Four Heroes of Risk Management

In his opus magnum Risk Analysis – A Quantitative Guide, David Vose identifies four important probability theorems for risk analysis. Each of our heroes is connected with one of these theorems.

• Strong law of large numbers (Chebyshev’s Inequality)
• Central Limit Theorem (Laplace)
• Binomial Theorem (Bernoulli)
• Bayes Theorem

Pafnuty Chevyshev is one of the founding fathers of Russian mathematics in the nineteenth century. The strong law of large numbers is the principle behind the Monte Carlo simulation. The greater the number of iterations (or sample size), the closer the risk analysis output (distribution) will be to the theoretical distribution. This is intuitively obvious but can be proven mathematically.

Pierre-Simon Laplace was a brilliant scholar, the French equivalent of Newton with achievements in many spheres. In statistics he refined Bayes interpretation and developed the Central Limit Theorem. The Central Limit theorem where the sums of independent distribution functions tend towards a normal / log normal distribution. Also, as the independent functions are summed then the variance of the sum will decrease.

The Bernolli family produced many prominent mathematicians including Jacob. Jacob Bernoulli described Bernoulli trials in his Ars Conjectandi, published 8 years after his death in 1705. The Binomial Theorem is used in probability analysis to calculate the results of Bernoulli trials. In risk management terms a risk can have one of two possible outcomes: the risk will either impact or it will be avoided. This is a Bernoulli trial.

Rev. Thomas Bayes was an English Presbyterian minister in the eighteenth century. His theorem was published by the Royal Society after his death. Bayes Theorem describes the probability of an event based on conditions that might be related to the event. It shows how the probability that a risk may occur is affected by a new piece of evidence.

A Pragmatic Approach to Three Point Estimating

Obtaining 3 point estimates for project schedule risk analysis:

You have prepared and quantified the project risk register. You have finally persuaded the project planner to prepare a suitable programme for Schedule Risk Analysis (SRA). All you need to do now is get the Project Manager to provide 3 point estimates (3PE) for each of the activities in the plan. In practice it is difficult for Project Managers to find the time and motivation to provide these estimates.

This shortcut will get the SRA started and point to activities where more attention is needed.

Ask the Project manager to allocate each activity (or set of activities) into one of four groups. Activities in group A are well understood with little variation in duration, whereas activities in group D are perhaps novel or little understood and large variation in duration.

These groupings can be carried out quickly. The Project Manager may have definite ideas on the 3PE for some of the activities, which of course can be completed separately. At this stage a Monte Carlo analysis can be carried both for uncertainty only and with risks included. Review the tornado diagram using the sensitivity index for the activities will identify the key activities.  The 3PEs for these activities can be reviewed and refined.

The justification for this approach is that:-
1.    Many of the plan activities will have little or no influence on the outcome of the analysis
2.    The outcome of the analysis will be mainly driven by the risks (rather than the activities)
3.    The Central Limit Theorem will tend to reduce the overall variation;
4.    This approach gives the Project Manager a manageable task which can be completed quickly

Project Issue Management – Risk or Issue?

• Risk management considers future events that may happen
• Issue management considers events that are happening or are unavoidable.
• Issue management should be straightforward.

Traditional risk (and issue) management tools (such as ARM) do not handle the urgency or timescale well (also called proximity). This is more important in issues than in risks.

If we have a non-reoccurring risk (a classic risk) that impacts then it is moved directly to the impact register and changed to an issue. This will maintain all the history of the risk/issue in one place. It will be appropriate to review the description and impact to show how the issue was manifested.

A previously unknown risk that emerges as an issue should go directly to the issues register without appearing on the risk register. Care must be taken to distinguish new changes in requirements from genuine issues within the existing scope of work.

We will also have risks that have the potential to reoccur. When the risk impacts, the new issue will be copied from the existing risk and moved to the issue register. It will be appropriate to tailor the description and impact to the specific issue. The remaining risk will also be reviewed to evaluate the probability and impacts of any future occurrence of the risk.