|
USING RISK-ADJUSTED COSTS FOR
PROJECTS
Project managers and business
analysts use risk-adjusted costs to define realistic expectations for
project budgets and contract performance. Over the past few months, we
have been evaluating approaches to risk adjustment as part of our
commitment to excellence in our IT management consulting practice.
We use risk-adjusted costs when we
develop business cases, conduct alternatives and cost benefits
analysis, and support project management offices.
A serious effort to estimate
risk-adjusted costs is extremely important. It can reduce the
likelihood of cost overruns or the embarrassment of running out of
money before a project is completed. Failure to apply risk adjustments
is also a common cause of poor financial and Earned Value Management
(EVMS) performance.
You Already Know about Risk-Adjusted
Costs
We all use risk-adjusted cost
estimates in everyday life: The taxi ride to the airport will probably
cost $35, but we’d better have $50 available just in case there are
detours or traffic jams. What’s more, we probably want to have access
to additional money, just in case something unexpected happens—like a
flight delay or cancellation.
The above airport example addresses
two key cost elements of risk, known unknowns and unknown unknowns. The
contingency reserve is for known risks—such as variances in the cost of
the taxi, and the management reserve is for unknown risks, such an
unexpected mechanical problem with the aircraft that causes a
cancellation. We'll review the distinctions between contingency and
management reserves later in the article.
Project managers and business
analysts use the same thought process for establishing risk-adjusted
costs when estimating project budgets, evaluating alternatives, and
conducting cost benefits analyses. However, the methods used should be
more rigorous and formal since hundreds of thousands or millions of
dollars are involved, and the reliability of the estimates can have a
major impact on the enterprise’s financial position.
Here are six points that can help
your organization make better use of risk-adjusted costs.
1. Understand Your Project
It is important to understand the
characteristics of your project before you can identify risks or
calculate risk-adjusted costs. In its best practices for planning, the
Project Management Institute (PMI) sequences risk planning as one of
the final steps—after you have defined scope, workflow, schedule, and
budget. You simply cannot assess risk or estimate risk-adjusted costs
until you have defined your project.
Understanding risk is
part of understanding your project, and it goes hand-in-hand with cost
estimating. One of the purposes of an Integrated Baseline Review (IBR),
either before contract award or immediately thereafter, is to review
risks and the realism of the budget, schedule, deliverables, and
intended project outcomes. In quite a few cases, the government or
contractor has been overly optimistic; and the
resulting financial shortfall is an undocumented, unplanned
risk cost that can lead to cost overruns or requests for additional
money.
2. Review Historic Experience
Any established enterprise has a
long history of project performance data—including historic experience
with variances between initial cost estimates and final cost to
complete. If a majority of your projects cost between 120% and 140% of
the initial budget estimate, then a typical new project will likely
perform the same way unless your organization undertakes a radical
overhaul of its business processes and policies.
Even if you are committed to
implementing more realistic approaches to cost estimating and
risk-adjusted costs, you need to review historic experience—because you
will likely discover patterns of cost risk and estimating problems. The
historic problems will point out where you should concentrate your risk
management focus … and where you should consider risk adjustments to
your cost estimates.
As Earned Value
Management becomes standard fare for projects and portfolios, EVMS
results of previous projects are highly valuable as a point of
reference for organizational experience with project cost performance.
If the median Cost Performance Index (CPI) for your organization is
0.80 (eighty cents of work completed for every dollar budgeted), then
your typical cost of risk is 25%, if you continue using the same
estimating methods. (To get the 0.80 back to the EVMS target of 1.0,
you have to add 25%.)
3. Decide How to Pay for the Cost of
Risk
There are many ways to pay for the
cost of risk, and most projects will use several of them: (1)
the planned expense of risk mitigation, (2) the budget added
for contingency and management reserves, and (3) the transfer of risk
to another entity.
Risk mitigation is a cost built into
the budget through design specifications and standards. For example, an
office building may be required comply with building codes that
mitigate earthquake risk, and the cost-to-build estimate incorporates
the required standards. An IT system may be designed according to
established information security standards to mitigate the risks of
disruption or the theft of sensitive information, and the cost of
security components are included in the cost estimates.
It is not always realistic or even
feasible to mitigate all risks, and it is therefore essential to
calculate risk-adjusted costs—a formal set-aside of budget for known
and unknown expenses that might occur. Best practices of the PMI
Project Management Book of Knowledge (PMBOK®) categorizes these into
contingency reserve and management reserve. The contingency reserve is
derived during the project cost estimating process and may be all or
part of the difference between the most likely estimate (which is
generally the basis for estimating) and the worst case scenario.
Usually only part of the difference between “most likely” and “worst
case” is added to the contingency because it is extremely unlikely that
typical projects will encounter all of the possible risks.
Another approach is to transfer
risk—either through insurance or a contractor. A frequent approach is
for an organization to issue a fixed-price performance contract where
the contractor agrees to deliver a completed project or set of tasks
for a firm price. Of course, the cost of risk doesn’t disappear:
Any astute contractor will incorporate the cost of risk into the
firm-fixed price.
4. Establish a Risk Policy and Goals
We recommend that you establish a
formal enterprise-wide policy for project cost performance. In the
Federal sector, for example, the Office of Management and Budget (OMB)
wants major capital investments to be completed within 10% of the
original cost estimate. In the case of OMB, that means that you will
need to carefully account for the cost of risks and decide, in advance,
how to pay for them.
In the case of OMB and the Federal
government, the strategy will often include cost estimating that
addresses risks through design-build to standards and regulatory
compliance, as well as use of firm fixed-price contracts which
incorporates certain risk costs in the acquisition budget.
Project risk policy and goals should
be integrated with an organization’s overall management controls for
budget performance and Earned Value Management. Quarterly or monthly
reviews should monitor variances between planned and actual costs,
because prompt corrective action provides a means to manage risks that
are getting out of control.
5. Use Analytic Tools
There are quite a few analytic tools
available to help you develop risk-adjusted cost estimates. For our own
clients, we have developed several that have been especially valuable:
-
A risk-mapping table that
helps project managers compare a new project to the real-world historic
norms of the enterprise
-
A relative risk
spreadsheet that compares alternatives by capital investment phase—to
provide appropriate cost weights to each solution in an alternatives or
cost benefits analysis
-
A workshop process that involves the
Integrated Project Team (IPT) in evaluating and understanding
risk-adjusted costs so that they can participate in monitoring project
risk throughout the project.
Sensitivity Analysis also addresses
the cost of risk by testing
assumptions. What happens to your costs if a phase of the project
takes several months longer to complete than planned? What happens
if there is a delay in your critical path? Variations in your spread
sheet assumptions (or project management estimating software) can give
you a good idea of the general cost variances that could occur.
There are relatively inexpensive
software tools for estimating the probability of risk associated with
capital investments. Tools such as Palisade’s @RISK provide Monte Carlo
simulations as an add-in for MS Excel. WelcomRisk is a tool that fits
neatly with Deltek’s suite of project management, cost analysis, and
EVMS software tools. These are just examples—many other tools are
available.
In addition to quantitative analysis
and probabilistic analysis, however, we also recommend that your IPT
also use informed judgment to focus on the most critical five or six
risks. Except for Research and Development projects, the most likely
risks are usually known and should be carefully managed to control
costs. Laundry lists of 20 or 50 risks are not sufficient—you need to
use judgment to track the most critical five or six, which is a normal
span of control.
6. Remember that the Improbable May
Still Happen
If you follow all of the suggestions
described above, there is still no guarantee that your project will not
exceed the risk-adjusted cost estimate. You only have the assurance
that you will be far less likely to experience a cost overrun or budget
shortfall.
|
