July 13, 2007
E 1038.00
Enterprise Risk Management
September 4, 2007
E 1042.00
Project Management and Reporting System
July 1, 2008
E 1032.01
Project Management
July 1, 2008
Project Delivery Memo 07-01
Project Cost Estimate Creation, Update, Review and Approval Procedures
July 1, 2008
E 1053.00
Project Risk Management and Risk Based Estimating
December 10, 2008
Page 68 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
1) Risk Management Planning
Risk Management will be a directed, focused and intentional effort for
this project. To that end the following items are included in this risk
management plan:
i. Level of Risk Assessment has been determined.
As indicated in E 1053.00 this project will conduct a Cost Risk
Assessment workshop as required for all projects between $25M and
$100M.
ii. Risk management activities are in the project schedule.
Risk management activities are included in the appropriate sections of
the project schedule, using the appropriate WSDOT MDL codes.
MDL Code MDL Name Description
PE.PD.04 Cost Risk
Estimate &
Management
Cost Risk Assessment, is an integral
element of project risk management
at WSDOT, and quantifes, within a
reasonable range, the cost and schedule to
complete a project; we will identify, assess
and evaluate risk that could impact cost
and/or schedule during project delivery.
PE.PD.04.20 CRA
Workshop
Cost Risk Assessment (CRA) is a workshop
process similar but less intense CEVP®.
The CRA workshop for this project is
planned for January 2010 and is included
in the project schedule; pre and post
workshop activities are also included in the
project schedule
NOTE: Project teams need to add tasks and sub-tasks as appropriate to their
project work activities using the appropriate MDL items.
iii. Risk management is an agenda item in regularly schedule project
meetings.
Risk management is included as an agenda item on our monthly
project meetings and is the number one agenda item each quarter.
iv. Communication to project team of our risk management effort and
expectations has been communicated to the project team.
During Initiate and Align, Plan the Work and Endorse the Plan risk
management has been communicated as an item of work for this
project. Specifcally it is included in the Team Mission/Assignment
and in our Roles and Responsibilities.
v. Risk will be managed, documented and reported.
Incorporated into the project schedule and monthly meetings is an item
for reporting on status of risk response actions. In addition this team
will use the Risk Management Plan Spreadsheet for summarizing and
tracking risk response action efforts for signifcant risks.
Project Risk Management Guidance for WSDOT Projects Page 69
July 2010
Appendix A Project Risk Management Plan Template
This Project Team is committed to aggressively and pro-actively managing
risk. We recognize that project risk management is at the heart of project
management and is an ongoing activity throughout the life of the project.
We also recognize that two pillars of risk management and we embrace
both, and we will respond to identifed risks and track the effectiveness
of our response actions.
Risk Management
Identify
Analyze
Respond
Monitor/Control
Risk Management
Identify
Analyze
Respond
Monitor/Control
First Pillar of Risk Management (Identify and Analyze)
2) Identify Risk Events
This project team will begin identifying risks and building its risk
register early in project development. Our risk manager will maintain
the risk register in anticipation of the CRA workshop and following the
risk management workshop. The WSDOT Risk Breakdown Structure
(RBS), provided in Chapter 2 of the Risk Management Guide, is used
for organizing risks via appropriate categories. Organizing risks in this
manner provides a consistent and convenient way to monitor and track
risks at the appropriate level of detail; this also allows for the development
of a risk database by category.
An example of how to use the RBS is provided on the following page.
Page 70 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
RISK BREAKDOWN STRUCTURE
EXAMPLE ON HOW TO USE
ENV 10.01
WSDOT Project Risk Management – “How to guide” APPENDIX_A_Risk Management Plan Template_2009-April
9 of 12
APPENDIX A Risk Management Plan Template
RISK BREAKDOWN STRUCTURE
EXAMPLE ON HOW TO USE ENV 10.01
ENV = Environmental/Hydraulics (Risk Category, Level 2 in the RBS)
ENV 10 = NEPA/SEPA Documentation (Level 3 in the RBS: 10 = Group within the category)
ENV10.01 = First Identified Risk in this Category and Group
3) Qualitative Risk Analysis
Initial analysis of risks will begin with a qualitative assessment; see Chapter 3 of the Risk
Management Guide.
4) Quantitative Risk Analysis
Quantitative analysis of risks will begin with our CRA workshop in January 2010; see
Chapter 4 of the Risk Management Guide for more detail on quantitative analysis.
ENV 10
NEPA/SEPA Documentation
Completion (incl. Section 4f,
etc.)
----------------
NEPA/SEPA Challenges
ENV = Environmental/Hydraulics (Risk Category, Level 2 in the RBS)
ENV 10 = NEPA/SEPA Documentation (Level 3 in the RBS: 10 = Group within the
category)
ENV10.01 = First Identifed Risk in this Category and Group
3 Qualitative Risk Analysis
Initial analysis of risks will begin with a qualitative assessment; see
Chapter 3 of the Risk Management Guide.
4) Quantitative Risk Analysis
Quantitative analysis of risks will begin with our CRA workshop in
January 2010; see Chapter 4 of the Risk Management Guide for more
detail on quantitative analysis.
Project Risk Management Guidance for WSDOT Projects Page 71
July 2010
Appendix A Project Risk Management Plan Template
Second Pillar of Risk Management (Respond, Monitor,
and Control)
5) Risk Response Planning
2
3
Our Project Team is committed to making effective use of the actionable
information that emerges from risk identifcation and analysis. Risk
response strategy is the process of the project team determining what,
if anything should be done with identifed risks signifcant enough to
impact project objectives. It leads to specifc actions the project team will
implement into their project management plan and work plans and then
pro-actively execute; response actions for threats (avoid, transfer, mitigate-
reduce) and opportunities (exploit, share, enhance) can be pursued or the
risk event may be accepted if the response action is not cost-effective.
Response actions will be developed and implemented promptly following
identifcation and analysis. Risks have a shelf life and risk management
plans can become stale if not monitored and updated regularly, we are
committed to making use of information when it is fresh and keeping our
project management and risk management plans up-to-date so they do not
lapse into irrelevance because they have become outdated and obsolete.
Chapter 5 of this document describes response actions for threats and
opportunities. The project work plan, including the schedule and resource
assignment establishes points at which response actions to identifed risks
will be implemented, including immediately following the CRA workshop
for this project. In addition the members of this project team are reminded
to be vigilant regarding risk for this project and to identify potential risk
events as they think of them, with the purpose of responding appropriately
to risk for this project.
Residual risks and responses (primary and secondary risks)
As a project develops its risk profle will change. Risks are identifed,
response actions are implemented which changes the nature of the project
risk profle and new risks are identifed. During risk identifcation we
identify of risk events, the frst time this is accomplished it constitutes a
list of primary risks, as actions are taken, secondary risks can emerge as a
result of implementing the treatment response to the primary risk.; where
possible secondary risks should be dealt with as part of the primary risk
response action. When developing our response actions we will be vigilant
in considering the ramifcations of the response actions. We will take
measures to include strategies that deal with the primary risk as well as
secondary risks and endeavor to minimize or eliminate residual risk as part
or risk response efforts.
2 Also referred to as Risk Treatment, Risk Mitigation, Risk Management or Risk Prevention in
some publications.
3 Practical Risk Management by David Hillson and Peter Simon (with edits)
Page 72 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
6) Risk Monitoring & Control
Monitoring and control is not complete unless communication has
occurred. COMMUNICATION is the lynch-pin of effective project
management and risk management.
Communication within and among the project team will be crisp,
concise, complete, correct and timely as will the communication to upper
management and executives. Effectiveness of the risk response actions
will be monitored and reported regularly, as indicated previously, at our
project meetings; adjustments will be made as needed.
RISK MONITORING and CONTROL (communication)
• Project Team
– Record assumptions that underlie judgments and decisions;
– Monitor and document results of implemented risk response
actions.
• Upper Management and Executives
– Avoid unpleasant surprises;
– Fully inform parties of risks, response actions and trade-offs;
• Accountability
– Document the risk assessment process in such a way that it can be
reviewed and examined for the reasons particular judgments and
decisions were made.
• Control of risk and management activities
– Specify criteria for risk management success, including targets and
measures used to assess performance;
– Follow-up with risk owners regarding the status of completing
the risk response actions and the resulting effect, track resource
allocation associated with risk response actions.
Project Risk Management Guidance for WSDOT Projects Page 73
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Performance
Date of this Report: ___________________
Cost Risk Estimating Management
Project Risk Management Performance Summary Report
(Workshops held between MMMM DD, YYYY and MMMM DD, YYYY)
Performance Measures
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Workshop Date(s)
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Pre-workshop Base Cost
Estimate for Project
Validated Base Cost
Estimate for Project
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Total # of Risks Identified
Total $ Value of Threats
Total $ Value of Opportunities
$ Value of Prospects for Risk
Response Actions
$ Cost of Risk Response
$ Cost Avoided through
pro-active risk response
RBS
CODE
Risk Break Down Structure
Group (Level 2)
Number of Risks Value of Threats $
Value of
Opportunities $
ENV Environmental and Hydraulics
STG Structures and Geotechnical
DES Design/PS&E
ROW Right-Of-Way and Access
UTL Utilities
RR Railroad
PSP Partnerships and Stakeholders
MGT Management and Funding
CTR Contracting and Procurement
CNS Construction
Page 74 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
doc_654456114.pdf
Risk management is the identification, assessment, and prioritization of risks (defined in ISO 31000 as the effect of uncertainty on objectives, whether positive or negative) followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events[1] or to maximize the realization of opportunities.
Project Risk
Management
Guidance for WSDOT Projects
July 2010
Americans with Disabilities Act (ADA) Information
Materials can be provided in alternative formats by calling the ADA Compliance Manager
at 360-705-7097. Persons who are deaf or hard of hearing may contact that number via the
Washington Relay Service at 7-1-1.
Title VI Notice to Public
It is the Washington State Department of Transportation’s (WSDOT) policy to assure that
no person shall, on the grounds of race, color, national origin, or sex, as provided by Title VI
of the Civil Rights Act of 1964, be excluded from participation in, be denied the benefts of,
or be otherwise discriminated against under any of its federally funded programs and activities.
Any person who believes his/her Title VI protection has been violated, may fle a complaint
with WSDOT’s Offce of Equal Opportunity (OEO). For Title VI complaint forms and advice,
please contact OEO’s Title VI Coordinator at 360-705-7098 or 509-324-6018.
To get the latest information for WSDOT administrative and engineering manuals, sign up for in-
dividual manual e-mail updates at www.wsdot.wa.gov/publications/manuals.
Washington State Department of Transportation
Administrative and Engineering Publications
PO Box 47304
Olympia, WA 98504-7304
Phone: 360-705-7430
E-mail: [email protected]
Internet: www.wsdot.wa.gov/publications/manuals
Project Risk Management Guidance for WSDOT Projects Page iii
July 2010
Foreword
Inaccurate cost estimating has dogged transportation projects for years. B.
Flyvbjerg’s noted study on the results of transportation project estimating
found that for the past 70 years, the cost of transportation projects has
been consistently underestimated in many parts of the world, including
the U.S.
The future is uncertain, but it is certain that there are two questions
will be asked about our projects: (1) How much will it cost? (2) How
long will it take? And of course the obvious follow-up question: Why?
(Why that much and why that long?)
These questions are posed in the future tense, and we are being asked
to predict an uncertain future. Because the future is uncertain the
fundamental answers to these questions is that an estimate is more
accurately expressed not as a single number but as a range. To determine
an accurate estimate range for both cost and schedule, risk and uncertainty
must be quantifed.
Estimates are comprised of two components: the base cost component and
the risk (or uncertainty) component. Base cost is defned as the likely cost
of the planned project if no signifcant problems occur. Once the base cost
is established, a list of uncertainties is created of both opportunities and
threats, called a “risk register.” The risk assessment replaces general and
vaguely defned contingency with explicitly defned risk events and with
the probability of occurrence and the consequences of each potential risk
event. Scope control is of course necessary for project management and
estimating. Cost estimates are to be reviewed and validated, and a base
cost for the project is determined.
Project risk management is a scalable activity and should be
commensurate with the size and complexity of the project under
consideration. Simpler projects may utilize simple qualitative analysis as
found in the Project Management Online Guide in the Risk Management
Plan spreadsheet. Larger more complex projects may wish to use more
robust analysis techniques via Monte-Carlo simulation models.
This guidance has been developed by the Strategic Assessment and
Estimating Offce (SAEO) in alignment with the goals of the Statewide
Program Management Group (SPMG). This document would not have
been possible with the contributions of dozens of key WSDOT people
who participated in the development and review of these guidelines.
DRAFT
FirstName LastName
WSDOT State Design Engineer
“What gets us in trouble is
not what we don’t know. It’s
what we know for sure that
just ain’t so.” Mark Twain
Page iv Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page v
July 2010
Comment Form
NOTE: This document is a working draft – your feedback and input is greatly appreciate.
From: Date:
Phone:
To: WSDOT – Headquarters Design
Strategic Analysis and Estimating Offce Mailstop 47330
PO Box 47330
310 Maple Park AVE SE
Olympia WA 98501-7330
Subject: Project Risk Management Guide Comment
Preserve this original for future use submit copies only
Acknowledgement: Author/Editor Mark Gabel, P.E.
WSDOT Strategic Analysis Estimating Offce
Page vi Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page vii
July 2010
Contents
Foreword iii
Comment Form v
Purpose ix
Defnitions of Selected Terms xi
The Value of Risk Management xiii
Project Risk Management Process xvii
Maximum Effort = Reduced Risk xix
Statement of Policy xxi
Chapter 1 Risk Management Planning 1
Chapter 2 Risk Identifcation 11
Chapter 3 Qualitative Risk Analysis 23
Chapter 4 Quantitative Risk Analysis 33
Chapter 5 Risk Response 43
Chapter 6 Risk Monitoring and Control 53
Appendix A Project Risk Management Plan Template 63\
Page viii Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page ix
July 2010
Purpose
This document provides information to project managers and
project teams that will help with their risk management efforts in the
following ways:
• Provide a consistent methodology for performing project risk
management activities.
*
• Provide techniques and tools for project risk management.
• Identify data requirements for risk analysis input and for output
(CPMS data requirements).
• Provide information on how project risk management fits into the
overall project management process at WSDOT.
• Provide guidance on how to proactively respond to risks.
Understanding of project risks will better enable project teams to
contribute to the fulfllment of public service through assessing project
risk and uncertainty to aide in making decisions regarding project
development and delivery. These decisions contribute to public safety and
the projects we deliver add value to Washington State on many levels.
Estimating the cost of transportation projects is a fundamental
responsibility of the Washington State Department of Transportation
(WSDOT). In recognition of the fundamental and strategic importance
of cost estimating these guidelines provide consistent practices across
the agency to enhance methods for meeting this responsibility. These
guidelines were developed by the Strategic Analysis and Estimating Offce
with contributions from a number of specialists in cost estimating and
project development.
Estimators must be shielded from pressures to prepare estimates that
match some preconceived notion of what a project should cost. Estimators
need to prepare estimates based on the scope of the project, the schedule
of the project and the bidding conditions that are anticipated.
* The methodology is consistent with the Project Management Institute (PMI) per the Project
Management Body Of Knowledge (PMBOK).
“No construction project
is risk free. Risk can be
managed, minimized,
shared, transferred,
or accepted. It cannot be
ignored.”
Sir Michael Latham, 1994
Page x Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page xi
July 2010
Base Cost Estimate – The Base Cost represents the cost which can
reasonably be expected if the project materializes as planned. The base
cost estimate is ubbiased and neutral- it is not optimistic and it is not
conservative. The base cost estimate includes the standard WSDOT
4% construction contingency described in the Plans Preparation
Manual M 22-31. It dose not include any signifcant risks (threats or
opportunities).
Note:
1. refer to WSDOT Plans Preparation Manual M 22-31 Section
800.03(2)
“Contingency percentages’ are setup to handle unforeseen changes in a
project during construction, including additional work, quantity over-
runs, and additional items. Contingencies are currently limited to 4%
of the total contract amount for all WSDOT contracts.”
2. The Base Cost typically falls in the 20% to 40% confdence level in
the Risk Based.
Construction Phase (CN) – The activities associated with the
administration of a contract for specifed services and physical
infrastructure. Primarily, the construction phase includes change
management, assurance that safety and associated impacts to the traveling
public are mitigated, payment for work completed, and the documentation
of physically constructed elements, certifcation and documentation of
quality.
Estimator – “One who assesses the extent of work and/or components
of the work (i.e. materials, equipment and labor) to be done to complete
a project, or a strictly defned part of the project, and state a likely or
approximate quantity in generally accepted units of measurement and cost
for the project.”
Preliminary Engineering Phase (PE) – The effort (budget/cost) of taking
a project through the planning, scoping, and design phases. Planning
and scoping typically have separate budgets but are encompassed under
Preliminary Engineering. The terms “Design” or “Design Phase” are
sometimes used interchangeably with PE.
Project Cost Estimate – total project cost estimate includes
PE + RW + CN
Defnitions of Selected Terms
Page xii Project Risk Management Guidance for WSDOT Projects
July 2010
Right-Of-Way Phase (R/W) – This effort includes the revision of existing
plans or the preparation of new plans detailing the need for new Right
of Way defned during the design phase. It also includes the appraisal,
negotiation, and purchase of new Right of Way by the Real Estate Services
offce. The right-of-way phase can begin during scoping, after design
completion, or anytime in between. The phase end is when the RW is
certifed, but this may not have a direct relationship to the construction
phase, except that CN cannot begin unless the RW is certifed. Except
under rare circumstances, all new Right-of-Way must be acquired before
the project can go to Ad. NOTE: Preparation of R/W Plans is paid for
with PE dollars and is part of the design effort; Negotiation, Purchase and
Acquisition of R/W is performed by the Real Estate Services offce and
comprises the cost of R/W.
Risk – The combination of the probability of an uncertain event and its
consequences. A positive consequence presents an opportunity; a negative
consequence poses a threat.
Risk Management –Refers to the culture, processes, and structures that
are directed toward effective management of risks –including potential
opportunities and threats to project objectives.
Risk-Based Estimate – Involves simple or complex modeling based
on inferred and probabilistic relationships among cost, schedule, and
events related to the project. It uses the historical data and/or cost based
estimating techniques and the expert’s best judgment to develop a Base
Cost or the cost of the project if the project proceeds as planned. Risk
elements (opportunities or threats) are then defned and applied to the Base
Cost through modeling to provide a probable range for both project cost
and schedule.
A comprehensive glossary can be found at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/workshop.htm
Project Risk Management Guidance for WSDOT Projects Page xiii
July 2010
Project risk management delivers the following values:
• Contributes to project success;
• Recognizes uncertainty and provides forecasts of possible outcomes;
• Produces better business outcomes through more informed decision-
making;
• Is a positive influence on creative thinking and innovation;
• Offers better control –less overhead and less time wasted, greater focus
on benefits;
• Helps senior management to understand what is happening with the
project and the challenges the project has to overcome.
Project risk management is an integral component of project management
and found at the heart of WSDOT’s Project Management processes.
Risk management is also a key component of project cost estimating
and scheduling, as noted in the National Cooperative Highway Research
Program in NCHRP Report 574, which is available at the WSDOT
library along with other publications on project management and risk
management.
Figures 1 and 2, on the following pages, depict Project Risk Management
through Project Development and Balanced Risk Management.
“The problem with the
future is that more things
might happen than will
happen” (Plato). With
effective risk management,
as an integral and
required part of project
management, we can
not only predict possible
future outcomes, we can
take action to shift the
odds for project success
in our favor.
The Value of Risk Management
Page xiv Project Risk Management Guidance for WSDOT Projects
July 2010
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
t
h
r
o
u
g
h
P
r
o
j
e
c
t
D
e
v
e
l
o
p
m
e
n
t
a
n
d
C
o
n
s
t
r
u
c
t
i
o
n
F
i
g
u
r
e
1
H
ig
h
w
a
y
S
y
s
t
e
m
P
la
n
C
a
p
it
a
l
I
m
p
r
o
v
e
m
e
n
t
&
P
r
e
s
e
r
v
a
t
io
n
P
r
o
g
r
a
m
(
C
I
P
P
)
&
B
ie
n
n
ia
l
P
r
o
g
r
a
m
A
w
a
r
d
C
o
n
c
e
p
t
u
a
l
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
p
o
t
e
n
t
i
a
l
f
u
n
d
s
n
e
e
d
e
d
&
p
r
i
o
r
i
t
i
z
e
n
e
e
d
s
f
o
r
h
i
g
h
w
a
y
s
y
s
t
e
m
p
l
a
n
S
c
o
p
i
n
g
E
s
t
i
m
a
t
i
n
g
S
e
t
b
a
s
e
l
i
n
e
c
o
s
t
f
o
r
p
r
o
j
e
c
t
a
n
d
p
r
o
g
r
a
m
p
r
o
j
e
c
t
(
C
I
P
P
a
n
d
b
i
e
n
n
i
a
l
p
r
o
g
r
a
m
)
D
e
s
i
g
n
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
f
o
r
C
o
s
t
M
a
n
a
g
e
m
e
n
t
P
S
&
E
E
s
t
i
m
a
t
i
n
g
E
s
t
i
m
a
t
e
c
o
n
s
t
r
u
c
t
i
o
n
c
o
s
t
s
t
o
o
b
l
i
g
a
t
e
f
u
n
d
s
&
c
o
m
p
a
r
e
w
i
t
h
b
i
d
s
P
l
a
n
n
i
n
g
a
n
d
P
r
o
j
e
c
t
D
e
v
e
l
o
p
m
e
n
t
P
h
a
s
e
s
P
r
o
g
r
a
m
(
p
r
o
j
e
c
t
)
s
c
o
p
e
(
c
a
t
e
g
o
r
y
,
c
o
n
c
e
p
t
s
,
s
c
h
e
m
a
t
i
c
s
&
l
o
c
a
t
i
o
n
)
N
e
e
d
s
/
d
e
f
i
c
i
e
n
c
i
e
s
C
o
s
t
E
s
t
i
m
a
t
e
s
(
R
e
c
y
c
l
e
l
o
o
p
)
P
r
o
g
r
a
m
(
p
r
o
j
e
c
t
)
c
o
s
t
e
s
t
i
m
a
t
e
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
P
l
a
n
n
i
n
g
P
r
o
j
e
c
t
s
c
o
p
e
(
s
c
h
e
m
a
t
i
c
s
,
t
y
p
e
,
(
P
o
r
I
)
,
p
r
e
l
i
m
i
n
a
r
y
p
l
a
n
s
,
a
l
t
e
r
n
a
t
i
v
e
s
,
l
o
c
a
t
i
o
n
B
a
s
e
l
i
n
e
c
o
s
t
e
s
t
i
m
a
t
e
P
r
o
j
e
c
t
s
c
o
p
e
(
d
e
s
i
g
n
,
d
e
v
e
l
o
p
m
e
n
t
,
e
g
,
p
l
a
n
s
f
o
r
a
p
p
r
o
v
a
l
,
e
t
c
)
P
e
r
i
o
d
i
c
c
o
s
t
e
s
t
i
m
a
t
e
u
p
d
a
t
e
s
P
r
o
j
e
c
t
s
c
o
p
e
(
f
i
n
a
l
p
l
a
n
s
/
s
p
e
c
s
a
n
d
b
i
d
d
o
c
u
m
e
n
t
s
)
E
n
g
i
n
e
e
r
’
s
E
s
t
i
m
a
t
e
P
S
&
E
A
d
v
e
r
t
i
s
e
a
n
d
B
i
d
C
o
n
s
t
r
u
c
t
i
o
n
S
c
o
p
i
n
g
D
e
s
i
g
n
Pre - constructionphases
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
C
o
s
t
E
s
t
i
m
a
t
i
n
g
T
A
K
E
A
C
T
I
O
N
-
I
M
P
L
E
M
E
N
T
R
I
S
K
R
E
S
P
O
N
S
E
P
L
A
N
C
U
R
R
E
N
T
P
r
o
j
e
c
t
M
g
m
t
P
l
a
n
S
c
o
p
e
S
c
h
e
d
u
l
e
E
s
t
i
m
a
t
e
s
D
o
c
u
m
e
n
t
a
t
i
o
n
U
p
d
a
t
e
P
r
o
j
e
c
t
M
g
m
t
P
l
a
n
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
n
i
n
g
R
i
s
k
m
a
n
a
g
e
m
e
n
t
i
s
a
t
t
h
e
h
e
a
r
t
o
f
p
r
o
j
e
c
t
m
a
n
a
g
e
m
e
n
t
a
n
d
i
s
a
n
o
n
g
o
i
n
g
a
c
t
i
v
i
t
y
u
n
t
i
l
t
h
e
p
r
o
j
e
c
t
i
s
c
o
m
p
l
e
t
e
d
.
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
D
o
c
u
m
e
n
t
a
n
d
r
e
c
o
r
d
C
h
a
n
g
e
O
r
d
e
r
s
a
n
d
t
h
e
e
f
f
e
c
t
o
n
p
r
o
j
e
c
t
s
c
o
p
e
,
s
c
h
e
d
u
l
e
a
n
d
c
o
s
t
.
R
i
s
k
A
n
a
l
y
s
i
s
R
i
s
k
I
d
e
n
t
i
f
i
c
a
t
i
o
n
(
d
e
t
e
r
m
i
n
e
a
n
d
d
o
c
u
m
e
n
t
r
i
s
k
c
h
a
r
a
c
t
e
r
i
s
t
i
c
s
P
r
o
d
u
c
e
P
r
e
l
i
m
i
n
a
r
y
R
i
s
k
R
e
g
i
s
t
e
r
)
Q
u
a
l
i
t
a
t
i
v
e
Q
u
a
n
t
i
t
a
t
i
v
e
P
r
e
-
R
e
s
p
o
n
s
e
A
n
a
l
y
s
i
s
R
i
s
k
R
e
s
p
o
n
s
e
P
l
a
n
n
i
n
g
P
o
s
t
-
r
e
s
p
o
n
s
e
A
n
a
l
y
s
i
s
R
e
s
u
l
t
s
O
f
R
i
s
k
R
e
s
p
o
n
s
e
A
c
t
i
o
n
s
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
c
d
ef
h
r
Project Risk Management Guidance for WSDOT Projects Page xv
July 2010
B
a
l
a
n
c
e
d
R
i
s
k
M
a
n
a
g
e
m
e
n
t
(
R
i
s
k
T
o
l
e
r
a
n
c
e
)
F
i
g
u
r
e
2
S
p
e
n
d
r
e
s
o
u
r
c
e
s
o
n
“
f
i
r
e
-
f
i
g
h
t
i
n
g
”
I
n
a
d
e
q
u
a
t
e
r
e
s
o
u
r
c
e
s
f
o
r
r
i
s
k
p
r
o
c
e
s
s
S
t
r
e
n
g
t
h
e
n
r
i
s
k
p
r
o
c
e
s
s
R
i
s
k
p
r
o
c
e
s
s
b
e
c
o
m
e
s
b
u
r
d
e
n
s
o
m
e
U
n
d
e
r
-
i
n
v
e
s
t
i
n
r
i
s
k
m
a
n
a
g
e
m
e
n
t
O
v
e
r
-
i
n
v
e
s
t
i
n
r
i
s
k
m
a
n
a
g
e
m
e
n
t
E
f
f
e
c
t
s
o
f
r
i
s
k
-
a
v
e
r
s
e
a
p
p
r
o
a
c
h
E
f
f
e
c
t
s
o
f
r
i
s
k
-
s
e
e
k
i
n
g
a
p
p
r
o
a
c
h
I
n
e
f
f
e
c
t
i
v
e
r
i
s
k
m
a
n
a
g
e
m
e
n
t
T
h
r
e
a
t
s
m
a
t
e
r
i
a
l
i
z
e
O
p
p
o
r
t
u
n
i
t
i
e
s
a
r
e
m
i
s
s
e
d
R
i
s
k
m
a
n
a
g
e
m
e
n
t
b
e
c
o
m
e
s
l
e
s
s
c
o
s
t
e
f
f
e
c
t
i
v
e
R
e
s
o
u
r
c
e
s
s
p
e
n
t
o
n
l
o
w
p
r
i
o
r
i
t
y
i
t
e
m
s
B
a
l
a
n
c
e
d
R
i
s
k
M
a
n
a
g
e
m
e
n
t
A
p
p
r
o
a
c
h
A
p
p
r
o
p
r
i
a
t
e
R
i
s
k
M
a
n
a
g
e
m
e
n
t
M
a
t
c
h
e
s
E
n
t
e
r
p
r
i
s
e
R
i
s
k
T
o
l
e
r
a
n
c
e
P
r
o
-
A
c
t
i
v
e
r
e
s
p
o
n
s
e
s
t
o
r
i
s
k
s
R
e
s
o
u
r
c
e
s
a
l
l
o
c
a
t
e
d
e
f
f
e
c
t
i
v
e
l
y
Page xvi Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page xvii
July 2010
Risk management, as an integral part of project management, occurs on
a daily basis. With pro-active risk management we look at projects in a
comprehensive manner and assess and document risks and uncertainty.
The steps for risk management are provided below.
Risk Management Steps
WSDOT Project Management Online Guide (PMOG) risk management
steps:
1) Risk
Management
Planning
Risk Management Planning is the systematic process
of deciding how to approach, plan, and execute risk
management activities throughout the life of a project.
It is intended to maximize the benefcial outcome of the
opportunities and minimize or eliminate the consequences
of adverse risk events. (WSDOT PMOG)
2) Identify Risk
Events
Risk identifcation involves determining which risks might
affect the project and documenting their characteristics. It
may be a simple risk assessment organized by the project
team, or an outcome of the CEVP®/CRA workshop process.
3) Qualitative
Risk Analysis
Qualitative risk analysis assesses the impact and likelihood
of the identifed risks and develops prioritized lists of these
risks for further analysis or direct mitigation. The team
assesses each identifed risk for its probability of occurrence
and its impact on project objectives. Project teams may elicit
assistance from subject matter experts or functional units to
assess the risks in their respective felds.
4) Quantitative
Risk Analysis
Quantitative risk analysis is a way of numerically estimating
the probability that a project will meet its cost and time
objectives. Quantitative analysis is based on a simultaneous
evaluation of the impacts of all identifed and quantifed risks.
5) Risk
Response
Planning
Risk response strategy is the process of developing options
and determining actions to enhance opportunities and reduce
threats to the project’s objectives. It identifes and assigns
parties to take responsibility for each risk response. This
process ensures that each risk requiring a response has an
“owner” . The Project Manager and the project team identify
which strategy is best for each risk, and then selects specifc
actions to implement that strategy.
6) Risk
Monitoring &
Control
Risk Monitoring and Control tracks identifed risks, monitors
residual risks, and identifes new risks—ensuring the
execution of risk plans, and evaluating their effectiveness
in reducing risk. Risk Monitoring and Control is an ongoing
process for the life of the project.
The remainder of this document includes more detail on the steps listed
above.
Project Risk Management Process
Page xviii Project Risk Management Guidance for WSDOT Projects
July 2010
Table 1 provides a helpful comparison between risk and objectives for
various types of risk management. For this document we are interested in
Project risk management.
Type of risk
management
Description Sample objectives
Generic Risk: any uncertainty that, if
it occurs, would affect one or
more objectives
-
Project risk
management
Project Risk: any
uncertainty that, if it occurs,
would affect one or more
project objectives
Time, cost, performance,
quality, scope, client
satisfaction.
Business risk
management
Business Risk: any
uncertainty that, if it occurs,
would affect one or more
business objectives
Proftability, market share,
competitiveness, Internal Rate
of Return (IRR), reputation,
repeat work, share price.
Safety risk
management
Safety Risk: any uncertainty
that, if it occurs, would affect
one or more safety objectives
Low accident rate, minimal
lost days, reduced insurance
premiums, regulatory
compliance.
Technical risk
management
Technical Risk: any
uncertainty that, if it occurs,
would affect one or more
technical objectives
Performance, functionality,
reliability, maintainability.
Security risk
management
Technical Risk: any
uncertainty that, if it occurs,
would affect one or more
security objectives
Information security, physical
security, asset security,
personnel security.
Credit: David Hillson, Effective Opportunity Management for Projects
Relationship between Risk and Objectives
Table 1
Project Risk Management Guidance for WSDOT Projects Page xix
July 2010
Description
The power of risk management is fully realized when a project manager
takes action to respond to identifed risks based on the risk analysis, with
effort being directed toward those risks that rank the highest in terms of
signifcant impact to project objectives.
Inputs
Project scope, schedule, and estimate package. The estimate package
should include the most current versions of the following items:
• Project Summary
• Detailed scope of work (commensurate to the level of development)
• Project Cost Estimate (with basis of cost estimate completed)
– PE cost estimate
– ROW cost estimate
– Construction cost estimate
• Previous risk analyses (if applicable)
• Project Management Plan
• Project Schedule
– Overall project schedule
– Detailed construction schedule (commensurate to the level
of development)
• Additional information as necessary
Techniques and Tools
WSDOT provides a number of techniques and tools to assist in project risk
management. These tools and techniques provide scalability and fexibility
so that project teams can match the tool with the specifc needs of their
projects. Often times the appropriate tool is determined by the size and
complexity of the project. These tools include:
• Project Management Online Guide (PMOG)
– Project Management Plan (fundamental for all project
management)
– The PMOG provides a risk matrix suitable for smaller simpler
projects
– Risk planning and risk management are an integral element
of project management
Maximum Effort = Reduced Risk
Page xx Project Risk Management Guidance for WSDOT Projects
July 2010
• Risk Management Plan spreadsheet template (found on
SAEO website)
• Self-Modeling tool for quantitative risk analysis
• CRA workshops for all projects between $25M and $100M
• CEVP workshops for all projects over $100M
Output
CPMS data requirements per in Instructional Letter (IL) 4071.00; Project
teams must provide specifc data to the region program management offce
for inclusion into CPMS and the Transportation Executive Information
System (TEIS). The required data is:
1. Project scheduling data for the following milestone dates:
• Project defnition completion date
• Date for the beginning of preliminary engineering
• Completion date for the environmental document
• Start date for the acquisition of right of way
• Date of right of way certifcation
• Project advertisement date
• Date project is operationally complete (substantially complete)
2. Estimated Project Cost Data (in Current Year Dollars, CY$)
• Date of estimate basis (i.e., “2007 $”)
• Design cost estimate
• Right of way cost estimate
• Construction cost estimate
3. Midpoint for construction phases using the project award date and the
operationally complete date.
Project Risk Management Guidance for WSDOT Projects Page xxi
July 2010
Project Risk Management and Risk Based Estimating
It is the policy of the Washington State Department of Transportation
(WSDOT) to conduct risk based estimating workshops for all projects over
$10 Million (PE, R/W and Const). These workshops provide information
to project managers that can help them control scope, cost, schedule, and
manage risks for all projects. This policy reaffrms the requirement that a
risk management plan is a component of every project management plan.
Levels of risk based estimating, in support of risk management (E 1053.00):
Project Size ($)
Required Process
(project managers can use a higher level process if desired)
Less than $10 M Qualitative Spreadsheet in the Project Management
Online Guide
1
$10 M to $25 M In-formal workshop using the Self-Modeling Spreadsheet
1, 3
$25 M to $100 M Cost Risk Assessment (CRA) Workshop
1, 2
Greater than
$100 M
Cost Estimate Validation Process (CEVP®) Workshop
2
1 In some cases it is acceptable to combine the Value Engineering Study and Risk
Based Estimating Workshop.
2 Projects $25 Million and over should use the self-modeling spreadsheet in the
scoping phase risk based estimating process, followed up by the more formal CRA
or CEVP® process during the design phase.
3 An informal workshop is comprised of the project team (or key project team
members), other participants may be included as the project manager/project team
deem necessary.
A general comparison of a few typical characteristics for CRA and CEVP®
CRA CEVP®
Workshop length 1 – 2 days 3 – 5 days
Subject Matter
Experts
Internal and local. Internal and external.
Timing (when to
hold workshop)
Anytime. Typically updated
when design changes or
other changes to the project
warrant an updated CRA.
Best to start early in the
process, major projects are
typically updated as needed.
General An assessment of risks with
an evaluation and update
of costs and schedule
estimates.
An intense workshop
that provides an external
validation of cost and
schedule estimates and
assesses risks.
Note: Workshops are orchestrated by the Cost Risk Estimating Management (CREM)
unit of the Strategic Analysis and Estimating Offce in HQ in collaboration with the
project manager. The project manager submits a workshop request and works with
the CREM unit to ascertain the type of workshop required and candidate participants.
See WSDOT Guidelines for CRA-CEVP workshops for more details.
Statement of Policy
Page xxii Project Risk Management Guidance for WSDOT Projects
July 2010
“It must be recognized that even the fnal construction estimate is of
limited accuracy and that it bears little resemblance to the advance
determination of the production costs of mass-produced goods.
Construction estimating is a relatively crude process. The absence of any
appreciable standardization together with a myriad of unique site and
project conditions make the advance computation of exact construction
expenditures a mater more of accident than design. Nevertheless, a skilled
and experienced estimator, using cost accounting information gleaned
from previous construction work of a similar nature, can do a credible job
of predicting construction disbursements despite the project imponderables
normally involved. The character of location of a construction project
sometimes presents unique problems, but some basic principle for which
there is precedent almost always apply.”
Construction Project Management 5th Edition, Sears and Clough 2008
Project Risk Management Guidance for WSDOT Projects Page 1
July 2010
Chapter 1 Risk Management Planning
Good risk management planning begins with sound project management
practices including review of organizational policies and guidance, Project
Initiation and Team Alignment, and Project Planning steps as provided
for in the WSDOT Project Management Online Guide. Risk Management
must commence early in the project development process and proceed as
project knowledge evolves and project information increases in quantity
and quality. Monitoring project development and risk exposure continues
formal risk assessments of risk may occur several times through the
life of the project. People and resources involved in the project, project
management plan development, and risk management plan development
must consider the resources needed for project risk management and build
it into their project development budget and schedule. Risk management
activities, including risk workshops (such as CRA, CEVP or other
meetings) should be part of the Project Workplan and built into the project
schedule and budget.
As the project develops and moves through scoping and early design
phases, more knowledge about the project becomes available, see
Figure 1-1. With the rising knowledge about a project’s scope comes an
understanding that contending with some elements of the project will
require signifcant additional resources. Such elements could be related
to scope, environmental mitigation and permitting, rising cost of right-of-
way as corridors develop in advance of the project, utilities, seismic and
other considerations. Traditional estimating practices tend to produce “the
number” for a project. But the single number masks the critical uncertainty
inherent in a particular project. It implies a sense of precision beyond what
can be achieved during planning, scoping or early design phases. WSDOT
has come to the understanding that an estimate is more accurately
expressed not as a single number but as a range.
To determine an accurate estimate range for both cost and schedule,
risk must be measured. Formerly, WSDOT measured risk based on the
estimator’s experience and best judgment, without explicitly identifying
the project’s uncertainties and risks. That has changed. Estimates now
comprise two components: the base cost component and the risk (or
uncertainty) component. The Base Cost represents the cost which
can reasonably be expected if the project materializes as planned. .
The base cost does not include contingencies. Once the base cost is
established, a list of risks is created of both opportunities and threats,
called a “risk register.” The risk assessment replaces general and vaguely
defned contingency with explicitly defned risk events. Risk events are
characterized in terms of probability of occurrence and the consequences
of each potential risk event.
Page 2 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
In Executive Order E 1038.00 WSDOT establishes, as policy, to
proactively assess and respond to any risks that may affect the
achievement of WSDOT’s strategic performance based objectives and
their intended outcomes. It further goes on to direct employees to support
the department’s efforts to identify, share and manage risk across all
organizations and functions. Risk reviews are an integral part of budget
development, and the intent is for the department to make informed
decisions about risk tolerance. In can be inferred that determined
Enterprise Risk Management will require comprehensive Project Risk
Management, and Project Risk Management is also a key component of a
Project Management Plan, which is required for all WSDOT projects.
We then, as stewards of the public trust, must endeavour to inform
decision-makers of the uncertainty and risk associated with the projects we
develop. We must understand risk tolerance and we must weigh the value
of project decisions with risks associated with the project.
WSDOT Project Risk Management – “How to guide” 1 Risk Management Planning rev 2009-April
2 of 9
Chapter 1 Risk Management Planning
We then, as stewards of the public trust, must endeavour to inform decision-makers of the
uncertainty and risk associated with the projects we develop. We must understand risk tolerance
and we must weigh the value of project decisions with risks associated with the project.
Figure 1-1 Evolution of Project Knowledge through Project Development
In Chapter 5 of the book “Risk, Uncertainty and Government”, it notes “…lawyers and
economists are accustomed to think of contracts for future performance as devices for allocating
risks of future events”. In order for us to understand this allocation of risk -projects must be
examined and the uncertainty and risks must be documented and characterized.
Components of Uncertainty
P
o
r
t
i
o
n
o
f
P
r
o
j
e
c
t
C
o
s
t
(
w
h
a
t
i
s
k
n
o
w
n
a
n
d
u
n
k
n
o
w
n
?
)
Unrecognized
Unknown - Unknowns
Known but not Quantified
Known - Unknowns
Known and Quantifiable
Known - Knowns
Conservative Estimate w/Allowance
Deterministic Estimate
(conservative est. w/allowance + contingency)
Contingency
Project Development Phase
Planning Programming Scoping Design/P&E Ad/Bid/Award Construct
D
e
s
ig
n
A
llo
w
a
n
c
e
s
Engineer’s
Estimate at Ad
Components of Uncertainty
P
o
r
t
i
o
n
o
f
P
r
o
j
e
c
t
C
o
s
t
(
w
h
a
t
i
s
k
n
o
w
n
a
n
d
u
n
k
n
o
w
n
?
)
Unrecognized
Unknown - Unknowns
Known but not Quantified
Known - Unknowns
Known and Quantifiable
Known - Knowns
Conservative Estimate w/Allowance
Deterministic Estimate
(conservative est. w/allowance + contingency)
Contingency
Project Development Phase
Planning Programming Scoping Design/P&E Ad/Bid/Award Construct
D
e
s
ig
n
A
llo
w
a
n
c
e
s
Engineer’s
Estimate at Ad
Evolution of Project Knowledge through Project Development
Figure 1-1
In Chapter 5 of the book “Risk, Uncertainty and Government”, it notes
“…lawyers and economists are accustomed to think of contracts for future
performance as devices for allocating risks of future events”. In order for
us to understand this allocation of risk -projects must be examined and the
uncertainty and risks must be documented and characterized.
Project Risk Management Guidance for WSDOT Projects Page 3
July 2010
Chapter 1 Risk Management Planning
WSDOT Project Risk Management – “How to guide” 1 Risk Management Planning rev 2009-April
3 of 9
Chapter 1 Risk Management Planning
We can think of risk management as depicted above, the two pillars of risk management are
“IDENTIFY and ANALYZE” the risks then, as depicted in the second pillar “RESPOND,
MONITOR and CONTROL” project risk.
Unless we incorporate the second pillar we are not realizing the full value of risk management.
When preparing our project management plan and work activities for our project, we must
include both pillars of risk management in our plan.
Risk Management
Identify
Analyze
Respond
Monitor/Control
Risk Management
Identify
Analyze
Respond
Monitor/Control
We can think of risk management as depicted above, the two pillars of risk
management are “IDENTIFY and ANALYZE” the risks then, as depicted
in the second pillar “RESPOND, MONITOR and CONTROL” project
risk.
Unless we incorporate the second pillar we are not realizing the full
value of risk management. When preparing our project management plan
and work activities for our project, we must include both pillars of risk
management in our plan.
Page 4 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Risk Management Planning
“ How to”
Project Risk Management Guidance for WSDOT Projects Page 5
July 2010
Chapter 1 Risk Management Planning
How to Plan for Project Risk Management
Do you plan to manage risk for your project? YES! Then include risk
management in your project management plan.
#1 Determine the Level of Risk Assessment for your Project (see Table
1.1).
#2 Incorporate risk management activities into the project schedule (see
Table 1.2 and Figures).
#3 Make Risk Management an agenda item for regularly scheduled
project meetings.
#4 Communicate the importance of risk management to the entire project
team.
#5 Establish the expectation that risk will be managed, documented and
reported.
Helpful Hints for Risk Management Planning
• Risk assessment should begin early, but there must be enough known
about the project to understand what is being assessed. This will
of course be to varying levels of detail depending on the point in
project development at which the risk assessment is conducted
(planning, scoping, design/ps&e) –hence schedule risk assessments
at appropriate times.
• Allow time in the schedule for prep activities, this includes review and
QA/QC of project schedules and cost estimates at appropriate times.
• Allow budget for risk assessment, risk management and risk response
activities.
• Report on status of Project Risk in regularly scheduled project
meetings.
• Know the organization’s tolerance for risk. –are project managers (and
upper management) risk averse or risk seeking? How much risk is the
organization will to accept? Knowing the answers to these questions
will help with risk management and contribute to the decision-making
process when determining risk-response actions.
Page 6 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Project
Size ($M)
Risk Assessment Level Notes
L
e
s
s
F
o
r
m
a
l
R
i
s
k
A
s
s
e
s
s
m
e
n
t
0 to 10
Project Team Risk Assessment
Project Management
Online Guide (PMOG) Risk
Management Plan
Qualitative Tool
The Project team assesses each identifed
risk for its probability of occurrence and its
impact on project objectives. Project teams
may request assistance from subject matter
experts or functional units to assess the risks
in their respective felds. The self-modeling
spreadsheet can be used for any project.
10 to 25
Project Team Risk Assessment
Self-Modeling Spreadsheet
Quantitative Tool
M
o
r
e
F
o
r
m
a
l
R
i
s
k
A
s
s
e
s
s
m
e
n
t
(
W
o
r
k
s
h
o
p
s
)
25 to 100
Cost Risk Assessment
(CRA) Workshop
Quantitative Tool
The team, working collaboratively with
independent subject matter experts, reviews
and/or validates cost and schedule estimating
and identifes, characterizes and analyzes
risks. Accomplished in a structured workshop
setting. Modeling can be accomplished with off
the shelf software or using the self-modeling
spreadsheet.
Over 100
Cost Estimate Validation
Process (CEVP) Workshop
Quantitative Tool
Determine the Level of Risk Assessment
Table 1-1
Less Formal Risk Assessment
(does not require a Formal Workshop)
Milestones include:
Formal Workshop (CRA/CEVP)
Milestones include:
• Project Scope, Schedule and Estimate are
complete (apt for the level of development)
• Prep meeting (initial review of areas of
concern, determine tool qualitative or self-
modeling)
• Risk Meeting (risks are identifed and
characterized)
• Risk Response Actions Developed
• Risk Response Actions Implemented
• Workshop Request Form submitted
• Project Scope, Schedule and Estimate are
complete (apt for the level of development)
• Prep Session (fowchart project; determine
subject matter experts; additional prep items)
• Workshop
• Preliminary Results Presented
• Draft Report
• Final Report
Include Risk Management Milestones in the project schedule.
Table 1-2
Project Risk Management Guidance for WSDOT Projects Page 7
July 2010
Chapter 1 Risk Management Planning
S
i
m
p
l
i
f
e
d
W
o
r
k
s
h
o
p
T
i
m
e
l
i
n
e
F
i
g
u
r
e
1
-
2
Page 8 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Management Planning Chapter 1
Project Risk Management Guidance for WSDOT Projects Page 9
July 2010
Risk Management Schedule
(with workshop activities and post workshop activities)
Figure 1-3
WSDOT Project RiskManagement – “How to guide” 1 Risk Management Planning rev 2009-April
8 of 9
Chapter 1RiskManagement Planning
Figure1-3 Risk Management Schedule(with workshop activities and post workshop activities)
Page 10 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Guidance for WSDOT Projects Page 11
July 2010
Chapter 2 Risk Identifcation
Risk identifcation occurs through each of the four phases of project
development:
1. Planning
2. Scoping
3. Design/Plans, Specifcations and Estimate (Engineer’s Estimate)
4. Construction
As projects evolve through project development so too the risk profle
evolves project knowledge and understanding grows; hence previously
identifed risks may change and new risks identifed throughout the life of
the project.
Risk Identifcation: Inputs, Tools and Techniques, Outputs
Risk Identifcation Inputs
The frst and most important input is a defned project. In order to
fully understand and assess the risks that our projects are exposed to
we must frst insure that there is a mutual understanding of the project
under evaluation. This means that when we embark to meaningfully and
deliberately focus on the risks and uncertainties our project will face, we
must frst be able to defne the project in terms of scope, schedule and
estimate -commensurate with the level of project development at the time
of risk analysis.
Projects tend to develop in small steps; this incremental process of project
development is termed, by some, progressive elaboration. “Progressive
elaboration means developing in steps, and continuing by increments. For
example, the project scope will be broadly described early in the project
and made more explicit and detailed as the project team develops a better
and more complete understanding of the objectives and deliverables.
Progressive elaboration should not be confused with scope creep.”
PMBOK
Risk Identifcation Tools and Techniques
Try to identify as many risks as possible that may affect project objectives.
State the assumptions for risk identifcation and analysis and delineate
thresholds for risks. For example a project team may want to describe
all cost risks below $100,000 as minor and all schedule risks less than
2 weeks as minor thereby not spending inordinate amounts of time
on those risks and allowing them to focus on more signifcant risks
(assumptions and thresholds for risk assessment will be infuenced by the
size and complexity of the project, project environment, and the owners’
Page 12 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
tolerance for risk). There are a wide variety of techniques used for risk
identifcation. Some common techniques, used at WSDOT are provided
below.
Documentation Reviews
Peer level reviews of project documentation, studies, reports, preliminary
plans, estimates and schedules are a common and early method to help
identify risks that may affect project objectives.
Information Gathering
• Brainstorming Formal and informal brainstorming sessions with
project team members and extended project team members such as
specialty groups, stakeholders and regulatory agency representatives
is a technique for risk identification.. This technique can be scaled
for use on the simplest to the most complex projects. This technique
can also be tailored to specific areas of interest for the project risk,
for example if a project manager is most concerned about Geotech
conditions a brainstorming session on Geotech can be convened, and
so forth.
• Lessons Learned Database Searching for lessons learned using key-
words in the WSDOT lessons learned database that are relevant to
your project can provide an abundance of information on projects that
may have faced similar risks.
• Other methods There are many techniques, some common techniques
include: questionnaires and surveys, interviewing, checklists, and
examination of the Work Breakdown Structure for the project with
appropriate specialty groups, asking “what-if’ questions, for example
“what-if we miss the fsh window?” or “what-if our environmental
documentation is challenged and we have to prepare an EIS?” etc.
Risk Identifcation Outputs
An expected deliverable from Risk Identifcation includes a preliminary
“risk register” which documents the following information:
Identifcation # for each risk identifed
A unique number is assigned to each risk for tracking purposes. If
available this can be done utilizing an established Risk Breakdown
Structure (RBS); the WSDOT RBS is provided in the appendix of this
document.
Date and phase of project development when risk was identifed
Document the date the risk was identifed and which project development
phase (planning, scoping, design/PS&E, construction).
Project Risk Management Guidance for WSDOT Projects Page 13
July 2010
Chapter 2 Risk Identifcation
Name of Risk (does the risk pose a threat or present an opportunity?)
Each identifed risk should have an appropriate name, for example
“NEPA Delay” or “Reduction in Condemnation”; the nature of the risk
with respect to project objectives (threat or opportunity) should also be
documented. This can be done using the Risk Breakdown Structure (RBS)
for naming conventions.
Detailed Description of Risk Event
The detailed description of the identifed risk; the description must be
provide information that is Specifc, Measurable, Attributable (a cause is
indicated), Relevant, and Time bound (SMART). The description must
be clear enough and thorough enough so that others reading about the
description of the risk will understand what it means.
Risk Trigger
Each identifed risk must include the risk trigger(s). Risks rarely just
suddenly occur; usually there is some warning of imminent threat
or opportunity. These warning signs should be clearly described and
information about the risk trigger should be documented. For example
“NEPA Approval Date” may be considered a risk trigger on a project that
has a risk of a legal challenge, or other as appropriate.
Risk Type
Does the identifed risk affect project schedule, cost, or both?
Potential Responses to Identifed Risk
Document, if known, possible response actions to the identifed risk
–can the identifed threat be avoided, transferred, mitigated or is it to
be accepted? Can the identifed opportunity be exploited, shared or
enhanced?
Comments about Risk Identifcation
Risk Management is an iterative process; risks should be reviewed
regularly and as new risks are identifed they should be documented and
assessed. The resulting risk register should only be considered preliminary
until the completion of additional and appropriate activities that may
include any or all of the techniques listed above and/or more robust
processes such as Cost Risk Assessment and Cost Estimate Validation
Process (CRA/CEVP) workshops. More detail about the WSDOT
workshops for CRA/CEVP is offered later in this document, and at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/
Page 14 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Identify Risk Events
How to Identify Risk
#1 Determine risk thresholds for the project (establish a minimum dollar
amount and time duration considered signifcant for the project under
evaluation).
#2 Focus on identifying large signifcant risks which affect project
objectives.
#3 Carefully document and describe risks in a risk register.
HELPFUL HINTS FOR RISK IDENTIFICATION
• Determine, for your project, what constitutes “significant” risk.
• Thoroughly describe the risk – there is a form in the following pages
to help with this or you may create your own.
• Include specialty groups and/or other persons who may have
meaningful input regarding the challenges the project may face.
• Determine who “owns” the risk and who will develop a response.
Brainstorming - is an effective method. Brainstorming can range from a small informal project team
effort for simpler projects to a full-blown CEVP workshop. Effective brainstorming requires a skilled
facilitator, working together with the project team and specialists who can bring additional expertise.
Checklists and/or Questionnaires to `specialty groups - checklists/questionnaires are a quick
and easy-to-use technique but limited in nature; they only deal with the items on the list. Each project
is unique; hence a standard list will often not capture the project specifc risks of most concern.
Nonetheless a checklist/questionnaire can spark thinking prior to a more formal brainstorming process.
Examination of past similar projects - lessons learned from past projects help us to avoid repeating
mistakes; using past examples requires prudent and objective judgment, since a previous project may
be similar but is nonetheless different because each new project has unique requirements and features,
including uncertainties and risks.
WSDOT Lessons Learned website:
http://eefmapps.wsdot.wa.gov/fmi/xsl/Lessons/Main.xsl?-db=DebriefReport&-lay=LessonWebForm&Mo
nthlyHighlight=Yes&-fnd
Combination of above methods and/or others - It is quite likely that for most projects a combination
of the above methods will be used to identify risks. The important thing is that once identifed the risks
are properly documented.
Figure 2-1 Blank template for documenting identifed risks (tailor to your needs).
Figure 2-2 Example of how template is used.
Figure 2-3 Risk Breakdown Structure for categorizing and organizing risks.
Figure 2-4 Example of risk identifcation using spreadsheet from Project Management Online
Guide found at: http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-
Construction/Pre-Construction_fles/slide0001.htm
Risk Identifcation
Table 2.1
Project Risk Management Guidance for WSDOT Projects Page 15
July 2010
Chapter 2 Risk Identifcation
P
r
e
-
m
i
t
i
g
a
t
e
d
E
X
A
M
P
L
E
O
N
L
Y
R i s k #
S t a t u s
D e p e n d e n c y
P r o j e c t P h a s e
S
u
m
m
a
r
y
D
e
s
c
r
i
p
t
i
o
n
T
h
r
e
a
t
a
n
d
/
o
r
O
p
p
o
r
t
u
n
i
t
y
D
e
t
a
i
l
e
d
D
e
s
c
r
i
p
t
i
o
n
o
f
R
i
s
k
E
v
e
n
t
(
S
p
e
c
i
f
ic
,
M
e
a
s
u
r
a
b
l
e
,
A
t
t
r
i
b
u
t
a
b
le
,
R
e
le
v
a
n
t
,
T
im
e
b
o
u
n
d
)
[
S
M
A
R
T
]
R
i
s
k
T
r
i
g
g
e
r
T y p e
P r o b a b i l i t y
C o r r e l a t i o n
(
1
)
(
2
)
(
3
)
(
5
)
(
6
)
(
7
)
(
8
)
(
9
)
(
1
0
)
[
1
0
a
]
(
1
1
)
T
h
r
e
a
t
M
I
N
0
.
5
0
$
M
M
A
X
7
.
0
0
$
M
M
o
s
t
L
ik
e
l
y
1
.
5
0
$
M
0
M
a
s
t
e
r
D
u
r
a
t
i
o
n
R
i
s
k
M
I
N
1
.
0
M
o
M
A
X
6
.
0
M
o
T
h
r
e
a
t
M
o
s
t
L
ik
e
l
y
2
.
0
M
o
R
i
s
k
I
m
p
a
c
t
(
$
M
o
r
M
o
)
A c t i v e
C o n s t r u c t i o n
A
l
t
h
o
u
g
h
s
i
g
n
i
f
i
c
a
n
t
p
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
s
a
r
e
t
o
b
e
c
o
n
d
u
c
t
e
d
t
h
e
r
e
i
s
s
t
i
l
l
s
o
m
e
r
i
s
k
o
f
u
n
d
i
s
c
o
v
e
r
e
d
s
u
b
s
u
r
f
a
c
e
c
o
n
t
a
m
i
n
a
n
t
s
i
n
t
h
i
s
p
r
o
j
e
c
t
.
I
f
t
h
e
s
e
c
o
n
t
a
m
i
n
a
n
t
s
a
r
e
d
i
s
c
o
v
e
r
e
d
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
i
t
c
a
n
i
m
p
a
c
t
b
o
t
h
c
o
s
t
a
n
d
s
c
h
e
d
u
l
e
.
B
e
c
a
u
s
e
o
f
t
h
e
n
a
t
u
r
e
o
f
t
h
e
p
r
o
j
e
c
t
c
o
r
r
i
d
o
r
t
h
e
a
r
e
a
o
f
g
r
e
a
t
e
s
t
c
o
n
c
e
r
n
i
s
i
n
t
h
e
l
a
t
t
e
r
h
a
l
f
o
f
t
h
e
p
r
o
j
e
c
t
,
h
e
n
c
e
o
u
r
e
x
p
o
s
u
r
e
i
s
p
r
i
m
a
r
i
l
y
d
u
r
i
n
g
t
h
e
s
e
c
o
n
d
y
e
a
r
o
f
c
o
n
s
t
r
u
c
t
i
o
n
.
D
u
r
i
n
g
C
o
n
s
t
r
u
c
t
i
o
n
-
d
i
s
c
o
v
e
r
y
o
f
s
u
b
s
u
r
f
a
c
e
H
a
z
a
r
d
o
u
s
M
a
t
e
r
i
a
l
s
S c h e d u l e
R
I
S
K
T
R
I
G
G
E
R
D
e
t
a
i
l
s
(
a
n
d
d
u
r
a
t
i
o
n
o
f
e
x
p
o
s
u
r
e
t
o
t
h
i
s
r
i
s
k
)
:
T
h
e
t
r
i
g
g
e
r
f
o
r
t
h
i
s
r
i
s
k
i
s
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
u
c
t
i
o
n
.
O
u
r
p
r
o
j
e
c
t
i
s
o
v
e
r
4
m
i
l
e
s
i
n
l
e
n
g
t
h
,
t
h
e
a
r
e
a
o
f
m
o
s
t
c
o
n
c
e
r
n
,
f
o
r
e
x
p
o
s
u
r
e
t
o
u
n
k
n
o
w
n
s
u
b
s
u
r
f
a
c
e
m
a
t
e
r
i
a
l
s
,
i
s
i
n
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
;
t
h
i
s
c
o
n
s
t
r
u
c
t
i
o
n
i
s
e
x
p
e
c
t
e
d
t
o
o
c
c
u
r
i
n
t
h
e
f
i
n
a
l
1
2
m
o
n
t
h
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
(
~
M
a
r
c
h
2
0
1
5
t
o
M
a
r
c
h
2
0
1
6
)
.
R
i
s
k
M
a
t
r
i
x
N
O
T
E
S
:
T
h
i
s
r
i
s
k
h
a
s
b
e
e
n
d
i
s
c
u
s
s
e
d
f
o
r
s
o
m
e
t
i
m
e
a
n
d
o
u
r
c
o
n
c
e
r
n
s
a
r
e
k
n
o
w
n
b
y
m
a
n
a
g
e
m
e
n
t
a
n
d
r
e
g
i
o
n
a
l
s
t
a
k
e
h
o
l
d
e
r
s
.
P
O
S
S
I
B
L
E
R
E
S
P
O
N
S
E
S
T
R
A
T
E
G
I
E
S
T
O
E
X
P
L
O
R
E
:
(
1
)
e
v
e
n
t
h
o
u
g
h
a
t
h
o
r
o
u
g
h
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
i
s
p
l
a
n
n
e
d
w
e
m
a
y
w
a
n
t
t
o
g
o
a
b
o
v
e
a
n
d
b
e
y
o
n
d
,
p
a
r
t
i
c
u
l
a
r
l
y
w
h
e
n
i
n
v
e
s
t
i
g
a
t
i
n
g
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
t
h
i
s
p
r
o
j
e
c
t
;
(
2
)
i
n
v
e
s
t
i
g
a
t
e
t
h
e
u
s
e
o
f
G
r
o
u
n
d
P
e
n
e
t
r
a
t
i
o
n
R
a
d
a
r
;
(
3
)
l
o
o
k
a
t
s
t
r
a
t
e
g
i
e
s
f
o
r
r
e
d
u
c
i
n
g
p
r
o
j
e
c
t
f
o
o
t
p
r
i
n
t
s
o
a
s
t
o
m
i
n
i
m
i
z
e
a
r
e
a
w
e
a
r
e
d
i
s
t
u
r
b
i
n
g
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
.
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
C o s t
3
0
%
C N S 4 0
V
H
HML
V
L
V
L
L
M
H
V
H
I
m
p
a
c
t
P r o b a b i l i t y
S
Þ
L
C
I
I
I
C
Þ
r
o
v
l
d
e
a
w
e
l
l
w
r
l
L
L
e
n
d
e
L
a
l
l
e
d
d
e
s
c
r
l
p
L
l
o
n
o
f
L
h
e
8
l
s
k
L
v
e
n
L
.
W
h
a
L
l
s
L
h
e
s
p
e
c
l
f
l
c
l
s
s
u
e
o
f
c
o
n
c
e
r
n
?
M
L
A
S
U
k
A
8
L
L
Þ
r
o
b
a
b
l
l
l
L
y
o
f
8
l
s
k
L
v
e
n
L
C
c
c
u
r
l
n
g
?
C
o
n
s
e
q
u
n
c
e
l
f
l
L
d
o
e
s
C
c
c
u
r
?
(
l
m
p
a
c
L
L
o
c
o
s
L
a
n
d
s
c
h
e
d
u
l
e
)
A
1
1
k
I
8
U
1
A
8
L
L
W
h
a
L
w
l
l
l
L
r
l
g
g
e
r
(
c
a
u
s
e
)
L
h
l
s
r
l
s
k
?
P
o
w
d
o
w
e
k
n
o
w
?
W
h
o
o
w
n
s
L
h
l
s
r
l
s
k
?
k
L
L
L
V
A
N
1
W
h
y
l
s
L
h
l
s
r
l
s
k
l
m
p
o
r
L
a
n
L
L
o
o
u
r
p
r
o
[
e
c
L
?
W
l
l
l
l
L
l
m
p
a
c
L
p
r
o
[
e
c
L
o
b
[
e
c
L
l
v
e
s
?
l
s
l
L
c
r
l
L
l
c
a
l
?
1
I
M
L
8
C
U
N
D
8
l
s
k
s
h
a
v
e
a
"
s
h
e
l
f
l
l
f
e
"
-
L
h
a
L
l
s
o
u
r
p
r
o
[
e
c
L
l
s
n
o
L
e
x
p
o
s
e
d
L
o
s
p
e
c
l
f
l
c
r
l
s
k
e
v
e
n
L
s
l
n
d
e
f
l
n
L
e
l
y
-
w
h
e
n
a
r
e
w
e
a
L
r
l
s
k
?
Þ
C
1
L
N
1
I
A
L
k
L
S
Þ
C
N
S
L
A
C
1
I
C
N
S
?
l
f
p
o
L
e
n
L
l
a
l
m
l
L
l
g
a
L
l
o
n
s
L
r
a
L
e
g
l
e
s
a
r
e
m
e
n
L
l
o
n
e
d
b
e
s
u
r
e
L
o
c
a
p
L
u
r
e
L
h
e
m
s
o
L
h
e
y
c
a
n
b
e
m
o
r
e
f
u
l
l
y
e
x
p
l
o
r
e
d
l
a
L
e
r
.
Page 16 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
?
?
P
r
e
-
m
i
t
i
g
a
t
e
d
E
X
A
M
P
L
E
O
N
L
Y
R i s k #
S t a t u s
D e p e n d e n c y
P r o j e c t P h a s e
S
u
m
m
a
r
y
D
e
s
c
r
i
p
t
i
o
n
T
h
r
e
a
t
a
n
d
/
o
r
O
p
p
o
r
t
u
n
i
t
y
D
e
t
a
i
l
e
d
D
e
s
c
r
i
p
t
i
o
n
o
f
R
i
s
k
E
v
e
n
t
(
S
p
e
c
i
f
i
c
,
M
e
a
s
u
r
a
b
l
e
,
A
t
t
r
i
b
u
t
a
b
l
e
,
R
e
l
e
v
a
n
t
,
T
i
m
e
b
o
u
n
d
)
[
S
M
A
R
T
]
R
i
s
k
T
r
i
g
g
e
r
T y p e
P r o b a b i l i t y
C o r r e l a t i o n
(
1
)
(
2
)
(
3
)
(
5
)
(
6
)
(
7
)
(
8
)
(
9
)
(
1
0
)
[
1
0
a
]
(
1
1
)
T
h
r
e
a
t
M
I
N
0
.
5
0
$
M
M
A
X
7
.
0
0
$
M
M
o
s
t
L
i
k
e
l
y
1
.
5
0
$
M
0
M
a
s
t
e
r
D
u
r
a
t
i
o
n
R
i
s
k
M
I
N
1
.
0
M
o
M
A
X
6
.
0
M
o
T
h
r
e
a
t
M
o
s
t
L
i
k
e
l
y
2
.
0
M
o
R
I
S
K
T
R
I
G
G
E
R
D
e
t
a
i
l
s
(
a
n
d
d
u
r
a
t
i
o
n
o
f
e
x
p
o
s
u
r
e
t
o
t
h
i
s
r
i
s
k
)
:
T
h
e
t
r
i
g
g
e
r
f
o
r
t
h
i
s
r
i
s
k
i
s
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
u
c
t
i
o
n
.
O
u
r
p
r
o
j
e
c
t
i
s
o
v
e
r
4
m
i
l
e
s
i
n
l
e
n
g
t
h
,
t
h
e
a
r
e
a
o
f
m
o
s
t
c
o
n
c
e
r
n
,
f
o
r
e
x
p
o
s
u
r
e
t
o
u
n
k
n
o
w
n
s
u
b
s
u
r
f
a
c
e
m
a
t
e
r
i
a
l
s
,
i
s
i
n
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
;
t
h
i
s
c
o
n
s
t
r
u
c
t
i
o
n
i
s
e
x
p
e
c
t
e
d
t
o
o
c
c
u
r
i
n
t
h
e
f
i
n
a
l
1
2
m
o
n
t
h
s
o
f
c
o
n
s
t
r
u
c
t
i
o
n
(
~
M
a
r
c
h
2
0
1
5
t
o
M
a
r
c
h
2
0
1
6
)
.
R
i
s
k
M
a
t
r
i
x
N
O
T
E
S
:
T
h
i
s
r
i
s
k
h
a
s
b
e
e
n
d
i
s
c
u
s
s
e
d
f
o
r
s
o
m
e
t
i
m
e
a
n
d
o
u
r
c
o
n
c
e
r
n
s
a
r
e
k
n
o
w
n
b
y
m
a
n
a
g
e
m
e
n
t
a
n
d
r
e
g
i
o
n
a
l
s
t
a
k
e
h
o
l
d
e
r
s
.
P
O
S
S
I
B
L
E
R
E
S
P
O
N
S
E
S
T
R
A
T
E
G
I
E
S
T
O
E
X
P
L
O
R
E
:
(
1
)
e
v
e
n
t
h
o
u
g
h
a
t
h
o
r
o
u
g
h
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
i
s
p
l
a
n
n
e
d
w
e
m
a
y
w
a
n
t
t
o
g
o
a
b
o
v
e
a
n
d
b
e
y
o
n
d
,
p
a
r
t
i
c
u
l
a
r
l
y
w
h
e
n
i
n
v
e
s
t
i
g
a
t
i
n
g
t
h
e
l
a
s
t
1
.
5
m
i
l
e
s
o
f
t
h
i
s
p
r
o
j
e
c
t
;
(
2
)
i
n
v
e
s
t
i
g
a
t
e
t
h
e
u
s
e
o
f
G
r
o
u
n
d
P
e
n
e
t
r
a
t
i
o
n
R
a
d
a
r
;
(
3
)
l
o
o
k
a
t
s
t
r
a
t
e
g
i
e
s
f
o
r
r
e
d
u
c
i
n
g
p
r
o
j
e
c
t
f
o
o
t
p
r
i
n
t
s
o
a
s
t
o
m
i
n
i
m
i
z
e
a
r
e
a
w
e
a
r
e
d
i
s
t
u
r
b
i
n
g
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
.
d
i
s
c
o
v
e
r
y
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
C o s t
3
0
%
C N S 4 0
S c h e d u l e
A c t i v e
C o n s t r u c t i o n
A
l
t
h
o
u
g
h
s
i
g
n
i
f
i
c
a
n
t
p
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
s
i
t
e
i
n
v
e
s
t
i
g
a
t
i
o
n
s
a
r
e
t
o
b
e
c
o
n
d
u
c
t
e
d
t
h
e
r
e
i
s
s
t
i
l
l
s
o
m
e
r
i
s
k
o
f
u
n
d
i
s
c
o
v
e
r
e
d
s
u
b
s
u
r
f
a
c
e
c
o
n
t
a
m
i
n
a
n
t
s
i
n
t
h
i
s
p
r
o
j
e
c
t
.
I
f
t
h
e
s
e
c
o
n
t
a
m
i
n
a
n
t
s
a
r
e
d
i
s
c
o
v
e
r
e
d
d
u
r
i
n
g
c
o
n
s
t
r
u
c
t
i
o
n
i
t
c
a
n
i
m
p
a
c
t
b
o
t
h
c
o
s
t
a
n
d
s
c
h
e
d
u
l
e
.
B
e
c
a
u
s
e
o
f
t
h
e
n
a
t
u
r
e
o
f
t
h
e
p
r
o
j
e
c
t
c
o
r
r
i
d
o
r
t
h
e
a
r
e
a
o
f
g
r
e
a
t
e
s
t
c
o
n
c
e
r
n
i
s
i
n
t
h
e
l
a
t
t
e
r
h
a
l
f
o
f
t
h
e
p
r
o
j
e
c
t
,
h
e
n
c
e
o
u
r
e
x
p
o
s
u
r
e
i
s
p
r
i
m
a
r
i
l
y
d
u
r
i
n
g
t
h
e
s
e
c
o
n
d
y
e
a
r
o
f
c
o
n
s
t
r
u
c
t
i
o
n
.
D
u
r
i
n
g
C
o
n
s
t
r
u
c
t
i
o
n
-
d
i
s
c
o
v
e
r
y
o
f
s
u
b
s
u
r
f
a
c
e
H
a
z
a
r
d
o
u
s
M
a
t
e
r
i
a
l
s
R
i
s
k
I
m
p
a
c
t
(
$
M
o
r
M
o
)
V
H
HM
L
V
L
V
L
L
M
H
V
H
I
m
p
a
c
t
P r o b a b i l i t y
Project Risk Management Guidance for WSDOT Projects Page 17
July 2010
Chapter 2 Risk Identifcation
Blank Template For Documenting Identifed Risks (Tailor to Your Needs)
Figure 2-1
Project Title: CN Duration Estimate Risk ID Sheets.xls
Project Manager: PE Estimate
Date Risk Identified: RW Estimate
CN Estimate
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN
MAX
Most Likely
0Master Duration Risk
MIN
MAX
Threat Most Likely
Supplemental notes about this risk event
Risk Trigger Details: Risk Matrix
Risk Owner:
Risk Breakdown Structure # (RBS#)
Work Breakdown Stucture # (WBS#)
Critical Path (yes or no)
Response Actions (action to be taken)
Action by date:
Status review date:
Status review date:
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Risk Impact
($M or Mo)
1
R
e
t
i
r
e
d
S
c
h
e
d
u
l
e
C
o
n
s
t
r
u
c
t
i
o
n
C
o
s
t
VH
H
M
L
VL
VL L M H VH
P
r
o
b
a
b
i
l
i
t
y
Impact
Page 18 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Example of How Template is Used
Figure 2-2
Project Title: Risk Management Guide Example CN Duration Estimate 10.0Mo Risk ID Sheets.xls
Project Manager: Scott Adams PE Estimate 2.0 $M
Date Risk Identified: 1-Feb-29 RW Estimate 8.0 $M
CN Estimate 30.0 $M
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN 0.25$M
MAX 2.00$M
Most Likely 0.50$M
0Master Duration Risk
MIN 1.0Mo
MAX 8.0Mo
Threat Most Likely 5.0Mo
Supplemental notes about this risk event
Risk Trigger Details: Should know by the ides of March. Risk Matrix
Risk Owner: Mr. Ule Givens
Risk Breakdown Structure # (RBS#) ENV 30.1
Work Breakdown Stucture # (WBS#) PC-18
Critical Path (yes or no) yes
Response Actions (action to be taken)
One of the best tools we have to avoid this risk is a concerted, committed & sustained effort
to address env. permits upfront & thoroughly. Including verification of jurisdictions
and parties of concern and clarify understanding and expectations of all parties.
To this end we will form a team to puruse this effort with appropriate representatives from
each permitting authority with review dates and commitments.
Action by date: February 30, 2929
Status review date: March 32, 2929
Status review date: April 31, 2929
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Communication with parties. Project Mgr NOW
Succession plan for staff changes. Business Mgr 2929-Feb
Decisions ASAP on design elements. Executive Oversight 2929-March
Risk Impact
($M or Mo)
1
R
e
t
i
r
e
d
70%
Permits and
Permit Appeals
S
c
h
e
d
u
l
e
P
r
e
-
c
o
n
s
t
r
u
c
t
i
o
n
Complex project, might require additional time (longer than
average) to review. Potential agency staff changes. Tribal
issues includefishingrights, effects on fish and habitat, and
other environmental concerns.
Appeals can bemadeon any of themajor permits, whether
based on actual issues with thepermits or not. Thefollowing
specific issues werehighlighted:
• Shoreline permits from various jurisdictions are of particular
concern shorelinepermits areeasy to challengeand typically
result in significant delays. Thereis aprocess to weed out
frivolous appeals.
• New NPDES outfalls (appealable)
• HPA issues with WDFW
Coast Guard permits for THE channel.
Determination
decisions by several
agencies.
Revisions to our
estimated areas of
impact.
C
o
s
t
VH
H $,Mo
M
L
VL
VL L M H VH
Impact
P
r
o
b
a
b
i
l
i
t
y
Project Risk Management Guidance for WSDOT Projects Page 19
July 2010
Chapter 2 Risk Identifcation
Risk Breakdown Structure
Figure 2-3a
Level 1 Project Risk
--------------------
----
Level 2
Environmental &
Hydraulics
Structures & Geotech Design / PS&E Right-of-Way (including
Access and Acquisition)
Utilities Railroad Partnerships and
Stakeholders
Management / Funding Contracting and
Procurement
Construction
ENV STG DES ROW UTL RR PSP MGT CTR CNS
--------------------
----------
ENV 10
NEPA/SEPA Documentation
Completion (incl. Section 4f,
etc.)
----------------
NEPA/SEPA Challenges
STG 10
Potential Changes to
Structures Design (Bridge
Superstructure, Retaining
Walls)
DES 10
Potential Changes to roadway design
(including vertical and/or horizontal
alignment, earthwork, pavement,
etc.)
ROW 10
Issues Associated with
Development of ROW Plan
UTL 10
Utility Design Coordination
and Agreements
RR 10
Railroad Design
Coordination and
Agreements
PSP 10
Tribal Issues
MGT 10
Change in Project Managers
and/or other key Leadership
CTR 10
Change in Project Delivery
Method
CNS 10
Traffic Control and Staging
Issues (MOT/WZTC)
ENV 20
ESA Issues (incl.
consultation, Biologic
Assessments/Biological
Opinions, Fish Passage)
STG 20
Potential Changes to
Geotechnical Design
Foundations, Liquefaction,
Mitigation, etc.
------------------ Challenging
Geotech Conditions
DES 20
Approval of Design Deviations
----------------
Changes to roadway design criteria
(i.e. shoulder width, sight distance,
etc.)
ROW 20
Uncertainty in Future ROW
Escalation Rate (Project-
Specific, including change in
land use, urbanization, etc.)
UTL 20
Utility relocations and
conflicts
RR 20
Railroad Coordination during
construction (flagging, work
restrictions, work windows,
etc.)
PSP 20
Public Involvement Issues
-------------------------
Other Interagency
Agreements (i.e. Sound
Transit, USFS, cities,
counties, etc.)
MGT 20
Delayed Decision Making
CTR 20
Issues Related to Contract
Language (Contract
Packaging, Warranties,
Liquidated Damages, DBE,
Insurance/Bonding, etc.)
CNS 20
Construction Permitting
Issues (incl. work
restrictions)
ENV 30
Environmental Permitting
(incl. Appeals)
STG 30
Changes to Structural
Design Criteria (e.g.,
seismic)
DES 30
Changes to Architectural, CSS,
Landscape Design
ROW 30
Limited Access (Interchange
Justification Report - IJR,
Access Hearing, etc.)
RR 30
Contractor Right of Entry
Requirements
PSP 30
Additional Scope in
Response to Third Party
Concerns (e.g., artwork,
shared-use pathways,
intersection improvements,
etc.)
MGT 30
Availability of Funding / Cash
Flow Restrictions
CTR 30
Delays in Ad/Bid/Award
Process (Addenda, Protests,
etc.)
CNS 30
Work Windows (Weather,
Fish, etc.)
ENV 40
Archaeological/Cultural
Discoveries, historic property
impacts & mitigation
(Section 106)
DES 40
Projects by other agencies affected
by or affecting this project (design
coordination)
ROW 40
Managed Access (Appeal
Hearing, etc.)
MGT 40
Political/Policy Changes
CTR 40
Market Conditions (non-
competitive bidding
environment)
Lack of Qualified Bidders
CNS 40
Construction Schedule
Uncertainty (general,
including timing of award)
ENV 50
Hazardous Materials
Groundwater and Soil
Contamination (PE,
RW, CN)
DES 50
Potential Changes to Design of
Permanent Traffic Items (ITS,
Illumination, Intersection, etc.)
ROW 50
ROW Acquisition Issues
(condemnation, relocations,
demolitions, etc.)
MGT 50
State Workforce Limitations
CTR 50
Delays in Procurement of
Specialty Materials or
Equipment and associated
cost premiums
CNS 50
Marine/ Over Water
Construction Issues
ENV 60
Wetlands / Stream / Habitat
Mitigation
DES 60
Design / PS&E Reviews
----------------
Additional Scope Driven by Internal
Considerations (e.g., Maintenance,
Traffic Projections, Tolling, extend
project terminii, change to purpose
and need, etc.)
ROW 60
Additional ROW is required
(including full vs partial
takes): Temporary and
Permanent Access Breaks -
FHWA approval
-----------------
Construction / Subterranean
Easements
CTR 60
Contractor Non-
Performance
CNS 70
Earthwork Issues (re-use,
haul, disposal, etc.)
ENV 70
Stormwater, Potential
Changes to Flow Control or
Runoff Treatment/Hydraulic
Requirements
CTR 70
Availability of Specialty
Labor/Labor and/or
Productivity Disruptions
CNS 80
Coordination with Adjacent
Projects During Construction
ENV 80 Environmental
Impacts during Construction
(includng water quality,
TESC etc.)
CNS 90
Contractor Access / Staging
Coordination and
Constructability Issues
ENV 90
Permanent Noise Mitigation
CNS 100
Construction Accidents
ENV 900
Other Environmental Issues
STR 900
Other STR Issues
DES 900 Other
Design Issues
ROW 900
Other ROW Issues
UTL 900
Other UTL Issues
RR 900
Other RR Issues
PSP 900
Other PSP Issues
MGT 900
Other MGT Issues
CTR 900
Other CTR Issues
CNS 900
Other Construction Issues
(including unanticipated
change orders/claims)
-------------
L
e
v
e
l 3
Page 20 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Risk Breakdown Structure (Example of use)
Figure 2-3b
The RBS provides several functions and benefits to the project team and to management, including:
1) Consistency with taxonomy (wording);
2) Organizes risk events into common categories;
3) Helps to identify trends with respect to common usage of risk event categories & event types along with their probability and impact values;
4) Helps to identify common risk events among projects that the Region and HQ offices should be aware of due to their potential cumulative effects; e.g. negotiating agreements with agencies or other municipalities;
5) Provides a basis to work from for risk elicitors during CEVP workshops;
6) Provides a basis for development of independent risk surveys for those that are unable to attend a CEVP workshop.
This RBS serves as a starting point in assessing project risks in CEVP and CRA workshops; and also for smaller projects that may not conduct a formal workshop.
RBS CODE PROBABILITY
IMPACT
($) (TIME)
ENV 10.01 As a result of… 70% Ï$5M 8 weeks
ENV 10.02 Because of… 10% Ï$0.1M 6 months
ENV 10.03 Due to… 10% Ï$0.1M 4 months
public pressure and internal reviews
a challenge to the level of environmental documentation may
occur,
resulting in the need to prepare an EIS, adding scope and
cost and lengthening the schedule.
reviews by WSDOT Environmental
the design information may be deemed inadequate for
NEPA/SEPA approval
leading to additional design work, added cost, and schedule
delays.
the public involvement process a challenge to the NEPA/SEPA document may occur which would delay delivery of the EA document.
RISK TRIGGER
(CAUSE or PRECIPITATING EVENT)
RISK EVENT
CONSEQUENCE
(effect on project objectives)
Project Risk Management Guidance for WSDOT Projects Page 21
July 2010
Chapter 2 Risk Identifcation
Spreadsheet from Project Management Online Guide
Figure 2-4
Page 22 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Identifcation Chapter 2
Project Risk Management Guidance for WSDOT Projects Page 23
July 2010
Chapter 3 Qualitative Risk Analysis
Qualitative Risk Analysis assesses the impact and likelihood of the
identifed risks and develops prioritized lists of these risks for further
analysis or direct mitigation.
The team assesses each identifed risk for its probability of occurrence
and its impact on project objectives. Project teams may elicit assistance
from subject matter experts or functional units to assess the risks in their
respective felds. (WSDOT PMOG)
Qualitative analysis is often used as…
• an initial screening or review of project risks;
• when a quick assessment is desired;
• the preferred approach for some simpler and smaller projects where
robust and/or lengthy quantitative analysis is not necessary.
Qualitative - observations that do not involve measurements and numbers.
EXAMPLE the risk of a heavy rainstorm affecting our erosion control is
“Very High”.
Qualitative assessment - An assessment of risk relating to the qualities and
subjective elements of the risk –those that cannot be quantifed accurately.
Qualitative techniques include the defnition of risk, the recording of risk details
and relationships, and the categorization and prioritization of risk relative to
each other. SOURCE: Project Risk Analysis and Management Guide, 2004
APM Publishing
Qualitative analysis provides a convenient and “user-friendly” way to
identify, describe and characterize project risks.
Risk identifcation, as mentioned in the previous chapter, results in the
generation of a risk register. The risk register can be sizeable and it is
necessary to evaluate and prioritize the risk events identifed in the risk
register. Evaluation and prioritization is typically an iterative process and
can take place at various points in project development.
A thoroughly developed register of risks, that may affect project
objectives, is helpful. We sometimes fnd ourselves in situations where
moving forward is diffcult because of indecision. Identifying, describing,
and assessing project risks allow us to prioritize risks. Prioritization can
free us from indecision by providing specifc, documented risk events that
we can act on to shift the odds in favor of project success. Prioritizing
risks, which present the highest potential for signifcantly affecting project
objectives, gives project managers the information necessary to focus
project resources. Prioritization helps us make decisions in an uncertain
environment and address project risk in a direct and deliberate manner.
Page 24 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
Qualitative analysis utilizes relative degrees of probability and
consequence of each identifed project risk event in descriptive non-
numeric terms; see Figure 3-1 and Figure 3-2 for examples of qualitative
risk matrices. Qualitative analysis can provide a prioritized list of risks to
work on.
Project Risk Management Guidance for WSDOT Projects Page 25
July 2010
Chapter 3 Qualitative Risk Analysis
Qualitative Risk
Analysis
“ How to”
Page 26 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
How to perform Qualitative Risk Analysis
Once a risk is identifed, including a thorough description of the risk and
risk triggers, it can be characterized in terms of probability of occurrence
and the consequence if it does occur.
#1 Gather the project team and appropriate persons to discuss project
risk. Establish which of the qualitative risk matrices you intend to
use, defne the terms you plan to use (Very High, High, Medium,
Low…. Etc.).
#2 Review the risk information from the risk identifcation step.
#3 Discuss the risk with the group.
#4 Evaluate the likelihood of the risk occurring by asking the group “How
likely is it that this risk will occur?” Record the result that the group
agrees on.
#5 Evaluate the consequences if the risk does occur by asking the group
“What will be the impacts if this risk does occur?” Record the result
that the group agrees on.
#6 Prioritize the risks based on the results of the qualitative analysis.
If it is desirable the risks can also be group by category (i.e.
Environmental, Structures/Geotech) and ranked within each category.
HELPFUL HINTS FOR QUALITATIVE RISK ANALYSIS
• Invite appropriate participants (not too many not too few).
• Define terms.
• Stay focused – put a time limit on discussion if necessary.
• Record the results.
• Prioritize the risks based on the results.
Something to consider: those relatively new to risk analysis sometimes
claim, in exasperation, “This is nothing more than guessing”. This does
not represent the full actuality that assigning values for probability and
impact relies on the expertise and professional judgment of experienced
participants.
The determination of a value for the probability of occurrence and its
consequence to project objectives, if it occurs, is for many a new activity
and can seem strange at frst. In any feld, with experience, professionals
develop intuition and an ability to understand projects to a greater degree
than those not involved with project development and delivery. This
experience and intuition is extremely valuable –in a risk workshop forum
we surround ourselves with “wise counsel” to seriously and thoroughly
discuss the project. It might be helpful to examine the word “guess” and
compare it to other words such as ‘discernment’ and ‘judgment’ that more
appropriately describe risk assessment. The defnitions in the following
table come from the Merriam-Webster Online Dictionary/Thesaurus (with
edits).
Project Risk Management Guidance for WSDOT Projects Page 27
July 2010
Chapter 3 Qualitative Risk Analysis
Discernment
1: The quality of being able to grasp and comprehend what is obscure
: skill in discerning (insight and understanding); the process of
forming an opinion or evaluation by discerning and comparing
b: an opinion or estimate so formed; the capacity for judging;
the exercise of this capacity.
Synonyms Perception, Penetration, Insight, Acumen, Perception,
Penetration, Insight, and Acumen mean a power to see what is not
evident to the average mind. DISCERNMENT stresses accuracy;
PERCEPTION implies quick discernment; PENETRATION implies
a searching mind that goes beyond what is obvious or superfcial;
INSIGHT suggests depth of discernment coupled with understanding;
ACUMEN implies characteristic penetration combined with keen
practical judgment.
Judgment
a: The process of forming an opinion or evaluation by discerning and
comparing
b: An opinion or estimate so formed; a formal utterance of an
authoritative opinion; a position arrived at after consideration; an
idea that is believed to be true or valid without positive knowledge;
an opinion on the nature, character, or quality of something
Guess
To form an opinion from little or no evidence
Synonyms assume, conjecture, presume, speculate, suppose, surmise,
suspect, suspicion
Related Words gather, infer; hypothesize, theorize; believe, conceive,
expect, imagine, reckon
Decision
The act or process of deciding b: a determination arrived at after
consideration : <make a decision>; report of a conclusion
A position arrived at after consideration <after much deliberation, we
made a decision about what to use for an estimated unit price>
Synonyms conclusion, determination, diagnosis, judgment, resolution,
verdict.
Related Words mandate, fnding, ruling, sentence; choice, option,
selection
Page 28 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
EXAMPLES
ONLY
EXAMPLE (depicts a simple list of risks evaluated and ranked qualitatively)
Qualitative Risk List
count T/O RBS # Risk Title Probability Impact
a T ENV 30.1 Permits and Permit Appeals Medium High
b T UTL 20.1 Unidentifed Utility Conficts High Very High
c T STG 20.4 Change to Substructure Assumptions Very Low Low
d T ROW 40.1 Managed Access challenge Very High Low
WSDOT Project Risk Management – “How to guide” 3 Qualitative Risk Analysis rev 2009-April
6 of 10
Chapter 3 Qualitative Risk Analysis
EXAMPLE (depicts a simple list of risks evaluated and ranked qualitatively)
Qualitative Risk List
count
T/O RBS # Risk Title Probability Impact
a T ENV 30.1 Permits and Permit Appeals Medium High
b T UTL 20.1 Unidentified Utility Conflicts High Very High
c T STG 20.4 Change to Substructure Assumptions Very Low Low
d T ROW 40.1 Managed Access challenge Very High Low
Probability
(Likelihood)
Synonyms
Approximate
%
Very high Almost certain Very Sure >90%
High Likely Pretty Sure 70% - 90%
Medium Possible Maybe 30% - 70%
Low Unlikely Seldom 10% - 30%
Very Low Rare Improbable <10%
Consequence
(Impact)
Synonyms
Approximate
%
Very high Very Critical Very Strong >90%
High Critical Strong 70% - 90%
Medium Moderate Average 30% - 70%
Low Slight Mild 10% - 30%
VH
H
M
L
VL
VL L M H VH
Impact
Probability and Impact Matrix
Very Low Very Little Very Mild <10%
Figure 3-1 Probability Impact Matrix (5 X 5)
Qualitative Risk List (ranked based on qualitative risk analysis)
rank count
T/O RBS # Risk Title Probability Impact
2 a T ENV 30.1 Permits and Permit Appeals Medium High
1 b T UTL 20.1 Unidentified Utility Conflicts High Very High
4 c T STG 20.4 Change to Substructure Assumptions Very Low Low
3 d T ROW 40.1 Managed Access challenge Very High Low
a
b
c
d
Probability
(Likelihood)
Synonyms
1
Approximate %
Very high Almost certain Very Sure >90%
High Likely Pretty Sure 80%
Medium Possible Maybe 50%
Low Unlikely Seldom 20%
Very Low Rare Improbable <10%
Consequence
(Impact)
Synonyms
1
Approximate %
of Phase
(PE, RN, CN)
Very high Very Critical Very Strong >10%
High Critical Strong 8%
Medium Moderate Average 4%
Low Slight Mild 2%
Very Low Very Little Very Mild <1%
1
Suggested percentages; project teams may adjust if they desire.
Probability Impact Matrix (5 X 5)
Figure 3-1
EXAMPLES ONLY
Project Risk Management Guidance for WSDOT Projects Page 29
July 2010
Chapter 3 Qualitative Risk Analysis
EXAMPLES
ONLY
Qualitative Risk List (ranked based on qualitative risk analysis)
rank count T/O RBS # Risk Title Probability Impact
2 a T ENV 30.1 Permits and Permit Appeals Medium High
1 b T UTL 20.1 Unidentifed Utility Conficts High Very High
4 c T STG 20.4 Change to Substructure Assumptions Very Low Low
3 d T ROW 40.1 Managed Access challenge Very High Low
Qualitative Risk List (threats and opportunities)
count T/O RBS # Risk Title Probability Impact
A T ENV 30.1 Permits and Permit Appeals Medium High
B T UTL 20.1 Unidentifed Utility Conficts High High
C T STG 20.4 Change to Substructure Assumptions Low Low
D T ROW 40.1 Managed Access challenge High Low
E O CNS 30.1 Negotiate Better Work Windows Low Medium
F O CNS 50.1 Able to salvage some material for $ Medium Medium
G O DES 10.1 Opportunity to switch to ACP (HMA) High High
P
R
O
B
A
B
I
L
I
T
Y
HI D B G HI
P
R
O
B
A
B
I
L
I
T
Y
MED A F MED
LO E LO
VLO C VLO
VLO LO MED HI HI MED LO VLO
NEGATIVE IMPACT POSITIVE IMPACT
Probability Impact Matrix (Double 4 X 4)
Figure 3-2
EXAMPLES ONLY
Page 30 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
A simple matrix, provided below, suitable for smaller, less complex or routine projects, it also
appears in the Project Management Online Guide.
P
r
o
b
a
b
i
l
i
t
y
H
L
L H
Impact
High (probability): more likely than not to happen.
High (impact): Substantial impact on cost, schedule, or technical. Substantial action
required to alleviate issue.
Low (probability): less likely than not to happen.
Low (impact): Minimal impact on cost, schedule, or technical. Normal management
oversight is suffcient.
Project Management Online Guide is found at:
http://www.wsdot.wa.gov/projects/projectMgmt/Process
Project Risk Management Guidance for WSDOT Projects Page 31
July 2010
Simplifed Risk Management Plan Spreadsheet with 2×2 Probability Impact Matrix
Figure 3-3
Project Title EXAMPLE for Risk Management Document
Project PIN # #######
Date Feb 31, 2929
Project Mngr Mgr Name Telephone Number (xxx) xxx-xxxx
Status ID #
Date Identified
Project Phase
Risk Event
(threat/opportunity) SMART Column Risk Trigger
Impact
Area
Affected MDL/WBS
Level 2 process Probability Impact
Risk
Owner
Strategy
ACTION TO BE TAKEN
(include advantages and disadvantages)
Status Interval
or Milestone
Check Date, Status and Review Comments
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (13) (14) (15) (16) (17)
In
s
tr
u
c
tio
n
s
Active=actively monitored
& controlled
Dormant=risk is not
currently a high priority,
but may become active in
the future.
Retired=no longer a
threat to project
objectives.
E1 For example:
6/30/99
Scoping
Risk is an uncertain event or
condition that, if it occurs, has a
positive (opportunity) or negative
(threat) on a project.
For example; Wetland Mitigation
requires additional R/W.
Detailed description of the risk.
Includes information on the risk
that is Specific, Measureable,
Attributable, Relevant and
Timebound. Describe the
consequences of the risk to
scope, schedule, budget or
quality.
Triggers are indications that a risk
has occurred or is about to occur.
Used to determine when to
implement the Risk Response
Strategy.
For example: Wetland impact is
greater than 1/2 acre.
Is the
primary
impact to
the scope,
schedule,
or budget?
Which WBS
element will be
modified as part of
the response
strategy? For
example:
PC-19
Environmental
Permits
Assessment of
the likelihood
of occurrence.
Valid entries
are Low or
High.
The severity
of the risk's
effect on the
projects
objectives.
Valid entries
are Low or
High.
Name of the
person or
office
responsible for
managing the
risk event.
Avoidance
Transferance
Mitigation
Acceptance
(See PM Online
Guide for strategy
definitions.)
Develop options and determine actions to
be taken in response to the risk event.
Immediate action may be required at the
time of identification. Estimate value of
risk and estimate cost to respond.
For example:
Completion of
wetland
delineation
expected:
2/28/00
For example: Last status update
4/30/00. Wetland delineation
completed 3/15/00. Over 1 acre of
wetland was delineated, action is
being taken to expedite meetings with
regulatory agencies & expedite the
effort to provide appropriate wetland
mitigation & attain project permits.
H
L
X
L H
H
X
L
L H
H
L
X
L H
EXAMPLE OF QUALITATIVE ANALYSIS
WITH A 2X2 RISK MATRIX
Monitoring and Control Risk Identification
Scope
WBS 185
Prepare Base
Maps and
Plan Sheets
Low Low
P
r
o
b
a
b
i
l
i
t
y
Mr. History Acceptance
Numerous construcion work in
and around the area has
occurred in the past. No
artifacts have been found.
Supplmenta
l Field
investigatio
n report
due:
11/1/2008
Analysis is
due
9/30/2008
Design/PS&
E
Impact
mm/dd/yyyy
Threat - Cultural
Resources may be
encountered on D Island
During clearing and
grubbing there is a
potential for finding
historical artifacts,
particularly on the
northside of D Hill near
the water.
Trigger during Design:
Archival and/or field
investigation reveals
artifacts on site. Trigger
during CN: Discovery of
indicator items and/or
artifacts during
clearing/grubbing.
Constructio
n
Impact
High
Risk-Response Strategy
High
P
r
o
b
a
b
i
l
i
t
y
Mr.
Noiseman
Mitigation
Press for results of noise
analysis ASAP. This is a high
probability/high impact threat.
Carry design as if the noise wall
is going to be built (to minimize
future rush design work).
(12)
Ms. Eunice
Utility
P
r
io
r
ity
Active
UTL
20.1
PROJECT RISK MANAGEMENT PLAN
Threat - Unknown utility
impacts
(MP 14.7 to MP 19.4).
Next check
is at QPR
on
11/20/2008
Mitigation
Begin subsurface utility
investigations immediately.
Assign team member to this
issue full time until we are
confident all utilities have been
identifed.
May be required to buid a
permanent noise wall
pending results of Type 1
Analysis.
Resutls of Type 1 Analysis
will indicate the level of
Noise mitigation required.
Scope
WBS 165
Perform
Environmental
Studies and
Prepare Draft
Environmental
Document
(DED)
WBS 185
Prepare Base
Maps and
Plan Sheets
Multiple Triggers: If found
toward the end of design
phase may require
additional design work
and/or R/W acquisition. If
found during construction
could potentially stop
work.
mm/dd/yyyy
Scope
Design/PS&
E
Risk Matrix
Qualitative Analysis
High: Substantial impact
on cost, schedule, or
technical. Substantial
action required to
alleviate issue.
Low: Minimal impact on
cost, schedule, or
technical. Normal
management oversight is
ffi i t
P
r
o
b
a
b
i
l
i
t
y
Low
Active
Active
ENV
90.3
ENV
40.4
High
Areas outside of WSDOT
R/W have not been
investigated for utilities
conflicts; Additional work
is required for
sewer/stormwater for
Smalltown, additional
investigation required for
water, gas, power, fiber
optic, telecommunications,
etc.
Impact
mm/dd/yyyy
Threat - Noise Wall
http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-Construction/PC_Plan_the_Work/PC_Plan_Risk.htm
Page 32 Project Risk Management Guidance for WSDOT Projects
July 2010
Qualitative Risk Analysis Chapter 3
Simplifed Risk Management Plan Spreadsheet with 5x5 Probability Impact Matrix
Figure 3-4
Project Title EXAMPLE for Risk Management Document
Project PIN # #######
Date Feb 31, 2929
Project Mngr Mgr Name Telephone Number (xxx) xxx-xxxx
Status ID #
Date Identified
Project Phase
Risk Event
(threat/opportunity) SMART Column Risk Trigger
Impact
Area
Affected MDL/WBS
Level 2 process Probability Impact
Risk
Owner
Strategy
ACTION TO BE TAKEN
(include advantages and disadvantages)
Status Interval
or Milestone
Check Date, Status and Review Comments
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (13) (14) (15) (16) (17)
In
s
tru
c
tio
n
s
Active=actively monitored
& controlled
Dormant=risk is not
currently a high priority,
but may become active in
the future.
Retired=no longer a
threat to project
objectives.
E1 For example:
6/30/99
Scoping
Risk is an uncertain event or
condition that, if it occurs, has a
positive (opportunity) or negative
(threat) on a project.
For example; Wetland Mitigation
requires additional R/W.
Detailed description of the risk.
Includes information on the risk
that is Speci fi c, Measureable,
Attributable, Rel evant and
Ti mebound. Describe the
consequences of the risk to
scope, schedule, budget or
quality.
Triggers are indications that a risk
has occurred or is about to occur.
Used to determine when to
implement the Risk Response
Strategy.
For example: Wetland impact is
greater than 1/2 acre.
Is the
primary
impact to
the scope,
schedule,
or budget?
Which WBS
element will be
modified as part of
the response
strategy? For
example:
PC-19
Environmental
Permits
Assessment of
the likelihood
of occurrence.
Valid entries
are Low or
High.
The severity
of the risk's
effect on the
projects
objectives.
Valid entries
are Low or
High.
Name of the
person or
office
responsible for
managing the
risk event.
Avoidance
Transferance
Mitigation
Acceptance
(See PM Online
Guide for strategy
definitions.)
Develop options and determine actions to
be taken in response to the risk event.
Immediate action may be required at the
time of identification. Estimate value of
risk and estimate cost to respond.
For example:
Completion of
wetland
delineation
expected:
2/28/00
For example: Last status update
4/30/00. Wetland delineation
completed 3/15/00. Over 1 acre of
wetland was delineated, action is
being taken to expedite meetings with
regulatory agencies & expedite the
effort to provide appropriate wetland
mitigation & attain project permits.
VH
H
M
L $
VL
VL L M H VH
Impact
P
r
o
b
VH
H $
M
L
VL
VL L M H VH
Impact
P
r
o
b
VH
H
M
L $
VL
VL L M H VH
Impact
EXAMPLE OF QUALITATIVE ANALYSIS
WITH A 5X5 RISK MATRIX
High
Areas outside of WSDOT
R/W have not been
investigated for utilities
conflicts; Additional work
is required for
sewer/stormwater for
Smalltown, additional
investigation required for
water, gas, power, fiber
optic, telecommunications,
etc.
mm/dd/yyyy
Threat - Noise Wall
ENV
90.3
ENV
40.4
Active
Active
Risk Matrix
Qualitative Analysis
High: Substantial impact on cost,
schedule, or technical. Substantial
action required to alleviate issue.
Low: Minimal impact on cost,
schedule, or technical. Normal
management oversight is sufficient.
Low
P
r
o
b
a
b
ility
mm/dd/yyyy
Scope
Design/PS&
E
May be required to buid a
permanent noise wall
pending results of Type 1
Analysis.
Resutls of Type 1 Analysis
will indicate the level of
Noise mitigation required.
Scope
WBS 165
Perform
Environmental
Studies and
Prepare Draft
Environmental
Document
(DED)
WBS 185
Prepare Base
Maps and
Plan Sheets
Multiple Triggers: If found
toward the end of design
phase may require
additional design work
and/or R/W acquisition. If
found during construction
could potentially stop
work.
P
r
io
r
ity
Active
UTL
20.1
PROJECT RISK MANAGEMENT PLAN
Threat - Unknown utility
impacts
(MP 14.7 to MP 19.4).
Next check
is at QPR
on
11/20/2008
Mitigation
Begin subsurface utility
investigations immediately.
Assign team member to this
issue full time until we are
confident all utilities have been
identifed.
Risk-Response Strategy
High
Mr.
Noiseman
Mitigation
Press for results of noise
analysis ASAP. This is a high
probability/high impact threat.
Carry design as if the noise wall
is going to be built (to minimize
future rush design work).
(12)
Ms. Eunice
Utility
Analysis is
due
9/30/2008
Design/PS&
E
mm/dd/yyyy
Threat - Cultural
Resources may be
encountered on D Island
During clearing and
grubbing there is a
potential for finding
historical artifacts,
particularly on the
northside of D Hill near
the water.
Trigger during Design:
Archival and/or field
investigation reveals
artifacts on site. Trigger
during CN: Discovery of
indicator items and/or
artifacts during
clearing/grubbing.
Constructio
n
High
Scope
WBS 185
Prepare Base
Maps and
Plan Sheets
Low Low Mr. History Acceptance
Numerous construcion work in
and around the area has
occurred in the past. No
artifacts have been found.
Supplmenta
l Field
investigatio
n report
due:
11/1/2008
Risk Identification Monitoring and Control
http://www.wsdot.wa.gov/Projects/ProjectMgmt/OnLine_Guide/Phase_Guides/Pre-Construction/PC_Plan_the_Work/PC_Plan_Risk.htm
Figure3-4 Simplified Risk Management Plan Spreadsheet with 5x5 Probability Impact Matrix
Project Risk Management Guidance for WSDOT Projects Page 33
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative Risk Analysis is a way of numerically estimating
the probability that a project will meet its cost and time objectives.
Quantitative analysis is based on a simultaneous evaluation of the impacts
of all identifed and quantifed risks.
(WSDOT PMOG)
The Strategic Analysis and Estimating Offce at WSDOT offers several
tools for quantitative analysis of risk. These tools are described in
Executive Order 1053.00 December 10, 2008 and summarized in
Table 4.1 below.
Project Size ($)
Required Process
(project managers can use
a higher level process if desired)
$10 M to $25 M In-formal workshop using the Self-Modeling Spreadsheet
1, 3
Quantitative $25 M to $100 M Cost Risk Assessment (CRA) Workshop
1, 2
Greater than $100 M Cost Estimate Validation Process (CEVP®) Workshop
2
1 In some cases it is acceptable to combine the Value Engineering Study and Risk Based Estimating
Workshop.
2 Projects $25 Million and over should use the self-modeling spreadsheet in the scoping phase risk based
estimating process, followed up by the more formal CRA or CEVP® process during the design phase.
3 An informal workshop is comprised of the project team (or key project team members), other participants may
be included as the project manager/project team deem necessary.
NOTE: For Projects less than $10M qualitative analysis is suffcient, although a higher level may be used if desired.
Levels of risk based estimating, in support of risk management:
Tabel 4.1
Quantitative techniques, such as Monte Carlo simulation, can be a
powerful tool for analysis of project risk and uncertainty. This technique
provides project forecasts with an overall outcome variance for estimated
project cost and schedule. Probability theory allows us to look into the
future and predict possible outcomes.
Use of quantitative analysis, while very powerful, also can be misleading
if not used properly. WSDOT provides a comprehensive guide for
risk workshops that, if followed, help insure a consistent process and
safeguards against biased and/or misleading results. The comprehensive
set of workshop guidelines are posted at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/workshop.htm
The following caution comes from a paper titled: “Top Down Techniques
for Project Risk Management” by Martin Hopkinson presented at the 2006
PMI Conference in Madrid.
But to us, probability is the
very guide of life. – Bishop
Joseph Butler (1756)
“Poor modeling can
produce an output
that looks convincing
to managers but is so
fawed that the results
are dangerously
misleading. On
a project with
unrealistically tight
targets, poor risk
analysis may thus
become a tool that
fosters management
delusions about
the prospects for
success.”
Page 34 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Project Risk Management is an integral component of ongoing Project
Management.
Project Managers sometimes ask “when is the best time to conduct a CRA
or CEVP workshop?” This is answered by reviewing the status of Project
Development. When a Project Management Plan is being developed and
is kept current (appropriate to the level of project development) with a
well-written scope that can be communicated and comprehended, along
with the associated schedule and cost estimate a project team can begin in
earnest preparing for their risk management workshops.
When preparing materials and planning for a workshop that includes
quantitative analysis be sure to contact the Strategic Analysis and
Estimating Offce of WSDOT, CREM Unit and they can help guide
you through the process, including scheduling consultants and WSDOT
resources to effect the completion of a quantitative analysis, either through
the workshop process or use of the self-modeling spreadsheet.
When a project team prepares for a workshop much of the work that is
performed on a daily or regular basis becomes the input for the analysis.
This includes scope or work, schedule estimate (with backup and
assumptions), cost estimate – including the basis of estimate, assumptions
and backup information. Estimates are used to make fnancial decisions
hence in order to facilitate this materials should be developed that result in
and informed decision-making process; CPMS data requirements are listed
in Table 4-1.
Project teams must provide specifc data to the region program
management offce for inclusion into CPMS and the Transportation
Executive Information System (TEIS). The required data is:
1. Project scheduling data for the following milestone dates:
• Project defnition completion date
• Date for the beginning of preliminary engineering
• Completion date for the environmental document
• Start date for the acquisition of right of way
• Date of right of way certifcation
• Project advertisement date
• Date project is operationally complete (substantially complete)
2. Estimated Project Cost Data (in Current Year Dollars, CY$)
• Date of estimate basis (i.e., “March 2008 $”)
• Design cost estimate
• Right of way cost estimate
• Construction cost estimate
3. CPMS will be modifed to calculate the midpoint for construction
phases using the project award date and the operationally complete date.
CPMS Data Requirements
Table 4-1
Project Risk Management Guidance for WSDOT Projects Page 35
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative
Risk
Analysis
“ How To”
Page 36 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
How to perform Quantitative Risk Analysis
General Process
Once risks are identifed and have been screened via qualitative analysis,
they can be analyzed quantitatively. Recall that identifcation includes
a thorough description of the risk and risk triggers. With quantitative
analysis the probability of occurrence and consequence if the risk event
occurs must also be documented. Figure 4-1 depicts the workshop process.
Tools and Techniques
1 Gather and Represent Data
• Interviews – can be formal or informal settings, such as smaller
group meetings and/or larger formal workshops.
• Subject Matter Expert input – participating collaboratively with
the project team and cost-risk team can participate in interviews or
contribute opinions in other ways such as surveys (questionnaires).
• Represent data in terms of probability and impact, impacts can be
represented using discrete distributions or continuous distributions.
2 Quantitative Risk Analysis and Modeling
• Project simulation using Monte Carlo technique to generate a
probability distribution of project cost and schedule based on
uncertainty and risk effects.
Quantitative Risk Analysis Outputs
1 Risk Register – the risk register begins during Risk Identifcation and
is further developed during analysis (qualitative and/or quantitative);
the risk register is a key component of the project management plan.
• Prioritized list of quantifed risks – those risks that have the most
signifcant impact (threats or opportunities) to project objectives.
(tornado diagrams, expected values, decision trees)
• Probabilistic analysis of the project. Estimated cost and
completion dates and associated confdence levels.
• Quantitative analyses can be conducted several times throughout
project development; trends can be identifed, mitigation strategies
can be implemented and monitored, the risk profle of a project
evolves and changes as the project is developed and knowledge is
gained and design changes occur.
Informal Workshop (Meeting)
For smaller projects an informal workshop comprised of the project team
and/or key project team members, and other participants (such as specialty
groups involved with critical items) may suffce.
Project Risk Management Guidance for WSDOT Projects Page 37
July 2010
Chapter 4 Quantitative Risk Analysis
Workshop Process for CRA or CEVP
Figure 4-1
Page 38 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Risk management is ongoing and iterative, periodically workshop
members can regroup to evaluate the project and associated uncertainty
and risks, workshops typically occur for a project every 12 to 24
months or at key project milestones. Project risks and mitigation
efforts should be discussed at regular project meetings, make changes
as appropriate and following those changes re-run the risk model. Value
is gained when action is taken to respond to risks resulting in a cost and
schedule savings to the project.
In order to fully understand our project we must determine what we
know and what we do not know about a project. In our industry, Civil
Engineering – Transportation, we have devoted a good deal of resources
to clearly explain what is known of a project, we have many specialty
offces that gather and provide data in support of project delivery,
including: aerial photography, surveying, site investigations, bid
histories, real estate services, right-of-way, access management, utilities,
environmental, hydraulics, structures, geotech, railroad, tribal liaison
offce, planning and programming, ad/bid/award, construction, tolling,
economic, programming external resource agencies and stakeholders,
public interest groups, and others. J ust as important is to devote some
energy and resources to assess what is not known and/or is uncertain
about a project, one tool for accomplishing this is intentional, thoughtful
and deliberate project risk management –as part of an overall project
management plan.
Risk assessment is not a measure of estimate accuracy:
The project team must examine each critical item and predict its possible
extreme values considering all risks, including compounding effects. It is
important to understand that the range,as considered in this method, is not
the expected accuracy of each item. This is a key issue. Risk analysis is
not an analysis of estimate accuracy. Accuracy is dependent upon estimate
deliverables and estimate maturity.
AACE International Recommended Practice No. 41R-08
RISK ANALYSIS AND CONTINGENCY
DETERMINATION USING RANGE ESTIMATING
TCM Framework: 7.6 – Risk Management
June 25, 2008
Project Risk Management Guidance for WSDOT Projects Page 39
July 2010
Chapter 4 Quantitative Risk Analysis
Risk management must be partnered with a well-organized and properly
documented project base cost estimate. Risk management introduces
reality into our project management process by recognizing that every
project has a risk of cost overrun –this does not mean cost overrun is
inevitable –it means it is possible.
In the book titled “Project Risk Management” by Chris Chapman
and Stephen Ward there is an acronym presented to describe a Risk
Management Process framework for projects, the acronym is SHAMPU
which refers to: Shape, Harness, And Manage Project Uncertainty. There
are some helpful ideas expressed via this acronym and they are presented
here from page 58 of the above referenced book.
Detailed steps of process Mid level portrayal Simplest portrayal
defne the project
focus the process
clarify the basis of analysis shape the project strategy
identify the issues
structure the issues
clarify ownership
execute the qualitative analysis
estimate variability
evaluate implications
execute the quantitative
analysis
harness the plans harness the plans harness the plans
manage implementation manage implementation manage implementation
SHAMPU process in 3 levels of detail
Table 4-3
Figure 4-2 is a schematic of how an estimate range emerges from a risk
based estimating process. The frst estimate, or “plan value”, provided by
the project team often will contain contingencies (explicit and/or implicit)
within the estimate; the frst step is to review the estimate and remove
the contingencies and making any needed corrections that are identifed.
Figure 4-3 depicts the regions of an estimate.
Page 40 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
PLAN VALUE
(includes contingency)
RAW ESTIMATE
(no contingency)
validated base
subtract
contingency
BEST CASE WORST CASE
subtract
opportunity impacts
add
threat impacts
subtract
opportunity
contingency ?
add
threat
contingency ?
OPINION
OF COST
(most likel y)
probabilistic cost range
PLAN VALUE
(includes contingency)
RAW ESTIMATE
(no contingency)
validated base
subtract
contingency
BEST CASE WORST CASE
subtract
opportunity impacts
add
threat impacts
subtract
opportunity
contingency ?
add
threat
contingency ?
OPINION
OF COST
(most likel y)
probabilistic cost range
Credit: David Hillson, Effective Opportunity Management for Projects
Credit: David Hillson, Effective Opportunity Management for Projects
Creating a probabilistic estimate
Figure 4-2
WSDOT Project Risk Management – “How to guide” 4 Quantitative Risk Analysis
9 of 9
Chapter 4 Quantitative Risk Analysis
Opini on
of
Cost
Mean
Regions of an estimate.
Min Max
(Most likel y)
Potential opportunity Potential threat
Area of estimating
uncertainty
“Base uncertainty”
Opini on
of
Cost
Mean
Regions of an estimate.
Min Max
(Most likel y)
Potential opportunity Potential threat
Area of estimating
uncertainty
“Base uncertainty”
Credit: David Hillson, Effective Opportunity Management for Projects
Regions of an estimate
Figure 4-3
Project Risk Management Guidance for WSDOT Projects Page 41
July 2010
Chapter 4 Quantitative Risk Analysis
Quantitative analysis is a natural activity that fts into our standard project management process,
and unfolds something like this:
Initiate
and
Align
Plan
the
Work
Endorse
the
Plan
Work
the
Plan
Transition
and
Closure
• Project Description
• Team Mission/Assignment
• Major Milestones
• Boundaries
• Team Identification
• Roles/Responsibilities
• Measures of Success
• Operating Guidelines
• Work Breakdown Structure
• Task Planning & Scheduling
• Budget
• Risk Planning
• Communication Plan
• Change Management Plan
• Quality (QA/QC) Plan
• Transition and Closure Plan
• Manage SSB
• Manage Risks
• Manage Change
• Communicate
-Progress
-Issues
-Lessons Learned
• Implement
Transition Plan
• Review Lessons
Learned
• Reward &
Recognize
• Archive
• Project Team
Commitment
• Management
Endorsement
Initiate
and
Align
Plan
the
Work
Endorse
the
Plan
Work
the
Plan
Transition
and
Closure
• Project Description
• Team Mission/Assignment
• Major Milestones
• Boundaries
• Team Identification
• Roles/Responsibilities
• Measures of Success
• Operating Guidelines
• Work Breakdown Structure
• Task Planning & Scheduling
• Budget
• Risk Planning
• Communication Plan
• Change Management Plan
• Quality (QA/QC) Plan
• Transition and Closure Plan
• Manage SSB
• Manage Risks
• Manage Change
• Communicate
-Progress
-Issues
-Lessons Learned
• Implement
Transition Plan
• Review Lessons
Learned
• Reward &
Recognize
• Archive
• Project Team
Commitment
• Management
Endorsement
IDENTIFY and ANALYZE Risk RESPOND, MONITOR and CONTROL Risk
Project Description: subject of the risk
assessment
Risk Management is an integral component of
day-to-day project management. Project teams
implement and continuously upgrade the Risk
Management Plan throughout the project. Primary
Risk Management functions include:
• Monitor risks (threats and opportunities)
• Identify new risks
• Evaluate/update probability of occurrence and
potential impacts
• Devise and implement response strategies
• Evaluate and document effectiveness of
response
• Report to Management and Stakeholders
Task Planning &
Scheduling Budget
This produces a project
estimate and schedule.
Risk Planning:
The project team, as part of their normal project
development and project management activities
needs to include activities for risk management in
its work plan.
----
The team prepares a project estimate based on
what is known about the project at that time; the
estimate refects the project if things go per the
project plan. Uncertainty and risk events are
identifed and characterized.
Risk Management, a part of Project Management
Figure 4–4
Page 42 Project Risk Management Guidance for WSDOT Projects
July 2010
Quantitative Risk Analysis Chapter 4
Project Risk Management Guidance for WSDOT Projects Page 43
July 2010
Chapter 5 Risk Response
Take action in response to identifed risks. Following identifcation and
analysis of project risks project managers and project teams must take
action in response to the identifed project risks, focusing on risks of most
signifcance, in order to shift the odds in favor of project success.
Early in project development, activities and information can seem chaotic
and comes to us from multiple directions and multiple sources, risk
management provides a structured and disciplined way to document the
information, evaluate and analyze the information, and emerge with a
well-organized and prioritized list of project risks. This prioritization
rescues us from indecision with information we can use to direct our
project risk management resources.
In order to maximize the benefts of project risk management we must
incorporate the project risk management activities into our project
management plan and work activities. This means building risk
management activities into our Work Breakdown Structure (WBS);
WSDOT has a ready made WBS in the form of its Master Deliverables
List (MDL) to help insure our project workplans are comprehensive,
consistent and complete. Recall the Risk Management steps include: Risk
Management Planning, Risk Identifcation, Qualitative Risk Analysis,
Quantitative Risk Analysis, Risk Response, Risk Monitoring and Control.
Risk Response requires effort to develop and implement response actions;
we must plan for expending this effort following the results of our
risk analysis. To this end we have a number of tools readily available,
including the Risk Management Planning Spreadsheet found at:
http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/
Descriptions of risk response actions follow:
Actions in response to risks: Threats Opportunities
1. Avoid 1. Exploit
2. Transfer 2. Share
3. Mitigate 3. Enhance
4. Accept
Risk Response: Actions
AVOID (threats)
Avoidance actions include: change project management plan to eliminate
a threat, to isolate project objectives from the risk’s impact, or to relax the
project objective that is in jeopardy, such as extending schedule or reducing
scope. Some risks that arise early in the project can be avoided by clarifying
requirements, obtaining information, improving communication, or acquiring
expertise
PMBOK
Action taken to insure the
probability or impact of a
threat is eliminated.
Page 44 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Two types of action 1) remove the cause of the risk (risk trigger); 2) execute
project in different way while still aiming to achieve project objectives. Not all
risks can be avoided or eliminated, and for others this approach may be too
expensive or time-consuming, but this should be the frst strategy considered for
each risk.
Effective Opportunity Management for Projects by David Hillson
EXPLOIT (opportunities)
Opposite of avoid – this strategy is to insure a positive impact, an opportunity is
realized. Taking action to make the opportunity defnitely happen, such response
actions include: assigning more talented resources to a project to reduce time to
completion, and/or to provide better quality than originally planned.
PMBOK
Eliminate the uncertainty associated with a particular upside risk. An opportunity
is defned as a risk event that if it occurs will have a positive effect on
achievement of project objectives. Avoid and Exploit is the most aggressive of
the response strategies and should be reserved for those “golden opportunities”
with high probability and impacts.
Effective Opportunity Management for Projects by David Hillson
TRANSFER (threats)
Transferring a threat does not eliminate it; the threat still exists however it is
owned and managed by another party. Transferring risk can be an effective
way to deal with fnancial risk exposure. Transferring project risk almost always
involves payment of a risk premium to the party taking the risk, examples include:
insurance, performance bonds, warranties, etc. Contracts may be used to
transfer specifed risks to another party.
PMBOK
Transferring risk involves fnding another party who is willing to take responsibility
for its management, and who will bear the liability of the risk should it occur. The
aim is to ensure that the risk is owned and managed by the party best able to
deal with it effectively. Risk transfer usually involves payment of a premium, and
the cost-effectiveness of this must be considered when deciding whether to adopt
a transfer strategy.
Effective Opportunity Management for Projects by David Hillson
SHARE (opportunities)
Sharing a positive risk involves allocating ownership to a third party who is best
able to capture the opportunity for the beneft of the project. Examples of sharing
actions include forming risk-sharing partnerships, teams, or joint ventures, which
can be established with the express purpose of managing opportunities.
PMBOK
Allocating risk ownership for an opportunity to another party who is best able
to handle it, in terms of maximizing probability of occurrence and increasing
potential benefts if it does occur. Transferring threats and sharing opportunities
are similar in that a third party is used, those to whom threats are transferred
take on the liability and those to whom opportunities are allocated should also be
allowed to share in the potential benefts.
Effective Opportunity Management for Projects by David Hillson
Action taken to insure the
beneft of an opportunity
is realized.
Action to allocate
ownership for more
effective management of
a threat.
Action to share with a third
party; enhance/exploit
opportunity.
Project Risk Management Guidance for WSDOT Projects Page 45
July 2010
Chapter 5 Risk Response
MITIGATE – or reduce (threats)
Risk mitigation implies a reduction in the probability and/or impact of an adverse
risk event to an acceptable threshold. Taking early action is often more effective
to repair than trying to repair the damage after the risk has occurred. Examples
of mitigation strategies include: adopting less complex processes, conducting
more tests and/or feld investigations, developing a prototype; measures to
address impact include: targeting linkages that determine the severity, such as
designing redundancy into a subsystem may reduce the impact from a failure of
the original component.
PMBOK
Mitigation or acceptance or the strategies most often used since the number
of threats that can be addressed by avoidance or transfer are usually limited.
Preventive responses are better than curative responses because they are more
pro-active and if successful can lead to risk avoidance. Preventive responses
tackle the causes of the risk; where it is not possible to reduce probability a
mitigation response should address the adverse impact, targeting the drivers that
determine the extent of the severity.
Effective Opportunity Management for Projects by David Hillson
ENHANCE (opportunities)
This response modifes the “size” of an opportunity by increasing probability
and/or impact. Seeking to facilitate or strengthen the cause of the opportunity,
and proactively targeting and reinforcing its trigger conditions. Impact drivers
can also be targeted, seeking to increase the project’s susceptibility to the
opportunity.
PMBOK
This response aims to modify the “size” of the positive risk. We enhance the
opportunity by increasing the probability and/or impact of an opportunity thereby
maximizing benefts realized for the project. If the probability can be increased to
100% this is effectively an exploit response.
Effective Opportunity Management for Projects by David Hillson
ACCEPT
The term “accept” refers to risks that remain after response actions and/or for
which response is not cost effective are accepted; risks that are uncontrollable
(no response actions are practical) are also accepted.
Effective Opportunity Management for Projects by David Hillson
Ultimately it is not possible to eliminate all threats or take advantage of all
opportunities –we can document them and at least provide awareness that
these exist and have been identifed, some term this ‘passive acceptance’. In
some cases, in some industries, a contingency reserve is established to deal
with the aggregate residual risk that has been accepted, some term this ‘active
acceptance’.
As we continue through project development the project risk profle will
change. Typically as we successfully respond to risks and our project
knowledge increases our risk exposure will diminish. In effect we can
retire risk reserve as risk events are successfully avoided or mitigated
or we have passed the time during which the risk is active and it
becomes retired.
Action taken to reduce the
probability and/or impact of
a threat.
Action to enhance
opportunity.
Action taken to document
the acceptance of the risk.
Page 46 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Risk Response
“ How to”
Project Risk Management Guidance for WSDOT Projects Page 47
July 2010
Chapter 5 Risk Response
Risk Management Planning Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/)
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
5 of 11
Chapter 5 Risk Response
Risk Management Planning Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Risk Identification Risk Analysis Risk Response Monitor and Control
(description/trigger) (quantitative/qualitative) (actions, owner, date) (status, updates, results)
Next page zooms in
on this section.
IN THIS CHAPTER WE FOCUS ON RESPONSE
IN THIS CHAPTER WE FOCUS ON RESPONSE
Risk Management & Planning Spreadsheet
Figure 5-1
Page 48 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Type of Response action
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
6 of 11
Chapter 5 Risk Response
Type of Response action
Threats Opportunities
Avoid
Transfer
Mitigate
Exploit
Share
Enhance
Accept
Detailed description of
response action that
will be taken; the
response action should
be reflected in project
management plan and
work activities.
Name of person who
owns the risk and is
responsible for
implementing the
responseactions.
J ournal entries for date
and status of risk –
track effectiveness of
response action.
Risk response requires
an effort and
investment of
resources – enter the
planned cost of the
response here.
RMP Spreadsheet: Response
Figure 5-2
Project Risk Management Guidance for WSDOT Projects Page 49
July 2010
Chapter 5 Risk Response
Risk Response Tools and Techniques
After we have identifed and analyzed the risks we know where to focus
our efforts. The output from the analysis provides a ranked risk register
with the risks of greatest signifcance to project objectives determined.
Apt response actions to signifcant risks must be cost effective and
realistic.
Critical risks must be met with vigorous response actions, lower
ranking risks should receive response actions commensurate with their
signifcance.
Documentation of Response Actions
Document the response action by describing the action, which work
activities it will affect and the cost of the response action. Identify the
person(s) responsible for successful implementation of the response
action. Also consider the time impacts of the response action and how the
risk response may affect the overall project and/or other risks.
Planning Risk Response Actions
• Select a response action - the action selected is influence by the level
of the risk consider the figure below:
High impact and high probability
risks require aggressive
responses (threats should
be avoided and opportunities
exploited if possible).
P
r
o
b
a
b
i
l
i
t
y
H
i
g
h
Transfer
(share)
Avoid
(exploit)
L
o
w
Accept
Mitigate
(Enhance)
Low High
Impact
Simple Response Matrix
Figure 5-3
The next two fgures on the following pages depict typical response
actions for threats and for opportunities depending on the region of
probability and impact the risk resides.
Page 50 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
8 of 11
Chapter 5 Risk Response
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition
as part of the base.
2. Risks (threats) with high impacts, can over a given limit, wreck a project; these risks must be
avoided.
3. Insignificant risks can be accepted, passive response.
4. Between avoidance and acceptance we can take other actions such as mitigation or for risks with
low probabilities we may want to transfer them.
5. For risks (threats) above a certain probability we may choose to accept actively by mitigating
and/or preparing contingency plans in the event of its occurrence.
6. All risks (threats) should be mitigated where practical and cost-effective.
Typical Risk Response Planning Chart for Threats
Risk Response Planning: Selecting the Right Strategy Piney (2002)
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition as part
of the base.
2. Risks (threats) with high impacts, can over a given limit, wreck a project; these risks must be avoided.
3. Insignifcant risks can be accepted, passive response.
4. Between avoidance and acceptance we can take other actions such as mitigation or for risks with low
probabilities we may want to transfer them.
5. For risks (threats) above a certain probability we may choose to accept actively by mitigating and/or preparing
contingency plans in the event of its occurrence.
6. All risks (threats) should be mitigated where practical and cost-effective.
Typical Risk Response Planning Chart for Threats
Risk Response Planning: Selecting the Right Strategy Piney (2002)
Figure 5-4
Project Risk Management Guidance for WSDOT Projects Page 51
July 2010
Chapter 5 Risk Response
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
9 of 11
Chapter 5 Risk Response
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition
as part of the base.
2. Risks (opportunities) with high impacts; these risks should be exploited.
3. Insignificant risks can be accepted, passive response.
4. Between exploit and accept we can take other actions such as enhance and/or share opportunity
risks.
5. Risks (opportunities) above a certain probability we may choose to accept actively by preparing
plans in the event of its occurrence –how will we take advantage of a fortunate occurrence?
6. All risks (opportunities) should be enhanced where practical and cost-effective.
Typical Risk Response Planning Chart for Opportunities
Risk Response Planning: Selecting the Right Strategy Piney (2002)
1. If a risk has an extremely high probability of occurrence, it may be best to assume the condition as part of the
base.
2. Risks (opportunities) with high impacts; these risks should be exploited.
3. Insignifcant risks can be accepted, passive response.
4. Between exploit and accept we can take other actions such as enhance and/or share opportunity risks.
5. Risks (opportunities) above a certain probability we may choose to accept actively by preparing plans in the
event of its occurrence –how will we take advantage of a fortunate occurrence?
6. All risks (opportunities) should be enhanced where practical and cost-effective.
Typical Risk Response Planning Chart for Opportunities
Risk Response Planning: Selecting the Right Strategy Piney (2002)
Figure 5-5
Page 52 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Response Chapter 5
Recall the Identifed Risk (compare pre-mitigated to mitigated)
WSDOT Project Risk Management – “How to guide” 5 Risk Response rev 2009-April
10 of 11
Chapter 5 Risk Response
Recall the Identified Risk (compare pre-mitigated to mitigated)
Project Title: CN Duration Estimate Risk ID Sheets.xls
Project Manager: PE Estimate
Date Risk Identified: RW Estimate
CN Estimate
Parameters for
Pre-mitigated or Post mitigated ? Monte-Carlo Modeling
R
i
s
k
#
S
t
a
t
u
s
D
e
p
e
n
d
e
n
c
y
P
r
o
j
e
c
t
P
h
a
s
e
Summary
Description
Threat and/or
Opportunity
Detailed Description of Risk Event
(Specific, Measurable, Attributable, Relevant,
Timebound) [SMART]
Risk Trigger
T
y
p
e
P
r
o
b
a
b
i
l
i
t
y
C
o
r
r
e
l
a
t
i
o
n
(1) (2) (3) (5) (6) (7) (8) (9) (10) [10a] (11)
Threat MIN
MAX
Most Likely
0Master Duration Risk
MIN
MAX
Threat Most Likely
Supplemental notes about this risk event
Risk Trigger Details: Risk Matrix
Risk Owner:
Risk Breakdown Structure # (RBS#)
Work Breakdown Stucture # (WBS#)
Critical Path (yes or no)
Response Actions (action to be taken)
Action by date:
Status review date:
Status review date:
ADDITIONAL NOTES:
Actions to implement strategy:
What needs to be done? Who will do it? Due date?
Communication with parties.
Succession plan for staff changes.
Decisions ASAP on design elements.
S
c
h
e
d
u
l
e
C
o
n
s
t
r
u
c
t
i
o
n
C
o
s
t
1
R
e
t
i
r
e
d
Risk Impact
($M or Mo)
VH
H
M
L
VL
VL L M H VH
P
r
o
b
a
b
i
l
i
t
y
Impact
Risk ID Sheet
Figure 5-6
Project Risk Management Guidance for WSDOT Projects Page 53
July 2010
Chapter 6 Risk Monitoring and Control
“Control is an illusion.” Some of us may have heard this phrase before;
and we may have had experiences when we have felt this phrase to be
very apropos –however this phrase does not tell the whole story. We may
have little or no control over the external environment but we do have
control over how we interact with it. We do have control over our state
of readiness, we can look ahead and improvise and adapt. We can control
the robustness of our response to identifed risk events and the quality of
our documentation. We have control over how earnestly we integrate risk
management into our project management plans.
Risk Monitoring and Control
As we continue through project development the project risk profle will
change. Typically as we successfully respond to risks and our project
knowledge increases our risk exposure will diminish. In effect we can
retire risk reserve as risk events are successfully avoided or mitigated
or we have passed the time during which the risk is active and it
becomes retired.
Risk Monitoring and Control Tools and Techniques
After we have implemented response actions, we must track and record
their effectiveness and any changes to the project risk profle. Did the
response actions have a positive or negative effect on achieving project
objectives? If so explain how and why in the risk management plan.
Documentation of Response Actions
This section is devoted to measuring project risk management per
performance, and determining whether a project is tracking to plan or
deviating in a negative manner. This will require a blend of qualitative
judgments and quantitative measures to determine the “health” of the
project. Document the response action by describing the action, the
work activities it will affect and the cost of the response action. Identify
the person(s) responsible for successful implementation of the response
action. Also consider the time impacts of the response action and how the
risk response may affect the overall project and/or other risks.
Determining the appropriate metrics for the project, ensuring they are
not burdensome and affect behavior. Too often, metrics change behavior
to provide better metrics not better performance. Set the amounts
and conditions for use of the project risk reserves. Establish the fnal
objectives of the project with stakeholders to improve the chances of
project success. Confrm endorsement of team members and stakeholders
as the project plan evolves.
Page 54 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Monitoring and Controlling Project Risk
The project manager and project team apply their project management
plan through project development and completion of their deliverables.
Monitor the project status looking for trends that can indicate variations
(good and bad) in the project execution. Results of the analysis need to
be communicated and adjustments made through a change management
and/or issue resolution process. The ability to describe the history of the
project and how it evolved is essential to developing lessons learned for
the future.
Helpful Hints
• Be thorough and tenacious in gathering status update information for risks.
• Monitor status and trends continuously (scope, schedule, cost estimates, quality of product, et al).
• Address problems and issues immediately –in fact anticipate and discuss in advance if possible.
• Communicate.
Project Risk Management Guidance for WSDOT Projects Page 55
July 2010
Chapter 6 Risk Monitoring and Control
Risk
Monitoring and Control
“ How to”
Page 56 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Risk Management Planning (RMP) Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Figure 6-1 depicts the RMP spreadsheet; this easy to use spreadsheet provides an effective and
convenient way to summarize project risk management activities for projects that have conducted
a quantitative risk analysis. The spreadsheet is typically used for the most signifcant risks as
determined via the quantitative risk analysis, some term these risks “candidates for mitigation”.
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
4 of 9
Chapter 6 Risk Monitoring and Control
Risk Management Planning (RMP) Spreadsheet
(http://www.wsdot.wa.gov/Projects/ProjectMgmt/RiskAssessment/ )
Figure 6-1 depicts the RMP spreadsheet; this easy to use spreadsheet provides an effective and
convenient way to summarize project risk management activities for projects that have conducted a
quantitative risk analysis. The spreadsheet is typically used for the most significant risks as
determined via the quantitative risk analysis, some term these risks “candidates for mitigation”.
Risk Identification Risk Analysis Risk Response Monitor and Control
(description/trigger) (quantitative/qualitative) (actions, owner, date) (status, updates, results)
FIRST PILLAR OF RISK MANAGEMNENT
Identify and Analyze
SECOND PILLAR OF RISK MANAGEMENT
Response, Monitor and Control
Notice that the spreadsheet is conveniently arranged into four sections: 1) risk identification; 2) risk
analysis; 3) risk response; and 4) monitor and control. In this chapter we focus on monitor and
control.
Risk Management Plan spreadsheet
Figure 6-1
Notice that the spreadsheet is conveniently arranged into four sections: 1) risk identifcation; 2)
risk analysis; 3) risk response; and 4) monitor and control. In this chapter we focus on monitor
and control.
Project Risk Management Guidance for WSDOT Projects Page 57
July 2010
Chapter 6 Risk Monitoring and Control
Figure 6-2 zooms in on the second pillar of risk management, as recorded in the RMP
spreadsheet, and indicates how to use the entries to document the risk response actions and their
effectiveness in the monitoring and control portion of the spreadsheet.
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
5 of 9
Chapter 6 Risk Monitoring and Control
Figure 6-2 zooms in on the second pillar of risk management, as recorded in the RMP spreadsheet,
and indicates how to use the entries to document the risk response actions and their effectiveness in
the monitoring and control portion of the spreadsheet.
Figure 6-3 provides an example of a completed RMP spreadsheet, and the following pages, describe
how to use the Risk Management Plan spreadsheet to monitor and control project risk.
Name of person who
owns the risk and is
responsible for
implementing the
responseactions.
J ournal entries for date and
status of risk – track
effectiveness of response
action.
What happened after the risk response
actions were implemented? How
much was spent? What did it save us?
Figure 6-2
Figure 6-3 provides an example of a completed RMP spreadsheet, and the following pages,
describe how to use the Risk Management Plan spreadsheet to monitor and control project risk.
Page 58 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
s
p
r
e
a
d
s
h
e
e
t
(
c
o
m
p
l
e
t
e
d
)
F
i
g
u
r
e
6
-
3
W
S
D
O
T
P
r
o
j
e
c
t
R
i
s
k
M
a
n
a
g
e
m
e
n
t
–
“
H
o
w
t
o
g
u
i
d
e
”
6
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
r
e
v
2
0
0
9
-
A
p
r
i
l
6
o
f
9
C
h
a
p
t
e
r
6
R
i
s
k
M
o
n
i
t
o
r
i
n
g
a
n
d
C
o
n
t
r
o
l
F
i
g
u
r
e
6
-
3
R
i
s
k
M
a
n
a
g
e
m
e
n
t
P
l
a
n
s
p
r
e
a
d
s
h
e
e
t
(
c
o
m
p
l
e
t
e
d
)
h
t
t
p
:
/
/
w
w
w
.
w
s
d
o
t
.
w
a
.
g
o
v
/
p
r
o
j
e
c
t
s
/
p
r
o
j
e
c
t
m
g
m
t
/
r
i
s
k
a
s
s
e
s
s
m
e
n
t
/
Project Risk Management Guidance for WSDOT Projects Page 59
July 2010
Chapter 6 Risk Monitoring and Control
Notice the frst 15 columns in the risk management plan spreadsheet are
devoted to Identify and Analyze – the frst pillar of risk management. The
remaining columns (16 thru 25) are devoted to the second pillar of risk
management – RESPONSE, MONITOR and CONTROL.
In Chapter 5 we reviewed in some detail risk response actions, in
this chapter we follow-up and follow-through with monitoring and
control. The way we “monitor and control” risk is regularly review the
effectiveness of the response. Are the response actions working? Are
things getting better? Are we more confdent about our ability to meet
project objectives after the response actions have been implemented?
In effect response, monitor and control is a natural component of our day-
to-day project management activities, communicate with the project team
and ascertain how things are going. Make note in the risk management
plan and document the results.
Notice that Figure 6-1 only lists 5 risks – most will agree this is not too
many to manage, but is it enough to make a difference for our project.
The answer is a resounding YES and it is demonstrated in the example
provided. Figure 6-4 below depicts the bottom of the RMP Spreadsheet
under column 11, notice that for these 5 risks there is an expected value of
$7.1 M.
It should also be recognized that this project identifed over 50 risks, 23
of which were deemed signifcant enough to warrant inclusion in the
quantitative risk analysis model. These fve emerged as the top ranked
risks after the analysis and provided the project manager a prioritized list
of risks to manager. The other 40+ risks were not simply ignored, they
provided “issues awareness” for various specialty groups and were dealt
with as each specialty group deemed appropriate for relevant risks; these
additional risks also acted as a “watch list” for the project.
Total Estimated Cost Impacts of
top 5 risks for the example project
Figure 6-4
The following page depicts a performance measure for the effectiveness of
risk management on this project (Figure 6-5).
Page 60 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Performance Measure of Risk Management for this project
Figure 6-5
When reporting on the risk management efforts for this project we can
summarize as follows:
“The total dollar amount planned for response actions was $0.6M, to
achieve reduced project risk exposure by an estimated $3.8M (expected
value of risk reduction). After implementing the response actions we
found the total cost of the response actions were $0.7M which avoided an
estimated $3.7M in project costs.”
This example illustrates an excellent return on the dollar for risk
management efforts. Other benefts, less quantifable, included: improved
communication among team members and externally to stakeholders and
the public; identifed areas of concern for each specialty group as they
helped develop the risk register during risk elicitation; greater confdence
by the project manager and project team during project development;
upper management was informed of the issues and there were fewer
surprises; the information gleaned from the overall risk workshop and risk
management effort resulted in more informed decision-making.
Project Risk Management Guidance for WSDOT Projects Page 61
July 2010
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management
efforts, including:
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our state of readiness
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our commitment to looking ahead, and being prepared to
improvise and adapt
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
The robustness of our risk response actions
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
The quality of our documentation
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
How earnestly we integrate risk management into our project
management plan
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Keeping our RMP up-to-date, including the RMPS spreadsheet
WSDOT Project Risk Management – “How to guide” 6 Risk Monitoring and Control rev 2009-April
9 of 9
Chapter 6 Risk Monitoring and Control
We can monitor and control a number of things in our risk management efforts, including:
Our state of readiness
Our commitment to looking ahead, and being prepared to improvise and adapt
The robustness of our risk response actions
The quality of our documentation
How earnestly we integrate risk management into our project management plan
Keeping our RMP up-to-date, including the RMPS spreadsheet
Our preparedness to provide the following performance data regarding our risk
management efforts:
o Number of risks identified
o Number of significant risks, as determined through quantitative analysis
o Dollar value of significant risks
o Estimated cost of planned response actions
o Estimated value of costs avoided through risk management
o Actual cost of response actions
o Estimated Actual value of costs avoided through risk management
o Estimated amount of delay (months) avoided through risk management
Our preparedness to provide the following performance data
regarding our risk management efforts:
• Number of risks identifed
• Number of signifcant risks, as determined through quantitative
analysis
• Dollar value of signifcant risks
• Estimated cost of planned response actions
• Estimated value of costs avoided through risk management
• Actual cost of response actions
• Estimated Actual value of costs avoided through risk
management
• Estimated amount of delay (months) avoided through risk
management
Page 62 Project Risk Management Guidance for WSDOT Projects
July 2010
Risk Monitoring and Control Chapter 6
Project Risk Management Guidance for WSDOT Projects Page 63
July 2010
Appendix A Project Risk Management Plan Template
A project risk management plan describes how a project team will incorporate the risk
management process into its project management plan. Particular emphasis should be given
to how a project team will respond to risks and monitor and control risk throughout the life
of the project. By identifying and analyzing risks, and then responding to risk aggressively and
monitoring the effectiveness of the response, project teams can improve the odds of meeting
project objectives.
This template is a convenient tool for project teams wishing to develop a detailed risk
management plan document; typically this is more common for highly complex project and/
or projects with signifcant risk.
The template presents an organized approach and is meant as a starting point only;
project teams must tailor the document to meet the needs for the risk management plan
for their project.
Page 64 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
Project Risk Management Plan
Offcial Project Title:
SR ###, MP limits:
Project Manager:
Risk Manager:
WIN:
PIN:
L#:
Introduction
This document is the Risk Management Plan for this project; it is a plan of action that describes how
this project team will deal with uncertainty and risk. Project risk management is an ongoing and integral
part of project management and is performed throughout the life of the project. The Project Manager is
responsible for reviewing and maintaining the Risk Management Plan to ensure that risk is appropriately
dealt with by the project team.
Project Manager Review
Initial and date after each review and update of this risk management plan:
Year Quarter 1 Quarter 2 Quarter 3 Quarter 4
2009
2010
2011
Project Risk Management Guidance for WSDOT Projects Page 65
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Plan
1
A formal project risk management plan is: a detailed plan of action for the management of
project risk. Project risk planning involves the thoughtful development, implementation, and
monitoring of appropriate risk response strategies. It is the process to develop and document an
organized, comprehensive, and interactive risk management strategy; determine the methods to
be used to execute a risk management strategy; and plan for adequate resources. The project risk
management plan may be specifc in some areas and general in others. The key to this tool is
its scalability. Every project should have a formal risk management plan, but the level of detail
varies with the project complexity.
What is a project risk management plan?
It is a document that gives a summary of the project and outlines the steps of the risk
management process and how the project manager and project team is approaching them.
The risk management plan employed will vary based on the complexity of the project, but most
project risk management plans should include an outline similar to the following:
1. Introduction 4. Organization and roles 7. Risk assessment and analysis
2. Summary 5. Risk management strategy/approach 8. Risk response actions/allocation
3. Defnitions 6. Risk identifcation 9. Risk monitoring and control
Why use a project risk management plan?
It explains how a project manager and project team manages risk for their project. It provides
guidance and requirements, and serves as a communication tool for those who wish to be
informed of a project’s risk management approach. The plan formalizes the ideas presented
during the risk management process and may clarify some of the assumptions the project team
has regarding the risk management process.
What does a project risk management plan do?
It provides specifc guidance for the project team members in all steps of the risk management
process for their project. The risk management plan documents the processes to use throughout
the project for identifying, assessing, and managing risk.
When to develop and use a project risk management plan?
The formal plan should be developed during the Planning and Scoping Process and updated
during subsequent project development phases.
How to use a project risk management plan?
The risk management plan is developed early in the project by collaboration with as many
members of the team as possible. It should be consulted and revised throughout the project
development process to guide the project through to completion.
1 (from NCHRP 8-60 review draft –with edits)
Page 66 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
Duties
Project Manager
• Approve the project risk management plan.
• Approve and insure implementation of response actions to identifed risks,
particularly signifcant risks that emerge as prospects for risk response.
• Confrm who will carry-out response actions and when action will be taken,
incorporate into work plan.
• Monitor effectiveness of response actions.
• Regularly review and update the project risk management plan.
• Promote aggressive risk management for this project.
• Actively participate in risk workshops.
• Communicate to senior management the risk and uncertainty the project is
exposed to and the action be taken to address it.
Project Team
Member
• Pro-actively identify risks and their characteristics in terms of probability of
occurrence and impact.
• Pro-actively respond to risks within specialty area.
• Document actions and report to project manager for inclusion in risk
management updates.
• Monitor effectiveness of response actions.
• Communicate with project manager with regard to risk management
actions and changing project risk profle (addition of new risks or retirement
of old risks –as appropriate).
Project Risk
Manager
• Prepare and update the project risk management plan.
• Develop a schedule for key check-in milestones for review and update of
the risk management plan.
• Determine when risk workshops will be needed and that appropriate
preparation is accomplished prior to the workshop.
• Collaborate with the Strategic Analysis and Estimating Offce, CREM
unit to coordinate pre-workshop, workshop and post-workshop activities,
including the need for consultants and/or other participants –both internal
and external.
• Oversee and manage day-to-day risk management process for the project.
• Ensure quality of risk data.
• Track and monitor effectiveness of response actions.
• Promote risk management activities within the project team and with
stakeholders.
• Communicate with project manager on all matters related to risk
management.
Risk Owner
(Action Owner)
• Implement agreed response actions.
• Report on effectiveness of the risk actions to the project manager/risk
manager and affected project team members.
• Identify new risks that may emerge after response actions.
• Communicate with project manager regularly, including the need for other
risk response actions if needed.
Project Risk Management Guidance for WSDOT Projects Page 67
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Process
This project complies with all WSDOT directional documents and
guidance for project risk management, including:
WSDOT Project Risk Management References
Project Management Online Guide (pre-construction) http://www.wsdot.wa.gov/Projects/
ProjectMgmt/Process.htm
Project Risk Management Guidance for WSDOT Projects
(Draft Working Document)
http://www.wsdot.wa.gov/Projects/
ProjectMgmt/Process.htm
WSDOT Guidelines for CRA-CEVP Workshops
Risk Management Plan Spreadsheet
Reference materials on the topic of risk management and risk
workshops at WSDOT.
WSDOT Directional Documents relating to Project Risk Management
IL 4071.00
Infation and Market Conditions Applied to Base Estimates
July 13, 2007
E 1038.00
Enterprise Risk Management
September 4, 2007
E 1042.00
Project Management and Reporting System
July 1, 2008
E 1032.01
Project Management
July 1, 2008
Project Delivery Memo 07-01
Project Cost Estimate Creation, Update, Review and Approval Procedures
July 1, 2008
E 1053.00
Project Risk Management and Risk Based Estimating
December 10, 2008
Page 68 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
1) Risk Management Planning
Risk Management will be a directed, focused and intentional effort for
this project. To that end the following items are included in this risk
management plan:
i. Level of Risk Assessment has been determined.
As indicated in E 1053.00 this project will conduct a Cost Risk
Assessment workshop as required for all projects between $25M and
$100M.
ii. Risk management activities are in the project schedule.
Risk management activities are included in the appropriate sections of
the project schedule, using the appropriate WSDOT MDL codes.
MDL Code MDL Name Description
PE.PD.04 Cost Risk
Estimate &
Management
Cost Risk Assessment, is an integral
element of project risk management
at WSDOT, and quantifes, within a
reasonable range, the cost and schedule to
complete a project; we will identify, assess
and evaluate risk that could impact cost
and/or schedule during project delivery.
PE.PD.04.20 CRA
Workshop
Cost Risk Assessment (CRA) is a workshop
process similar but less intense CEVP®.
The CRA workshop for this project is
planned for January 2010 and is included
in the project schedule; pre and post
workshop activities are also included in the
project schedule
NOTE: Project teams need to add tasks and sub-tasks as appropriate to their
project work activities using the appropriate MDL items.
iii. Risk management is an agenda item in regularly schedule project
meetings.
Risk management is included as an agenda item on our monthly
project meetings and is the number one agenda item each quarter.
iv. Communication to project team of our risk management effort and
expectations has been communicated to the project team.
During Initiate and Align, Plan the Work and Endorse the Plan risk
management has been communicated as an item of work for this
project. Specifcally it is included in the Team Mission/Assignment
and in our Roles and Responsibilities.
v. Risk will be managed, documented and reported.
Incorporated into the project schedule and monthly meetings is an item
for reporting on status of risk response actions. In addition this team
will use the Risk Management Plan Spreadsheet for summarizing and
tracking risk response action efforts for signifcant risks.
Project Risk Management Guidance for WSDOT Projects Page 69
July 2010
Appendix A Project Risk Management Plan Template
This Project Team is committed to aggressively and pro-actively managing
risk. We recognize that project risk management is at the heart of project
management and is an ongoing activity throughout the life of the project.
We also recognize that two pillars of risk management and we embrace
both, and we will respond to identifed risks and track the effectiveness
of our response actions.
Risk Management
Identify
Analyze
Respond
Monitor/Control
Risk Management
Identify
Analyze
Respond
Monitor/Control
First Pillar of Risk Management (Identify and Analyze)
2) Identify Risk Events
This project team will begin identifying risks and building its risk
register early in project development. Our risk manager will maintain
the risk register in anticipation of the CRA workshop and following the
risk management workshop. The WSDOT Risk Breakdown Structure
(RBS), provided in Chapter 2 of the Risk Management Guide, is used
for organizing risks via appropriate categories. Organizing risks in this
manner provides a consistent and convenient way to monitor and track
risks at the appropriate level of detail; this also allows for the development
of a risk database by category.
An example of how to use the RBS is provided on the following page.
Page 70 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
RISK BREAKDOWN STRUCTURE
EXAMPLE ON HOW TO USE
ENV 10.01
WSDOT Project Risk Management – “How to guide” APPENDIX_A_Risk Management Plan Template_2009-April
9 of 12
APPENDIX A Risk Management Plan Template
RISK BREAKDOWN STRUCTURE
EXAMPLE ON HOW TO USE ENV 10.01
ENV = Environmental/Hydraulics (Risk Category, Level 2 in the RBS)
ENV 10 = NEPA/SEPA Documentation (Level 3 in the RBS: 10 = Group within the category)
ENV10.01 = First Identified Risk in this Category and Group
3) Qualitative Risk Analysis
Initial analysis of risks will begin with a qualitative assessment; see Chapter 3 of the Risk
Management Guide.
4) Quantitative Risk Analysis
Quantitative analysis of risks will begin with our CRA workshop in January 2010; see
Chapter 4 of the Risk Management Guide for more detail on quantitative analysis.
ENV 10
NEPA/SEPA Documentation
Completion (incl. Section 4f,
etc.)
----------------
NEPA/SEPA Challenges
ENV = Environmental/Hydraulics (Risk Category, Level 2 in the RBS)
ENV 10 = NEPA/SEPA Documentation (Level 3 in the RBS: 10 = Group within the
category)
ENV10.01 = First Identifed Risk in this Category and Group
3 Qualitative Risk Analysis
Initial analysis of risks will begin with a qualitative assessment; see
Chapter 3 of the Risk Management Guide.
4) Quantitative Risk Analysis
Quantitative analysis of risks will begin with our CRA workshop in
January 2010; see Chapter 4 of the Risk Management Guide for more
detail on quantitative analysis.
Project Risk Management Guidance for WSDOT Projects Page 71
July 2010
Appendix A Project Risk Management Plan Template
Second Pillar of Risk Management (Respond, Monitor,
and Control)
5) Risk Response Planning
2
3
Our Project Team is committed to making effective use of the actionable
information that emerges from risk identifcation and analysis. Risk
response strategy is the process of the project team determining what,
if anything should be done with identifed risks signifcant enough to
impact project objectives. It leads to specifc actions the project team will
implement into their project management plan and work plans and then
pro-actively execute; response actions for threats (avoid, transfer, mitigate-
reduce) and opportunities (exploit, share, enhance) can be pursued or the
risk event may be accepted if the response action is not cost-effective.
Response actions will be developed and implemented promptly following
identifcation and analysis. Risks have a shelf life and risk management
plans can become stale if not monitored and updated regularly, we are
committed to making use of information when it is fresh and keeping our
project management and risk management plans up-to-date so they do not
lapse into irrelevance because they have become outdated and obsolete.
Chapter 5 of this document describes response actions for threats and
opportunities. The project work plan, including the schedule and resource
assignment establishes points at which response actions to identifed risks
will be implemented, including immediately following the CRA workshop
for this project. In addition the members of this project team are reminded
to be vigilant regarding risk for this project and to identify potential risk
events as they think of them, with the purpose of responding appropriately
to risk for this project.
Residual risks and responses (primary and secondary risks)
As a project develops its risk profle will change. Risks are identifed,
response actions are implemented which changes the nature of the project
risk profle and new risks are identifed. During risk identifcation we
identify of risk events, the frst time this is accomplished it constitutes a
list of primary risks, as actions are taken, secondary risks can emerge as a
result of implementing the treatment response to the primary risk.; where
possible secondary risks should be dealt with as part of the primary risk
response action. When developing our response actions we will be vigilant
in considering the ramifcations of the response actions. We will take
measures to include strategies that deal with the primary risk as well as
secondary risks and endeavor to minimize or eliminate residual risk as part
or risk response efforts.
2 Also referred to as Risk Treatment, Risk Mitigation, Risk Management or Risk Prevention in
some publications.
3 Practical Risk Management by David Hillson and Peter Simon (with edits)
Page 72 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
6) Risk Monitoring & Control
Monitoring and control is not complete unless communication has
occurred. COMMUNICATION is the lynch-pin of effective project
management and risk management.
Communication within and among the project team will be crisp,
concise, complete, correct and timely as will the communication to upper
management and executives. Effectiveness of the risk response actions
will be monitored and reported regularly, as indicated previously, at our
project meetings; adjustments will be made as needed.
RISK MONITORING and CONTROL (communication)
• Project Team
– Record assumptions that underlie judgments and decisions;
– Monitor and document results of implemented risk response
actions.
• Upper Management and Executives
– Avoid unpleasant surprises;
– Fully inform parties of risks, response actions and trade-offs;
• Accountability
– Document the risk assessment process in such a way that it can be
reviewed and examined for the reasons particular judgments and
decisions were made.
• Control of risk and management activities
– Specify criteria for risk management success, including targets and
measures used to assess performance;
– Follow-up with risk owners regarding the status of completing
the risk response actions and the resulting effect, track resource
allocation associated with risk response actions.
Project Risk Management Guidance for WSDOT Projects Page 73
July 2010
Appendix A Project Risk Management Plan Template
Project Risk Management Performance
Date of this Report: ___________________
Cost Risk Estimating Management
Project Risk Management Performance Summary Report
(Workshops held between MMMM DD, YYYY and MMMM DD, YYYY)
Performance Measures
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Workshop Date(s)
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Pre-workshop Base Cost
Estimate for Project
Validated Base Cost
Estimate for Project
CRA
Workshop #1
CRA
Workshop #2
CRA
Workshop #3
CRA
Workshop #4
Total # of Risks Identified
Total $ Value of Threats
Total $ Value of Opportunities
$ Value of Prospects for Risk
Response Actions
$ Cost of Risk Response
$ Cost Avoided through
pro-active risk response
RBS
CODE
Risk Break Down Structure
Group (Level 2)
Number of Risks Value of Threats $
Value of
Opportunities $
ENV Environmental and Hydraulics
STG Structures and Geotechnical
DES Design/PS&E
ROW Right-Of-Way and Access
UTL Utilities
RR Railroad
PSP Partnerships and Stakeholders
MGT Management and Funding
CTR Contracting and Procurement
CNS Construction
Page 74 Project Risk Management Guidance for WSDOT Projects
July 2010
Project Risk Management Plan Template Appendix A
doc_654456114.pdf