Episode 273: How Risky is Your Project? Overall Project Risk Explained. (Premium)

This episode is reserved for subscribers of the Premium Podcast. Learn how to subscribe to the Premium Podcast to access this interview and transcript...

This episode is sponsored by The PM PrepCast for The PMP Exam:

This week we continue our journey into risk management in project management with a second interview that I did with Dr David Hillson (http://www.risk-doctor.com). We will discuss “overall project risk”, which is different from “individual project risks”.

At the center of our discussion is the situation when your project sponsor or client asks you “How risky is this project?”

This is a question you might get about risk management in agile projects too, as clients want to know what their exposure is regardless of the methods or techniques used in the delivery.

The concept of “overall project risk” is mentioned in the PMBOK® Guide as well as the PMI Practice Standard for Project Risk Management, but it seems not too well understood and few project managers are using it. So let’s change that.

As you’ll hear in our conversation, David will be presenting on this topic at an upcoming PMI Congress shortly after we recorded this interview. He has made his paper available to us all and you can download a PDF version right here...

I also recommend that you read the following paper from David: http://risk-doctor.com/pdf-files/ADV05.pdf

And of course you can always stop by at the David Hillson Author Page on Amazon, where you will find all the books he has published.

Below are the first few pages of the transcript. The complete transcript is available to Premium subscribers only. 

Podcast Introduction

Cornelius Fichtner: Hello and welcome to Episode # 273. This is the Project Management Podcast™ at www.project-management-podcast.com and I am Cornelius Fichtner.

You are listening to one of our Premium Episodes. Thank you for your support of The Project Management Podcast™. Your subscription fees help us pay for our expenses.

This week, we continue our journey into project risk management with a second interview that I did with Dr. David Hillson. We will discuss overall project risk which is different from individual project risk.

At the center of our discussion is the situation when your project sponsor or client asks you 'how risky is this project?' The concept of overall project risk is mentioned in the PMBOK® Guide, as well as in the PMI® practice standard for project risk management. But it seems not too well understood and few project managers are using it. So let's change that.

As you'll hear in our conversation, David will be speaking on this topic at an upcoming PMI® Congress shortly after we recorded this conversation. He has made his paper that he is going to present there available to us all and you can download it as part of Episode 273 on the Podcast website.

And now, tell me, how risky is your project?

Podcast Interview

Female voice: The Project Management Podcast’s feature Interview: Today with Dr. David Hillson, the risk doctor.

Cornelius Fichtner:Good afternoon, David and welcome back to The Project Management Podcast™!

Dr. David Hillson: Thank you very much, Cornelius. I enjoyed our first conversation. I'm looking forward to this one as well.

Cornelius Fichtner: Wonderful! Let's jump right in. How do you define the term 'overall project risk'?

Dr. David Hillson: Well, that's a very interesting question. There are of course answers which came directly from the PMBOK® Guide and also from other guides in the world of project management.

So if we went to the PMI® practice standard for project risk management which is published in 2009 or the PMBOK® Guide itself, we have a very clear definition. Most people know the definition of individual risk, an uncertainty or condition that if it occurs has a positive or negative effect on a project's objectives and within the project, there are lots of those. But the practice standard and the PMBOK® Guide also include this other concept and it says overall project risk represents the effective uncertainty on the project as a whole and it goes on to say this is more than the sum of individual risks on a project.

So we have a definition in the PMI world. There are similar definitions in other project management standards and in other risk standards that say, there is a concept of overall risk which sits above individual risks and you can't get to overall risk exposure just by adding up all the individual risks.

Cornelius Fichtner: You told me before we started this interview; this is a new concept unlike the discussion we had previously. So why should the concept of overall project risk be of importance to our listeners?

Dr. David Hillson: Well I think most of our listeners will be project management professionals and quite a lot of them will be project managers. One of the key questions that you will be asked by your project sponsor or your project owner or your customer is this: How risky is this project?

If we only concentrate on individual risks, our answer is "Well I got this risk register and I've got this list of risks and I got this report and I got this probability impact matrix. The answer is kind of here somewhere." And then the project sponsor or the project owner says: "No, no, no. Those are the risks in the project. I want to know what is the riskiness of the project." And I think we can’t answer the question of how risky is this project with a list of risks. It just is a different language. It's a different concept altogether.

Overall project risk is designed to answer the question, how risky is the project, because it measures that riskiness of the overall project as a whole rather than individual uncertainties that might affect the progress on the project.

Cornelius Fichtner: So the overall risk is not just adding up the individual risks?

Dr. David Hillson: No, because there are different sources of uncertainty that could affect the whole project not just the individual risks within the project. So if we think about the kind of predefinition, the proto-definition of risk as uncertainty that matters, then we can have uncertainties that affect individual project objectives, those would be our individual risks so risk that might affect the timeline or it might affect the budget or it might affect the performance requirement or it might affect safety, or it might affect reputation.

What we're looking at with overall project risk is an uncertainty that would affect the whole project. Now, those are of course some of those individual risks within the project could affect the whole project and they contribute to overall project risk. But there are other things which are not risks within the project which would include context, the organizational context, the program within which this project sits, the environment that we're delivering our results into, the culture of our own organization under the client organization. So there are many things which are outside the project which contribute to uncertainty of the project as a whole in addition to the risky things within the project that the project manager has to manage through the risk register.

Cornelius Fichtner: Interesting because when I think of the PMBOK® Guide and I let the risk management processes sort of fly by in my mind, I don’t think that this is addressed in the way that you have just described that I have to go outside. So why do then common implementations of risk management focus on individual risks and often, why don’t they address overall project risk exposure?

Dr. David Hillson: Well I think you've the nail on the head with part of the answer. One is that risk management processes don’t describe how to tackle overall project risk and it certainly true of the PMBOK® Guide Chapter 11 that it has this definition of overall project risk in the introductory paragraph, para 11.1 but then it doesn’t go on to say: "And this is how you manage it."

Cornelius Fichtner: Right.

Dr. David Hillson: And so people who are following the PMBOK see this concept in the introduction and then they have no guidance on how to manage it. Fortunately, there is some guidance in the PMI® practice standard on project risk management which was published in 2009 and introduced this term to the PMI world and unfortunately, when we got to the fifth edition of the PMBOK® Guide, those of us said: "Well you know, this is in the practice standard and the practice standard says the context of the PMBOK® Guide." The answer we got back was: "Well it's a big change. We are not ready for big changes in the fifth edition. It's only incremental changes." And it wasn't included.

So we are having this internal discussion within PMI. If you follow the practice standard, you will find some guidance on how to manage it. If you follow the PMBOK® Guide, I'm afraid it's silent.

But I think there's another thing on why implementations commonly focus on individual risks and that's because it's easier. We can do our risk workshops and have our probability impact matrices and maybe some Monte Carlo modeling and a risk register and we can take each one and pick them apart and manage them separately. And that's easy to do.

When you think big about the whole project, it becomes a bit overwhelming, a bit more complicated, a bit hard to get your hands around to say: "Well, how risky is the project as a whole and how can I manage the riskiness of this project as a whole?" And that's much more difficult. So I think the one thing is the processes don’t support it and the second thing is it's much easier just to concentrate on individual risks.

Cornelius Fichtner: So what does the practice standard say? Can you give us, I don’t know, the high level 10,000-foot overview of what we're supposed to be doing? What tools we're supposed to be using?

Above are the first few pages of the transcript. The complete PDF transcript is available to Premium subscribers only.