Risk Management in Portfolios, Programs, and Projects: A Practice Guide

Risk Management in Portfolios, Programs, and Projects:

A Practice Guide

Risk Management in Portfolios, Programs, and Projects: A Practice Guide (paperback)

ISBN: 978-1-62825-816-5

©2024 Project Management Institute, Inc. All rights reserved.

Our copyright content is protected by U.S. intellectual property law that is recognized by most countries. To republish or reproduce our content, you must obtain our permission. Please go to http://www.pmi.org/permissions for details.

PMI, the PMI logo, PMBOK, OPM3, PMP, CAPM, PgMP, PfMP, PMI-RMP, PMI-SP, PMI-ACP, PMI-PBA, PROJECT MANAGEMENT JOURNAL, PM NETWORK, PMI TODAY, PULSE OF THE PROFESSION and the slogan MAKING PROJECT MANAGEMENT INDISPENSABLE FOR BUSINESS RESULTS. are all marks of Project Management Institute, Inc. For a comprehensive list of PMI trademarks, contact the PMI Legal Department. All other trademarks, service marks, trade names, trade dress, product names and logos appearing herein are the property of their respective owners. Any rights not expressly granted herein are reserved.

To place an order or for pricing information, please contact Independent Publishers Group:

Independent Publishers Group

Order Department

814 North Franklin Street

Chicago, IL 60610 USA

Phone: 800 888 4741

Fax: +1 312 337 5985

Email: [email protected] (For orders only)

Printed in the United States of America. No part of this work may be reproduced or transmitted in any form or by any means, electronic, manual, photocopying, recording, or by any information storage and retrieval system, without prior written permission of the publisher.

The paper used in this book complies with the Permanent Paper Standard issued by the National Information Standards Organization (Z39.48—1984).

10 9 8 7 6 5 4 3 2 1

Notice

The Project Management Institute, Inc. (PMI) standards and guideline publications, of which the document contained herein is one, are developed through a voluntary consensus standards development process. This process brings together volunteers and/or seeks out the views of persons who have an interest in the topic covered by this publication. While PMI administers the process and establishes rules to promote fairness in the development of consensus, it does not write the document and it does not independently test, evaluate, or verify the accuracy or completeness of any information or the soundness of any judgments contained in its standards and guideline publications.

PMI disclaims liability for any personal injury, property or other damages of any nature whatsoever, whether special, indirect, consequential or compensatory, directly or indirectly resulting from the publication, use of application, or reliance on this document. PMI disclaims and makes no guaranty or warranty, expressed or implied, as to the accuracy or completeness of any information published herein, and disclaims and makes no warranty that the information in this document will fulfill any of your particular purposes or needs. PMI does not undertake to guarantee the performance of any individual manufacturer or seller’s products or services by virtue of this standard or guide.

In publishing and making this document available, PMI is not undertaking to render professional or other services for or on behalf of any person or entity, nor is PMI undertaking to perform any duty owed by any person or entity to someone else. Anyone using this document should rely on his or her own independent judgment or, as appropriate, seek the advice of a competent professional in determining the exercise of reasonable care in any given circumstances. Information and other standards on the topic covered by this publication may be available from other sources, which the user may wish to consult for additional views or information not covered by this publication.

PMI has no power, nor does it undertake to police or enforce compliance with the contents of this document. PMI does not certify, test, or inspect products, designs, or installations for safety or health purposes. Any certification or other statement of compliance with any health or safety-related information in this document shall not be attributable to PMI and is solely the responsibility of the certifier or maker of the statement.

Preface

Risk Management in Portfolios, Programs, and Projects: A Practice Guide is a supplemental resource aligned with the PMI series of American National Standards Institute (ANSI)-approved standards, bringing consistency to the customer experience across the PMI publications portfolio. Organizations must adapt their visions, missions, and objectives to changing environments; therefore, PMI practice guides are evolving with them. In addition, the goal of A Guide to the Project Management Body of Knowledge (PMBOK® Guide) is to adapt and implement new project management perspectives and the approaches used to increase benefits and generate value for organizations.

This presents a new opportunity to align Risk Management in Portfolios, Programs, and Projects: A Practice Guide with those shifting perspectives related to risk management. During the last few years in particular, new trends have emerged; new management skills are requested in the market; and people continue to improve their capabilities, increasing their knowledge and developing abilities to contribute to the objectives of their organizations.

The PMBOK® Guide—Seventh Edition made several changes in the structure and content of the guide, with an enhanced focus on delivering value to organizations and their stakeholders. Those changes were incorporated in the new Risk Management in Portfolios, Programs, and Projects: A Practice Guide, changing the Knowledge Areas to the eight project management performance domains, aligning the concept of a system for value delivery, implementing agile approaches in the risk management process, and including a case study to make the content more relatable to project managers.

The new Risk Management in Portfolios, Programs, and Projects: A Practice Guide also aligns risk management more closely with the updated PMI Talent Triangle®, integrating the required skills in Ways of Working, Business Acumen, and Power Skills. These new ways of working will help project professionals navigate business changes and connect outcomes to generating greater value for organizations. Part of the objective of Risk Management in Portfolios, Programs, and Projects: A Practice Guide is to identify the risk management skills that organizations need to increase project success and value.

The previous edition of The Standard for Risk Management in Portfolios, Programs, and Projects focused on processes, tools, and techniques, and was aligned with the Process Groups and Knowledge Areas. Risk Management in Portfolios, Programs, and Projects: A Practice Guide responds to the elements that stakeholders have requested in their feedback: It improves the usefulness of the techniques, tools, processes, and good practices of risk management; aligns risk management practices with performance domains and portfolio, program, and project management principles; and is focused on realizing benefits and value through project outputs and outcomes.

Table of Contents

1 Introduction

1.1 Purpose of This Practice Guide

1.2 Approach of This Practice Guide

1.3 Audience for This Practice Guide

1.4 Principles of Risk Management

1.4.1 Strive to Achieve Excellence in the Practice of Risk Management

1.4.2 Align Risk Management with Organizational Strategy, Governance Practices, and Project Management Performance Domains

1.4.3 Focus on the Higher Risk Value

1.4.4 Optimize Risk Responses to Focus on Value Realization

1.4.5 Foster a Culture That Embraces Risk Management

1.4.6 Navigate Complexity Using Risk Management to Enable Successful Outcomes and Value Realization

1.4.7 Continuously Improve Risk Management Competencies

1.5 Structure of This Practice Guide

2 Context and Key Concepts of Risk Management

2.1 Key Concepts and Definitions

2.1.1 Risk

2.1.2 Risk Attitude

2.1.3 Risk Appetite

2.1.4 Risk Threshold

2.1.5 Uncertainty

2.2 Risk Management in Organizations

2.3 Risk Management at Different Organizational Levels

2.3.1 Enterprise

2.3.2 Portfolio

2.3.3 Program

2.3.4 Project

2.4 Key Success Factors

3 Framework for Risk Management in Portfolio, Program, and Project Management

3.1 Business Context of Risk Management in Portfolio, Program, and Project Management

3.1.1 Organizational Framework

3.1.2 Organizational Context

3.1.3 Strategic and Organizational Planning

3.1.4 Linking Planning with Execution through Portfolio, Program, and Project Management

3.2 Scope of Accountability, Responsibility, and Authority

3.2.1 Accountability at the Enterprise Level

3.2.2 Accountability at the Portfolio Level

3.2.3 Accountability at the Program Level

3.2.4 Accountability at the Project Level

3.3 General Approaches to Risk Management

3.3.1 Factors for Evaluating Risk

3.3.2 Responding to Risks

4 Risk Management Life Cycle in Portfolio, Program, and Project Management

4.1 Introduction to the Risk Management Life Cycle

Case Study: Introduction to the Compact Wind Turbine Project

4.1.1 Risk Management in Adaptive, Predictive, and Hybrid Project Management

4.1.2 Integrating Project Risk Management and Organizational Risk Management

4.1.3 Risk Escalation

Case Study: Risk Escalation in the Compact Wind Turbine Project

4.1.4 Organizational Project Management and Its Application in Risk Management

4.2 Plan Risk Management

4.2.1 Purpose of Plan Risk Management

Case Study: Tailoring and Scaling the Risk Management Plan in the Compact Wind Turbine Project

4.2.2 Key Success Factors for Plan Risk Management

Case Study: Planning Risk Management in the Compact Wind Turbine Project

4.3 Identify Risks

4.3.1 Purpose of Identify Risks

4.3.2 Key Success Factors for Identify Risks

Case Study: Identifying Risks in the Compact Wind Turbine Project

4.4 Perform Qualitative Risk Analysis

4.4.1 Purpose of Perform Qualitative Risk Analysis

4.4.2 Key Success Factors for Perform Qualitative Risk Analysis

4.5 Perform Quantitative Risk Analysis

4.5.1 Purpose of Perform Quantitative Risk Analysis

4.5.2 Key Success Factors for Perform Quantitative Risk Analysis

4.6 Plan Risk Responses

Case Study: Responses to Threats in the Compact Wind Turbine Project

Case Study: Responses to Opportunities in the Compact Wind Turbine Project

4.6.1 Purpose of Plan Risk Responses

4.6.2 Key Success Factors for Plan Risk Responses

Case Study: Planning Risk Responses in the Compact Wind Turbine Project

4.7 Implement Risk Responses

4.7.1 Purpose of Implement Risk Responses

4.7.2 Key Success Factors for Implement Risk Responses

Case Study: Implementing Risk Responses in the Compact Wind Turbine Project

4.8 Monitor Risks

4.8.1 Purpose of Monitor Risks

4.8.2 Key Success Factors for Monitor Risks

Case Study: Monitoring Risks in the Compact Wind Turbine Project

5 Risk Management in the Context of Portfolio Management

5.1 Interconnectedness of Risks in Portfolios, Programs, and Projects

5.1.1 Risk Efficiency and Risk-Return Trade-Offs

Case Study: Portfolio Management in the Context of the Compact Wind Turbine Project

5.1.2 Risk Exposure in Portfolios

5.1.3 Role of Portfolio Manager

5.1.4 Risk-Efficient Boundary and Organizational Strategy

Case Study: The Risk-Efficient Boundary in the Compact Wind Turbine Project

5.1.5 Emerging Trends in Portfolio Risk Management

Case Study: Incorporating Emerging Trends in the Compact Wind Turbine Project

5.2 Portfolio Risk Management Life Cycle

5.2.1 Portfolio Risk Identification

Case Study: Strategic-Level Portfolio Risks in the Compact Wind Turbine Project

5.2.2 Portfolio Risk Qualitative and Quantitative Analyses

Case Study: Portfolio Risk Analyses in the Compact Wind Turbine Project

5.2.3 Portfolio Risk Response Strategies

5.2.4 Implementing Portfolio Risk Responses

5.2.5 Monitoring Portfolio Risks

5.3 Integration of Risk Management into the Portfolio Management Performance Domains

6 Risk Management in the Context of Program Management

6.1 Distinctions and Challenges in Program Risk Management

6.1.1 Understanding Program Risk Management

6.1.2 Sources, Nature, and Types of Program Risks

6.1.3 Bridging the Risk Management Gaps among the Portfolio, Program, and Project Levels

6.1.4 Managing Program Overall and Individual Risks

6.1.5 Achieving Flexibility and Resilience in Program Risk Management

6.1.6 Program Risk Management Implementation Challenges

6.2 Program Risk Management Life Cycle

6.2.1 Program Risk Identification

Case Study: Program Management in the Context of the Compact Wind Turbine Project

6.2.2 Program Risk Qualitative and Quantitative Analyses

Case Study: Program Risk Analyses in the Compact Wind Turbine Project

6.2.3 Program Risk Response Strategies

Case Study: Program Risk Response Strategies in the Compact Wind Turbine Project

6.2.4 Implementing Program Risk Responses

6.2.5 Monitoring Program Risks

Case Study: Monitoring Program Risks in the Compact Wind Turbine Project

6.3 Integration of Risk Management into the Program Management Performance Domains

6.3.1 Strategic Alignment

6.3.2 Benefits Management

6.3.3 Stakeholder Engagement

6.3.4 Governance Framework

6.3.5 Collaboration

6.3.6 Life Cycle Management

Case Study: Program Management Performance Domains in the Compact Wind Turbine Project

6.3.7 Program Activities

Case Study: Program Activities in the Compact Wind Turbine Project

7 Risk Management in the Context of Project Management

7.1 Risk Management Gaps among the Project and Higher Levels

7.1.1 Establishing Risk Thresholds

7.1.2 Addressing Risks from Higher and Strategic Levels

7.1.3 Project-Level Risk Interfaces with Operations

7.2 Project Risk Management Life Cycle

7.2.1 Enhancing Risk Analysis and Involving the Right Participants

Case Study: Project Management in the Context of the Compact Wind Turbine Project

7.2.2 Project Risk Identification

Case Study: Project Risk Identification in the Compact Wind Turbine Project

7.2.3 Project Risk Qualitative and Quantitative Analyses

Case Study: Project Risk Analyses in the Compact Wind Turbine Project

7.2.4 Project Risk Response Strategies

Case Study: Project Risk Response Strategies in the Compact Wind Turbine Project

7.2.5 Implementing Project Risk Responses

Case Study: Implementing Project Risk Responses in the Compact Wind Turbine Project

7.2.6 Monitoring Project Risk

Case Study: Monitoring Project Risk in the Compact Wind Turbine Project

7.3 Integration of Risk Management into Project Management Processes

7.3.1 Initiating Processes

7.3.2 Planning Processes

7.3.3 Executing Processes

7.3.4 Monitoring and Controlling Processes

7.3.5 Closing Processes

Case Study: Integration of Risk Management into the Project Management Processes in the Compact Wind Turbine Project

7.4 Project Risk Management Controls

References

Appendix X1 Contributors and Reviewers of Risk Management in Portfolios, Programs, and Projects: A Practice Guide

X1.1 Contributors

X1.2 PMI Team Members

Appendix X2 Techniques for the Risk Management Framework

X2.1 Risk Management Planning

X2.2 Identify Risks

X2.2.1 Assumptions and Constraints Analysis

X2.2.2 Brainstorming

X2.2.3 Cause and Effect (Ishikawa) Diagrams

X2.2.4 Checklists

X2.2.5 Delphi Technique

X2.2.6 Document Review

X2.2.7 Expert Judgment

X2.2.8 Facilitation

X2.2.9 Historical Information

X2.2.10 Interviews

X2.2.11 Prompt Lists

X2.2.12 Questionnaires

X2.2.13 Root Cause Analysis

X2.2.14 SWOT Analysis

X2.2.15 Premortem

X2.3 Qualitative Risk Analysis

X2.3.1 Affinity Diagrams

X2.3.2 Analytic Hierarchy Process

X2.3.3 Influence Diagrams

X2.3.4 Nominal Group Technique

X2.3.5 Probability and Impact Matrixes

X2.3.6 Risk Data Quality Analysis

X2.3.7 Assessment of Other Risk Parameters

X2.3.8 System Dynamics

X2.4 Quantitative Risk Analysis

X2.4.1 Contingency Reserve Estimation

X2.4.2 Decision Tree Analysis

X2.4.3 Estimating Techniques Applied to Probability and Impact

X2.4.4 Expected Monetary Value

X2.4.5 Failure Modes and Effects Analysis/Fault Tree Analysis

X2.4.6 Monte Carlo Simulation

X2.4.7 Program or Project Evaluation and Review Technique

X2.5 Plan Risk Responses

X2.5.1 Contingency Planning

X2.5.2 Force Field Analysis

X2.5.3 Multicriteria Selection Technique

X2.5.4 Scenario Analysis

X2.5.5 Simulation

X2.6 Response Plan Implementation

X2.7 Monitor Risks

X2.7.1 Data Analytics

X2.7.2 Reserve Analysis

X2.7.3 Residual Impact Analysis

X2.7.4 Risk Audit

X2.7.5 Risk Breakdown Structure

X2.7.6 Risk Reassessment

X2.7.7 Sensitivity Analysis

X2.7.8 Status Meetings

X2.7.9 Trend Analysis

X2.7.10 Variance Analysis

X2.8 Risk Management Techniques Recap

Appendix X3 Risk Classification

Glossary

List of Figures and Tables