Most organizations have more project proposals and ideas than they can realistically fund. This means project teams are competing for project approval and funding. Consequently, project champions often conceal or exaggerate the true value of their projects. Teams and organizations typically focus on the up-front costs of a project and the expected return. Other costs are glossed over or ignored entirely, and risk assessment is treated as a perfunctory afterthought. This focus on the up-front costs and the net return is only half of the story, however.

It may be time to stop thinking of risk assessment as the killjoy exercise which drains the enthusiasm from your project and to start thinking of it as a tool for enhancing your project's value.

Understanding the Fundamentals:

A project risk is any problem that could cause some loss or threaten the success of the project1. Risks differ from issues because they refer to the future or to the potential for adverse outcome.

“A risk consists of a condition which is not currently true, the likelihood that the condition will materialize, and a consequence or impact on the project if the condition does materialize."

Risk management is the process of identifying, analyzing, and addressing project risks proactively to maximize positive consequences (opportunities) and minimize negative consequences (losses). Risks are addressed by formulating mitigation plans, which are aimed at reducing the likelihood that the condition will materialize, and contingency plans, which are aimed at addressing the condition when it does materialize.

As mentioned above, the value of a project is determined by its net return and its risks. The net return on the project is equal to the present value of the project minus the costs (return = present value - costs). This return assumes that the project will proceed as planned and budgeted - that is, it assumes a risk-free project. But projects are rarely risk-free. To get a true assessment of the project, the return must be evaluated against the risks.

Applying Risk Management:

Suppose I have a project proposal to unify two corporate databases. I estimate that this will save the organization $100,000 over five years and that it will cost $80,000 to implement. The return is $20,000 without factoring in any risks, but there are risks.

1. Due to some uncertainty in the requirements, there is a 50% likelihood that the development effort will cost an additional $10,000. This comes to a reduction of the return by $5,000 ($10,000 x .50).

2. Although the project team has assurance from sales that the impact upon the sales force will not be substantial, the team believes that there is still a 25% likelihood that upon seeing the changes, sales will require additional training, costing $8,000, thereby reducing the return by $2,000 ($8,000 x 25).

3. Due to some inherent uncertainties regarding the technologies, as well as the direction of the organization and some anticipated acquisitions, there is a 10% likelihood that the entire project will fail or be superseded by other efforts. This means a reduction of the return by $8,000 ($80,000 in overall project costs x .10).

When all risks are factored, the reduction on the return is $5,000 + $2,000 + $8,000 or $15,000. The return is now $20,000 - $15,000 or $5,000, making the project substantially less attractive than it originally appeared. But by managing the risks, the value of this project can be increased to a level that again makes it attractive.

1. First, the requirements could be tightened by first developing a proof-of-concept or simply

by delaying the project until the uncertainties can be eliminated. By taking this approach, the

value of the project can be increased by eliminating the $5,000 reduction for the risk of uncertainty.

2. A proof-of-concept could also be evaluated by the sales force to ensure that they will not

need training, as feared, thereby eliminating the second risk and increasing the project's

value by an additional $2,000.

3. Finally, although external uncertainties cannot be eliminated, mitigation and contingency

plans can be put in place to reduce the overall impact on the project's value. For example,

instead of structuring the project as an all-or-nothing proposition, perhaps it can be

implemented so that parts or stages of it can be adapted to many different environments.

Perhaps the data structures and encoding can be separated from the database implementation

so that if organizational changes arise that undermine the implementation, the data structures can

still be used in the implementation ultimately adopted by the organization. If a third of the work can

be salvaged, the value of the project is increased by $2,640 ($8,000 x .33).

This brings the total increase in return as a result of risk management to $9,640.

After risk management, the value of the project is $14,640 ($5,000 return after risk assessment

+ total increase in return after risk management).

Conclusion:

The true value of a project cannot be evaluated without being realistic about the costs of the undertaking, including the risks. Risks that are simply acknowledged and built into the costs will always lessen the value of a project, motivating project managers to report overly optimistic outlooks, which undermines the very reason for considering risks. But if risks are actively managed by meeting them head-on, formulating mitigation and contingency plans and treating risk management as an ongoing process, risks can be minimized. As a result, project values can be increased, and organizations will get a more accurate and consistent understanding of project values.

About Ralph Dandrea:

Ralph Dandrea is the President of ITX Corp., and leads its Business Performance practice. He is experienced in business and information technology management and holds graduate degrees in business and law.

1 http://www.processimpact.com/articles/risk_mgmt.html