Interfacing Earned Value and Risk Management

risk decisions 2 whitepaper Interfacing Earned Value and Risk Management by Val Jonas, CEO, Risk Decisions Group Lauren Bone, Managing Director, Bone Consulting Ltd www.riskdecisions.com management solutions

Val Jonas and Lauren Bone: Interfacing Earned Value and Risk Management whitepaper Interfacing Earned Value and Risk Management The difference between risks, issues and uncertainties Sound risk management process and robust earned value management application each offer the opportunity to improve project control and provide the project manager with reliable information on which to base proactive management decisions. All too often the disciplines are practised in isolation with focus on the mechanisms rather than the management value. They can compete with each other for resource and project management attention, rather than leveraging the advantages each has to offer. Instead, it should be recognised that they complement each other to deliver more holistic project management. This white paper explains how risk and earned value approaches work together during different phases of a project lifecycle, starting with setting the baseline, then change control as the project progresses, finally looking at how to improve Estimates to Complete. It demonstrates how to combine the two disciplines of Risk Management and Earned Value Management, in order to support better decision making, encourage more communication and increase chances of delivering a successful project. Introduction As separate disciplines, both Earned Value and Risk Management are valuable components of project management and control, needed to manage projects successfully. Even projects that don t undertake these disciplines in a formal way will nonetheless be following the basic elements of both disciplines: understanding what needs to be done, by whom and when, agreeing budgets, understanding and managing what might go wrong, measuring progress, estimating and forecasting outcomes. The disciplines of Earned Value and Risk Management simply apply a rigour to all of these activities. It s advisable to put in place the appropriate foundations for the application of Earned Value as early as possible in the project lifecycle. This includes identifying a product based Work Breakdown Structure (WBS), creating an effective schedule structure, as well as recording early basis of estimates and assumptions against preliminary scope definitions. While it is possible to draft these features at the outset, unfortunately application of Earned Value does not typically commence until the project concept is transformed into a scope of work. On the other hand, Risk Management commonly does commence early in the project lifecycle: during the concept phase it is used to inject realism into the planning process, challenging over-enthusiastic optimism and ensuring the plan is within an agreed level of risk appetite. For example, you may decide to take risks to bring a new product out on time, to beat a competitor to market; however, you must understand what level of risk you are taking and whether the organisation can bear the consequences. Understanding an organisation s capacity to proactively take risk is a very important part of the early decision making process, whereby the project is allowed to go to the detailed design and planning stages. Going forward, the role of Risk Management includes the top down identification of key sources of uncertainty and potential risk events, with associated risk responses. A risk budget is set and used to manage risk and keep the project on target, through to completion. Earned Value Management involves the establishment of a baseline that combines work, budget, schedule and responsibility. This baseline is then used to measure performance, understand variance, extrapolate likely outcomes and support action to manage variance back to the baseline targets. While each discipline is useful on its own, together they add up to more than the sum of the parts. The benefits of bringing the two together include: An improved baseline, which takes risk into account (including incorporation of risk response actions) More robust calculation of risk management budget (Management Reserve) Early identification of risks (threats and opportunities), leading to more proactive management Confidence that agreed risk response actions will be actively managed, because they have been explicitly included within the baseline More robust forecasts (Estimates to Complete) that include a view of risk In addition, for management, these benefits support a better appreciation of the significance of variance with regard to risk appetite and the challenge incorporated into the baseline. It also streamlines the governance of change involving identified risk and risk responses. This white paper goes through the steps required to implement Risk and Earned Value side by side, to take advantage of these benefits, improve project control and increase the chances of project success. Establish the baseline For a project to be successful, it will need to start with a realistic baseline. This requires the scope to be clearly defined, the associated work scheduled and budgets set. This is done in 3 stages: Adding an allowance first for uncertainty, then for known risk and finally for unknown (or emergent) risk. Adjusting the baseline based on uncertainty and risk appetite We start with identifying a time-phased budget for the known scope as planned in the schedule. (This might typically look like Figure 1). However, a risk analyst would want to consider optimistic or pessimistic scenarios when estimating the work, based on future uncertainties. They would do cost and schedule risk analysis, which results in a range of values instead of a fixed completion date and budget (this envelope of uncertainty is shown as a red box in Figure 2). 2 www.riskdecisions.com risk decisions 2

whitepaper Val Jonas and Lauren Bone: Interfacing Earned Value and Risk Management Figure 1. Typical Earned Value baseline The optimistic and pessimistic scenarios should be examined in order to extract any significant threats or opportunities that should be tracked and managed proactively via a risk register. Now, Earned Value must measure progress against a specific target and not a range. Therefore the envelope of uncertainty is used to decide where to set the baseline, based on your risk appetite. If you are confident that you can deliver against a challenging timescale and budget, then you should set an aggressive baseline closer to the line. In this optimistic case, we may expect variances to arise more often and be of greater magnitude as the control system warns us that the optimistic scenario has not been achieved. On the other hand, if we take a risk averse attitude and approve the pessimistic baseline, we should be very worried if we experience even minor variance, as this would indicate we are not even managing to achieve a worst case' scenario, with very little opportunity to redress the situation. In this case the ability of the system to provide us with an early management warning has been greatly diminished. 211 2 2 2 2 2 2 213 213 213 Pessimistic 211 2 2 2 2 2 2 213 213 213 Figure 2. Using optimistic and pessimistic analysis to generate an envelope of uncertainty Typically, the baseline will be set at neither of the pessimistic or optimistic extremes, but instead will be set somewhere in the middle as shown in Figure 3. The reasons for choosing one baseline over another are many and varied, often more to do with politics and behaviour than good project management practice. Wherever the baseline is set, the management interpretation of variance must be based on an understanding of whether we have softened the system. Note: Your project contracting and delivery mechanism may also affect how aggressively you set your baseline. For example, you may decide to set an aggressive deadline and offer a bonus incentive if your contractor achieves the deadline. This baseline against which Earned Value metrics will be assessed (representing agreed work to be executed, with a target schedule and budget) is referred to as the, shown in Figure 3. Figure 3. Risk adjusted baseline (uncertainty) Pessimistic 211 2 2 2 2 2 2 213 213 213 In this first stage, Risk Management has helped make the Earned Value baseline more robust and set an expectation for what level of variances might arise. Allowing for known risk in the baseline We now turn to a different type of work and expenditure the kind that arises from future uncertain scenarios and risk events that are not covered in the scheduled baseline. An amount of budget and time needs to be set aside for known risk, a stated set of events or future scenarios which will affect your ability to deliver the project scope, for which likelihood and impact information has been evaluated. For example, this could be an analysed risk for the requirement of re-work to achieve agreed quality; or it may be that you need to execute a second trial because the original one failed to prove a requirement. Both of these examples would be regarded as in-scope risks; whereas, additional design that results in increased functionality not included in the original scope would not be allowable. A statement of known risk is established and (usually) recorded in a risk register, initially without risk responses. A preliminary risk budget is calculated, based on an overall analysis of the probability and impacts of all known risks. This is shown as the yellow band in Figure 4. Cost-effective risk response actions now need to be identified, and the ones that are approved are then transferred into the Earned Value baseline. Note that transfer of work (risk response action) into the baseline results in an increase in the baseline scope and budget, shown by the red arrow in Figure 4. This is normally accompanied by a risk decisions 2 www.riskdecisions.com 3

Val Jonas and Lauren Bone: Interfacing Earned Value and Risk Management 211 2 2 2 2 2 2 213 213 213 Figure 4. Risk adjusted baseline part 2: adding risk response actions to the baseline reduction in residual risk, shown by the green arrow in Figure 4. By including the agreed risk response actions in the baseline, the Earned Value process will ensure that these actions are managed alongside the original scope. On-going management of these included actions as part of the risk discipline should be used to ensure that any schedule delay does not undermine the effectiveness of the action, for example, because it fails to mitigate the risk in a timely manner. So far, we have only considered budget, but we also need to ensure the extra work is incorporated into the schedule, which may result in extending project timescales. A more realistic view of the baseline is shown in Figure 5, which includes a provision for schedule risk in addition to the provision for the risk budget. Drawdown risk budget: Transfer work and budget in to the PMB 211 2 2 2 2 2 2 213 213 213 Figure 5. with risk provision for both budget and schedule Note: Budget risk provision is often calculated as an expected value of risk (the simplest mechanism for calculating this is by summing the risks impacts weighted by each of their probability values). The provision for schedule cannot be calculated in such a simplistic way, as activities incorporated into the schedule will only impact on overall timescales if they are on the schedule s critical path. One way of recognising that risks are likely to arise and impact the schedule delivery is to set milestone target or promise dates. This technique incorporates an element of schedule reserve immediately after the dates indicated by the, without altering the baseline dates against which performance will be measured. This introduces a 'buffer' between the milestone promise dates (which may be contractual) and the baseline target dates. Schedule Buffers Milestone Promise Dates 211 2 2 2 2 2 2 213 213 213 Figure 6. Schedule reserve inserted as buffers on milestone promise dates Once the budget and schedule provision for known risk is agreed, project governance will need to establish the mechanism by which this budget (both cost and schedule) can be drawn down. As long as a sufficiently robust risk process is in place to approve risk response actions, there is no reason why, subject to appropriate audit, this budget should require any higher level sign off than the project manager. Allowing for unknown (emergent) risk in the baseline While every endeavour should be made to identify known risks when setting the baseline, it will not be possible to foresee everything that may occur. Therefore, you will need to make an allowance for unknown risk, to cover things that emerge during project execution. The amount of provision you set aside must not be pure guesswork; instead, there are various methods you should employ to come to an acceptable and justifiable level of provision. Methods you might consider using include: expert opinion on current maturity of project definition the level of budget and schedule buffer required to satisfy your organisation s risk appetite consideration of previous out-turns for projects of this type The combination of the budget determined for known risk and that for emergent risk is callled the Management Reserve in Earned Value terminology. This is made up of both the yellow and grey areas shown in Figure 7. As new risk emerges, and is identified into the risk register, budget set aside for emergent risk will be drawn down into the provision for known risk. The risk will then be treated as any other known risk, including identifying response actions, with further transfer of budget into the baseline to cover the associated work as appropriate. Whereas it was suggested above that the draw down against provision for known risks can be managed within the project, it is possible that approval of budget for emergent risk may need to be the remit of the 4 www.riskdecisions.com risk decisions 2

whitepaper Val Jonas and Lauren Bone: Interfacing Earned Value and Risk Management project sponsor, at a higher level than the project itself. This is to ensure the right level of monitoring of unforeseen activities, partly to consider whether the project will still meet its overall completion targets, but also to avoid the temptation to use this grey area of budget to add unauthorised scope. This budget, combining the known work, known risks and emergent risks, provides a complete picture of the baseline budget, or Budget at Completion for the project. This may not be the same amount as the total project target cost; for example, if the project is to be delivered by an external contractor, then the final cost may also include a margin for profit. We do not cover any such extra costs in this white paper. Change Management Provision for emergent risks 211 2 2 2 2 2 2 213 213 213 Figure 7. Addition of provision for emergent risks Although setting a realistic baseline is fundamental to the success of any project, keeping the project under control as it progresses is equally important. This is where a sound Earned Value system plays a very significant role, by being a major enabler of project control. Earned Value not only measures actual performance against the baseline of agreed work, but by quantifying variance to that baseline it also provides information to plan corrective action as necessary. At the same time, risk management seeks to manage the inevitable changes that a project will experience. Risk management does this in two ways (a) Using proactive risk response actions to prevent or minimise the impact of risks (b) Using reactive risk response actions to recover as quickly as possible from risks that happen New risk response actions approved for inclusion in the, utilise risk budget drawn down from known risk provision to budget for the additional work. Variances recorded through Earned Value monitoring occur in the main due to error in the estimates of work (value or time), whether this was original work or work added to respond to risks. Budget at completion Improved Estimates to Complete Although variances are a key indicator of progress and a measure of what volume of corrective action is required to get back on track, the periodic generation of an Estimates to Complete (ETC) is the mechanism by which management will get the complete picture of likely project outcome. Forecasts of Estimates to Complete using Earned Value data provide an understanding of the likely cost and schedule out-turn of the project based on performance so far. By including the impact of risk on the Estimate to Complete you will have a much more thorough assessment of the likely outturn of your project. The Estimate to Complete will provide a basis for confidence (or not!) in achieving the desired results. Having this level of robust forecast information from both disciplines enables you to make better decisions to: implement corrective actions to address performance issues; proactively take significant risks or opportunities; authorise pro-active strategies for dealing with significant risks; target budget and management attention on those areas that need it most and so on. Any bottom up Estimate to Complete should consider the same steps adopted in generation of the original baseline: this exercise must include not only a forecast against allocated work, but also forecasts for identified and emergent risk; it should also adopt the same risk appetite to enable effective comparison of the Estimate at Completion to the original budget. Conclusions Sound risk management process and robust earned value management application each offer the opportunity to improve project control and provide the project manager with reliable information on which to base proactive management decisions. All too often the disciplines are practiced in isolation with focus on the mechanisms rather than the management value. They can compete with each other for resource and project management attention, rather than leveraging the advantages each has to offer. Instead, it should be recognised that they complement each other and deliver more holistic project management. Implementing Risk and Earned Value together delivers more effective project control than each discipline being executed separately. Together they provide mechanisms for: improving the soundness of the by considering uncertainty and risk appetite; focussing attention on addressing what risk response actions should be included in the project from the outset; controlling change, particularly the change required for inclusion of effective risk responses; facilitating timely change by introducing the potential to pre-approve potential risk responses to known risks; ensuring all approved work is effectively performance monitored in the same system and providing an effective reporting drum beat for the re-assessment of risk and risk responses in line with performance reporting; and improving confidence in Estimates to Complete. Ultimately this facilitates project management and achieves improved project out-turns in terms of cost, schedule and quality. risk decisions 2 www.riskdecisions.com 5

Val Jonas and Lauren Bone: Interfacing Earned Value and Risk Management Bibliography Association for Project Management 28 Interfacing Risk and Earned Value management, APM publishing, High Wycombe, Bucks, UK; ISBN-1: 1-93494- -9 Jonas, V. and Welch, A (22) The integration of Risk and Earned Value Management, Proceedings of the 1st UK International management Symposium, presented in Bristol, UK, 3 October 22 Jonas, V and Welch, A (23) Risk and EVM: An Integrated Approach to handling Management Reserve, Proceedings of the 2nd UK International Management Symposium, presented in London, UK, 9 October 23 For further information visit: www.riskdecisions.com or contact Sandra Cohen at: Risk Decisions Ltd, Whichford House, Parkway Court, Oxford Business Park South, Oxford, O4 2JY Tel: 1865 718666 Email: sandra.cohen@riskdecisions.com European HQ For enquiries from the UK and mainland Europe. Risk Decisions Ltd Whichford House Parkway Court Oxford Business Park South Oxford O4 2JY United Kingdom For general enquiries: Tel: +44 ()1865 718666 Fax: +44 ()1865 718 Email: enquiries@riskdecisions.com For help desk support: Tel: +44 ()1865 395698 Fax: +44 ()1865 718 Email: support@riskdecisions.com www.riskdecisions.com management solutions