|
|
FEDERAL
SECTOR REPORT
September 2003
IN THIS ISSUE
Managing the
Project Risks of Federal Initiatives
Links of the
Month: Project Risk Management
Consulting
Support for Capital Planning and Investment Control
Home Page
(c)
2004
by the P2C2 Group, Inc.
MANAGING THE
PROJECT
RISKS OF FEDERAL INITIATIVES
You may have
heard the story of the man who drowned in a swamp with an average water
depth of 24 inches. Risks abound in everyday life because the world
deviates, unexpectedly, from the average. You can find yourself over
your head without warning.
Alligator Alert! In the Federal
Sector, agencies and contractors face risks of cost overruns and
scheduling delays, and many of these risks are far more complex than
determining the depth of a swamp. All but the simplest programs and
projects involve multiple risks. Many of these "alligators" are
identifiable during the planning phase, but others may appear
unexpectedly during project execution.
The Basics of Managing Cost and
Scheduling Risks
Risks Are Numerous: A project
strategy that seems promising may not survive the test of reality, and
it may require costly changes. There may be errors or omissions in the
budget, contract, and project plan. A supplier may go bankrupt.
Technology may change. Key personnel may leave. A technician may make a
disastrous error that goes undetected. The Congressional appropriation
may be four months later than expected, causing a domino effect on
schedule dependencies. A blizzard may delay work. Software or data may
be destroyed by fire, water, or computer virus.
Consequences. Cost overruns and
scheduling delays are no fun. An agency has to explain to the Office of
Management and Budget (OMB) if a major capital investment varies by
more than 10% of the budget estimate. Wildly out of control initiatives
will cause serious embarrassment in the media, as well as at
Congressional hearings. And contractors on fixed-price performance
contracts may be at risk of large financial losses.
The Upside of Risk Management. A
project may experience unexpected "good news" as well as the impact of
negative risks. Particularly if you evaluate the status of your project
on an ongoing basis, you may discover opportunities to reduce costs or
complete milestones ahead of schedule. Even bad news may yield
opportunities to take action and limit negative consequences. But all
of this requires wide-awake and fully capable project management.
The Costs and Benefits of Risk
Assessment. Thorough risk control activities can cost thousands of
dollars in time and effort, and I'm obviously not suggesting that that
you conduct a major drill every time you make a commitment for a few
thousand dollars. But many federal projects have price tags in the
millions of dollars, at least over the life cycle of the initiative.
For major commitments, it is foolish not to evaluate and manage cost
and schedule risks on an ongoing basis.
Many Federal Risk Assessments Are Weak.
Some risk assessments that I have seen in federal agencies are
extremely weak, consisting of no more than a boilerplate risk with a
pro forma solution, such as: Risk--lack of cooperation between
cooperating agencies in the Department; Mitigation--proactive
communication program for buy-in. While boilerplate platitudes reflect
a smattering of truth, they do not adequately identify or control many
of the risks to cost and schedule.
Some Risk Analysis Efforts Are
Superficial or Stunted. A more comprehensive approach is a risk
analysis, which combines and studies the effects of multiple risk
assessments, but these efforts are often far too limited. Some are
little more than boilerplate paper forms with check-offs and fill-in
the blanks. A related problem is that the risk assessment may suffer
from "stunted" development--completed before the project is executed,
put on a shelf, and not updated to address changing risk conditions on
an ongoing basis.
A Better Approach to Risk Management.
The management of cost and scheduling risks is a responsibility that is
broader than simply conducting risk assessments. The basic ingredients
reflect a comprehensive approach:
- Experienced and highly
skilled project managers are essential for
both the planning and execution phases
- The planning phase must thoroughly define
the requirements, design, performance criteria, and expected outcomes
of the initiative
- Standard practices or best practices
should be followed whenever possible, including "lessons learned" from
initiatives elsewhere in the government
- If you are attempting to "trail blaze"
with an innovative approach that deviates from standard practices, you
need to pilot
test (proof of concept) on a small scale
before making a huge budget commitment
- You need detailed technical plans and
specifications so that you can schedule and price all aspects of the
initiative
- Contracts and subcontracts for services,
equipment, and supplies should be performance based and fixed price, so
that there are defined limits to costs
- Market research is needed to validate
pricing assumptions
- Project management software should be
used to establish a detailed work breakdown structure, schedule,
critical path, and resource allocation
- Control of cost and scheduling risks must
continue throughout the execution phase using up-to-date status
information.
|
|
The Risk
Assessment and Risk Analysis Process
Large and
complex federal initiatives require an individualized
approach to identifying and controlling cost
and scheduling risks. Here's how:
- Collect information
and case studies about similar projects
and best practices--the more information
you have, the better you will be able to
identify, anticipate, and mitigate risks
- Determine how your initiative is
different from other projects, and identify unique risks that may not
be evident from the information you have collected about other projects
- Assess the individual risks--for
likelihood of occurrence and magnitude of impact
- Develop preliminary "best estimate" cost
and scheduling data based on the information collected, as adapted by
your unique situation
- Prepare to conduct a risk analysis,
combining data from the various individual risk assessments
- Develop a model (usually a spreadsheet)
that estimates average, best case, and worst case scenarios for (1)
each risk and (2) for interaction between all of the risks
- Conduct a Monte Carlo simulation of the
hundreds (usually thousands) of various outcomes
- Analyze the simulations and evaluate
statistically a range of outcomes that you are willing to live with
(you almost never will be able to eliminate all probability of risk)
- Revise your budget (costs) and schedule
to attain an optimized budget and schedule within an acceptable range
of risk
- Re-run your risk analysis monthly or
quarterly--depending on the likelihood of encountering new or altered
risks.
As a note, Monte
Carlo risk analysis is a quantitative simulation technique used in many
different simulation analysis models. Data is usually based on point
estimates of the most likely value (e.g., the mode of the swamp's depth
is 24 inches), but range estimates are included for each risk to define
best and worst case extremes. Usually a computer runs over a thousand
simulations--sampling various combinations of values for all of the
risks, and this establishes a pattern of outcomes based on random
probability. Based on the pattern of outcomes, for example, it may be
possible to determine that there is a 15% chance of under-running the
budget and a 45% chance of overrunning it. And if you don't like the
results, you can change the inputs (e.g., change your schedule,
substitute more experienced project managers, etc.) to reduce the
likelihood of cost and scheduling risks.
Other methods are available, but
hopefully I've made the point that quantitative analysis can be very
useful (if based on solid data and preparation).
Connecting Risk Analysis with a More
Comprehensive
Management Strategy
Risk analysis is crucial, but it must be
integrated into a broad project management strategy to achieve
effective cost and schedule controls. In his doctoral dissertation (see
Links of the Month), William J. Bender contends that "Risk analysis
alone will not control cost, it provides clues to cost issues, but does
not track costs associated with risky items." Instead, Bender applied a
combination of simulation, earned value, and risk analysis to develop
an integrated approach to cost control for a major Navy construction
initiative:
During the planning phase risk is
identified, assessed, deemed acceptable or unacceptable, decision
analysis is performed, and risk-based cost and schedule targets using a
simulation technique are developed. During the execution phase a
similar process is followed with the addition of the cost control
technique of earned value that is intertwined with risk assessment
updates and decision analysis to provide cost control. (p. 382)
Haven't You Heard this Before? In
federal capital planning and investment management, the Office of
Management and Budget (OMB) requires effective risk management, earned
value management, and accountability for attaining cost and scheduling
goals. Incorporating better risk management into a comprehensive cost
control strategy is vital to attaining better program and project
performance. And it's required by the OMB A-11 guidance.
Managing the Costs of Risk Management.
Risk management is a rigorous process, and it becomes unnecessarily
expensive unless it is implemented at the enterprise level (i.e., at
the government Departmental or contractor corporate level). Here are
some suggestions:
- Provide enterprise-wide
leadership and technical support for risk management--ideally within an
enterprise-level Program Management Office
- Involve all relevant players at the
enterprise level: policy, planning, senior program managers, the budget
officer, the financial officer, the chief information officer,
procurement executive, security officer-- probably under the leadership
of the enterprise's Chief Operating Officer
- Develop enterprise-wide guidelines for
"acceptable risk," and conduct periodic cost-benefits analyses to make
certain that
you are not spending more on mitigation
than the likely cost risk occurrences
- Use uniform enterprise-wide software
tools for budget planning, risk assessment, project management, and
financial analysis
- Implement a scaleable approach to risk
assessment--so that $100 million projects are adequately managed, but
$100,000 projects are not buried in excessive (and costly) drills
- Develop a process of peer reviews, where
risk assessments and performance reports are reviewed by other
experienced project managers
- Cultivate a culture that acknowledges the
probabilistic nature of cost and scheduling projections--and
concentrate on monitoring and optimization, rather than blame games.
There's a lot to
think about. So investigate the links.
LINKS OF THE
MONTH
In this
newsletter, I have written about how to identify and manage risks
associated with federal programs and projects. Following are references
that point to additional information.
|
Monte Carlo
Graph
Based on 5,000
Simulations
(c)
Decisioneering
(Crystal Ball
software product)
|
HOME PAGE
I have had a
great summer and feel totally energized. A high spot was a
double-header vacation in California, taking my twenty-something kids
to San Francisco and then going with Elena to Yosemite National Park.
Peace and
prosperity!
Enterprise
Management Consultant
P2C2 Group, Inc.
kendrick@p2c2group.com
(301) 942-7985
|
California
Vacation:
Yosemite
and
San Francisco
|
|
|
|
|
