The ultimate purpose of risk identification and analysis is to prepare for risk mitigation. Mitigation includes reduction of the likelihood that a risk event will occur and/or reduction of the effect of a risk event if it does occur. This chapter discusses the importance of risk mitigation planning and describes approaches to reducing or mitigating project risks.
RISK MITIGATION PLANNING
Risk management planning needs to be an ongoing effort that cannot stop after a qualitative risk assessment, or a Monte Carlo simulation, or the setting of contingency levels. Risk management includes front-end planning of how major risks will be mitigated and managed once identified. Therefore, risk mitigation strategies and specific action plans should be incorporated in the project execution plan, or risk analyses are just so much wallpaper. Risk mitigation plans should
Characterize the root causes of risks that have been identified and quantified in earlier phases of the risk management process.
Evaluate risk interactions and common causes.
Identify alternative mitigation strategies, methods, and tools for each major risk.
Assess and prioritize mitigation alternatives.
Select and commit the resources required for specific risk mitigation alternatives.
Communicate planning results to all project participants for implementation.
Although risk mitigation plans may be developed in detail and executed by contractors, the owner’s program and project management should develop standards for a consistent risk mitigation planning process. Owners should have independent, unbiased outside experts review the project’s risk mitigation plans before final approval. This should be done prior to completing the project design or allocating funds for construction. Risk mitigation planning should continue beyond the end of the project by capturing data and lessons learned that can benefit future projects.
RISK RESPONSE AND MITIGATION TOOLS
Some risks, once identified, can readily be eliminated or reduced. However, most risks are much more difficult to mitigate, particularly high-impact, low-probability risks. Therefore, risk mitigation and management need to be long-term efforts by project directors throughout the project.
Responding to the Level of Uncertainty
If a project is determined to have a low level of uncertainty, then the optimal policy is to proceed expediently in order to increase the present value of the project by completing it as soon as possible and thereby obtaining its benefits sooner. Fixed-price contracts, perhaps with schedule performance incentives, are appropriate for this type of project. Everything else being equal, projects that take longer generally cost more and deliver less value to the owner. Many projects take longer than they should, in part due to dilatory decision-making processes and the lack of a sense of urgency.
However, when a project has some uncertainty, a full-speed-ahead approach may not be optimal. In such projects, scope changes and iterative recycling of the design are the norm, not the exception. Regulatory issues also provide a fertile source of uncertainty that can cause conceptual project planning and design to recycle many times. For projects with a high degree of uncertainty, fixed-price contracts may be inappropriate, but performance-based incentive contracts can be used.
Failure to recognize and anticipate changes, uncertainty, and iteration in preparing schedules and budgets can lead to unfortunate results. The techniques and skills that are appropriate to conventional projects often give poor results when applied to projects with great potential for
changes and high sensitivity to correct decisions. For these projects, a flexible decision-making approach may be more successful. Often this approach may seem contrary to experience with conventional projects. The use of unconventional methods to manage uncertainty requires the active support of senior managers.
Dealing With High-Impact, Low-Probability Risks
High-impact, low-probability events in general cannot be covered by contingencies. In these cases, the computation of the expected loss for an event as the product of the loss if the event occurs times the probability of the event is largely meaningless. As an extreme example, suppose a certain project is expected to cost $1,000,000 if a certain event does not occur and $50,000,000 if it does. One would certainly not assign a contingency of $49,000,000 to a $1,000,000 project. If the probability of the event is estimated as 0.02, the expected loss due to the risk event is $1,000,000. One would not assign this number as a contingency either, because the estimated cost with contingency would rise 100 percent to $2,000,000. If the event occurs, the contingency of $1,000,000 will be completely inadequate to cover it, with a shortfall of $49,000,000. If the event never occurs, the additional $1,000,000 is likely to be spent anyway, so that the net effect is simply to double the cost of the project.
High-impact, low-probability events must be mitigated by reducing the impact or the likelihood, or both. But risk mitigation and management certainly are not cost-free. In the simple illustration above, it might be worth it to the owner to expend as much as $1,000,000 more to mitigate the $50,000,000 risk, and perhaps more than $1,000,000 if the owner is very risk averse. In determining the budget allocation needed to mitigate high-impact, low-likelihood risks, it is necessary to identify specific risk mitigation activities. These activities should then be included in the project budget and schedule, and tracked and managed just as other critical project activities are managed. However, risk mitigation activities may differ from other project activities in that there may be some uncertainty about whether the selected risk mitigation strategies will work—that is, the activities may be contingent on whether the risk mitigation strategies are effective. This has led to the development of a special kind of network diagram for risk mitigation activities, known as the waterfall diagram, which is described in Chapter 7.
Risk Transfer and Contracting
There is a common adage about risk management—namely, that the owner should allocate risks to the parties best able to manage them.
Although this sounds good, it is far easier said than done. It is impossible, for example, to assign risks when there is no quantitative measurement of them. Risk allocation without quantitative risk assessment can lead to attempts by all project participants to shift the responsibility for risks to others, instead of searching for an optimal allocation based on mutually recognized risks. Contractors generally agree to take risks only in exchange for adequate rewards. To determine a fair and equitable price that the owner should pay a contractor to bear the risks associated with specific uncertainties, it is necessary to quantify the risks.
Owners’ project representatives should explicitly identify all project risks to be allocated to the contractors and to the owner, and these risks should be made known to prospective bidders. In order to use a market-based approach to allocate risks, and to avoid unpleasant surprises and subsequent litigation, it is necessary that all parties to the agreements have full knowledge of the magnitude of the risks and who is to bear them.
Risk transfer can be entirely appropriate when both sides fully understand the risks compared to the rewards. This strategy may be applied to contractors, sureties, or insurance firms. The party that assumes the risk does so because it has knowledge, skills, or other attributes that will reduce the risk. It is then equitable and economically efficient to transfer the risks, as each party believes itself to be better off after the exchange than before and the net project value is increased by the risk transfer.
Risk buffering (or risk hedging) is the establishment of some reserve or buffer that can absorb the effects of many risks without jeopardizing the project. A contingency is one example of a buffer; a large contingency reduces the risk of the project running out of money before the project is complete. Buffering can also include the allocation of additional time, manpower, machines, or other resources used by the project. It can mean oversizing equipment or buildings to allow for uncertainties in future requirements.
Risk buffering is often applied by project contractors as well as by owners. Overestimating project quantities, man-hours, or other costs is a form of buffering used by many project participants. If jobs are awarded on the basis of lump-sum, fixed-price bids, then too much cost buffering can be detrimental to contractors’ ability to compete. Contractors and sub-contractors may compensate by overestimating project or activity durations. Schedule buffers allow contractors to adjust their workforce and resource allocations within projects and across multiple projects.
Buffering in the forms of cost or schedule overestimates and other factors can accumulate across a project and can be to the owner’s detri-
ment because they can easily result in a general upward trend in the expected project costs and durations. In private projects, this trend is controlled by competitive factors and by the owners’ knowledge of what costs and schedules should be. If the bidding pool is small, or if the owner is not knowledgeable, there may be inadequate controls on scope creep, cost creep, and schedule creep.
Risk avoidance is the elimination or avoidance of some risk, or class of risks, by changing the parameters of the project. It seeks to reconfigure the project such that the risk in question disappears or is reduced to an acceptable value. The nature of the solution may be engineering, technical, financial, political, or whatever else addresses the cause of the risk. However, care should be taken so that avoiding one known risk does not lead to taking on unknown risks of even greater consequence.
Risk avoidance is an area in which quantitative, even if approximate, risk assessments are needed. For example, the project designers may have chosen solution A over alternative B because the cost of A is estimated to be less than the cost of B on a deterministic, single-point basis. However, quantitative risk analysis might show that A is much riskier than the alternative approach B. The function of quantitative risk assessment is to determine if the predicted reduction in risk by changing from alternative A to alternative B is worth the cost differential.
Risk avoidance is probably underutilized as a strategy for risk mitigation, whereas risk transfer is overutilized—owners are more likely to think first of how they can pass the risk to someone else rather than how they can restructure the project to avoid the risk. Nevertheless, risk avoidance is a strategy that can be employed by knowledgeable owners to their advantage.
Risk control refers to assuming a risk but taking steps to reduce, mitigate, or otherwise manage its impact or likelihood. Risk control can take the form of installing data-gathering or early warning systems that provide information to assess more accurately the impact, likelihood, or timing of a risk. If warning of a risk can be obtained early enough to take action against it, then information gathering may be preferable to more tangible and possibly more expensive actions.
Risk control, like risk avoidance, is not necessarily inexpensive. If the project is about developing a new product, and competition presents a risk, then one solution might be to accelerate the project, even at some
considerable cost, to reduce market risk by beating the competition to market; this is a typical strategy in high-technology industries. An example of a risk control method is to monitor technological development on highly technical one-of-a-kind projects. The risk is that the promised scientific development will not occur, requiring use of a less desirable backup technology or cancellation of the project.
Many projects experience high levels of uncertainty in many critical components. Some of these important risks cannot be adequately characterized, so optimal risk mitigation actions cannot be determined during project planning. This is common when uncertainties will be reduced only over time or through the execution of particular project tasks. For example, the uncertainty about the presence of specific chemical pollutants in a water supply may be reduced only after project initiation and partial completion. Under these circumstances commitment to specific risk management actions during planning makes project success a gamble that the uncertainty will be resolved as assumed in planning.
The following are examples of flexible decision making that can help mitigate risks under conditions of uncertainty:
Defer some decisions until more data are obtained in order to make better decisions based on better information. Good decisions later may be preferable to bad decisions sooner, particularly if these decisions constrain future options. It may be argued that deferring decisions is never desirable because to do so might delay the project, but this is a fallacy of deterministic thinking. When uncertainty is high, poor decisions made too early will delay the project much more, or even cause it to be canceled due to resulting budget and schedule overruns. In these circumstances, deliberately deferring decisions may be good management practice, but it is essential that the project be scheduled such that deferred decisions reduce rather than increase the risks of delays.
A flexible policy of delaying decisions should not be equated with simple procrastination or wishful thinking. Decisions should be delayed only when, based on analysis, there are solid reasons to believe that new information will be forthcoming that will affect the decision one way or another. If there is no such expectation, then the project manager should consider whether it might be cost-effective to acquire more information even at additional cost. For example, an expanded boring program to identify subsurface conditions, an expanded testing program to characterize wastes, or
pilot plant tests of new technology are just a few examples in which it may be very cost-effective to buy more information before making a decision.
Restructure the project such that the impact of early decisions on downstream conditions is minimized. Decisions that constrain future decisions and eliminate options should be reconsidered. Safety factors may be added to buffer the effect of decisions. For example, something may be oversized to provide a safety factor against high uncertainty in requirements, just as safety factors are used in engineering design to provide a margin against uncertainty in loads; the higher the uncertainty, the greater the contingency in the load factor. If a building must be built before the contents are known precisely, then oversizing the building may well be prudent. These safety factors typically increase project costs, but they may increase them far less than the alternative strategies for mitigating risk or the consequences of an undersized building.
Stage the project such that it is reviewed for go or no-go decisions at identifiable, discrete points. These decision points should be built into the front-end plan. Based on updated information available at these future times, the project may be modified, continued, or terminated. Termination of the project at a future time will be costly, but it may be far less costly than continuing it in the hope that something good will happen.
Change the scope of the project, either up or down, at some future decision points. Changing scope is generally a bad practice in conventional projects, but in high-uncertainty projects midcourse corrections may be necessary responses to changed conditions or improved information, if the scope change is made in accordance with a preplanned review and decision process defined in the frontend plan (i.e., not scope creep or the unplanned use of scope as contingency).
Analyze and simulate the effects of strategic decisions before making them. These issues typically cannot be decided only on the basis of prior experience, especially when that experience may have been obtained on conventional projects.
A flexible decision-making approach requires that project directors be active and show initiative. If project directors are constrained by organizational culture, bureaucratic restrictions, fear, or self-interest, they will not exhibit initiative or flexibility and are likely to apply rigid management principles to situations that require flexible decision making. The value of management flexibility increases in direct proportion to the uncertainty in the project. As stated by General Dwight D. Eisenhower,
“In preparing for battle, I have always found that plans are useless, but planning is indispensable.” The same thought can be applied to risk management.
An option provides the opportunity to take an action without the obligation to take that action. Options may cost money, but they also add value by allowing managers to shift risk or capture added value, depending on the outcome of one or more uncertain parameters. For example, a contract clause permitting termination of a contract if a critical technology is not developed provides an opportunity (but not an obligation) to terminate. An options approach also improves strategic thinking and project planning by helping to recognize, design, and use flexible alternatives to manage uncertainty.
Increasing options and decision points is a valid risk mitigation strategy for project owners. For example, the option to terminate a contract can be of value to owners. Conversely, contractors often want to reduce owners’ options to terminate a project once it gets started. Obviously, the owner’s option is not cost-free as there are costs involved in terminating a project; nevertheless, owners should always provide off-ramps or exit strategies in case projects become nonviable.
Delaying commitment to a single strategy or solution by carrying alternative optional strategies until sufficient information becomes available to resolve the uncertainty is an example of the use of options as a form of managerial flexibility. Another example of an options approach was that used by the Manhattan Engineer District in World War II, in which both an enriched uranium and a plutonium device were developed so that there would be an available alternative; information gained from one was used in making a decision about the other (i.e., which to use), so that the managers had an option to switch between alternatives and select the more attractive one. This is similar to power plants that can run on gas or oil and switch between the fuels based on their relative price. In the case of the Manhattan Project we can safely assume that the progress and relative effectiveness of the alternative efforts were compared in order to make informed choices, including (ultimately) the choice that was used in the war. Both worked, but the additional cost to buy the option was considered justifiable.
There are many places in which options can be inserted to deal with virtually any project’s technical, market, financing, or other risks. The use of these options may, however, require some imagination and changes from the usual methods and practices. Because risk is uncertainty and information reduces uncertainty, many options involve the creation or
purchase of information. It should be stressed that creating options to generate new information is not the same as simply postponing decisions in the hope that some new data will materialize to save the situation.
The use of options is premised on specific rules for implementation that define the conditions that would trigger a change in strategy. The process includes continuing to monitor the uncertain parameters, evaluating their status and impact, and changing strategies if alternative options are warranted. This should be a proactive not a reactive process.
As an illustration of a risk assessment applied to both downside risk and upside opportunity, consider the case of a risk associated with two alternate technologies or processes. Process 1 is newer, and the cost estimates for this process are highly uncertain, compared to Process 2, which is more established and for which the cost estimates are much less uncertain than those of Process 1. If the estimated construction cost of using either of the two processes is the same, then there is a substantially greater risk of obtaining a high project cost with Process 1 than with Process 2.
It is assumed that the probable costs of these two processes are statistically independent—that is, there is no correlation between the cost of one and the other. Figure 5-1, which plots the probability that the project
cost will overrun any specified budget, shows the relationship between the use of either process and the likelihood of project cost overruns.
Figure 5-2 shows these two options plus a third, which is to pursue both Process 1 and Process 2. Note that in this third approach, the expected cost is less than for either of the two processes individually, and the probability of a cost overrun is less than with either of the others for any budget. Obviously, one does not construct two facilities just to find out which process is cheaper. However, this elementary illustration indicates that the best approach may be to pursue the engineering of both options until, using a series of decision points, enough additional information is obtained to refine the cost estimates and thus determine which process should be chosen.
If project directors seek to manage the risks, not simply to compute them, then they should recognize that project engineering and design can be conducted in a series of steps, such that after each step—e.g., conceptual design, process engineering, plant general arrangements, production design, detailed design, and procurement—the engineering process will produce new information and a new cost estimate for the technologies being considered. Thus at discrete breakpoints—for example, at the quarterly project reviews—the project’s engineering team will produce its
current best estimate of the final cost of the facility. Based on the new information generated by the engineering, design, and procurement process, the estimates at each quarter will provide better guidance about the economics of the final facility. Then the sponsor can make a decision to continue the project or to terminate it.
The principal benefit of the options approach is that by reliance on sequential decisions made as more and better information is available, rather than on a single decision made at the beginning of a project, and using the high uncertainty as an opportunity not simply a risk, the net value of a project can be increased. Thus a project that might have been canceled can instead be turned into a highly beneficial one. Although this example is simple, the fundamental point it illustrates is that the purpose of risk analysis is to support decisions. The objective of risk management should be to decide whether or not to build a project, and which of alternative process technologies to use, not merely to compute risks or probability distributions. The example also shows that adding management decision points increases the value of the project to the owner.
Risk assumption is the last resort. It means that if risks remain that cannot be avoided, transferred, insured, eliminated, controlled, or otherwise mitigated, then they must simply be accepted so that the project can proceed. Presumably, this implies that the risks associated with going ahead are less than, or more acceptable than, the risks of not going forward. If risk assumption is the appropriate approach, it needs to be clearly defined, understood, and communicated to all project participants.