1 Risk Management Principle: Tool 2E

Risk Management Principle
Risk Management Principle

Risk management is a systematic process to reduce exposure to risk by identifying, understanding, analysing, and managing the uncertainty in a project. Risk management helps ensure project objectives are aligned and that risks to ongoing activities (GMP Operations) are managed. Risk management includes the identification of key areas of risk, the likelihood of an event occurring, and estimates of the possible consequences. Risk management is applied throughout the life of a project as a method of preventing cost and time overruns, scope creep and business risk. A project risk is a potential problem that could impact the project in the future. However, a risk differs from a critical issue, which is an open/unresolved matter that will impact the project if not addressed in a timely manner. In other words, a critical issue is a risk occurrence of special importance, or one that requires special attention. For more information on critical issues, see Tool 2E, Project Plan Instructions. Figure 8.1 shows the essential activities of Risk management, with the inputs and outputs for each activity. The diagram reflects that Risk management is an iterative processas changes occur, the basic cycle (plan, analyse, and handle risks) repeats. Figure 8.1 Essential Activities of Risk Management
Initial Assessment and Decision to Proceed
Risk Management Strategy

Formulate and implement an overall risk management strategy that is consistent with business objectives Project Plans & Strategies
Risk Analysis
Identify and describe risks to gain awareness of the risk type, probability of occurrence, and potential impacts Quantified Risk s
Risk Handling
Prepare a method of response to eliminate, accept, or reduce the impact/probability of risks
Risk Responses
Risk Monitoring
Monitor the risk environment throughout the project lifecycle to update strategies and forecasts
Changes and Additions
Updated Risk Register and Forecasts
2002 GlaxoSmithKline, Rev.1 Jun 2003
8-1
Project Management Standard
2
2.1
Risk Management Practice

Creating a Risk Management Strategy
Conducting an initial assessment and defining a strategy are steps required to create a risk management strategy.
2.1.1
Conduct an Initial Assessment

During the Inception stage of the project, the Project Sponsor conducts an initial assessment of overall project complexity and associated business risks (see Tool 8A, Initial Risk Assessment). At this point, the primary concern is fundamental uncertainties risks that could make the business case non-viable and need to be addressed at department, site, or corporate levels. The results of this exercise are used to help determine whether to proceed with the project, and if so, putting in place an appropriate project risk management strategy that minimises GSK's risk.
2.1.2
Define the Strategy

At the outset of the project, the Project Manager must establish an efficient risk management strategy to monitor and manage risks throughout the life of the project. The Project Manager documents the risk strategy in the Project Plan. The risk strategy establishes the risk management framework for the project. It explains how risk management will be tailored to the needs of the project, and addresses the following topics: The scope of risk management for the project (e.g., to focus only on risks that could impact the plant commissioning date or to focus only on risks that may impact project objectives) Any aspects of risk management that will be addressed by others outside the project team How the risks will be analysed, handled, and monitored across the life cycle of the project The frequency and level of detail at which risks are analysed and reviewed and whether formal quantitative analysis will be applied Any major strategic decisions made to reduce the project risk, such as the development of a prototype or the decision to appoint a contractor to deliver a turnkey solution Any major risks that are accepted into the project and their funding implications Any specialist resources, tools, or training needed to effectively implement risk management on the project
2.2
Analysing Risk
Risk analysis involves identifying all known risks at an early stage of the project and establishing a risk register describing the nature of the risk, probability of occurrence, and possible impact.
8-2
2002 GlaxoSmithKline, Rev.2 July 2008
2.2.1
Identify the Risks

This step consists of identifying all the possible risks that may significantly impact project success. Risk identification is not a one-time event; it should be performed on a regular basis throughout the project. The basic approach to risk identification is to: Gather all of the relevant data possible (e.g., project description, Project Objectives, Project Plan, cost estimate, schedule, and lessons learned from past projects) as it is useful to have a good understanding of any business operations that may be impacted by the Project. Schedule a facilitated risk management workshop with the core project team and any other key participants; see Tool 8B, How to Conduct a Risk Management Workshop, for more information on workshop preparation, workshop agenda, risk identification methods, and risk identification guidelines Use a creative approach to identify risks with the team and be thorough, continuing until no more risks can be identified; for help in identifying potential sources of risk, see Tool 8C, Risk Source Checklist
2.2.2
Assess the Risks

After identifying the range of possible risks, the next step is to assess them. Risk assessment is performed whenever a new risk is identified or an existing risk changes. The purpose of risk assessmenta structured process based on calculationis to quantify the impact of risk. Risk assessment ranks risks in terms of type, probability, and impact. Probability measures the likelihood of the risk occurring, and impact measures the severity to the project or facility when the risk occurs. Risk assessment consists of the following activities: Determine specific definitions of probability and impact appropriate to the project Assign numeric values to the definitions for probability and impact Analyse risks for both probability and impact Calculate the risk index by multiplying the values for probability and impact (the higher the risk index, the more significant the risk) Use the risk index to rank the risks for prioritised attention See Tool 8D, Project Risk Definitions, for detailed explanations of probability, impact, risk index, quantitative analysis, and sample project risk definitions.
2.2.3
Register the Risks

The results of the risk identification and risk assessment are captured in a risk register (see Tool 8E, Risk Register, for a suggested format). The collection of risks and their associated risk index values also provides insight into the overall project risk profile. If desired, this can be depicted graphically on a grid (see Tool 8F, Risk Matrix, for an example).
2.3
Handling Risk
Risk handling involves developing specific, discrete responses to address each risk and to reduce overall project uncertainty. If the identified risks are unacceptable, seek ways of preventing or reducing those risks and create fallback plans. In some cases, risks can be
8-3
eliminated while other risks are completely external to the project, presenting little scope for reduction.
2.3.1
Develop Responses
Develop suitable responses for each risk: Avoid remove the risk, usually by eliminating the cause Transfer allocate the risk to others through contracts or insurance Mitigate reduce the risk probability, risk impact, or both Accept accept the possible consequences of the risk; absorb within project allowances, or fund specific risks separately
2.3.2
Evaluate Responses
Transferring risk will be cost-effective only if the contractor has proper and effective control over the source of the risk. For insurance of project-associated risks, consult with GSK Corporate Insurance and Risk Management for advice and for the appropriate insurance arrangements. With mitigation or acceptance, the risk is not removed completely. In these instances, establish a fallback plan (e.g., emergency responses) in case the risk occurs. Identify any secondary effects associated with the proposed response. Ensure that any costs, time, and resources required to implement any response or fallback plan are identified and included in the Project Plan, schedule, and cost estimate or budget. Determine the feasibility of the responses, both individually and collectively. Consider the cost of managing the risk versus the perceived benefits of the proposed responses. It may be better to accept some risk as is, rather than expending resources reducing it.
2.3.3
Assign Responsibility
Where mitigating actions are feasible and justifiable, assign action owners and due dates to each risk. Place the ownership of risks with those best placed to manage them, and who have the necessary expertise, resources, and authority to carry out any mitigating action.
2.3.4
Accumulate Results
Consolidate plans (e.g., contractual, insurance, and fallback) and incorporate them into the overall project plans. Price the cumulative results of the risks and their responses to assess the overall impact to project costs.
R1
Make adequate provision for risk management actions in project cost estimates. For Class 1 through Class 3 estimates, the risk results may be used to help determine the amount of contingency required within the range of typical contingency levels. For the Class 4 estimate, the results are used to determine the impact on project contingency and if a risk allowance is required. For more information on setting contingency and risk allowances, see the Cost Estimating and Schedule Development practices, along with Tools 11C Detailed Contingency Estimating Method and 11D Estimating Risk. Document the recommendations, including those risks that the project team has consciously decided to accept or ignore. Communicate the risk strategies to the project team, senior management, and stakeholders. Obtain agreement from stakeholders regarding the handling of
8-4
major project risks. Ensure that decisions made regarding risk are agreed throughout all project stages.
2.4
Monitoring Risk
Establish risk controls to ensure the ongoing management of project risk. Continually review project risks and their significance, monitor the effectiveness of risk response strategies, and regularly update fallback plans. Ensure that the risk management process remains consistent with the main project objectives.
2.4.1
Identify Triggers
Identify the potential triggers that would indicate the occurrence of a risk, and make sure these triggers are visible to the project team. Monitor the triggers on a frequent basis, and use the information to update forecasts.
2.4.2
Document Risk Occurrences

Some of the identified risks will occur, others will not. Risks that occur are actual risk occurrences, and the project team must recognise them in order to implement the fallback plan. If a risk occurs, capture the facts as soon as possible. Prepare an analysis of the risk occurrence and create a lessons learned file. Communicate the results to the project team and the organisation. Report major risk events to ETCM as a Project Alert topic. During the post-project review, record the descriptions of risks experienced and their consequences. Review the risk management strategy after each unexpected risk occurrence to determine if revisions are needed.
2.4.3
Track Status and Communicate Changes

Track the status of project risks by reviewing the risk register frequently. As the project develops, reassess the probability and impact of identified risks. Evaluate the project for new risks, especially when changes occur on the project (such as starting the next project stage). Repeat the cycle of identify, assess, and respond for any new risks. Transfer the updated risk information into the forecast costs and schedule, and update any special risk allowances. For more information on effective forecasting, see the Cost Control practice within Project Controls. Incorporate changes and updates into the risk register on a regular basis. Re-issue the risk register to the project team, highlighting changes since the last report. Include the status of any major risks in the monthly project report.
2.5
Responsibilities
This section describes the risk management responsibilities for various roles.
8-5
2.5.1
Project Sponsor
Conducts an initial assessment of overall project complexity and associated business risks during the Inception stage Obtains agreement from stakeholders regarding the handling of major project risks
2.5.2
Project Manager
Defines the risk management strategy for the project and documents it in the Project Plan Sets up the risk management workshop Assigns suitable responses to and owners for risks Documents the results of the risk assessment in a risk register (further updates to the risk register may be delegated to the contractor) Includes adequate provisions for risk management actions in project cost estimates Monitors risks and uses the latest information to update forecasts Documents risk occurrences and communicates results to others
2.5.3
Customer
Actively participates in the risk management workshop Takes ownership of risks that fall under the Customer's authority
2.5.4
Contractor
Actively participates in the risk management workshop Takes ownership of risks that fall under the contractor's authority
8-6

1 Risk Management Principle: Tool 2E

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1 Risk Management Principle: Tool 2E

Uploaded by

Copyright:

Available Formats

Risk Management Principle

Risk Management Principle

Risk Management Strategy

Changes and Additions

Updated Risk Register and Forecasts

2002 GlaxoSmithKline, Rev.1 Jun 2003

Project Management Standard

Risk Management Practice

Conduct an Initial Assessment

Define the Strategy

2002 GlaxoSmithKline, Rev.2 July 2008

Risk Management Practice

Identify the Risks

Assess the Risks

Register the Risks

2002 GlaxoSmithKline, Rev.1 Jun 2003

Project Management Standard

Risk Management Practice

Document Risk Occurrences

Track Status and Communicate Changes

2002 GlaxoSmithKline, Rev.1 Jun 2003

Project Management Standard

2002 GlaxoSmithKline, Rev.2 July 2008

You might also like