Risk Contingency - Are You Confident?

The Need for Risk Management

The current financial crisis has provided a poignant reminder of why prudent, honest risk management is so important. Unlike the great casino of the banking world, very few private sector organisations can rely on being bail-out by the state should any venture go awry, so a sound understanding of the risks inherent to any commercial endeavour is crucial to project success.

Firstly, to give confidence of project viability, a full and comprehensive risk review must be undertaken before any competitive bids are submitted. Many organisations have a well established risk assessment process, involving representatives from an array of disciplines and reviewing all elements of the project by stepping through the Statement of Work (SoW) or the WBS task by task. Having identified the risks though, the register is often devalued by vaguely defined, "finger-in-the-air", cost and probability estimates. There is a wide range of estimating techniques available (which I will hopefully touch upon in another post), which should be fully deployed to reach accurate cost predictions, and probability estimates should be derived from past experience or via mathematical reasoning where applicable. Where a risk impact involves extra work (labour), costs should be calculated as with any other task - estimating man-hours, choosing the most appropriate resource or resource type, and calculating the cost parametrically. Where the range of potential impact is particularly large, three-point-estimating should be used along with PERT analysis to provide a single figure.

An oft forgotten element of assessing risk, and a major reason for late project delivery, is the evaluation of the schedule impact. You may have ensured that sufficient funds are laid by, but is your customer more focused on a timely completion? As I sit here watching Olympic swimming out of the corner of my eye, I would imagine that LOCOG had a far keener interest in any risks to facility delivery dates in the build-up to the games than on potential cost overruns.

Once an accurately costed risk register has been developed, the practice of calculating the 'technical contingency' or 'management reserve' by adding up the 'Gross Cost Impact x Probability %' for each risk, is well established. But why do so many project teams stop there?

Monte-Carlo Analysis

Simple Cost Risk, or 'Monte Carlo' analysis is critical element of any risk management process. Without it, a project can have no confidence that their contingency is sufficient. I imagine the reason many organisations shy away from it is because it's seen as overly complicated - probably due to the fact that is usually something performed by a dedicated Risk Management tool, which brings it's own costs and complications. But Monte Carlo analysis is simpler than most people realise.

For the uninitiated, Monte Carlo analysis effectively 'rolls the dice' on a project to calculate a total risk impact cost using the probabilities defined for each risk. On each simulated 'run', the mathematical dice, which is effectively a random number generator, 'decides' whether each risk occurs. Any of the risks might be selected to occur, or all of them, or indeed none at all. But by doing the same calculations over hundreds or thousands of iterations, a picture begins to develop of a 'typical' outcome. A simple calculation can tell you what percentage of runs produced total risk impact costs that fell within the contingency budget (i.e. the percentage of runs in which the project had sufficient contingency to cover the total cost of all impacted risks). This percentage essentially tells you how likely you are to have enough money to cover your risks.

Typically, the basic contingency figure (calculated as descried above) will produce a fairly low confidence figure, usually in the region of 50%, which is precisely why this analysis is so valuable. By altering the contingency budget by adding some additional 'confidence funding', and re-running the simulation, higher confidences can be achieved. Depending on the nature of the project and any risk/benefit analysis carried out, a particular desired confidence level can be defined by the organisation and the 'confidence funding' set appropriately.

In the 'Toolbox' section of this blog, I have uploaded a simple monte-carlo analysis spreadsheet to illustrate how easy it is to run a basic simulation. Feel free to make use of it.