Managing Schedule Risk (Part 1)

The concept that risk can be "programmed" out of your project schedule is a false hope.

However, you can manage in the presence of uncertainties creating risk by understanding the risk types they represent and addressing each appropriately. An aerospace program manager explains this in part two of this risk management series.

In Against the Gods: The Remarkable Story of Risk, author Peter Bernstein states that one of the major intellectual triumphs of the modern world is the transformation of risk from a matter of fate to an area of study. And so, risk analysis is the process of assessing risks, while risk management uses risk analysis to devise management strategies to reduce or ameliorate risk and its impacts.

In the first article in this series, “Risk/Opportunity,” the importance of explicitly planning risk management activities was presented. These risk buy-down tasks are just like any other task in the plan. The role of these tasks is to manage the uncertainty in the project. The term “uncertainty” has a broader meaning than risk. (The whole discussion of what a risk is, how to mitigate the risk, and how to perform risk management is another topic.)

Project planning involves uncertainty. This uncertainty can be characterized by:

?1) Uniqueness — a project is a unique undertaking. This does not bode well for the management of technical or programmatic risk, since there is little if any, historical data by which to calibrate the models describing this risk.

?2) Variability — there are various tradeoffs between performance, cost, schedule, quality, and risk. A model of these tradeoffs requires that the correlation between each of the elements of the model be known in some way.

?3) Ambiguity – a state that emerges from the lack of clarity and structure as well as the built-in biases of estimating cost, schedule, and risk.

?Although mature organizations use many tools to support project planning, quantifying the uncertainty in these plans is not as prominent. The PMBOK Guide identifies risk as a key area of concern but does not describe the management of the underlying uncertainty that results in this risk. Transforming project risk into project uncertainty often requires that the concept of risk as an “event” ignore the source of risk emerging from the probabilistic nature of the project’s technical and programmatic activities.

?The concept that uncertainty and risk can be “programmed out” of the schedule is a false hope. Intrinsic variation pervades all natural systems. Observe or measure any characteristic of anything, and the result will vary from instance to instance. Plan or measure a task duration, or a cost associated with that task, and a natural variance will appear. Management gurus Walter Shewhart and W. Edwards Deming taught that reacting to random changes in the system as if they mean something always degrades the process.

?Managing the uncertainty in a network of tasks that describe a schedule is the topic of this article. But first, let’s put some bounds on the term “uncertainty.” There are four kinds of uncertainty in projects and corresponding mechanisms to address them.

Identifying the Risk Mitigation Tasks in the Plan

Planning for risk management starts after risks have been identified and assessed. Risk Analysis makes use of a variety of mathematical models to evaluate the effects of choices of risk and mitigation.?Risk Analysis also determines the sensitivity of risks to changes in independent and dependent factors described in the plan.

?The actual schedule (network of tasks) has two types of uncertainty. These are orthogonal to the classes of uncertainty shown in the table above.

• Static uncertainty – which is uncertainty about a specific parameter.
• Dynamic uncertainty – which are stochastic behaviors in the underlying environment.

The static uncertainty needs to be explicitly addressed in the plan with “mitigation” tasks. If X occurs, I’ll deal with it by doing Y. This type of schedule risk planning should be embedded in the baseline plan. Making these risks visible, demonstrates explicit mitigation steps.

?A dynamic uncertainty needs to be addressed differently. The first step is to determine the probability distribution of these dynamic uncertainties. This does not mean the specific shape of the probability distribution function — that should be done for the static uncertainties — but the likelihood of occurrence profiles. This can be done through a risk classification scheme. An example of such a scheme is shown below.

For this approach to be effective, the percentage overruns need to be calibrated to the class of the project, and the classification levels need to be calibrated to match the vocabulary of the project.

?Using the risk classifications in the table above, the explicit risk mitigation tasks (risk buy down) must appear in the schedule. With this in place, the next steps include:?

1. Identification probabilities for the various durations for the activities in the plan (this activity maps the risk profile overruns with the actual durations of the activities involved in the risk mitigation or progress performance in the presence of risk), and?
2. Assessment of the “risk-adjusted” completion dates for the deliverables defined in the schedule.