Guide for the Process of Managing Risk on Rapid Renewal Projects (2012)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

103 9 IMPLEMENTING RISK MANAGEMENT PLAN INTRODUCTION As discussed in Chapter 8, the risk management plan is intended to optimize project performance through the following three basic elements: • Specific actions whose purpose is to reduce particular individual risks, focusing on the higher-priority risks; • Management of contingency to cover most of the residual risks and other uncer- tainties; and • Recovery if established contingency is inadequate (i.e., to cover the rest of the residual risks and other uncertainties). However, like any plan, the risk management plan must be appropriately implemented to be successful and actually achieve optimal project performance. Also like any plan, successful implementation requires the follow- ing (at a minimum): • Responsibility—assignment of a risk manager and “owners” of significant individual risks; • Commitment—the organization has to commit to the plan; • Resources—adequate resources (funding and staff) have to be provided to carry out the plan; and • Authority—specific individuals have to be given adequate authority, as well as resources, for carrying out their assigned plan responsibilities. Adequately and efficiently implement the risk management plan: • Proactively reduce individual risks. • Address changing conditions. • Establish, track, and control contingency. • Decide on “recovery” (if needed).

104 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS A unique feature of the risk management plan, unlike most plans, is that it is actually an evolving document, with the expectation that it will be adjusted to reflect changes in the project as that project develops (including any changes due to recovery). This means that those project actions and conditions must be monitored and the plan periodically updated to reflect observed changes. For example: • Planned risk reduction actions generally should be performed as planned. Their progress should be monitored and their actual impact on risks should be assessed. However, these plans might be adjusted on the basis of their progress and pro- jected results, considering changing needs. For example, it might be determined (based on new information) that the risk being addressed is not as important as previously thought. • Risks will either happen or not happen during various project phases. If they have not happened while their window is open, they will not happen after their window has closed and they can be retired in the risk register. Conversely, if they have happened, contingency should be reserved for that risk and this should be noted in the risk register. However, such expenditure of contingency must be carefully controlled. • As conditions change, particular risks (either their assessed probability or impacts) whose windows have not yet closed can change (e.g., becoming either more or less likely). In fact, sometimes previously unidentified (“new”) risks are identified and should be assessed and included with the other existing risks. Such changes in remaining risks should be noted in the risk register. • As noted above, realized risks might result in spending or reserving some of the established contingency, leaving less contingency for the rest of the project. Con- versely, if few risks are realized, there might be excess contingency. The adequacy of the remaining contingency needs to be periodically reevaluated to give as much advance warning as possible of either possible future inadequacy (which might trigger recovery plans) or excess contingency (which can be released for other purposes). This process of implementing the risk management plan (which includes monitor- ing, updating, and implementing protocols for making significant project decisions, for example, regarding contingency and recovery) needs to be effective but should also be efficient and compatible with the DOT organization and project. PROCESS OF IMPLEMENTING THE RISK MANAGEMENT PLAN Implementation of the risk management plan consists of first getting set up to carry out the plan, and then actually implementing the various elements of the plan. Preparing to carry out the plan requires the following steps: • Organizationally committing to the plan; • Assigning responsibility for the plan;

105 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS • Providing adequate authority and resources to carry out the plan; and • Gathering and distributing information. Without these steps, the plan likely will not be successfully implemented—it will be just another document on the shelf. As part of this, it is recommended that a risk manager, a position reporting directly to the project manager, be named for the project and given overall responsibility for implementing the plan; for small projects (which should not require much effort) the risk manager might simply be the project manager, whereas for larger projects (which might require significant effort) it would be a sepa- rate person (e.g., the assistant project manager). The risk manager then typically will delegate responsibility for various elements of the plan to those who are in the best position to complete them and will follow up with them to ensure that they actually complete those elements. For this to happen, the risk manager must be given adequate authority and resources (e.g., budget). However, this needs to be done as efficiently as possible to prevent wasting resources. For example, periodic risk management status meetings should be short and integrated into regular project status meetings. Similarly, risk management status reports should be streamlined, simply highlighting changes since the last report, and appropriately distributed in a timely fashion. With an adequate organizational structure and set of procedures in place, the vari- ous elements of the plan can be successfully implemented. The basic elements of the plan, which are somewhat flexible in order to be most efficient, include the following (see Chapter 8): • Risk reduction actions. A set of actions is specified in the risk management plan for reducing individual risks. These actions must be successfully performed to realize any risk reduction, although the actual amount of risk reduction, and typically to a lesser extent their cost and schedule to implement, will be uncertain before- hand. However, such actions can be adjusted (e.g., stopped) as their projected performance or need changes. The DOT must assign responsibility for each ac- tion, and then track progress of that action. The cost and schedule, as well as the results (in terms of risk reduction), of implementing that action will be re- ported. Figure 9.1 provides an example based on the Risk Management Plan form for Phase A for Phase A for Phase A for Phase B for Phase B for Phase B for Phase C for Phase C for Phase C 0 1 2 3 4 5 6 7 A B C Project Phase C on tin ge nc y ($ M ) cumulativetriggerrecovery Figure 9.1. Contingency drawdown and recovery for project phases.

106 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Example Risk Reduction Action from Risk Management Plan (this is not the hypothetical case study) Action successfully completed, and risk eliminated <by name and date> 6 2014.01.13 R09 10 Guide Chapter 9_final for composition.docx significant right-of-way risk. The management actions provide an estimate of the resources, an estimate of the risk reduction, and a person who is responsible for verifying that the risk plan has been implemented by a key milestone. Status updates can then be documented on this form. [Insert Box 9.2] Contingency management. Contingency allowances for cost and schedule are established in the risk management plan to cover the residual risks (after they have been reduced) with appropriate confidence. As risks are realized, some of the contingency must be reserved to cover them. However, like any project costs, such expenditures must be carefully controlled; similarly, giving up project float in the project schedule must also be carefully controlled. Conversely, if few risks occur and contingency is not used, then the excess contingency can be released for other purposes. As shown in Figure 9.1, such Example Risk Reduction Action from Risk Management Plan (this is not the hypothetical case study): ti n successfully complete , and risk eliminated <by name and date> RUi(1). The team will design around areas where right of way may be an issue, specifically at US555-SH111 junction. Design lead, in conjunction with right-of-way lead By end of preliminary design Need to get approval for design deviations. provided in Appen dix C. In this example, the project team has determined that it will be more cost-effective to design around an area with a significant right-of-way risk. The management actions provide an estimate of the resources, an estimate of the risk reduction, and a person who is responsible for verifying that the risk plan has been implemented by a key milestone. Status updates can then be documented on this form. • Contingency management. Contingency allowances for cost and schedule are es- tablished in the risk management plan to cover the residual risks (aft r they have been reduced) with appropriate confidence. As risks are realized, some of the con- tinge cy must be reserve to cover them. However, like a y project costs, such expenditures must be carefully controlled; similarly, giving up project float in the project schedule must also be carefully controlled. Conversely, if few risks oc- cur and contingency is not used, then the excess contingency can be released for other purposes. As shown in Figure 9.1, such contingencies are typically allocated to, and tracked by, the different phases of the project. For the case shown in red circles in this example, the contingency actually spent in each phase (and thus cumulatively) was less than that budgeted (e.g., in Phase A, only $2 million of the budgeted $3 million was spent); after each phase, unused contingency could be released. DOTs typically have established protocols for approving and tracking contingency expenditure and releases, with approvals generally required at higher organizational levels as the amounts increase. • Recovery. Contingency (or recovery) plans are identified in the risk management plan just in case the contingency allowances are found to be inadequate (e.g., if a disproportionate number of significant risks actually happen). For example, if as

107 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS shown in the black square in Figure 9.1, the reserved contingency exceeds the allowable contingency during a phase, then recovery is triggered (e.g., in Phase A, $4 million was spent, which was $1 million more than the $3 million budgeted for that phase, meaning that there is not enough left for later phases). Typically, such plans are somewhat drastic (e.g., deferring or eliminating scope to save cost and/ or schedule) and are only intended as a last resort. However, in general, each such plan is only possible up to a specific point in project development; for example, savings associated with deferring some scope cannot be realized once that scope has been built. Clearly, such decisions must be made at a high organizational level. Because (as described above) the plans are somewhat flexible to adapt to changing conditions, to be successfully completed, each of the above elements of the risk man- agement plan requires specific information at various points in time: • The status and projected results of the various risk reduction actions, as well as projected needed performance improvements; • The status or availability of contingency, as well as projected contingency needs; and • The status or availability of recovery actions, as well as projected recovery needs. In particular, to determine changes in needs (whether for risk reduction, for con- tingency, or for recovery), the changes in risks should be adequately monitored and updated. Such changes in risks are due to inevitable changes in project conditions with time. Monitoring is relatively quick, but informative. The following should be moni- tored periodically (e.g., monthly, or less frequently at moderately important points or changes in project development): project development status and conditions, risk reduction action status and projected results, existing risks, and contingency and recov- ery plans. These should be adequately documented (e.g., in a memorandum or directly in the risk register). For example: (a) the status of a risk reduction action is illustrated in the above example; (b) qualitative changes in risk might simply be described, includ- ing their cause; and (c) the status of contingency is illustrated in Figure 9.1. Updating is more involved (including reassessment and reanalysis, if needed), but also more informative, than monitoring. The following should be updated periodically (e.g., quarterly, or less frequently at important points or changes in project develop- ment, as indicated by monitoring): base performance, risks (including adding new risks), and contingency and recovery requirements. These should be documented (e.g., in the risk register and in the risk management plan).

108 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS CONCLUSIONS ON IMPLEMENTING THE RISK MANAGEMENT PLAN The risk management plan consists of three main elements designed to optimize project performance: (1) plans for individual risk reduction actions; (2) protocols for contingency management; and (3) protocols for recovery plans. Because project condi- tions, and hence risks, inherently change as a project moves through the development process, the risk management plan is intended to be an evolving document, adjusting as the project develops. This in turn requires monitoring (e.g., of the progress and results of specific risk reduction action, of specific risks in the risk register, and of con- tingency) and periodic updating (e.g., of residual risks, of risk reduction plans, and of contingency requirements). This then requires a DOT commitment to carrying out the risk management plan, including assignment of responsibility (e.g., a designated risk manager), with adequate authority and resources, and ways to gather and distribute relevant information. This also needs to be an efficient process, compatible with the DOT organization and project. Example Risk Register Update (this is not the hypothetical case study) There was a risk of a landowner being unwilling to sell a parcel needed to construct a project. When it was first identified, there was a high probability (50%) that the owner would not be willing to sell and the impact of this risk was $500,000 and 2-month delay, with an expected value of about $300,000 [including increased escalation and extended overheads (OHs)] and 1 month (critical path). However, as seen in a previous example, the manage- ment action was successfully taken to avoid this risk by designing around the parcel, at a cost of about $100,000 ($150,000 including increased escalation and extended OHs) and 1-month delay. The resulting reduction in risk meant that about $300,000 and 1 month less contingency was required; however, the resulting cost ($150,000) and delay (1 month) of the mitigation effort had to be added to the base cost and schedule. Based on such updates of the various inputs, the contingency requirements (and recovery requirements) could be recalculated. Risk RUi updated <by name and date> 10 2014.01.13 R09 10 Guide Chapter 9_final for composition.docx CBaum 1/30/14 11:16 AM Deleted: 2013.02.11 R09 10 Guide Chapter 9.docx <H1>Conclusions on Implementing the Risk Management Plan The risk management plan consists of three main elements designed to optimize project performance: (1) plans for individual risk re uction a tions; (2) p otocols for contingen y management; and (3) protocols for recovery plans. Because project co ditions, and hence risks, Example Risk Register Update (this is not the hypothetical case study): There was a risk of a landowner being unwilling to sell a parcel needed to construct a project. When it was first identified, there was a high probability (50%) that the owner would not be willing to sell and the impact of this risk was $500,000 and 2-month delay, with an expected value of about $300,000 [including increased escalation and extended overheads (OHs)] and 1 month (critical path). However, as seen in a previous example, the management action was successfully taken to avoid this risk by designing around the parcel, at a cost of about $100,000 ($150,000 including increased escalation and extended OHs) and 1-month delay. The resulting reduction in risk meant that about $300,000 and 1 month less contingency was required; however, the resulting cost ($150,000) and delay (1 month) of the mitigation effort had to be added to the base cost and schedule. Based on such updates of the various inputs, the contingency requirements (and recovery requirements) could be recalculated. Risk RUi updated <by name and date>

109 GUIDE FOR THE PROCESS OF MANAGING RISK ON RAPID RENEWAL PROJECTS Example The hypothetical QDOT case study (see Appendix D), which is used to illustrate the various steps of the risk man- agement process and includes a risk management plan (RMP, Appendix E), describes an effective and efficient implementation of its RMP following the principles and process outlined in this chapter, as documented in RMP Section 9 and summarized below. After QDOT developed the RMP, its implementation was adequately supported by management and adequate resources provided. The RMP included an organizational structure with specified responsibility and authority (i.e., the project manager served as the risk manager) to implement that RMP throughout project development. The project’s designated risk manager then successfully implemented that RMP, as follows: • Proactively and cost-effectively reduced individual risks that were within QDOT’s control, including monitor- ing and updating the risks and the RMP over time, resulting in successful reduction of several large risks; • Used established protocols for contingency control, including monitoring and periodic updating of con- tingency status (expended to date and capacity required for completion) and recommending contingency expenditure (to cover actual risk occurrences as needed) and releasing excess contingency (when no longer needed), resulting in adequacy of the initially established contingency throughout the project, with the unused contingency subsequently released; and • Used established protocols for recovery decisions, including monitoring and periodic updating of recov- ery status (achieved to date and capacity required for completion) and recommending recovery actions as needed when remaining contingency was not sufficient, resulting in no recovery actions being required.