Innovative knowledge system for project risk management

Transcription

1 Innovative knowledge system for project risk management Konstantinos KIRYTOPOULOS Vrassidas LEOPOULOS Charalampos MALANDRAKIS Ilias TATSIOPOULOS Abstract: - Aim of this paper is to provide a knowledge system, able to identify risks and help their assessment in projects. Risk management has recently been considered as key tool for decision making in project management. Although several papers have been issued concerning this problem, project risk management is still a research field for the scientific community. However, a specific part of it, which is the identification and assessment, seems to be the most fertile for investigation. Moreover, the paper is illustrated with a case study concerning the implementation of the method on a project in the construction sector. Key-Words: - knowledge system, risk management, project management, risk identification 1 Introduction Nowadays, the competition among firms is higher than ever. In addition to the traditional cost considerations, time and performance have also become crucial factors. This phenomenon is even more recognisable in projectised competitive environments. Industrial firms, in the construction, software and consulting are traditionally project oriented. In addition, several industries in the repetitive manufacturing environment adopt project based management, widening thus the number of companies affected. As a reaction, many methods and tools have been built in order to make these firms capable of facing the problem. The method proposed in this paper to cope with the problem is a merging of two very important factors for enterprise excellence. The former is the knowledge management system and the latter the risk management. Knowledge management is a very tempting and swiftly evolving procedure, the goal of which is to obtain as much knowledge as possible from the organisation itself. There are many references concerning knowledge systems where one can see its value and how such a system could be quite important and effective for the efficiency of an enterprise [1]. On the other hand, we have the risk management [10]. Risk management is a high innovative method of running projects and its principle is to see, act and be prepared to expect the unexpected. The more a project is being analysed through the risk management processes, the more chances it has to obtain a forecast close to the real outcome. The fact that risk management alone is not enough

2 [2], lead us to examine closely which factor could support it in order to come up with a tangible and useful result. The core problem of risk management is how to identify risks that could affect your project. The answer that we unfold in this paper is to use a knowledge management system in order to acquire that important knowledge so as to become able to implement risk management techniques. By implementing the techniques of risk management enhanced with a knowledge management system we claim that one can estimate more precisely the final duration and cost of a project. This is because he/she takes into account expected risks that more or less do occur, so they lengthen the duration of the project and increase the cost. This claim will be supported by a case study from the construction sector. The rest of this paper is organised as follows: In Section 2 the problem of the study is formulated. The method proposed for the solution problem is described in Section 3. In Section 4 one can find the presentation of the case study that supports this paper. In this section, results of the method are presented and compared with the initial estimation and the events of the actual project, as well. Finally, in Section 5 the conclusions and opportunities for further research in the topic are presented. 2 Problem Formulation The description of the problem is separated into two major sub-problems: 2.1 Risk management The first important consideration is how the cost and the duration of a project can be estimated with the higher possible accuracy. Although several techniques exist for such estimations and there is a lot of paperwork in order enterprises to find efficient ways to cope with the problem [3], planning in minute detail to cover every eventuality reaches quickly the limits of cost, time and effort. As we cannot predict the future we have eventually to stop planing and take up managing the risk. Successful risk management reduces the exposure of the project to risk [4]. It has been confirmed that too many problems would have been avoided and much more projects would have been delivered on time and within the estimated cost if managers have adopted a risk management policy [5], [6]. Risk Management is based on four basic steps, namely Identification, Assessment, Mitigation and Follow Up [4], [7]. Risk identification consists of determining those risks that are likely to affect the project and documenting the characteristics of each. It is the first step of the risk management process and the most critical. If the manager fails to identify important risks at this very first level, the whole risk management process fails. Checklists and interviewing are tools used to help risk identification. A knowledge system has to be implemented in order to reduce the probability of missing important risks (see section 2.2). Risk identification is a continuous task during the lifecycle of a project. It is for sure that in the early phases it is of higher importance but it should not be neglected even in the last phases of project execution. The purpose of risk assessment is to measure risk severity, which is called exposure. The easiest way to calculate exposure is to multiply probability of appearance of a risk with the expected impact. Both the impact and the exposure are expressed either in cost or time with the former outrunning the latter. Furthermore, exposure could be either qualitative or quantitative depending on the level of detail available or desirable [3]. More sophisticated methods for risk assessment have also been proposed [8], however, the aforementioned seems the easiest to adopt. The benefit of risk assessment is that the project team comes up with a ranking of risks so that it can focus on the important ones. Although many techniques that cope with risk assessment have been developed or adopted from other fields of science [9], such as three point estimate (optimistic, pessimistic, most likely values), decision trees, heuristics (e.g. precedence diagramming method) etc, Monte Carlo simulation is the dominant one. In the mitigation process we have to cope with the identified and prioritised risks. Mitigation actions, should either reduce the probability of occurrence and/or impact, or to smooth the recover of the project after the appearance of the risk. These types of actions are preventive and corrective respectively. Both should be taken into account, as they are complementary aspects and in the most effective risk management strategies the former back the latter up and vice versa. This step is a step with added value ; the better risk response is defined, the more savings you will come up with. Risk follow up involves executing the risk management plan in order to respond to risk events over the course of the project. When changes occur the basic cycle of identify, assess and mitigate is repeated. 2.2 Knowledge system This procedure is the answer to the second problem,

3 which is how risks can be identified and assessed in order to have a sound risk management process. For the identification of risks three basic methods are used: Expert s knowledge (interviewing), checklists and lately corporate memory. Expert s knowledge is probably the easiest way of identifying risk but its valuable information may be disregarded, unless high professional interview techniques are being performed. Checklists are a structured way of knowledge acquisition. They are often divided into categories, moving from more generic, such as external or internal risks, to more detailed levels, such as fields of business (managerial, technical, legal, etc.). Corporate memory is a step further and enhances considerably the success of risk identification and assessment. Its basic principle is the maintenance of the past experience of the company in a knowledge base in order to reused it effectively, when needed. A combination of the knowledge stored in the data base with experts opinion and a check list, results in more accurate and closer to reality estimations. This concept consists in developing a knowledge system and is going to be analysed next. 3 Problem Solution The method proposed as a solution to this problem, is based on a vivid and continuous bone up Risk Breakdown Structure (RBS) that is being used as a risk guide. Category Category (Overall exposure) (Overall exposure) Risk (Exposure) Impact (Gravity) Risk... (Exposure) Final exposure (Global exposure) Cause (Probability)... Driver (Question) Driver (Question)... Risk (Exposure)... Driver (Question) Fig.1: Risk Breakdown Structure Category (Overall exposure) Cause (Probability) The method consists in building a Risk Breakdown Structure (RBS) that will guide the project manager through structured steps to achieve an as accurate as possible estimation of the global exposure of his/her project to risk. This risk guide, presented next, is very important to be adaptable to the environment and to the needs of each enterprise that is going to use it. More specifically, every single enterprise that will use the method will build its own RBS based on its interest, economic size, scope of work, etc. The model s structure is presented in figure 1 and the explanation of its components in table 1. Following the structure of the model, the objective is to come up with a global exposure, a measurable indicator such as money, time or qualitative like performance. 1 Final Exposure The final exposure consists of categories. It is the highest level of the RBS and it is expressed by a global exposure, which is the sum of the overall exposures of the categories that is composed of. 2 Category A category consists of a number of risks and it also has an overall exposure. This exposure is the sum of the exposures of the individual risks that it is composed of. 3 Risk Each risk is described by its exposure. Exposure is the multiplication of the probability of the cause by the gravity of the impact. 4 Impact By definition we assume that each risk has one and only impact. Each impact is described by its gravity. 5 Cause A cause is the connector between a driver and a specific risk. Each cause has a probability, which is how probable is that the emergence of a specific driver will lead to the emergence of the risk itself. 6 Driver It is the lowest level of the RBS and it is, in fact, a yes or no question. Table 1: Components of RBS When we structure the model for each specific

4 enterprise we try to keep a top-down approach. That is, we identify the categories of risks, risks that constitute each category and drivers that lead to the realisation of the risks. This is a time consuming, however very worth-trying procedure as the RBS outcome will be the enterprise s guide to any project. It is also very important to mention that our knowledge acquisition system imposes a continuous updating of the RBS at the end of each project. In other words, after the delivery of the project, the project manager is asked to define any new categories, risks or even drivers that he/she confronted during the project. By performing this later task we ensure that our model is a learning one and that we always have an updated version with all the factors that might affect our project. This is how we construct our RBS with the top-down method. On the other hand, bottom up approach should be used when the method has to be put in practice. Starting from the lower level, we identify which drivers exist in the project under investigation. The existence of those drivers will indicate the probability of risk occurrence. It is of high importance to keep in mind that drivers should always be independent because this is a prerequisite in order to add the probabilities to the level of risk. Each risk has an overall probability of occurrence, which is the sum of the probabilities of drivers that constitute the risk. This addition can only be done directly in case of independent probabilities something that is obtained through the independence of drivers. In order to ensure this independence, statistical tests can be used. By examining all the drivers of our model, we end up with a list of risks with an overall probability of occurrence (P ov ). Each risk has also an impact (I), which by being multiplied with the overall probability of occurrence offers risk s exposure (E): E = I * P ov (1) Then risks are being synthesised in order to give the overall exposure of each category and then we synthesise categories in order to get the global exposure of the final exposure of the project to risk (see Fig. 1, Table 1). Having the final exposure, the project manager can have a clear view of his/her project and take steps in order to reduce or even better avoid risks. Moreover, by using simulation tools he/she can get a better approximation of the length and cost of the project. 4 Case study This method has been adopted in the case study that is going to be presented. The project under consideration concerns the construction of an exhibition centre. The project was undertaken by J&P HELLAS, which is a construction company based in Greece. Although we didn t interfere in the project management, we performed in parallel and in close co-operation with the project manager a study of what we would have achieved if we had used the proposed method. The outcome was for sure very encouraging. In Fig. 2 can be seen the schedule of the project as it has been issued from the project manager to the top management. The Gantt view of the project plan is simplified for reasons of brevity, but the basic tasks have been kept. Only the summary level of each task is presented, without describing the lower levels. Risks identified for these lower level tasks have nevertheless been taken into consideration. The duration of each task has been estimated by the project team, based on their knowledge and past experience acquired from similar projects. Fig. 2: Project s Gantt Chart During a study that had been set out prior to the realisation of this project, we had developed a first draft of RBS concerning the construction company that undertook this project. This study had been based on publications concerning risks analysis [4], [7], [11], [12], enhanced with risk experts opinion and experience from projects that had been developed in the past. The higher level of this RBS can be seen in Fig. 3. This figure consists of risk categories and their risks (see also table 1). By exploring this in regard to the project under analysis we ended up with a list of risks that would possible affect it. In a nutshell, the project team was reviewed and were put to confront the dilemma to choose whether the drivers of each risk are going to appear or not.

5 Final Exposure External Lega State Acts of Managemen Changes in seniror Lack Of Lack of Bad Scheduling Political disorder Changes in payment High technology Non realistic Bureaucrac Design Lack of Incomplete Contro uncertainty and the point values of exposures that describe risks. The results of the simulation for the schedule duration, are presented in fig. 4 and the results for the cost in fig. 5. In order to obtain these results, we used the software tool RISKMAN Professional. This software tool is dedicated to risk management and it runs as an add-on on Microsoft Project. The first outcomes of the simulation were very disappointing for the project team. The simulation was indicating a cost overrun of more than 100% and a duration overrun nearly 200% (see Table 2). However, the actual result of the project turned in favour of the model! Actually, the project did overrun both budget and duration for 104% and 130% respectively. For sure the simulation results were not perfect, however they were much more accurate than the initial schedule. Moreover, both actual budget and duration were within the simulation curve as one can see in fig. 4 and fig. 5. In other words, the simulation indicated a much more reliable information, although it seems that risks somehow were overestimated. This overestimation was probably due to the risk aversion of the project team. Market Functional risks Tech Close out Conflicts with Customer Fig. 3: Higher level of RBS After having this information the same team was asked to assign a probability that the identified drivers would lead to the appearance of the risk that they corresponded to. Following the model (Fig. 1) we calculated the overall probability and we also identified the impact of each risk so that we could calculate its exposure (see eq. (1)). The impact, so the exposure as well, was measured in terms of cost or time. Impact was estimated by expert s knowledge and past experience. The identified and assessed risks were integrated in the overall length and cost of the whole project by developing a model for Monte Carlo simulation. The simulation model that we used took into account the triangular distribution for each task that describes the Fig. 4: Probable end of project Fig. 5: Probable cost of project

6 Parameters Initial scheduled - anticipated Actual (return from experience) Simulation Results (80% prob.) Start date 06-Mar Mar Mar-00 Delivery date 23-Jun Nov Jan-01 Total duration (days) Cost (cu*) Table 2.: Comparison of project initial schedule actual simulation results * cu stands for currency units 5 Conclusion further research Taking into account the results of this research and the comments that we had from the project team, we come up with the finding that a knowledge system could essentially aid the risk project management procedure. It seems that this structured approach of exploring the environment of your own company and dig out risks that lay in wait can be of great benefit for the better estimation of coming projects. This knowledge system is currently under formation and there is a quite wide range of possible elements for its improvement. We have already been working on the calculation of the probability of the cause using past experience. Such an approach will reduce significantly the interference of human factors and their intuitive feelings as well, in the system, which means that the system will be probably more reliable. The importance of that claim can be deduced from our case study where the risk aversion of the project team led our system to overestimate risks. We also believe that this approach can help to better estimation of the parameters of the project and moreover to assist to the independence of the enterprise from key staff that when leave the company their knowledge slips out as well, like they have never been in enterprise s workforce before. As a conclusion we strongly recommend project mangers to lead their teams towards knowledge systems that can have a high beneficial impact with also high probability of success. [4] Project Management Institute. Project management book of knowledge. PMI, [5] C. Chapman, S.Ward, Project risk management: Processes, Techniques and Insights, John Wiley & Sons Ltd, [6] Y.Chong, E.Brown, Managing project risk: Business risk management for project leaders. Pearson Education Ltd, [7] R.Kliem, I.Ludin, Reducing Project Risk, Gower Publishing Ltd, [8] C.Chapman, S.Ward, J.Bennell, International Journal of Project Management, Vol. 18, 2000, pp [9] G.Koller, Risk assessment and decision making in business and industry: a practical guide, CRC Press, [10] B.Ritchie, D.Marshall, Business Risk Management, Chapman & Hall, [11] C.Chapman, International Journal of Project Management, Vol. 15, 1997, pp [12] R.Wideman, Project and program risk management: a guide to managing project risks and opportunities. PMI, References: [1] T.Davenport, L.Prusak, Working Knowledge, Harvard Business School Press, [2] S.Pender, International Journal of Project Management, Vol. 19, Issue 2, 2001, pp [3] C.Gray, E.Larson, Project Management, McGraw-Hill, 2000.