The Project Risk Maturity Model

More documents

Recommendations

Info

T h e P r o j e c t R i s k M a t u r i t y M o d e l 11 the case. This was despite these organisations having externally audited risk management processes. In the case of one UK bank, it is alleged that the corporate risk manager lost their job after bringing management’s attention to the unacceptably high risk associated with its aggressive sales strategy for mortgages. It is further alleged that their post was then filled by a sales manager! If allegations such as these are true, they demonstrate how a poor risk management culture can fundamentally undermine a risk management process. Examples of the Project Risk Maturity Model in Practice The following two examples are based on Project RMM assessments of real projects. They are designed to illustrate what different levels of RMM maturity look and feel like in practice. The first example (Project A) describes the case of a large civil construction engineering project that had a Level 3 risk management capability. For the project in question, this was sufficient to ensure that it achieved all its objectives. In contrast, Project B was a project that continuously underperformed against its objectives. It has been selected as a typical example of a project with a Level 1 risk management capability. Chapter 3 provides a third example (see pp. 38–59), by describing a project that achieves RMM Level 4. Comparing it to Project A illustrates the difference between RMM Level 3 and Level 4. Whereas Project A applied the risk management process after setting its objectives, the project in Chapter 3 uses risk management to shape the project solution. Project A – An Example of Level 3 Risk Management Capability Project A was a major renewal project on a manufacturing plant in the steel industry. Whilst the facility in question was out of commission, a number of the company’s other production functions also had to be put on standby. The project timescale was therefore critical to both the company’s turnover and its reputation with customers for timely delivery. The RMM output shown in Figure 1.5 reveals a fairly even capability across the six perspectives and confirms that the project team was making good use of formal risk management practices. Risk identification and assessment produced a risk register of about 80 risks. Mapping these to a Probability-Impact Matrix (PIM) produced a reasonable priority order. A risk interviewing process led by a part-time risk manager ensured that each of these risks was reviewed on a regular basis. In addition, the top 30 risks were also reviewed at monthly project meetings, a procedure that allowed the project manager to intervene if the implementation of risk responses was inadequate. The effectiveness of this process was fostered by a good risk management culture. There was a high level of mutual respect amongst the team members that prompted constructive debate about potential difficulties. This openness of communication also extended to the project sponsor. The approach of keeping a risk register is common practice in project risk management. Many projects do no more than this; some very simple projects don’t need to. However, in the case of Project A, schedule performance was a key concern. The plant outage was scheduled for 70 days. Accordingly, a Monte Carlo schedule risk analysis was performed for the process of stripping down the old plant and then renewing it.
12 T h e P r o j e c t R i s k M a t u r i t y M o d e l 100% Level 4 75% Level 3 50% Level 2 25% Level 1 Stakeholders Risk Risk Risk Project Culture Identification Analysis Responses Management Figure 1.5 Project RMM assessment results for Project A An early pass of this analysis suggested a probable schedule slip of 5–15 days. Lessons learned from this analysis were then used to introduce planning improvements and additional risk mitigation. Two further passes of this analysis were undertaken, after which the plan was considered to be sufficiently robust. This was an excellent example of how a schedule risk analysis should be used; the process enabled the team to rehearse the project delivery and understand how best to respond to events that could arise. During a post-project lessons learned exercise, risk management was identified as having been a major factor that enabled the project to meet its objectives. Given the success of risk management on Project A, one could ask whether or not the Project RMM assessment should have been Level 4 rather than Level 3. The answer is that this is an example of the fact that, sometimes, a Level 3 project risk management capability is sufficient to achieve an organisation’s objectives. Although Project A was large (approximately £50M), it was not particularly complex. As an internal project, it also had simple relationships with its stakeholders. Moreover, a project of this type was not new to the company concerned; it owned similar production plants and the same plant had been renewed 13 years previously. Finally, there were no incentives for members of the project team to make biased risk estimates. The sponsor had made a shrewd estimate of where to set objectives that were challenging, yet realistic and the project team knew that they would be judged by results, not forecasts. The main reason for the risk management process falling short of Level 4 capability is that it had only a limited effect on the project strategy. For example, the schedule and cost objectives were set prior to the introduction of risk management. There was also no risk-based evidence that the project could live within its budget. For the company that sponsored Project A, these were minor issues. On more complex projects or when estimating bias or when conflicts of interest are potential causes of difficulty, a project RMM less than Level 4 would be more of a concern.
Page 1 and 2: The Project Risk Maturity Model Mea
Page 3 and 4: T h e P r o j e c t R i s k M a t u
Page 9: 10 T h e P r o j e c t R i s k M a
Page 13 and 14: 14 T h e P r o j e c t R i s k M a

The Project Risk Maturity Model

Create successful ePaper yourself

Delete template?

Save as template?