CONF. 404- Effective risk management and avoiding project disasters. A pragmatic approach.
2 likes1,896 views
The subcontractor's subject matter experts may not be available when needed or their work may not meet expectations. Mitigation Actions: - Define clear roles and responsibilities for subcontractor in SOW - Include penalty clauses for non-performance - Require resumes of key personnel and approve in advance - Establish regular check-ins with subcontractor to review progress - Maintain list of backup subcontractor resources Risk Category: Schedule • Aggressive timeline increases risk of delays Mitigation Actions: - Add schedule contingency/float - Break work into phases with checkpoints - Overstaff critical activities - Identify and prioritize critical path activities - Establish escalation process
CONF. 404- Effective risk management and avoiding project disasters. A pragmatic approach.
- 1. Effective Risk November 7, 2012 Management – A Pragmatic Approach to Avoiding Project Disasters Presented by Jane Davison, VP CGI © CGI GROUP INC. All rights reserved _experience the commitment TM Agenda • Introduction • Risk Management - Defined • Risk Management - in Practice • Risk Management - the Process • Risk Management - Examples • Risk/Contingency Relationship • In Summary • Questions 2 “” 1
- 2. Introduction • Jane Davison, Vice President Engagement Assessment Services • Since 2009, responsible for team providing risk assessments & oversight of delivery for strategic projects & major outsourcing contracts within Canada • Over 30 years’ consulting experience in the IT sector • Achieved CMC designation in 1999; FCMC in 2008 Today, we will review how CGI has implemented the theory of Risk Management 3 Confidntial CGI’s Health Check Process Benefits • Based on CGI’s experience • A pragmatic approach to risk management using the techniques we will review today has allowed CGI to reduce: • The number of project failures • Cost overruns • Schedule delays • Management time spent dealing with project failures • Benefits realized include: • Increased quality • Increased customer satisfaction • Increased member satisfaction 4 Confidential 2
- 3. Risk Management - Defined Confidential The Importance of Risk Management “Any threat to the achievement of one of the primary objectives of the project” • All projects face threats to their success • To achieve success we must recognize and actively manage risk 6 Confidential 3
- 4. Keys to Successful Risk Management • Identify and manage risks before they become issues – avoid surprises! • Include all stakeholders (including the client) to ensure all resources can be brought to bear on risks • Maintain a proper risk log throughout the opportunity/project life cycle • Ensures continuity – nothing falls between the cracks • Key document for ensuring Quality Hand-Offs across life-cycle stages • Be disciplined around reviewing risks in every applicable meeting • Clearly identify responsibilities for all Risk Management activities • Keep Risk Management activities visible internally & externally • Ensure clear and safe escalation triggers Effective Risk Management significantly increases the probability for project success 7 Confidential Ensure Proper Escalation of Risks • All risks must be visible to the Client Your appropriate level in a timely Organization’s Organization’s manner Chain of command Chain of command • Escalation should only be utilized if normal communication channels have not addressed Risk Mgt Owner risk mitigation steps BD Leader, Proposal Leader, Contract Leader, • It is Management’s responsibility Project Manager to provide a safe escalation environment Project Team Members and Subcontractors Addresses issues Escalates (if persists and no resolution) 8 Confidential 4
- 5. Definitions RISK Project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on a project’s objective RISK MANAGEMENT Approach by which uncertainty can be understood, assessed and managed within projects A PRAGMATIST’S DEFINITION OF RISK There are things that might go wrong and, when they do, we better have a plan in place to deal with them 9 Confidential Risk Management - in Practice Confidential 5
- 6. Things that can go wrong • No clear scope baseline • Change not managed • Inappropriate original estimates & missed costs • Failure to re-estimate and re-plan • Insufficient project management resources • Inadequate communication • Inadequate or inappropriate staffing • Failure to manage subcontractors • Subcontractor inability to deliver • Failure to manage client involvement, expectations • Lack of, or inappropriate, technical architecture • Unclear decision-making process “How do projects get to be a year late?... One day at a time.” Fred Brooks, The Mythical Man Month 11 Confidential Managing Risk Through the Life of a Project Risk Management is a Continual, disciplined, and Visible process. Unknown, Identified Opportunity Dev Potential Risks Managing Meeting of the Minds Managing Risks Early Proposal Risk Management identifies, reduces to an acceptable level, and mitigates Risk over a Contract period of time. Delivery - Start-Up Manageable Risks 12 Confidential 6
- 7. The Importance of Early Risk Management Narrowing of Options Increase of Costs as time passes to Mitigate Risk If risk is not addressed, the costs to mitigate and resolve increase over time, while options decrease. As each decision point passes, options are reduced. We need to maximize the desirable quality of outcomes at each phase. Opportunity Proposal Contract Delivery Start-Up Delivery Execution End of Contract Development Project Life Cycle Risk Management Owners Opp Mgr => Proposal Mgr => Contract Mgr =>………………Project Manager……………………… Warm hand-off of assumptions & risks 13 Confidential Example – Election Referendum Project Risk Proposal Phase Risk : • To be election-ready at short-notice, we need to train in advance 3,000 electoral staff on the data entry application, who may not be available to work by the time the election is called Mitigations: • Confirm attrition percentage from previous electoral events with the client, across different Canadian geographies; that is, remote locations vs. towns vs. cities • Train more people than needed to deal with attrition, based on the pre- established attrition percentage • Establish a process & person responsible for monitoring attrition of trained staff, leading up to the Referendum Call • Partner with a Canadian-wide agency to establish a process & persons responsible to identify a pipeline of candidates & fill staffing gaps quickly once the Referendum is called 14 Confidential 7
- 8. The CGI Approach to Risk Management • Risk management on every project • Project manager is responsible for risk management • Start risk management as early as possible • Disciplined approach to risk management • Quality hand-offs between risk owners • Risks are made visible • Involves all stakeholders (including client, 3rd parties) • Utilizes synergy groups • Continually revisited • Leverages lessons learned • Follows CGI’s Risk Management Methodology Risk Management is the responsibility of every member! 15 Confidential Risk Management – Make it an integral part of Project Management • Take an action-oriented focus • All Status Reports should have a designated section for Risks and Issues e.g.: weekly status; monthly status; Steering Committee Agenda • Weekly Status Reports Every team member submits a weekly written status report Reports status against project plan and schedule Designed section for Risks and Issues – What would prevent you from meeting your milestones? – What would prevent our team or our partners from meeting it’s milestones? – What would prevent our client from meeting their milestones? 16 Confidential 8
- 9. Make Risks Visible • Take an action-oriented focus (cont.) • Weekly Status Meetings – Team Level Project Manager to ensure risk visibility Roundtable - Key questions to each team member – Walkthrough your status report • Status Meeting Rollup: From Team to Client Level Project Manager => Engagement Manager Engagement Manager / Project Manager => BU Management Engagement Manager / Project Manager => Client / Steering Committee 17 Confidential Risk Management at CGI – Beyond the Project Level (Health Check Process) • Corporate EAS team provides independent assurance of project performance, through monthly monitoring • Web Health Check Application, plus regular meetings • Principles: value-added, independent, continuous, universal, timely • Clearly defined framework for reporting • Key project risks & issues are reported to Management Committees, plus the Risk and Audit Committee of the Board • Enterprise level risks are managed through the internal Audit Department • Corporate EAS team also promotes pro-active risk management through internal tools • Sharing lessons learned & championing adoption of new methods/tools • Providing workshops & coaching • Initiating in-depth project reviews, with recommended corrective actions 18 Confidential 9
- 10. Risk Management - the Process Confidential Risk Management Cycle Identify, Prioritize & Document Key Risks Report Develop Adjust Mitigations & Mitigations Escalate & Action Plans Monitor & Re-assess Risks 20 Confidential 10
- 11. Develop the Risk Management Plan • Good Risk Management starts with a Risk Management Plan • Defines the process for managing risks on an project • Determines the level, type and visibility of risk management to be applied • Leverages processes, templates, and tools • Attributes of a Successful Risk Management Plan • Involves the right people (including external parties) who should be involved in risk reviews • Addresses client-facing and internal risks • Is an on-going process (monitoring and adjusting) • Updates provided on previous risks & mitigation action plan • Elements of new risks identified through the project life cycle • Includes details of individual risks & associated mitigations • Priorities, impact, action due dates & action owners • Has appropriate visibility internally & externally; reporting and escalation • Is understood and followed by the delivery team and client 21 Confidential Identify Risks • Determine which risks might affect the project • Participants may include team, subject matter experts external to the team, project stakeholders, clients, users • Inputs include (but are not limited to) the following: • Risk management plan • Risks identified in the opportunity phase • Project plan, schedule, and estimates • Resource plan • Assumptions and constraints • Client objectives and business strategies • Output: A list of risks (start of the project risk log) Note: New risks arise throughout the course of a project 22 Confidential 11
- 12. Constructive risk management • Use brainstorming and collaboration • Get input from every key player • Cover every aspect of the project/program • Think through very step of the delivery and ask: what could go wrong? • Whittle down the list to those that would have the greatest impact and brainstorm an effective response • Use outside help when stuck – to get creative ideas • Make sure that the cost plan covers risk responses and/or contingency 23 Confidential Example – Election Referendum Project Risk Proposal Phase Risk : • To be election-ready at short-notice, we need to train in advance 3,000 electoral staff on the data entry application, who may forget their training by the time the election is called Mitigations: • Schedule ten last-minute, web-based training sessions for Returning Office train-the-trainers as a refresher; two for each time zone • Per Returning Office, figure out how many computers need to be equipped for web-based training, and include in technical build specification • Record (voice & video) an early training session and make two copies on DVD for each of the 295 Returning Offices • Adjust the specification for at least two computers per Returning Office to include a DVD player 24 Confidential 12
- 13. Analyze and Evaluate Risks What is the probability the risk will occur? Probability “Highly Likely” Highly likely the risk will occur “Likely” The risk will probably occur “Unlikely” The risk may occur, but it is not likely What is severity (impact) if the risk occurs? Severity “Major” Very significant impact on clients, customers and/or budget, which would prevent achievement of the objective. Significant adjustment required to meet objectives. “Moderate” Viability of project or achievement of objective(s) are threatened. Adjustments required to achieve objectives. “Minor” Minor threat to the efficiency and effectiveness of some aspects of achievement. Little or no adjustments required. * From “Guide to Managing Risk” (Audit & Risk Division), 2006 25 Confidential Prioritize Risks Prioritize risks based on both Probability and Severity to come up with a risk priority Severity Probability “Minor” “Moderate” “Major” “Unlikely” Insignificant Low Medium “Likely” Low Medium High “Highly Likely” Medium High Very High Focus on the most important risks (no more than 10) For example, Very High, High, and selective Mediums 26 Confidential 13
- 14. Develop Mitigations and Action Plans There are several risk mitigation strategies Avoid the risk Reduce the impact of risk e.g. Do not proceed with the activity e.g. develop treatments to reduce which is the source of the risk; consequences should risk occur; (De-scope project) (establish help desk etc). Mitigating Risks Reduce likelihood of risk Share the risk e.g. Develop strategies to reduce the Use combination of e.g. Transfer all or part of risk to third likelihood of the risk event occurring; strategies party; (Ask another agency to (Regular project reviews etc.) as appropriate undertake control of the risk etc.) 27 Confidential Clearly Articulate Mitigations S pecific WHO WHAT M easurable THINK A greed “SMART” R ealistic HOW WHEN T imely - Specific Who has ownership to ensure that the mitigation strategy is executed? What are the specific actions required ? - Measurable How can we measure (track and manage) the mitigation strategy to completion? - Agreed Mitigation strategy must be agreed with relevant parties - Realistic Mitigation strategy must realistic and actionable - Timely By when must the mitigation strategy be executed? Note: Mitigations should be reflected in the project plan and associated costs included in the financial forecast 28 Confidential 14
- 15. Example – Election Referendum Project Risk Proposal Phase Risk : • Electoral staff have problems with the data entry application once it is up and running in the Returning Office (could be technical or application related) Mitigations: • Develop a “Frequently Asked Questions” document • Write a User Manual for the data entry application, and include a trouble- shooting section for reference • Set-up a Help Desk toll-free line for Returning Offices to call • Staff the Help Desk to cover all time zones when Returning Offices are open, with a least two staff knowledgeable in the application • At least two technical staff will be on call during all time zones when Returning Offices are open • Include spare parts in each infrastructure kit for the Returning Office; specifically, two desktops & two cables. 29 Confidential How do you know your Risk Management Process is Effective? • Risk reviews have been built into standard agendas for progress meetings and management meetings • Risks are visible & escalated appropriately • If you asked project team members about the top 3 things that could go wrong, they would show on the risk log • For the top risks, there is time and money allocated for mitigations • Mitigation activities are included in the project plan, and/or contingency money is allocated • Risks are being actively monitored regularly to determine if • Mitigations have been implemented as planned • Mitigations are working (i.e., effective) • Project assumptions are still valid • Risk exposure has changed • Any new risks have arisen 30 Confidential 15
- 16. Risk Management - Examples Confidential Risks and Mitigation Actions – Example Proposal Stage Risk Category: Subcontractor • Critical reliance on subcontractor subject matter experts and solution to deliver Mitigations: • Assign a Project Coordinator to produce a plan for subcontractor work; assign a CGI lead to oversee vendor and to work on vendor site 50% of the time • Prepare a Teaming Agreement to include: • A responsibility matrix tied to the RFP; put vendor’s code in escrow • A statement of sign-off that technology/application will meet the RFP requirements • Tie payment to CGI acceptance of deliverables and ultimate client acceptance • Implement a joint internal steering committee • Include activities to transition vendor’s work to CGI within the first year • Vendor has provided a technical paper to confirm scalability; no infrastructure constraints or commitments in contract 32 Confidential 16
- 17. Risks and Mitigation Actions – Example Proposal Stage Risk Category: Technical • Client has included performance criteria within the scope of the contract, which includes the use of shared production resources (routers; servers; firewall) Mitigations: • Client to provide a test environment within their architecture • Evaluate the need/cost for a separate test environment to validate the raw performance of the new application • Conduct testing baseline with network traffic at a minimum • Conduct baselines of current environment to validate expectations (e.g. current environment may not be capable of supporting the performance without the new application running) 33 Confidential Risks and Mitigation Actions – Example Proposal Stage Risk Category: Global Delivery • We need to conduct project work in a geography that is new to us; we need to be well prepared to avoid risks (schedule/costs) to delivery of the project for the client Mitigations: • Research how to do business in that geography • Brief the project team on local customs • Build in schedule delays for obtaining visas for staff; include visa costs in budget • Include tax requirements/costs to company & individuals in the budget • When staffing, ensure members have time for recommended immunization before going on site; build in schedule delay & costs • Budget for travel costs based on clear assumptions of number of trips, per trip costs & number of team members travelling • Budget for security services based on safety risk; such as, car & driver; kidnapping insurance • Brief the project team on security & safety risks • Identify safe hotels and budget accordingly as part of travel costs • Budget for currency exchange risk over the life of the deal 34 Confidential 17
- 18. Risks and Mitigation Actions – Example Project Delivery Risk Category: Schedule • There is a key dependency on the quality of client’s data for conversion, in order to meet expected conversion quality outcome of 99% accuracy & the go-live date for the application Mitigations: • Conduct a data assessment early on in the project schedule to identify data quality issues • Based on the issues identified, work with the client to identify required clean-up activities • Build a plan for the clean-up activities, identify tasks, method (manual or automated), time line and persons responsible • Identify key milestone checkpoints to ensure work is on track • Report status on data cleanup • Run pilot conversion routines early, so there is time to recover from any surprises 35 Confidential Risk/Contingency Relationship Confidential 18
- 19. How Much is the Right Amount of Contingency? Contingency depends on risk factors of each project There is no one-size fits all • Contingency should address specific anticipated issues or risks which could arise and which can not be avoided, transferred or mitigated with a specific action plan • For each key risk, state in detail its probability, associated financial impact, the activities chosen to mitigate it and any specific contingency amount allocated to it. This way, the size of the overall contingency amount is supported through a factual analysis and can stay visible throughout all phases • Project contingencies should always be identified separately in the schedule and in the budget, not buried at task levels 37 Confidential In Summary Confidential 19
- 20. Develop a Working Risk Management System Challenges Risk Project Activities Mitigated Elements Risks Addressing Early Unmitigated Following Through Risks Are the right people addressing the Did we do a thorough follow- right things at the right time? through until the risk is mitigated? Making Quality Decisions Risks Are the right people at the table? Mitigation Plan Is there a culture of accepting escalation? Did we assess the impact of the decision? The Importance of Early Risk Management 39 Confidential Alignment with PMI Critical Success Factors Recognize Value of Risk Management Integrate Individual with Project Commitment/ Management Responsibility Risk Management Success Scale Risk Effort Open & Honest To Project Communication Organizational Commitment 40 Confidential 20
- 21. Critical Success Factors • Use risks identified in the Proposal Stage to help establish costs & contingency for fixed-price projects • Widen the focus of effort • Instead of looking at risk just from your internal perspective, think about what would reduce risk for both your company & the client • Instead of purely preventative techniques and building a large “list of assumptions”….. • Leverage lessons learned & prior experience; create alternate & creative solutions • Actively manage risks & mitigations; make them visible & start early • No more than 10 key risks for each project • Don’t fall into the trap of filling out templates & reports and forgetting about them because you are too busy • Take risk management seriously & apply discipline • Important to have executive level support in your organization 41 Confidential In Summary • Risk Management is • A pro-active process every project should practice • The responsibility of every team member • Revisited often (at least monthly) • NOT just a list of every risk • Risk Management should • Include the entire team and partners (client and vendors) • Address real risks and plans for handling their occurrence • Broken down by client facing and Your Company internal risks (two separate lists) • Provide strong achievable mitigation strategies (not just closer management) • Be adjusted throughout the project • Take into account the impact to each aspect of the project 42 Confidential 21
- 22. Final Thought • Keep it simple! • There are many sophisticated models and methods available for performing detailed quantitative and qualitative risk analysis, but… There’s no need to be fancy! Just perform basic risk management and you’ll be in a much better position to achieve success 43 Confidential Questions 44 Confidential 22