Integrated Qualitative and Quantitative Risk Analysis of Project Portfolios
Lev Virine · 2013
Project portfolio risk management and risk analysis form one of the critical components of enterprise risk management. Organizations measure and analyze risks associated with projects, project portfolios, and programs. Such risks can be related to project schedules and affect, for example, project durations, completion dates, costs, resources, and success rates. The project risks also can be unrelated to particular project schedules and affecting market, capital, insurance, joint ventures, and other parameters. The process of project portfolio risk management begins with risk identification. Risks are included on the corporate risk register and presented on the risk matrix. At this step risk probabilities and impacts are defined qualitatively. The second step of the process is quantitative risk analysis of project schedules using event chain methodology (ECM). ECM is a stochastic modeling technique for schedule risk analysis. All risks, including schedule and nonschedule-related risks, are assigned to a particular project and within this project to the particular activity or resource. Further, ECM allows one to model the relationship between project risks by defining risks that cause or trigger other risks. All risks and relationships between them will be presented on the project or portfolio Gantt charts using event chain diagrams. After risks are assigned to project and portfolio schedules, Monte Carlo simulation of the project schedule is performed based on a standard scheduling algorithm. Statistical distributions of project cost, duration, finish time, resource allocation, and other parameters help to determine the chance that the project can be completed on time and on budget. Risk impact is calculated based on correlation between the incremental increase of a task’s cost or duration and project cost, duration, and other parameters. Risks within a risk register are ranked based on calculated impact and probabilities. The methodology simplifies complex risk analysis process, which in most cases is performed by project schedulers. *Lev Virine, Ph.D., P.Eng. is President of Intaver Institute Inc., 303, 6707, Elbow Drive S.W., Calgary, Alberta, Canada, T2V0E5, [email protected]. 1. Enterprise Risk Management in Project-Based Organizations Many organizations, especially those in the construction, aerospace, and pharmaceutical industries, focus their resources primary on projects rather than on operation. A project is a “temporary endeavour undertaken to create a unique, product, service, or result” (Project Management Institute 2013). Projects are time related and usually include multiple activities and resources. Many projects have a project schedule with a number of interlinked activities and resources attached to them. The projects are managed by tracking actual project performance versus original project plans. Most organizations have a portfolio of projects that can be related to each other, for example, by sharing the same resources. Project management includes project scope, time, quality, procurement, and other processes. One of the most important project management processes is risk management. Project risk management includes steps of risk management planning, risk identification, qualitative and quantitative risk analysis, risk response planning, risk monitoring, and control. The main difference between enterprise risk management (ERM) for operation-based organization and portfolio risk management is that in portfolio risk management many risks can be assigned to the activities of project schedules. For example, some risks can affect an activity’s duration, and the same or another risk can affect an activity’s cost, resource allocation, project success rate, and other project parameters. By assigning risk to a project activity and recalculating the project schedule it is possible to determine how risk would affect the schedule and portfolio. The risk register in a project portfolio includes schedulerelated risks and nonschedule risks. Market, capital, insurance, and joint ventures belong to the category of nonschedule risks. They may be assigned to activities of the project schedule, but they do not affect project schedule directly. Risks related to an activity’s duration and cost affect the project schedule. 2. Quantitative versus Quantitative Analysis of a Project Portfolio The risk register of a project portfolio is a set of risks of opportunities with their properties. The risk properties include the following: Risk attributes, such as risk description, objectives, owner, and start and end date