|
|
FEDERAL
SECTOR REPORT
September 2003
IN THIS ISSUE
Managing the
Project Risks of Federal Initiatives
Links of the
Month: Project Risk Management
Consulting
Support for Capital Planning and Investment Control
Home Page
(c)
2004 by the P2C2 Group, Inc.
MANAGING THE
PROJECT
RISKS OF FEDERAL INITIATIVES
You may have
heard the story of the man who drowned in a swamp with an average water
depth of 24 inches. Risks abound in everyday life because the world
deviates, unexpectedly, from the average. You can find yourself over
your head without warning.
Alligator
Alert! In the Federal Sector, agencies and contractors face risks
of cost overruns and scheduling delays, and many of these risks are far
more complex than determining the depth
of a swamp. All but the simplest programs
and projects involve multiple risks. Many
of these "alligators" are identifiable during the planning phase, but
others may appear unexpectedly during project execution.
The Basics of
Managing Cost and Scheduling Risks
Risks Are
Numerous: A project strategy that seems promising may not survive
the test of reality, and it may require costly changes. There may be
errors or omissions in the budget, contract, and project plan. A
supplier may go bankrupt. Technology may change. Key
personnel may leave. A technician may make
a disastrous error that goes undetected. The Congressional
appropriation may be four months later than expected, causing a domino
effect on schedule dependencies. A blizzard may delay work. Software or
data may be destroyed by fire,
water, or computer virus.
Consequences.
Cost overruns and scheduling delays are
no fun. An agency has to explain to the
Office of Management and Budget (OMB) if
a major capital investment varies by more
than 10% of the budget estimate. Wildly out
of control initiatives will cause serious
embarrassment in the media, as well as at Congressional hearings. And
contractors on fixed-price performance contracts may be at risk of
large financial losses.
The Upside of
Risk Management. A project may experience unexpected "good news" as
well as the impact of negative risks. Particularly if you
evaluate the status of your project on
an ongoing basis, you may discover opportunities
to reduce costs or complete milestones ahead
of schedule. Even bad news may yield opportunities
to take action and limit negative consequences.
But all of this requires wide-awake and fully
capable project management.
The Costs and
Benefits of Risk Assessment. Thorough risk control activities can
cost thousands of dollars in time and effort, and I'm obviously not
suggesting that that you conduct a major
drill every time you make a commitment for
a few thousand dollars. But many federal projects have price tags in
the millions of dollars, at least over the life cycle of the
initiative. For major commitments, it is foolish not
to evaluate and manage cost and schedule risks on an ongoing basis.
Many Federal
Risk Assessments Are Weak. Some risk assessments that I have seen
in federal agencies are extremely weak, consisting of no more than a
boilerplate risk with a pro forma solution, such as: Risk--lack of
cooperation between cooperating agencies in the Department;
Mitigation--proactive communication program
for buy-in. While boilerplate platitudes reflect
a smattering of truth, they do not adequately
identify or control many of the risks to cost
and schedule.
Some Risk
Analysis Efforts Are Superficial or Stunted.
A more comprehensive approach is a risk analysis, which combines and
studies the effects
of multiple risk assessments, but these
efforts are often far too limited. Some
are little more than boilerplate paper forms
with check-offs and fill-in the blanks.
A related problem is that the risk assessment
may suffer from "stunted" development--completed
before the project is executed, put on a
shelf, and not updated to address changing
risk conditions on an ongoing basis.
A Better
Approach to Risk Management. The management
of cost and scheduling risks is a responsibility that is broader than
simply conducting risk assessments. The basic ingredients reflect a
comprehensive approach:
- Experienced and highly
skilled project managers are essential for
both the planning and execution phases
- The planning phase must thoroughly define
the requirements, design, performance criteria, and expected outcomes
of the initiative
- Standard practices or best practices
should be followed whenever possible, including "lessons learned" from
initiatives elsewhere in the government
- If you are attempting to "trail blaze"
with an innovative approach that deviates from standard practices, you
need to pilot
test (proof of concept) on a small scale
before making a huge budget commitment
- You need detailed technical plans and
specifications so that you can schedule and price all aspects of the
initiative
- Contracts and subcontracts for services,
equipment, and supplies should be performance based and fixed price, so
that there are defined limits to costs
- Market research is needed to validate
pricing assumptions
- Project management software should be
used to establish a detailed work breakdown structure, schedule,
critical path, and resource allocation
- Control of cost and scheduling risks must
continue throughout the execution phase using up-to-date status
information.
|
|
The Risk
Assessment and Risk Analysis Process
Large and
complex federal initiatives require an individualized
approach to identifying and controlling cost
and scheduling risks. Here's how:
- Collect information
and case studies about similar projects
and best practices--the more information
you have, the better you will be able to
identify, anticipate, and mitigate risks
- Determine how your initiative is
different from other projects, and identify unique risks that may not
be evident from the information you have collected about other projects
- Assess the individual risks--for
likelihood of occurrence and magnitude of impact
- Develop preliminary "best estimate" cost
and scheduling data based on the information collected, as adapted by
your unique situation
- Prepare to conduct a risk analysis,
combining data from the various individual risk assessments
- Develop a model (usually a spreadsheet)
that estimates average, best case, and worst case scenarios for (1)
each risk and (2) for interaction between all of the risks
- Conduct a Monte Carlo simulation of the
hundreds (usually thousands) of various outcomes
- Analyze the simulations and evaluate
statistically a range of outcomes that you are willing to live with
(you almost never will be able to eliminate all probability of risk)
- Revise your budget (costs) and schedule
to attain an optimized budget and schedule within an acceptable range
of risk
- Re-run your risk analysis monthly or
quarterly--depending on the likelihood of encountering new or altered
risks.
As a note, Monte
Carlo risk analysis is a quantitative simulation technique used in many
different simulation analysis models. Data is usually based
on point estimates of the most likely value
(e.g., the mode of the swamp's depth is 24
inches), but range estimates are included
for each risk to define best and worst case
extremes. Usually a computer runs over a thousand
simulations--sampling various combinations
of values for all of the risks, and this
establishes a pattern of outcomes based on random probability. Based on
the pattern of outcomes, for example, it may be possible to determine
that there is a 15% chance of under-running the budget and a 45% chance
of overrunning it. And if you don't like the results, you can change
the inputs (e.g., change your schedule, substitute more experienced
project managers, etc.) to reduce the likelihood of
cost and scheduling risks.
Other methods
are available, but hopefully I've made the point that quantitative
analysis can be very
useful (if based on solid data and preparation).
Connecting
Risk Analysis with a More Comprehensive
Management Strategy
Risk analysis is
crucial, but it must be integrated into a broad
project management strategy to achieve
effective cost and schedule controls. In
his doctoral dissertation (see Links of
the Month), William J. Bender contends that
"Risk analysis alone will not control cost,
it provides clues to cost issues, but does
not track costs associated with risky items."
Instead, Bender applied a combination of simulation, earned value, and
risk analysis to develop an integrated approach to cost control for a
major Navy construction initiative:
During the
planning phase risk is identified, assessed, deemed acceptable or
unacceptable, decision analysis is performed, and risk-based cost and
schedule targets using a simulation technique are developed. During the
execution phase a
similar process is followed with the addition
of the cost control technique of earned value
that is intertwined with risk assessment updates and decision analysis
to provide cost control. (p. 382)
Haven't You
Heard this Before? In federal capital planning and investment
management, the Office of Management and Budget (OMB) requires
effective risk management, earned value management,
and accountability for attaining cost and
scheduling goals. Incorporating better risk
management into a comprehensive cost control
strategy is vital to attaining better program
and project performance. And it's required
by the OMB A-11 guidance.
Managing the
Costs of Risk Management. Risk management
is a rigorous process, and it becomes unnecessarily expensive unless it
is implemented at the enterprise level (i.e., at the government
Departmental or contractor corporate level). Here are some suggestions:
- Provide enterprise-wide
leadership and technical support for risk management--ideally within an
enterprise-level Program Management Office
- Involve all relevant players at the
enterprise level: policy, planning, senior program managers, the budget
officer, the financial officer, the chief information officer,
procurement executive, security officer-- probably under the leadership
of the enterprise's Chief Operating Officer
- Develop enterprise-wide guidelines for
"acceptable risk," and conduct periodic cost-benefits analyses to make
certain that
you are not spending more on mitigation
than the likely cost risk occurrences
- Use uniform enterprise-wide software
tools for budget planning, risk assessment, project management, and
financial analysis
- Implement a scaleable approach to risk
assessment--so that $100 million projects are adequately managed, but
$100,000 projects are not buried in excessive (and costly) drills
- Develop a process of peer reviews, where
risk assessments and performance reports are reviewed by other
experienced project managers
- Cultivate a culture that acknowledges the
probabilistic nature of cost and scheduling projections--and
concentrate on monitoring and optimization, rather than blame games.
There's a lot to
think about. So investigate the links.
LINKS OF THE
MONTH
In this
newsletter, I have written about how to identify and manage risks
associated with federal programs and projects. Following are references
that point to additional information.
|
Monte Carlo
Graph
Based on 5,000
Simulations
(c)
Decisioneering
(Crystal Ball
software product)
|
HOME PAGE
I have had a
great summer and feel totally energized. A high spot was a
double-header vacation in California, taking my twenty-something kids
to San
Francisco and then going with Elena to
Yosemite National Park.
Peace and
prosperity!
P2C2 Group, Inc.
kendrick@p2c2group.com
(301) 942-7985
|
California
Vacation:
Yosemite
and
San Francisco
|
|
|
|
|
