How to handle costly risks?

Question

In general risk costs are not estimated as part of the initial estimates. How do you handle these costs? Through Change Requests? Any other thoughts on these costs? What is the best way to communicate these to Senior Management and Sponspors?

Answer 1

Without estimating the cost for risks, any cost or timeline estimate that you have provided to senior management or sponsors is a best-case scenario. You have set an expectation for when the project will be delivered and how much it will cost, but if any of those risks materialize you will not be able to meet those expectations.

In general, the impact (cost in currency and time) and likelihood (percentage) risks should be estimated, and ways to mitigate those risks should be identified (as well as the costs for the mitigations and the impact that they have on the risks - whether they reduce the cost of the risk or the likelihood of the risk materializing).

This information should then be included with your estimate along with your suggestion on how the risks should be dealt with. This means pointing out which mitigations you feel should be performed (and added directly to the estimate for the cost and timeline) and how much additional cost and timeline (from the remaining risk cost and likelihood) should be included in the estimate. A very simple way to do this is to just multiply each risk's cost by the likelihood of that risk and then sum those values. More complex methods also exist.

If your senior management and sponsors are open to it, you can provide a range for the cost and timeline, letting them know what the best case answer is as well as the worst case, and where on that spectrum things are most likely to fall.

It is important though to make sure that the proper expectations are set, and what your estimates represent. Ultimately, it will be up to the people providing the budget to decide on whether they want to pay to mitigate the risks or wait for the risks to materialize.

Answer 2

Best practices for risk management (as established in the Practice Standard for Risk Management) include quantitative analysis of costly risks. (Unless you are managing so much risk that costly risks fall below the threshold for quantitative evaluation of risks; in that case you have a serious problem).

Common methods to assess costly risks include

• Expected Monetary Value of the risk
• Decision Tree Analysis
• Contingency Reserves

Although I've linked to wikipedia, the material in the Practice Standard is superior, but it is only available to PMI members and to those who wish to pay.

Standard practice on communicating these risks varies widely in my experience, but probably the most common is to establish the Expected Monetary Value with a range & confidence interval. "Current forest fires in the area of Supplier X mean that there is a significant risk that Supplier X will be unable to deliver widget Y on schedule. We estimate with an 80% confidence that this will cost the project $13,000"

Answer 3

Cost risk should be part of the initial estimate. It is unrealistic to paint a picture to Senior Management or sponsors that the effort will go exactly as planned.

Answer 4

Generally, risks ARE estimated in your initial estimates, which would include a firm budget on known mitigating actions as part of your cost baseline but also reserves that sit in both management and contingency for risks identified later or when unknown unknowns impacts you.