Making a Party out of Project Management: Chapter 3 - Figuring Out the Details - Part 2 of 4

               The thought of the requirement to get the meat hot enough to be safe to eat stuck out in Abby’s mind as a definite risk to everyone’s safety, and it would really ruin the party if not successfully prevented. That would be a terrible way to remember Nathan’s 10^th birthday. Just the thought of it jolted Abby with a split second of fright.

               “This would be devastating to Nathan’s party…I need to make sure this doesn’t happen and also try to think ahead to anything else that could cause big problems.”

               Abby wanted to make sure that she and her friends would identify as many major risks as possible, as well as to find a way to deal with each one that they could. How might they go about this? Just like in other major parts of the project, Abby needed to figure out how she would do this part before she actually started working on it. What Abby needed was to create a risk management plan, which would help her to have a consistent way to identify and respond to risks that threatened the party’s success.

For the people dimension of risk, Abby reviewed her list of all the stakeholder groups involved with the party, including her project team. What were risks that each group faced, and what risks could each group pose to the party? Could the boys end up playing a little too close to the picnic tables and accidentally land a football in the potato salad five minutes before lunch was to start? Or knock a glass of punch off of a table and onto grandma’s dress? While not ready to focus on identifying as many risks as possible yet, a few ideas like this did start to enter Abby’s mind.

In addition to brainstorming with her friends, Abby knew her parents would be able to provide expert judgment based on their years of life experience and having thrown many of their own parties in the past. They could also review risk response ideas that Abby and her friends thought of and offer alternatives if they thought it would be worth mentioning. One thing Abby’s Dad recommended was to review the WBS and try to think of risks that could exist for each item on that.

               Abby gathered her friends together to discuss possible risks that the party had. She shared the project plans that they had developed so far, as many of them would be worth reviewing for not only identifying risks, but also noting limitations to how they could respond to those risks. They couldn’t spend infinite amounts of money and they only had a handful of days left until the party – those were two obvious limits. Also, they couldn’t work round the clock or obsess with everything being perfect. It would be a matter of optimizing between reducing risk and not working harder than it was worth. Once again, Abby had to use cost-benefit analysis, now to determine the best way to manage project risk.

But first, Abby decided that they should focus on just identifying risks; coming up with the solutions would be done after identifying those risks and analyzing them to determine which ones were most important. Together, she and her friends engaged in techniques also used in requirements gathering – brainstorming and the Delphi technique. They also tried to engage in some root cause analysis, examining specific risks as potential problems and looking for ways to prevent the problems from happening by addressing what would cause them. For example, they agreed they could have a real bee problem in the food line if a bunch of drinks and desserts were sitting out uncovered for very long. Why? Because the bees would be attracted to the smell of the sugar in those items. So, they noted this risk and decided they could address its root cause by putting plastic wrap over the containers.

               After some time of thinking through the planned events and the risks that could come from them, Abby and her team had a good starting list of risks to consider. Initial thoughts about risk responses were also recorded, though it wasn’t yet time to come up with detailed solutions. The result of this work was a document called the risk register, which recorded not only the risks but key features of each risk that would come in handy for the upcoming risk analysis. At this point, the stage was set for Abby and her team to size up the risks and deal with the most important ones.

Template for Abby’s risk register.

Abby’s risk register with risks identified and about to be analyzed.

               Now that Abby and her team had created an initial list of risks in the risk register, and they had noted certain attributes of each risk, it was time to review the risks as a whole and perform some analysis to figure out which ones deserved the earliest or closest attention. Could some risks be best mitigated by doing something now to prevent them or make them less likely to be realized? Would some risks become very problematic issues [11] if not addressed promptly or by a specific deadline? Are there any risks that can simply be accepted, as they aren’t very likely to happen and if they do, there won’t be much consequence? Qualitative risk analysis is the process of finding answers to questions like these, prioritizing the biggest risks and helping the team to manage them efficiently.

[11] An issue is a risk that has occurred; a risk might happen, and an issue has happened. There is a risk that you might fail a test if you don’t study for it ahead of time; that risk becomes an issue if you didn’t study and now you’ve failed the test.

               So, Abby and her team began analyzing the project risks that they identified and determining what they might do about them. They had a framework for how to respond to risks from the risk management plan, and they had a concrete list of risks to respond to. There would be different options for addressing each risk, and some options would be more suitable for a given risk than others. Since most of the risks were negative in nature, the team focused on risk response strategies used for those:

-        Avoid: Taking preventative action to keep a risk from happening, like holding the party inside to prevent some rain from spoiling the party.

-        Transfer: Hiring someone else to manage a risk and deal with it if it happens, like hiring a party shop to provide, set up and operate a bouncy castle, and promptly fixing air leaks if any are found.

-        Mitigate: Taking action to make a risk less likely or less consequential, although not entirely preventing it from being able to happen, like measuring food temperatures to reduce the risk of the food making anyone sick.

-        Accept: Doing nothing about the risk and hoping it doesn’t happen, like holding the party outside when it may or may not rain.

First, Abby and her friends reviewed each risk item and decided which of these four options to choose. Most risks they thought of really weren’t that big of a deal, so they decided to accept a majority of the risks and were comfortable with many of them happening. There was one risk they decided to accept even though it was significant, and that was holding the party in the park. Abby knew that Nathan loved having his birthday parties outdoors, and the benefit of him enjoying being outside outweighed the potential cost of holding the party at the park on a rainy day. She decided that they needed to do something about the other significant risks, though.

               Specific inputs help to provide context for analyzing the project’s risks. The risk management plan told Abby what information to include about each risk in the risk register, helping her to adequately define and categorize the risks as they were identified and added to the register. Another input is the project scope; knowing what will be done on a project and the context in which it is done allows the project team to better predict risks that could become issues or events that hamper the project’s success. Contextual (enterprise environmental) factors can also present risks, like rain impacting game options for the party.

               Abby’s mom stopped by the table for a moment to see if anyone needed anything, and to see how things were going. They told her about all that they were thinking about to keep risks from ruining the party.

               “That’s great that you thought of all that together. I can’t think of any additional risks off the top of my head that you should add,” said Abby’s mom. “There are a few things you should do before you call this done, though.”

               “Sure, Mom. What else do you think we should think about?”

               “Well, the first thing is to make sure you have good quality, relevant data for the risks you analyze. That’s great that you’ve got the weather forecast and checked a few years back to see what the weather was like at this time of year. If you were looking ten or twenty years back, that weather data probably wouldn’t help you predict the next week’s weather as well.”

               In the world of project management, this practice recommended by Abby’s mom can be called a risk data quality assessment.

               “I see that you have the risks organized by what part of the WBS they impact – that’s great!” she continued. “I was just about to recommend you do a risk categorization of some kind and then I saw that. Another way that is sometimes helpful is to organize risks by their root cause; then you know that by addressing the root cause, you’re preventing multiple risks from happening.”

               Abby’s mom pored over the list some more, “I’m glad to see you’ve done a risk urgency assessment to determine how time-sensitive it is to deal with each risk. Some risks have to be taken care of by tomorrow if you don’t want them to mess up the party, like ensuring you have the pavilion rental form and fee turned in to the city parks office on time. Great job there!”

               Like in many other parts of the project, expert judgment was important for helping Abby and her friends to size up the risks that the party faced. They used expert sources of information like the local health department’s website to confirm proper cooking temperatures for the foods, as well as their local news station’s weather forecast to assess the rain risk, instead of just guessing about these things. For example, they could have decided that the burgers would be done when their juices turn clear, but then they would feel terrible about anyone getting sick. So, they relied on the health department as an expert source and followed their recommendation to verify the temperature of the cooked food with a food thermometer. Referring to expert recommendations like this to ensure the appropriate quality standards are used to evaluate project work is called performing quality assurance. If someone were to ask Abby why her dad needed to cook the meat to 165° F, she could explain that she got that standard from knowledgeable experts at the local health department; it wasn’t just an arbitrarily chosen number.

               Going line by line through their risk register, Abby and her friends gave their best guesses about how likely a risk was to occur, and how much impact it would have on the party. Some risks they could research, like looking at historical weather records and the near-term forecast to decide the percent chance of rain. They assessed the impact of this risk as high; it would restrict the games that could be played and would cool the air enough that guests might get cold. Together, they spent an hour or so assessing the items and deciding which risks were worth still worrying about. Some, like the risk that the oven would stop working when Mom needed to bake the cake, were remote enough that they decided not to worry about it (they accepted the risk), especially when they could ask a neighbor for help if that did happen. It’s important to note that when a risk is accepted because it is considered minor, that should still be documented in the risk register for future reference, especially if that risk could become more threatening to project success later.

               Abby took a few minutes on her tablet to make a chart with the risk assessment they had just completed. Doing this made clear which risks would be most likely and problematic, thus focusing Abby and her friends on the biggest threats to the party. This chart is known as a probability and impact matrix. If it was forecasted to start raining during the party, that risk would have a fairly high likelihood (or probability) of happening, and it would of course have a high impact on the party, being outdoors at the park. A risk like this, with a high chance of occurring and high impact to the success of the project, is a top priority risk that requires very close monitoring and very thoughtful and effective risk response. Abby would be very smart to come up with a good plan for getting everything under cover ahead of time, instead of waiting until the rain started falling to figure out what to do.

Risk probability and impact matrix.

               In the course of identifying everything that could go wrong with the project, Abby and her friends also realized there were positive risks (sometimes called opportunities), which were things that might or might not happen but would be good for the project if they did. Strong winds would be problematic for blowing people’s plates and other items around, but a gentle breeze would be great for keeping the mosquitoes from biting the party guests. So, Abby and her friends noted that the right amount of wind could actually be helpful to a successful party, and that the occurrence of wind wasn’t inherently bad.

               There are four main strategies for maximizing positive risks on a project as well, and one of them (accepting the risk) is also one of the strategies for negative risks. While Abby and her friends accepted the positive breeze risk, here are ways they could have used the other three positive risk strategies, just for illustration:

-        Exploit: Abby and her friends could set up a few box fans along one side of the pavilion to ensure a steady breeze through it.

-        Enhance: Abby and her friends could set up a wind tunnel of tarps to make it more likely that the pavilion would receive a steady breeze during the party.

-        Share: They could have made a deal with the vendor that if he helped to set up the wind tunnel of tarps, he could go through the food line and take a break from his work to eat.

-        Accept: Doing nothing about the risk of a breeze and hoping it does happen, providing the party guests with a gentle and pleasant breeze while they eat.

               At the end of the qualitative risk analysis, Abby made a reminder to review the status of any high risks facing the project every day, and to check for any new high risks. That way, anything not going the right way could be dealt with before it became a huge problem. After all, Abby’s parents warned her in their discussion at the beginning of the project that it’s a lot easier to address risks as soon as they emerge instead of having to take drastic action at the last minute when the risks turn into issues.

Abby’s risk register with risk attributes filled in.

               To further prepare for the most important risks of the project, and to help Abby and her friends gauge the size of those risks, they needed to perform quantitative risk analysis. This would help them with planning risk responses, as they would have a better idea of how much money a risk could cost if realized, or when a risk would start to become an issue with an unacceptably high impact on the party. Performing quantitative risk analysis would require some of the same inputs as qualitative risk analysis (risk management plan, risk register, EEFs and OPAs), but would focus more on schedule and cost than the scope of the project; how much money will risk management likely cost, and how much time could be lost to a realized risk? Quantifying risks would come in handy soon when it would be time for Abby to put together the project schedule and the budget.

               As a starting point, Abby and her friends reviewed the risks that were the furthest to the upper right on their risk probability and impact matrix (presented earlier but also shown below for reference). They decided that three of these risks had quantifiable impacts; weather and food safety were really important to the party’s success, but it was hard to determine a monetary or schedule cost associated with those risks.

Risk probability and impact matrix with three quantifiable risks singled out for analysis.

               Abby and her friends reviewed the main risks from qualitative analysis to estimate the contingency reserve they should have for the project; this is an amount of money that should be budgeted on top of confirmed project costs, to fund various risk responses that might be needed during a project. Being aware of the risks but unable to pinpoint how much they would cost the project in total beforehand, these quantified risks were Abby’s known-unknowns. Costs for each quantified risk were estimated by noting the probability of the risk on the probability and impact matrix and multiplying that by the cost of that risk if it were to be realized. Some risks would happen and some wouldn’t, so the overall pool of money should be enough, or at least close to enough to fund any risk responses that end up being needed.

Quantified risk-impact spreadsheet with computation of contingency reserve for the three risks.

Abby felt reassured after they had figured out what to do about each of these risks. Sure, there might be more risks that could pop up, but at least now there was a very good chance that the party would go smoothly. In addition to deciding what to do about the negative risks, there was the positive risk mentioned earlier that could be used to the party’s advantage: if there was a slight breeze that wasn’t too strong, it could actually be nice to have enough wind to keep the bugs from bothering everyone while they were eating!

               As a result of all this risk analysis, Abby and her friends felt like they had a pretty good idea of what risks to keep track of for the time being. They recognized that they would need to review the risk register every day to ensure the big risks weren’t becoming issues and the small risks weren’t becoming big risks, but at least now they had specific things to focus on. Qualitative risk analysis helped them to make a smarter guess about how likely and consequential certain risks probably would be, and quantitative risk analysis helped to estimate how much money to budget for offsetting certain risks. It was also clearer how to manage risks through a step-by-step series of actions, starting with what responses Abby and her friends would need to take right away.

To wrap up risk assessments and planning for the time being, Abby went through her main project plans that she had so far and updated them based on what she and her friends were going to do about the project risks. She made notes in the schedule for any time-sensitive risks and identified how the big risks could affect stakeholders. Once all her project documentation was updated with the project’s risks and planned responses, she moved on to the next phase of planning.

Next post in the series: Making a Party out of Project Management: Chapter 3 - Figuring Out the Details - Part 3 of 4