DTU ProjectLab - User contributions [en-gb]

Risk management

2014-11-30T20:50:58Z

Saeh0803: /* Risk Management in Practice */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
Further information about M_O_R and ISO 31000:2009 is available in Michael Dallas report [http://www.best-managementpractice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.
Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project. To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

[[File:Mathrix.png|frameless|right]]

This example is more general and very simple; you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis Risk_analysis] which is described more in detail. I will not go in too details in this reports, because another one is writing.
By defining risk management processes for your company, you get closer to success by minimizing or completely eliminating any kind of risks that could have a negative impact on the the project. This lets you to fulfill the targets within the allowed budget and time deadlines. If the risk management strategies are not defined properly then the project could be more prone to deficiencies and failures. Effective risk management strategies helps to overcome the extra expenses that do not produce a return on investment and it also helps to maximize the profits. Through detailed analysis, clever leaders prioritize the on going work based on the results produced, despite the odds.

Assessing and managing risks is the best weapon you have against project's deficiencies. By identifying the risk management within the projects plan and strategies, you will improve your chances for a successful project even if the project is not a perfect project. Risk management is a way of success if you manage it in a correct way by making use of the correct framework and identifying all the risks that could have a negative impact on your project.

You can always use your projects result to the next project that what should be better on next project and which phases you should put more attention. An effective risks management will always help you to minimize the negative impacts of activities that could be a big problem for your projects and your organization.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:44:41Z

Saeh0803: /* Risk Management in Practice */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
Further information about M_O_R and ISO 31000:2009 is available in Michael Dallas report [http://www.best-managementpractice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.
Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project. To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

[[File:Mathrix.png|frameless|right]]

This example is more general and very simple; you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis Risk_analysis] which is described more in detail. I will not go in too details in this reports, because another one is writing.
By defining risk management processes for your company, you get closer to success by minimizing or completely eliminating any kind of risks that could have a negative impact on the the project. This lets you to fulfill the targets within the allowed budget and time deadlines. If the risk management strategies are not defined properly then the project could be more prone to deficiencies and failures. Effective risk management strategies helps to overcome the extra expenses that do not produce a return on investment and it also helps to maximize the profits. Through detailed analysis, clever leaders prioritize the on going work based on the results produced, despite the odds.

Assessing and managing risks is the best weapon you have against project's deficiencies. By identifying the risk management within the projects plan and strategies, you will improve your chances for a successful project even if the project is not a perfect project. Risk management is a way of success if you manage it in a correct way by making use of the correct framework and identifying all the risks that could have a negative impact on your project.
You can always use your projects result to the next project that what should be better on next project and which phases you should put more attention. An effective risks management will always help you to minimize the negative impacts of activities that could be a big problem for your projects and your organization.

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:43:38Z

Saeh0803: /* Risk Management in Practice */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
Further information about M_O_R and ISO 31000:2009 is available in Michael Dallas report [http://www.best-managementpractice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.
Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project. To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

[[File:Mathrix.png|frameless|right]]

This example is more general and very simple; you can maybe use it for a very small project. You can visit | Risk_analysis which is described more in detail. I will not go in too details in this reports, because another one is writing.
By defining risk management processes for your company, you get closer to success by minimizing or completely eliminating any kind of risks that could have a negative impact on the the project. This lets you to fulfill the targets within the allowed budget and time deadlines. If the risk management strategies are not defined properly then the project could be more prone to deficiencies and failures. Effective risk management strategies helps to overcome the extra expenses that do not produce a return on investment and it also helps to maximize the profits. Through detailed analysis, clever leaders prioritize the on going work based on the results produced, despite the odds.

Assessing and managing risks is the best weapon you have against project's deficiencies. By identifying the risk management within the projects plan and strategies, you will improve your chances for a successful project even if the project is not a perfect project. Risk management is a way of success if you manage it in a correct way by making use of the correct framework and identifying all the risks that could have a negative impact on your project.
You can always use your projects result to the next project that what should be better on next project and which phases you should put more attention. An effective risks management will always help you to minimize the negative impacts of activities that could be a big problem for your projects and your organization.

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:30:08Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
Further information about M_O_R and ISO 31000:2009 is available in Michael Dallas report [http://www.best-managementpractice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:28:49Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
Further information about M_O_R and ISO 31000:2009 is available in Michael Dallas report[http://www.best-management practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:26:07Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management.

M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R].

It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:24:13Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010
* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

Each step has described in detail on ISO 31010. Compare to [http://bcove.me/qvtxp001 M_O_R] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk. It is a framework for the management of risk at different levels of of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives [M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities. In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.
For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:15:57Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010
* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:13:30Z

Saeh0803: /* How to develop a risk analysis */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:
 By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.
 By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.
In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others. The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size. ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010
* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* Communication and consultation, and monitoring and review

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T20:00:01Z

Saeh0803: /* Three Levels of operational risk management */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity. Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff Operational risk management must spread over all these three levels, in order to be more effective and efficient

Risk management does not tell you to take a number of actions to tackel or facilitate an unexpected situation. It is a framework that helps you to apply leadership at all levels to meet project's requirements and to improve the project's result.

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:51:41Z

Saeh0803: /* Three Levels of operational risk management */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.
At this level, top managers should not expect that all process would be accomplished without defects, free errors, flaws or less than perfect projects, demanding such a standard leads to over management and paralysis. It creates nervous leaders, that can be afraid to make tough decisions in crisis and unwilling to take risks necessary for success in projects, In this level op managers must be aware of risk management, understand it and must be ready to support a project manager’s decision in those situations. The top managers must accept that things may go wrong, even if a project manager has a lot of experience and knowledge in that area. In this level the risks has a very high impact in the organization, because you will define the risks based on your Business Plan and Processes, where strategic goals are defined. These risks are expected to be managed by the organization’s CEO [Operational Risk Management, February 2002]

* Tactical level

At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the projects. It provides the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project.
There always should be a connection between strategic and tactical level, the vision or mission statements defines in strategic level and the projects, programmes, their deliverables and its requirements describes in tactical level. Many projects fail because of less communication between strategic vision and tactical project deliverables and requirements. [Integrated Risk Management, as a framework for Organizational Success].

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:35:00Z

Saeh0803: /* Benefit of risk management */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. These four factors are a part of [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse]. By identifying your projects strengths and opportunities you can reduce the weaknesses and threats and there by your project’s risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management]. There are many reasons for managing risks. Here are some main reasons: First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those [Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:32:35Z

Saeh0803: /* What is risk? */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:29:43Z

Saeh0803: /* Definition of risk management */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].

Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].

To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:28:59Z

Saeh0803: /* Definition of risk management */

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management] Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
Frank Knigh’s definition is more useful according to project, program and portfolio management. In many projects, risk is the uncertainty, which is associated with any kind of the action and projects in organization’s context that must understand and effectively manage during the project’s process and improve the results [Luce and Raiffa].
Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project. Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management,concepts and methods].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it. Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects. It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on. It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-30T19:27:27Z

Saeh0803:

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it. Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011]. This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Talk:Risk management

2014-11-29T17:57:57Z

Saeh0803: /* s132463 Review */

== Sube - Review ==

Greetings Risk management writer

* Answer: Hi :)

First of all, congratulation you wrote you first wiki style article!
* Answer: Thanks :)

Second, NOTE that the text flows to the right... I do not know how to fix this...
* Answer: Check

* Your english is pretty good and understandable:)

* Answer: Thanks

* General speaking. Be more concrete about what you are writing, remember the reader do not know what you have in mind when writing it...
Ex. First line "abstract" ''...in each area.''
- which areas... This issue is present around the article. And improved, would make it much more reader freindly.

* Answer: this is now corrected and described more specific.

* Try to make the text more compressed and concrete. Words and add-on words that dont add value to the sentence should more or less not be there.

* Take note of long sentences try to rewrite or divide them... They are present:)
* Answer: check :) I try to rewrite and make my sentences shorter

* Maybe use some example of best practice cases to further inhance the truthness of your writing.
* Answer: I will try to fine some good examples, you are right, it could be more interesting

* A suggestion; Have you heart about Monte Carlo Method regarding Risk Management/Analysis. This perspective could be interesting.

* Yes, I have, I will use it in my article :)

----
'''Abstract'''
- To start with I would place the abstract in the beginning of the document, followed by a table of content...

- Moreover, I would add a general introduction, maybe without heading, to explain why risk management is important, this way make the reader more intreaked.

- I think the Abstract could be rewritten, if you catch the reader here they will read the entire thing:)

----
'''Defination'''
- Titles... Definition is spelled like this, you do spell it right in the text though:) then definition of what? I would call it "Risk Management"

* Answer: Corrected :)

----
'''What is risk'''

- What is risk is a question and whould be ended with ?. Maybe Definition of risk instead...
When talking about the word risk,I would put the topic before Defination, as is explain some aspects of this topic.

* Answer: HMMM, I think I do this part a bit different, because I released that Definition and what is the risk is same :)

----
'''Benefit of risk management and why risk management'''
- Titles... Revisit; "Benefit of risk management and why risk management", title cuold be more focused. You dont really answer why risk management?.

* Answer: actually, benefit of risk is answer of why risk, because, you chose to define the risks, so you have benefit of it, but maybe I can be more specific :)

First line isnt that a SWOT. Maybe: risk managment do the same as a SWOT analysis, by evaluating both S, W, T and O ... And why does is avaluate this?

*Answer: YES, it is SWOT, and I will reference to SWOT, maybe its a good idea and help reader.

- Reference .16. "There are many reasons to manage risk" - is it where the benefits come from`?
Then I would move the reference. Otherwise I think it is a wierd reference:)

- Small Note: . after the first 7 bullet points none after...

* Answer: YES, thanks :)

----
'''Three levels of operational risk management'''
- Honestly I think this part is vaid. Maybe rearrange to focus on projects, programs and portfolio? What are the risks here
* I try to fine some examples in all three levels, if I could, then I will remove this part :)

- Another thing i notest, isnt it called; Strategic, Tactical and Operational level?

* Answer: yes you are right, it is corrected :)

----
'''How to develop a risk analysis'''
- First line... Again be specific ex. Risk can develop in two different ways... Risk Management can be developed in ....

* Answer: Check

I think the second way (second bulletpoing) is nonsence, dont get me wrong:)

* Answer: Actually, that is a part of guide, its not something I found out :)

- What is M_O_R? or what does it stand for?
* Answer: I will add this, thanks :)

- Good with ISO standarts:) Maybe make a list: ISO blabla - does this/provides this ect.
I suggest in bulletpoints. This would make it more illustrative and as a reader it provides a nice overview...

* Answer: I add a table, which shows differences between M_O_R and ISO. it can help reader to chose the correct framework :)
----
'''An example on how to identify your projects risks'''
- Title:) Risk Management in Practice - just a suggestion from my side.

* Thanks :) I used your suggestion :)

- It would be more appropriate in bulletpoints suplemented by text. Step by step what do you have to do?

I would add a wrapup to end the article, somehow answering what you tried to figure out...

* Answer: I think it is difficult to explain it with bulletpoints, thats why I tried to explain it in shorts

Hope you can use atleast some of my review... Good Luck Have Fun:)

* Answer: Thanks for your feedback, it helps me a lot to improve my article. You pointed those points that I didn't were aware of :)

thanks alot once again
have a nice weekend
Best regards
Saeh0803

== s132463 Review ==

* Hi S132463 :)

I like that you aim at defining risk and risk management before going into concrete examples. Also the use of many sources is good, as it gives the reader opportunity to read more on the topic. Maybe use more journal article style as references, rather than e-newspaper articles. Empirical evidence and good research is preferable.

* Answer: Thanks :) My references were not finished in that time, so now I changed style of it :)

However, I see the article as a whole having the following general flaws:
*The is no distinct red-thread through the article. I can see what you are trying to do, and I think the general layout/chapters are a good idea. The chapters just do not link in any way. Make sure to finish each chapter with some sort of conclusion, to clearly state what is learned.

* Answer: Actually the headlines are more in order and there is a connection between them, thats why I didn't make a connections between the text

*Many of the first chapters pretty much say the same thing, with minor changes. Be sure to write about the specific topic within the headline of the chapter. No information should be stated twice, unless it is in relation/discussion with something new.

* Answer: I reread it again an try to delete the parts which are repeated :)

*References should be done in wiki style references and with appropriate annotation of source (author(s), year, journal name, etc.).
**<nowiki><ref name=RefName>Information here. This is what can be found in the bottom.</ref></nowiki>
**You can reference to the same by using the "RefName" like this: <nowiki><ref name=RefName></ref></nowiki>. Be aware that Ref-names are case sensitive.
**Include </references> at the bottom of your page to get all reference information shown
*Include categories to your article (see front page here on the apppm.wiki). fx <nowiki>[[Category:Uncertainty]]</nowiki>. This should just be added somewhere in the wiki-code. Maybe as the very last.

* Answer: check

=== "Introduction" ===
* You write "...this article focuses on for example...". I think the focus of the article should be clearly stated, not mentioned as an example
* The NOTE at the end should link to the actual wiki pages (link by typing <nowiki>[["Category Name"]] fx. [[Risk management]]</nowiki> , beware that page names are case sensitive). Link to this page: [[Risk management]]

* Answer Done :)

=== Definition of risk management ===
I like the general idea of starting with description of risk, then risk management and how risk assesment is used.

* Answer: thanks :)

*I find the start of this chapter to be fine, but when you spend a lot of different sources to define risk in different ways, you should briefly discuss what the differences on the definitions actually mean. What definition do you assume?

* Answer: I will do

*The second part where you talk about how risk management is used, you can be a bit more direct in your description. I'm not quite sure what direction you try to direct my attention/understanding. Try to clearly answer: How is risk used? Why is risk used? What implications when using? What implications when not using? etc. - I can see what you try to do, but the red thread is a bit hard to find when reading it.

=== What is risk ===
*Again I am not 100% sure what you are trying to tell me as the reader. Defining the risk (again again)? Talking about what risk can actually be? I suggest you describe more different actual examples of risk (like the example of 6/12 months) and then call the chapter "Examples of Risk"

* Answer: Actually you are right, the definition and what is risk is same, I try to change this part.

=== Benefit of risk management and why risk management ===
*Nice with a bullet list of benefits, but I miss some sort of conclusion or specific declaration of "why risk management".
*Reference on bullets?

=== Three levels of operational risk management ===
*Strategic level:
**What is risk demand? why does strategic operational relate to this? I think this should be stated more clearly
**I find it somewhat unclear what risk management at the strategic level actually is. Try to be clear in your definitions.
*Tactical level:

I will do

**I find the information to be okay. However, this specific chapter is not very well-written. Consider rewriting to make sure the reader understand what you try to convey.

*Dynamic level:
**What is the dynamic level? Normally I would think strategic, tactical, and operational are the three organisational levels.

Answer: Corrected

=== How to develop a risk analysis ===
*I suppose first line should be: Risk analysis can develop in two different ways
*The comparison of ISO 31010 and M_O_R is a bit hard to follow. Be clear about what the differences are. Maybe set up a table, similar points of explanation or similar, and then do the comparison and discussion of differences.

* Answer I add a table, which shows the differences of it, thanks :)

=== An example of how to identify your project's risk ===
*What source(s) is/(are) used here?
* Answer: Actually, I tried to write the way I do, when I make a risk analyse, and I don't know which source I should use, because its something I found by myself.. 1. brainstorm- 2. prioritize the risk 3. assign each risk to a group member after their experience and skills. but yea I used the risk Matrix.

*I like the idea of describing an example of how to identify risk. However, the example is very short and provides very little information. Consider what you want to say with this chapter.

*Answer, Thanks :) okay I try

*The "second part" where you describe how risk should be assigned; Is that really a general way of doing risk analysis?
* Answer, maybe :)

*Try to combine the knowledge gained through previous chapters in this example. Since this ends the article, it should act as a conclusion/sum-up of important knowledge gained through the entire article

*Pictures should contain a text description. Also, are the pictures covered by copyright?

* Answer: It is something I done by myself, so its not something I copied from anything or any place, thats why I don't have any reference on it.

== TigR helping ==

I thought you might want to use this picture: http://apppm.man.dtu.dk/index.php/File:Risk_Management_from_ISO31000.JPG
I use a version of it in my article on Risk Analysis.. (also consider linking to my article where it is applicable. :)
Also.. you might not want to be too detailed on the "Risk Analysis" part.. instead let me know if I have missed out on some points which you mention.

Answer: Thanks, I referenced to your article now :) and yea I didn't went in too detail on risk analysis, because you are writing about it, but thanks for the idea :)

hilsen
Saeh0803

Talk:Risk management

2014-11-29T17:56:47Z

Saeh0803: /* TigR helping */

== Sube - Review ==

Greetings Risk management writer

* Answer: Hi :)

First of all, congratulation you wrote you first wiki style article!
* Answer: Thanks :)

Second, NOTE that the text flows to the right... I do not know how to fix this...
* Answer: Check

* Your english is pretty good and understandable:)

* Answer: Thanks

* General speaking. Be more concrete about what you are writing, remember the reader do not know what you have in mind when writing it...
Ex. First line "abstract" ''...in each area.''
- which areas... This issue is present around the article. And improved, would make it much more reader freindly.

* Answer: this is now corrected and described more specific.

* Try to make the text more compressed and concrete. Words and add-on words that dont add value to the sentence should more or less not be there.

* Take note of long sentences try to rewrite or divide them... They are present:)
* Answer: check :) I try to rewrite and make my sentences shorter

* Maybe use some example of best practice cases to further inhance the truthness of your writing.
* Answer: I will try to fine some good examples, you are right, it could be more interesting

* A suggestion; Have you heart about Monte Carlo Method regarding Risk Management/Analysis. This perspective could be interesting.

* Yes, I have, I will use it in my article :)

----
'''Abstract'''
- To start with I would place the abstract in the beginning of the document, followed by a table of content...

- Moreover, I would add a general introduction, maybe without heading, to explain why risk management is important, this way make the reader more intreaked.

- I think the Abstract could be rewritten, if you catch the reader here they will read the entire thing:)

----
'''Defination'''
- Titles... Definition is spelled like this, you do spell it right in the text though:) then definition of what? I would call it "Risk Management"

* Answer: Corrected :)

----
'''What is risk'''

- What is risk is a question and whould be ended with ?. Maybe Definition of risk instead...
When talking about the word risk,I would put the topic before Defination, as is explain some aspects of this topic.

* Answer: HMMM, I think I do this part a bit different, because I released that Definition and what is the risk is same :)

----
'''Benefit of risk management and why risk management'''
- Titles... Revisit; "Benefit of risk management and why risk management", title cuold be more focused. You dont really answer why risk management?.

* Answer: actually, benefit of risk is answer of why risk, because, you chose to define the risks, so you have benefit of it, but maybe I can be more specific :)

First line isnt that a SWOT. Maybe: risk managment do the same as a SWOT analysis, by evaluating both S, W, T and O ... And why does is avaluate this?

*Answer: YES, it is SWOT, and I will reference to SWOT, maybe its a good idea and help reader.

- Reference .16. "There are many reasons to manage risk" - is it where the benefits come from`?
Then I would move the reference. Otherwise I think it is a wierd reference:)

- Small Note: . after the first 7 bullet points none after...

* Answer: YES, thanks :)

----
'''Three levels of operational risk management'''
- Honestly I think this part is vaid. Maybe rearrange to focus on projects, programs and portfolio? What are the risks here
* I try to fine some examples in all three levels, if I could, then I will remove this part :)

- Another thing i notest, isnt it called; Strategic, Tactical and Operational level?

* Answer: yes you are right, it is corrected :)

----
'''How to develop a risk analysis'''
- First line... Again be specific ex. Risk can develop in two different ways... Risk Management can be developed in ....

* Answer: Check

I think the second way (second bulletpoing) is nonsence, dont get me wrong:)

* Answer: Actually, that is a part of guide, its not something I found out :)

- What is M_O_R? or what does it stand for?
* Answer: I will add this, thanks :)

- Good with ISO standarts:) Maybe make a list: ISO blabla - does this/provides this ect.
I suggest in bulletpoints. This would make it more illustrative and as a reader it provides a nice overview...

* Answer: I add a table, which shows differences between M_O_R and ISO. it can help reader to chose the correct framework :)
----
'''An example on how to identify your projects risks'''
- Title:) Risk Management in Practice - just a suggestion from my side.

* Thanks :) I used your suggestion :)

- It would be more appropriate in bulletpoints suplemented by text. Step by step what do you have to do?

I would add a wrapup to end the article, somehow answering what you tried to figure out...

* Answer: I think it is difficult to explain it with bulletpoints, thats why I tried to explain it in shorts

Hope you can use atleast some of my review... Good Luck Have Fun:)

* Answer: Thanks for your feedback, it helps me a lot to improve my article. You pointed those points that I didn't were aware of :)

thanks alot once again
have a nice weekend
Best regards
Saeh0803

== s132463 Review ==

* Hi S132463 :)

I like that you aim at defining risk and risk management before going into concrete examples. Also the use of many sources is good, as it gives the reader opportunity to read more on the topic. Maybe use more journal article style as references, rather than e-newspaper articles. Empirical evidence and good research is preferable.

* Answer: Thanks :) My references were not finished in that time, so now I changed style of it :)

However, I see the article as a whole having the following general flaws:
*The is no distinct red-thread through the article. I can see what you are trying to do, and I think the general layout/chapters are a good idea. The chapters just do not link in any way. Make sure to finish each chapter with some sort of conclusion, to clearly state what is learned.

* Answer: Actually the headlines are more in order and there is a connection between them, thats why I didn't make a connections between the text

*Many of the first chapters pretty much say the same thing, with minor changes. Be sure to write about the specific topic within the headline of the chapter. No information should be stated twice, unless it is in relation/discussion with something new.

* Answer: I reread it again an try to delete the parts which are repeated :)

*References should be done in wiki style references and with appropriate annotation of source (author(s), year, journal name, etc.).
**<nowiki><ref name=RefName>Information here. This is what can be found in the bottom.</ref></nowiki>
**You can reference to the same by using the "RefName" like this: <nowiki><ref name=RefName></ref></nowiki>. Be aware that Ref-names are case sensitive.
**Include </references> at the bottom of your page to get all reference information shown
*Include categories to your article (see front page here on the apppm.wiki). fx <nowiki>[[Category:Uncertainty]]</nowiki>. This should just be added somewhere in the wiki-code. Maybe as the very last.

* check

=== "Introduction" ===
* You write "...this article focuses on for example...". I think the focus of the article should be clearly stated, not mentioned as an example
* The NOTE at the end should link to the actual wiki pages (link by typing <nowiki>[["Category Name"]] fx. [[Risk management]]</nowiki> , beware that page names are case sensitive). Link to this page: [[Risk management]]

* Answer Done :)

=== Definition of risk management ===
I like the general idea of starting with description of risk, then risk management and how risk assesment is used.

* Answer: thanks :)

*I find the start of this chapter to be fine, but when you spend a lot of different sources to define risk in different ways, you should briefly discuss what the differences on the definitions actually mean. What definition do you assume?

* Answer: I will do

*The second part where you talk about how risk management is used, you can be a bit more direct in your description. I'm not quite sure what direction you try to direct my attention/understanding. Try to clearly answer: How is risk used? Why is risk used? What implications when using? What implications when not using? etc. - I can see what you try to do, but the red thread is a bit hard to find when reading it.

=== What is risk ===
*Again I am not 100% sure what you are trying to tell me as the reader. Defining the risk (again again)? Talking about what risk can actually be? I suggest you describe more different actual examples of risk (like the example of 6/12 months) and then call the chapter "Examples of Risk"

* Answer: Actually you are right, the definition and what is risk is same, I try to change this part.

=== Benefit of risk management and why risk management ===
*Nice with a bullet list of benefits, but I miss some sort of conclusion or specific declaration of "why risk management".
*Reference on bullets?

=== Three levels of operational risk management ===
*Strategic level:
**What is risk demand? why does strategic operational relate to this? I think this should be stated more clearly
**I find it somewhat unclear what risk management at the strategic level actually is. Try to be clear in your definitions.
*Tactical level:

I will do

**I find the information to be okay. However, this specific chapter is not very well-written. Consider rewriting to make sure the reader understand what you try to convey.

*Dynamic level:
**What is the dynamic level? Normally I would think strategic, tactical, and operational are the three organisational levels.

Answer: Corrected

=== How to develop a risk analysis ===
*I suppose first line should be: Risk analysis can develop in two different ways
*The comparison of ISO 31010 and M_O_R is a bit hard to follow. Be clear about what the differences are. Maybe set up a table, similar points of explanation or similar, and then do the comparison and discussion of differences.

* Answer I add a table, which shows the differences of it, thanks :)

=== An example of how to identify your project's risk ===
*What source(s) is/(are) used here?
* Answer: Actually, I tried to write the way I do, when I make a risk analyse, and I don't know which source I should use, because its something I found by myself.. 1. brainstorm- 2. prioritize the risk 3. assign each risk to a group member after their experience and skills. but yea I used the risk Matrix.

*I like the idea of describing an example of how to identify risk. However, the example is very short and provides very little information. Consider what you want to say with this chapter.

*Answer, Thanks :) okay I try

*The "second part" where you describe how risk should be assigned; Is that really a general way of doing risk analysis?
* Answer, maybe :)

*Try to combine the knowledge gained through previous chapters in this example. Since this ends the article, it should act as a conclusion/sum-up of important knowledge gained through the entire article

*Pictures should contain a text description. Also, are the pictures covered by copyright?

* Answer: It is something I done by myself, so its not something I copied from anything or any place, thats why I don't have any reference on it.

== TigR helping ==

I thought you might want to use this picture: http://apppm.man.dtu.dk/index.php/File:Risk_Management_from_ISO31000.JPG
I use a version of it in my article on Risk Analysis.. (also consider linking to my article where it is applicable. :)
Also.. you might not want to be too detailed on the "Risk Analysis" part.. instead let me know if I have missed out on some points which you mention.

Answer: Thanks, I referenced to your article now :) and yea I didn't went in too detail on risk analysis, because you are writing about it, but thanks for the idea :)

hilsen
Saeh0803

Talk:Risk management

2014-11-29T17:48:10Z

Saeh0803: /* s132463 Review */

== Sube - Review ==

Greetings Risk management writer

* Answer: Hi :)

First of all, congratulation you wrote you first wiki style article!
* Answer: Thanks :)

Second, NOTE that the text flows to the right... I do not know how to fix this...
* Answer: Check

* Your english is pretty good and understandable:)

* Answer: Thanks

* General speaking. Be more concrete about what you are writing, remember the reader do not know what you have in mind when writing it...
Ex. First line "abstract" ''...in each area.''
- which areas... This issue is present around the article. And improved, would make it much more reader freindly.

* Answer: this is now corrected and described more specific.

* Try to make the text more compressed and concrete. Words and add-on words that dont add value to the sentence should more or less not be there.

* Take note of long sentences try to rewrite or divide them... They are present:)
* Answer: check :) I try to rewrite and make my sentences shorter

* Maybe use some example of best practice cases to further inhance the truthness of your writing.
* Answer: I will try to fine some good examples, you are right, it could be more interesting

* A suggestion; Have you heart about Monte Carlo Method regarding Risk Management/Analysis. This perspective could be interesting.

* Yes, I have, I will use it in my article :)

----
'''Abstract'''
- To start with I would place the abstract in the beginning of the document, followed by a table of content...

- Moreover, I would add a general introduction, maybe without heading, to explain why risk management is important, this way make the reader more intreaked.

- I think the Abstract could be rewritten, if you catch the reader here they will read the entire thing:)

----
'''Defination'''
- Titles... Definition is spelled like this, you do spell it right in the text though:) then definition of what? I would call it "Risk Management"

* Answer: Corrected :)

----
'''What is risk'''

- What is risk is a question and whould be ended with ?. Maybe Definition of risk instead...
When talking about the word risk,I would put the topic before Defination, as is explain some aspects of this topic.

* Answer: HMMM, I think I do this part a bit different, because I released that Definition and what is the risk is same :)

----
'''Benefit of risk management and why risk management'''
- Titles... Revisit; "Benefit of risk management and why risk management", title cuold be more focused. You dont really answer why risk management?.

* Answer: actually, benefit of risk is answer of why risk, because, you chose to define the risks, so you have benefit of it, but maybe I can be more specific :)

First line isnt that a SWOT. Maybe: risk managment do the same as a SWOT analysis, by evaluating both S, W, T and O ... And why does is avaluate this?

*Answer: YES, it is SWOT, and I will reference to SWOT, maybe its a good idea and help reader.

- Reference .16. "There are many reasons to manage risk" - is it where the benefits come from`?
Then I would move the reference. Otherwise I think it is a wierd reference:)

- Small Note: . after the first 7 bullet points none after...

* Answer: YES, thanks :)

----
'''Three levels of operational risk management'''
- Honestly I think this part is vaid. Maybe rearrange to focus on projects, programs and portfolio? What are the risks here
* I try to fine some examples in all three levels, if I could, then I will remove this part :)

- Another thing i notest, isnt it called; Strategic, Tactical and Operational level?

* Answer: yes you are right, it is corrected :)

----
'''How to develop a risk analysis'''
- First line... Again be specific ex. Risk can develop in two different ways... Risk Management can be developed in ....

* Answer: Check

I think the second way (second bulletpoing) is nonsence, dont get me wrong:)

* Answer: Actually, that is a part of guide, its not something I found out :)

- What is M_O_R? or what does it stand for?
* Answer: I will add this, thanks :)

- Good with ISO standarts:) Maybe make a list: ISO blabla - does this/provides this ect.
I suggest in bulletpoints. This would make it more illustrative and as a reader it provides a nice overview...

* Answer: I add a table, which shows differences between M_O_R and ISO. it can help reader to chose the correct framework :)
----
'''An example on how to identify your projects risks'''
- Title:) Risk Management in Practice - just a suggestion from my side.

* Thanks :) I used your suggestion :)

- It would be more appropriate in bulletpoints suplemented by text. Step by step what do you have to do?

I would add a wrapup to end the article, somehow answering what you tried to figure out...

* Answer: I think it is difficult to explain it with bulletpoints, thats why I tried to explain it in shorts

Hope you can use atleast some of my review... Good Luck Have Fun:)

* Answer: Thanks for your feedback, it helps me a lot to improve my article. You pointed those points that I didn't were aware of :)

thanks alot once again
have a nice weekend
Best regards
Saeh0803

== s132463 Review ==

* Hi S132463 :)

I like that you aim at defining risk and risk management before going into concrete examples. Also the use of many sources is good, as it gives the reader opportunity to read more on the topic. Maybe use more journal article style as references, rather than e-newspaper articles. Empirical evidence and good research is preferable.

* Answer: Thanks :) My references were not finished in that time, so now I changed style of it :)

However, I see the article as a whole having the following general flaws:
*The is no distinct red-thread through the article. I can see what you are trying to do, and I think the general layout/chapters are a good idea. The chapters just do not link in any way. Make sure to finish each chapter with some sort of conclusion, to clearly state what is learned.

* Answer: Actually the headlines are more in order and there is a connection between them, thats why I didn't make a connections between the text

*Many of the first chapters pretty much say the same thing, with minor changes. Be sure to write about the specific topic within the headline of the chapter. No information should be stated twice, unless it is in relation/discussion with something new.

* Answer: I reread it again an try to delete the parts which are repeated :)

*References should be done in wiki style references and with appropriate annotation of source (author(s), year, journal name, etc.).
**<nowiki><ref name=RefName>Information here. This is what can be found in the bottom.</ref></nowiki>
**You can reference to the same by using the "RefName" like this: <nowiki><ref name=RefName></ref></nowiki>. Be aware that Ref-names are case sensitive.
**Include </references> at the bottom of your page to get all reference information shown
*Include categories to your article (see front page here on the apppm.wiki). fx <nowiki>[[Category:Uncertainty]]</nowiki>. This should just be added somewhere in the wiki-code. Maybe as the very last.

* check

=== "Introduction" ===
* You write "...this article focuses on for example...". I think the focus of the article should be clearly stated, not mentioned as an example
* The NOTE at the end should link to the actual wiki pages (link by typing <nowiki>[["Category Name"]] fx. [[Risk management]]</nowiki> , beware that page names are case sensitive). Link to this page: [[Risk management]]

* Answer Done :)

=== Definition of risk management ===
I like the general idea of starting with description of risk, then risk management and how risk assesment is used.

* Answer: thanks :)

*I find the start of this chapter to be fine, but when you spend a lot of different sources to define risk in different ways, you should briefly discuss what the differences on the definitions actually mean. What definition do you assume?

* Answer: I will do

*The second part where you talk about how risk management is used, you can be a bit more direct in your description. I'm not quite sure what direction you try to direct my attention/understanding. Try to clearly answer: How is risk used? Why is risk used? What implications when using? What implications when not using? etc. - I can see what you try to do, but the red thread is a bit hard to find when reading it.

=== What is risk ===
*Again I am not 100% sure what you are trying to tell me as the reader. Defining the risk (again again)? Talking about what risk can actually be? I suggest you describe more different actual examples of risk (like the example of 6/12 months) and then call the chapter "Examples of Risk"

* Answer: Actually you are right, the definition and what is risk is same, I try to change this part.

=== Benefit of risk management and why risk management ===
*Nice with a bullet list of benefits, but I miss some sort of conclusion or specific declaration of "why risk management".
*Reference on bullets?

=== Three levels of operational risk management ===
*Strategic level:
**What is risk demand? why does strategic operational relate to this? I think this should be stated more clearly
**I find it somewhat unclear what risk management at the strategic level actually is. Try to be clear in your definitions.
*Tactical level:

I will do

**I find the information to be okay. However, this specific chapter is not very well-written. Consider rewriting to make sure the reader understand what you try to convey.

*Dynamic level:
**What is the dynamic level? Normally I would think strategic, tactical, and operational are the three organisational levels.

Answer: Corrected

=== How to develop a risk analysis ===
*I suppose first line should be: Risk analysis can develop in two different ways
*The comparison of ISO 31010 and M_O_R is a bit hard to follow. Be clear about what the differences are. Maybe set up a table, similar points of explanation or similar, and then do the comparison and discussion of differences.

* Answer I add a table, which shows the differences of it, thanks :)

=== An example of how to identify your project's risk ===
*What source(s) is/(are) used here?
* Answer: Actually, I tried to write the way I do, when I make a risk analyse, and I don't know which source I should use, because its something I found by myself.. 1. brainstorm- 2. prioritize the risk 3. assign each risk to a group member after their experience and skills. but yea I used the risk Matrix.

*I like the idea of describing an example of how to identify risk. However, the example is very short and provides very little information. Consider what you want to say with this chapter.

*Answer, Thanks :) okay I try

*The "second part" where you describe how risk should be assigned; Is that really a general way of doing risk analysis?
* Answer, maybe :)

*Try to combine the knowledge gained through previous chapters in this example. Since this ends the article, it should act as a conclusion/sum-up of important knowledge gained through the entire article

*Pictures should contain a text description. Also, are the pictures covered by copyright?

* Answer: It is something I done by myself, so its not something I copied from anything or any place, thats why I don't have any reference on it.

== TigR helping ==

I thought you might want to use this picture: http://apppm.man.dtu.dk/index.php/File:Risk_Management_from_ISO31000.JPG
I use a version of it in my article on Risk Analysis.. (also consider linking to my article where it is applicable. :)
Also.. you might not want to be too detailed on the "Risk Analysis" part.. instead let me know if I have missed out on some points which you mention.

Risk management

2014-11-29T17:26:11Z

Saeh0803:

[http://en.wikipedia.org/wiki/Risk_management Risk management] is a very interesting and important topic both in our private and professional life. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on how an organization or project handles its risks and which framework could be relevant or helpful for it.

Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].

This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-29T17:23:54Z

Saeh0803:

Risk management is a very interesting and important topic both in our private and professional life. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on how an organization or project handles its risks and which framework could be relevant or helpful for it.

Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].

This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Talk:Risk management

2014-11-29T17:00:31Z

Saeh0803: /* Sube - Review */

== Sube - Review ==

Greetings Risk management writer

* Answer: Hi :)

First of all, congratulation you wrote you first wiki style article!
* Answer: Thanks :)

Second, NOTE that the text flows to the right... I do not know how to fix this...
* Answer: Check

* Your english is pretty good and understandable:)

* Answer: Thanks

* General speaking. Be more concrete about what you are writing, remember the reader do not know what you have in mind when writing it...
Ex. First line "abstract" ''...in each area.''
- which areas... This issue is present around the article. And improved, would make it much more reader freindly.

* Answer: this is now corrected and described more specific.

* Try to make the text more compressed and concrete. Words and add-on words that dont add value to the sentence should more or less not be there.

* Take note of long sentences try to rewrite or divide them... They are present:)
* Answer: check :) I try to rewrite and make my sentences shorter

* Maybe use some example of best practice cases to further inhance the truthness of your writing.
* Answer: I will try to fine some good examples, you are right, it could be more interesting

* A suggestion; Have you heart about Monte Carlo Method regarding Risk Management/Analysis. This perspective could be interesting.

* Yes, I have, I will use it in my article :)

----
'''Abstract'''
- To start with I would place the abstract in the beginning of the document, followed by a table of content...

- Moreover, I would add a general introduction, maybe without heading, to explain why risk management is important, this way make the reader more intreaked.

- I think the Abstract could be rewritten, if you catch the reader here they will read the entire thing:)

----
'''Defination'''
- Titles... Definition is spelled like this, you do spell it right in the text though:) then definition of what? I would call it "Risk Management"

* Answer: Corrected :)

----
'''What is risk'''

- What is risk is a question and whould be ended with ?. Maybe Definition of risk instead...
When talking about the word risk,I would put the topic before Defination, as is explain some aspects of this topic.

* Answer: HMMM, I think I do this part a bit different, because I released that Definition and what is the risk is same :)

----
'''Benefit of risk management and why risk management'''
- Titles... Revisit; "Benefit of risk management and why risk management", title cuold be more focused. You dont really answer why risk management?.

* Answer: actually, benefit of risk is answer of why risk, because, you chose to define the risks, so you have benefit of it, but maybe I can be more specific :)

First line isnt that a SWOT. Maybe: risk managment do the same as a SWOT analysis, by evaluating both S, W, T and O ... And why does is avaluate this?

*Answer: YES, it is SWOT, and I will reference to SWOT, maybe its a good idea and help reader.

- Reference .16. "There are many reasons to manage risk" - is it where the benefits come from`?
Then I would move the reference. Otherwise I think it is a wierd reference:)

- Small Note: . after the first 7 bullet points none after...

* Answer: YES, thanks :)

----
'''Three levels of operational risk management'''
- Honestly I think this part is vaid. Maybe rearrange to focus on projects, programs and portfolio? What are the risks here
* I try to fine some examples in all three levels, if I could, then I will remove this part :)

- Another thing i notest, isnt it called; Strategic, Tactical and Operational level?

* Answer: yes you are right, it is corrected :)

----
'''How to develop a risk analysis'''
- First line... Again be specific ex. Risk can develop in two different ways... Risk Management can be developed in ....

* Answer: Check

I think the second way (second bulletpoing) is nonsence, dont get me wrong:)

* Answer: Actually, that is a part of guide, its not something I found out :)

- What is M_O_R? or what does it stand for?
* Answer: I will add this, thanks :)

- Good with ISO standarts:) Maybe make a list: ISO blabla - does this/provides this ect.
I suggest in bulletpoints. This would make it more illustrative and as a reader it provides a nice overview...

* Answer: I add a table, which shows differences between M_O_R and ISO. it can help reader to chose the correct framework :)
----
'''An example on how to identify your projects risks'''
- Title:) Risk Management in Practice - just a suggestion from my side.

* Thanks :) I used your suggestion :)

- It would be more appropriate in bulletpoints suplemented by text. Step by step what do you have to do?

I would add a wrapup to end the article, somehow answering what you tried to figure out...

* Answer: I think it is difficult to explain it with bulletpoints, thats why I tried to explain it in shorts

Hope you can use atleast some of my review... Good Luck Have Fun:)

* Answer: Thanks for your feedback, it helps me a lot to improve my article. You pointed those points that I didn't were aware of :)

thanks alot once again
have a nice weekend
Best regards
Saeh0803

== s132463 Review ==
I like that you aim at defining risk and risk management before going into concrete examples. Also the use of many sources is good, as it gives the reader opportunity to read more on the topic. Maybe use more journal article style as references, rather than e-newspaper articles. Empirical evidence and good research is preferable.

However, I see the article as a whole having the following general flaws:
*The is no distinct red-thread through the article. I can see what you are trying to do, and I think the general layout/chapters are a good idea. The chapters just do not link in any way. Make sure to finish each chapter with some sort of conclusion, to clearly state what is learned.
*Many of the first chapters pretty much say the same thing, with minor changes. Be sure to write about the specific topic within the headline of the chapter. No information should be stated twice, unless it is in relation/discussion with something new.
*References should be done in wiki style references and with appropriate annotation of source (author(s), year, journal name, etc.).
**<nowiki><ref name=RefName>Information here. This is what can be found in the bottom.</ref></nowiki>
**You can reference to the same by using the "RefName" like this: <nowiki><ref name=RefName></ref></nowiki>. Be aware that Ref-names are case sensitive.
**Include </references> at the bottom of your page to get all reference information shown
*Include categories to your article (see front page here on the apppm.wiki). fx <nowiki>[[Category:Uncertainty]]</nowiki>. This should just be added somewhere in the wiki-code. Maybe as the very last.

=== "Introduction" ===
* You write "...this article focuses on for example...". I think the focus of the article should be clearly stated, not mentioned as an example
* The NOTE at the end should link to the actual wiki pages (link by typing <nowiki>[["Category Name"]] fx. [[Risk management]]</nowiki> , beware that page names are case sensitive). Link to this page: [[Risk management]]

=== Definition of risk management ===
I like the general idea of starting with description of risk, then risk management and how risk assesment is used.

*I find the start of this chapter to be fine, but when you spend a lot of different sources to define risk in different ways, you should briefly discuss what the differences on the definitions actually mean. What definition do you assume?
*The second part where you talk about how risk management is used, you can be a bit more direct in your description. I'm not quite sure what direction you try to direct my attention/understanding. Try to clearly answer: How is risk used? Why is risk used? What implications when using? What implications when not using? etc. - I can see what you try to do, but the red thread is a bit hard to find when reading it.

=== What is risk ===
*Again I am not 100% sure what you are trying to tell me as the reader. Defining the risk (again again)? Talking about what risk can actually be? I suggest you describe more different actual examples of risk (like the example of 6/12 months) and then call the chapter "Examples of Risk"

=== Benefit of risk management and why risk management ===
*Nice with a bullet list of benefits, but I miss some sort of conclusion or specific declaration of "why risk management".
*Reference on bullets?

=== Three levels of operational risk management ===
*Strategic level:
**What is risk demand? why does strategic operational relate to this? I think this should be stated more clearly
**I find it somewhat unclear what risk management at the strategic level actually is. Try to be clear in your definitions.
*Tactical level:
**I find the information to be okay. However, this specific chapter is not very well-written. Consider rewriting to make sure the reader understand what you try to convey.
*Dynamic level:
**What is the dynamic level? Normally I would think strategic, tactical, and operational are the three organisational levels.

=== How to develop a risk analysis ===
*I suppose first line should be: Risk analysis can develop in two different ways
*The comparison of ISO 31010 and M_O_R is a bit hard to follow. Be clear about what the differences are. Maybe set up a table, similar points of explanation or similar, and then do the comparison and discussion of differences.

=== An example of how to identify your project's risk ===
*What source(s) is/(are) used here?
*I like the idea of describing an example of how to identify risk. However, the example is very short and provides very little information. Consider what you want to say with this chapter.
*The "second part" where you describe how risk should be assigned; Is that really a general way of doing risk analysis?
*Try to combine the knowledge gained through previous chapters in this example. Since this ends the article, it should act as a conclusion/sum-up of important knowledge gained through the entire article
*Pictures should contain a text description. Also, are the pictures covered by copyright?

== TigR helping ==

I thought you might want to use this picture: http://apppm.man.dtu.dk/index.php/File:Risk_Management_from_ISO31000.JPG
I use a version of it in my article on Risk Analysis.. (also consider linking to my article where it is applicable. :)
Also.. you might not want to be too detailed on the "Risk Analysis" part.. instead let me know if I have missed out on some points which you mention.

Risk management

2014-11-29T16:24:47Z

Saeh0803:

Risk management is a very interesting and important topic both in our private and professional life. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-29T13:28:18Z

Saeh0803: /* Benefit of risk management and why risk management */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-29T13:23:23Z

Saeh0803: /* Benefit of risk management and why risk management */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-29T13:22:40Z

Saeh0803: /* Benefit of risk management and why risk management */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. [http://da.wikipedia.org/wiki/SWOT-analyse SWOT-analyse] can be the best tools for it.By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Talk:Project Evaluation and Selection for the Formation of the Optimal Portfolio

2014-11-28T20:32:12Z

Saeh0803: /* Reply to kikigaga */

== reviewed by Saeh0803 ==

1. Very long summary, maybe you can make it a bit short and interesting for reader

2. you didn't referenced the first figure in the text, you also not referenced the figure number two on the text, I know you explain the points from figure, but you need to write something like "..as it shown in figure X".

* Is the article interesting for a practitioner? --> I think it is a bit boring, it is maybe the way of writing.. (long explanations and long sentences ) but over all I think it is a good article and you have all main points, but if I search for this topic at google and want to read about it, then I will chose one, which is short and precis.. because you have write it in too many details..

* Does the article clearly relate to a project, program or portfolio management topic? --> Yes

* Is it clear which one of the four “content categories” the article belongs to? --> yes

* Does the length of the article seem appropriate? Does it contain less relevant passages or excessive details? Does it miss critical details? (The suggested length is “on the order of 3500 words”. Articles can be longer or shorter if it makes sense to do so in order to deliver a quality argument.) --> I think this articles is more in 3500 words, I can't see it on WIKI, but it seems to be more than 3500..

* Is there a logical flow throughout the article? Are the parts “tied together” through a red thread? --> I think yes

* Is the article free of grammatical, spelling and punctuation errors--> I think yes, I have difficult to understand,maybe because my English is not so good, but its really difficult to understand and readers may read one sentence more than one time to understand it..

* Is the article written in an engaging style, e.g. short, precise sentences instead of long winded, hard to follow mega -sentences? --> Puhaaa, I think it is difficult to understand and follow, you both have long sentences and many explanations

* Are all main points illustrated with an appropriate figure?

* Are the figures free of formal errors--> yes

* Are the figures referenced in the text? --> the first figure is not referenced in the text

* Does the author have the copyright or right to use the figures (e.g.through Creative) common Non-Commercial share Alike attribution?) --> maybe, can't see

* Is the article formatted properly, i.e. are the typical Wiki-features such sub-headings, proper bullet-point list and Wiki-style references used? are graphics, videos ect. integrated correctly? --> Yes

as I wrote, overall your article is good, try to change the sentences, so its understandable, maybe make it shorts and use some every days words, so everyone can understand what they are reading about :)

I hope you can use my comments and best of luck :)

== Reviewed by kikigaga==

Hi, as a product engineer I think the subject is interesting. So great:)
I believe that the article might be too long compared to the content, but what do I know..

Some short comments, since the other reviewer went through all the points I will only go through the ones i thought was standing out.

*Clarify the introduction so that the user knows what he/she is reading about.
**As i said, it is interesting but the long introduction made me almost give up.
*Gramma fails in some sentences
** Maybe it is because of sentences referring to the sentence before all the time, it is hard to read.
*Refer to the models or keep them out
** As i could see non of the figures are referred to?
*There are 4 major sources of internal dependencies – Says who?
**Make it clear: When is it your voice and when the references? (The implementation advice e.g.)

Thank you, and good luck:)

== Reply to Saeh0803 ==

'''First of all, thanks for your feedback, I found it very useful.

I went through each of the points, so I will paste here the bullet points in order to facilitate the reading. Your comments are in italics, while mines are in bold.
'''

''1. Very long summary, maybe you can make it a bit short and interesting for reader''

'''Actually, the summary is in the order of 500 words, that was the recommended size of the abstract. Anyway, I think that you are right, since it is quite long as an introduction and there is information that may not need to be there (I think that the illustration may also have an impact on the perceived size of this part). Finally, I managed to make it 150 words shorter, keeping the most relevant content.'''

''2. you didn't referenced the first figure in the text, you also not referenced the figure number two on the text, I know you explain the points from figure, but you need to write something like "..as it shown in figure X".''

'''You are right, this point has been addressed throughout the article'''.

* '' Is the article interesting for a practitioner? --> I think it is a bit boring, it is maybe the way of writing.. (long explanations and long sentences ) but over all I think it is a good article and you have all main points, but if I search for this topic at google and want to read about it, then I will chose one, which is short and precis.. because you have write it in too many details..
''
'''I've taken your point in consideration. I guess it's difficult to say if it is interesting or not, since maybe the topic per se is not interesting for you, but it may be for another person. However, I agree with the fact that keeping it simpler may be a better approach to try to engage the readers.
'''

* '' Does the article clearly relate to a project, program or portfolio management topic? --> Yes''
'''Check'''

* ''Is it clear which one of the four “content categories” the article belongs to? --> yes''
'''Check'''

* '' Does the length of the article seem appropriate? Does it contain less relevant passages or excessive details? Does it miss critical details? (The suggested length is “on the order of 3500 words”. Articles can be longer or shorter if it makes sense to do so in order to deliver a quality argument.) --> I think this articles is more in 3500 words, I can't see it on WIKI, but it seems to be more than 3500..''

'''You are correct. It was in the order of 4,500, but after getting rid of some very detailed information, I managed to make an article of about 3,700 words, without references (which is about 800 less words).'''

* '' Is there a logical flow throughout the article? Are the parts “tied together” through a red thread? --> I think yes''
'''Check'''

* '' Is the article free of grammatical, spelling and punctuation errors--> I think yes, I have difficult to understand,maybe because my English is not so good, but its really difficult to understand and readers may read one sentence more than one time to understand it..
''

'''Thanks, I've considered your comment in order to go through the text and try to make every sentence a little bit clearer.'''

* '' Is the article written in an engaging style, e.g. short, precise sentences instead of long winded, hard to follow mega -sentences? --> Puhaaa, I think it is difficult to understand and follow, you both have long sentences and many explanations''

'''As stated before, I've gone through all the text to look for this type of sentences. '''

* '' Are all main points illustrated with an appropriate figure?''

* '' Are the figures free of formal errors--> yes''
'''Check'''

* '' Are the figures referenced in the text? --> the first figure is not referenced in the text''

'''As stated before, this mistake has already been corrected.'''

* '' Does the author have the copyright or right to use the figures (e.g.through Creative) common Non-Commercial share Alike attribution?) --> maybe, can't see''

'''I draw all of the images by myself in order to avoid this point, and I made reference to the only one that I more or less took from other sources.
'''

* '' Is the article formatted properly, i.e. are the typical Wiki-features such sub-headings, proper bullet-point list and Wiki-style references used? are graphics, videos ect. integrated correctly? --> Yes
'' '''Check'''

''as I wrote, overall your article is good, try to change the sentences, so its understandable, maybe make it shorts and use some every days words, so everyone can understand what they are reading about :)

I hope you can use my comments and best of luck :)''

'''Thank you very much for your feedback; it was really useful. Sometimes, when you are writing, you don't know if you are being clear enough or if you are including enough detail, or too much of it. I think that with your feedback I've been able to improve my article, from format to the actual structure of the sentences.'''

== Reply to kikigaga ==

'''Hello, thank you very much for your feedback. I've found it interesting and relevant for improving my article. I know that it was quite long, so I've taken that into consideration for only including the most relevant parts. I will go through every bullet point to reply each of your suggestions. I include my comments in bold and yours in italics.'''

''Hi, as a product engineer I think the subject is interesting. So great:) I believe that the article might be too long compared to the content, but what do I know..''

'''Thanks! I'm glad that you found it interesting. I have shortened my article a little bit to make it more entertaining to read and to help the readers to go through it in a more natural way.'''

''Some short comments, since the other reviewer went through all the points I will only go through the ones i thought was standing out.''

* ''Clarify the introduction so that the user knows what he/she is reading about.''
** ''As i said, it is interesting but the long introduction made me almost give up.''

'''I agree with it. I've tried to highlight in some way the purpose of the article and to help the reader understand from the beginning what he/she is reading about. At the same time, the introduction was reduced in 150 words, so now it only contains the most relevant information. '''

* ''Gramma fails in some sentences''
** ''Maybe it is because of sentences referring to the sentence before all the time, it is hard to read.''

'''I've gone though the whole text taking this into consideration to avoid repetition of ideas or referring to sentences before.'''

* ''Refer to the models or keep them out''
** ''As i could see non of the figures are referred to?''

'''Now the text include references to the figures. I think now it is easier to relate to them to have a better idea of what the text is about.'''

* ''There are 4 major sources of internal dependencies – Says who?''
** ''Make it clear: When is it your voice and when the references? (The implementation advice e.g.)''

'''I've now clarified correctly that point. Actually, I read a couple of articles about dependencies, and I saw that they could be grouped in 4 categories. Now, I think that it could be easily seen if that is mine or someone else's idea'''

''Thank you, and good luck:)''

'''Once again, thanks for your feedback. I think that now I have an easier to read article and it is better formatted than before. Good luck to you as well.'''

happy to hear it :) good luck for the final and with your rest exams,

Risk management

2014-11-28T11:58:17Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk_analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:58:03Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/ Risk analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:57:29Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk analysis | Risk_analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:57:00Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk analysis| Risk analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:56:41Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk analysis |Risk analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:56:08Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple,you can maybe use it for a very small project. You can visit [http://apppm.man.dtu.dk/index.php/Risk analysis Risk analysis] which is described more in detail.

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:54:59Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple, you can visit [http://apppm.man.dtu.dk/index.php/Risk analysis Risk analysis]

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:53:18Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple, you can visit [Risk analysis]

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-28T11:51:51Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

This example is more general and very simple, you can visit [Risk analysis|Risk analysis]

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T22:00:33Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T22:00:05Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001 Video] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:58:46Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,[http://bcove.me/qvtxp001] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:58:01Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R,http://bcove.me/qvtxp001] and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:57:17Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, Code: {{#ev:youtube|video http://bcove.me/qvtxp001}} and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:48:05Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:45:56Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|contain|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:39:41Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

For further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:39:06Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

for further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

The Tabel as taken from Michael Dallas report, which shows a direct comparison of M_O_R with ISO 31000 against categories that are common to both framework.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:30:54Z

Saeh0803: /* How to develop a risk analysis */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100O based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

for further information about M_O_R and ISO 31000:2009 you can read Michael Dallas report[http://www.best-management-practice.com/gempdf/Management_of_Risk_Guidance_for_Practitioners_and_the_International_Standard_on_Risk_Management_ISO31000_2009.pdf]

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:19:39Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100 based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

File:Different between M O R AND ISO.png

2014-11-27T21:17:15Z

Saeh0803:

Risk management

2014-11-27T21:16:12Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100 based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

[[File:Different between_M_O_R_AND_ISO.png|frameless|right]]

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

Risk management

2014-11-27T21:13:36Z

Saeh0803: /* Risk Management in Practice */

Risk management is a very interesting and important topic in each area in our society. Actually everyone knows what a risk is; it is a part of our life. Each step or each decision we make, is full of risks, whether we notice it or not, but when we look at our professional life, then we have to take an action for each risk arise, because it has a negative effect and the effect can have consequences in terms of economic, professional reputation, environmental, safety and societal outcomes. This article focuses on for example how an organization or project handles its risks and which framework could be relevant or helpful for it.
Now a day, the risk management is an important part of project, program and portfolio management. In order to end up a project successfully and deliver it on time and within budget, it is important to get an overview of the risks, which is associated to the project. Most of the projects fail due to the lack of risk management [Why projects fail 2011]. In many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of project's planning process, the projects fail because the resources are not completely utilized to get the full advantage [Oehmen et. al.2012 and Zwikael and Ahn 2011].
This article further talks about the risk and different level of risks in organization level and how to identify the projects risks by using some of standard guidelines for risk management such as ISO 31000, ISO 2700S, DS/ISO 31000 Risk management- Principles and guidelines and M_O_R principles, which is a standard risk management framework, which can be used by any organization on any projects regardless of its size.
NOTE: This article might be similar to other articles; Risk analysis, risk register, Risk management strategy in project portfolios.

=Definition of risk management=

You can find different tools and definition for risk depending on the context in which it is used. A definition from Oxford English Dictionary sounds like “the possibility that something unpleasant or unwelcome will happen” [Oxford English Dictionary]. This is more general and related more to your every day. In decision theory, Luce and Raiffa relate risk to make decisions under known probabilities of the states of nature [Product Management Innovation 2009] and Frank Knight define the risk in economic theory as “risk arises when the decision maker can assign probabilities to possible outcomes”. A well-known definition of the risk in the domain of project management considers the risk as “an uncertain event or condition that, if it occurs, has a positive (opportunity) or negative (threat) impact on project objectives” [Innovation and Product Management]
Frank Knight defines the uncertainty and risk as “...Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated. … The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating. … It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an un-measurable one that it is not in effect an uncertainty at all" [Ariane Chapelle].
To minimize the uncertainty and reduce the risks on the project, you may regularly look back to your risk analysis, because most of the projects fail due to lack of risk management, in many projects the risks are not proactively identified, analyzed and mitigated or even in some projects the risk is a part of projects planning process, The projects fail because they do not invest their resources completely and do not pay attention to it.
Risk management is the most important part of the project planning process. It is a management tool, which project manager uses to analyses the risk factor within a project group or projects. Project group must be informed of the main risks and how they will deal with those risks. Often it requires extra resources to eliminate risks; these resources must allocate the project group. Many studies have pointed as well that the risk management has a big role in projects success [Tara Duggan]. The report by Jacob and Kwak highlights the positive contribution of risk management to improve the project selection, review and resource allocation of new product development projects.
It used in many areas such as public debate, research, danger of disease, death or accidents, threatening environmental problems in terms of risk of climate changes, CO2 , pollution and so on.
It is also used in many other projects such as customer needs and price, new technology and resources, construction and delivery projects, research projects and interests and other tasks.

=What is risk?=

Risk is the uncertainty, which is associated with any kind of the action and projects in organization's context that must understand and effectively manage during the project's process and improve the results[Luce and Raiffa]. Different types of risk management definitions can be found and the choice of definition depends on how big a concept of risk is used in order to which risks are covered by the definition. There is not a complete tool or solution that fits in every project, creating a new or changes the existing risk management process according to the project's goal is always helpful and flexible process that will ultimately result in a solution to the individual organization or project.
Risk is always based on imagination of how the project will be completed. It can be defined on the basis of an existing plan, for example, the project must be completed in 6 months. The risk of delay is bigger than if the project must be completed in one year. If the new technologies are a part of the project plan, that you have to use the new technologies is the risk bigger than use the known technologies. Therefor the risk is based on an existing plan; the same project may have very different risks, if you change the project’s plan. [Risk Management, concepts and methods].

=Benefit of risk management and why risk management=

Risk management helps you to identify your projects strengths, weaknesses, opportunities and threats [Jacob and Kwak]. By identifying your projects risks, you will be aware of the unexpected events and you can immediately take actions to reduce the losses [Overview of risk management].
There are many reasons for managing risks. Here are some main reasons:
First of all, risk management results in an overview and a number of options for an action to avoid known and unknown risk and reduce the impact of those[Power in projects & portfolio].

* Saving resources: Time, assets, income, property and people are all valuable resources that can be saved if fewer claims occur.
* Protecting the reputation and public image of the organization.
* Preventing or reducing legal liability and increasing the stability of operations.
* Increases the organizations profits and competitiveness and reflects an attractive professional approach to project work.
* Protecting people from harm.
* Protecting the environment.
* Enhancing the ability to prepare for various circumstances.
* Assisting in clearly defining insurance needs.
* By managing the risks, you can increase the quality of the project deliverable
* Protects public image
* Protects people from harm
* Prevents/reduces legal liability
* Protects the environment

=Three Levels of operational risk management=

The risk management in an organization can be categorized in three levels of operation- [three level of operational risk management].

* Strategic level:
At strategic level, operational risk management relates to the vision of the business, expansion planned over a few couple of years, the product position and the target customers in the market. In other words, the strategic operational risk management relates to the implementation of the risk demands. It must be defined at the top management level and must be deployed in a top-down manner through all the levels of the organization.

* Tactical level
At tactical level, the set of operational risk management tools and controls helps to reduce the number and intensity of the events. It provide the risk manager with a second line of defense. The effect of the risk responses deploys at tactical level, such as loss, fines and near misses reductions
Tactical operational risk management emphasizes on loss prevention and risk reduction techniques, process control, loss data analysis, key risk indicators, risk self-assessments and business expansion plans are some of the vast array of tools and techniques that have been developed to reduce the frequent occurrence of the risk elements and to reduce their impact on the overall project. Financial service industry is the most developed aspect of operational risk management, today.

* Operational level
Operational level provides a natural reduction of the operational incidents by redesigning all those processes that were prone to errors, removing any unnecessary tasks and useless controls, standardizing the procedures and improving the productivity.
Operational risk management targets the operational efficiency and process design. Work flows are redesigned in this level to improve the work speed by eliminating the errors. Staff
Operational risk management must spread over all these three levels, in order to be more effective and efficient

=How to develop a risk analysis=

Risk Management can be developed in two different ways [Best Management Practice]:

* By using the standard risk guidelines such as ISO 31000, which managers can go step by step and identify the risks and analyse the situation of each phase and take an action for each risk, that have negative impact on each situation. In this step more leaders must participate in order to reduce the impact of risks and take care of each situation.

* By using more general analysis or guidelines to define the project's goals and reduce the risks without managing it and less management participation.

In the first option many standard guidelines and analysis can be used such as ISO 31000, IEC/ISO 311010, and ISO 73-2009 and many others.
The International Organization for Standard (ISO ) risk management provides principles, general guidelines; framework and a process for managing the risks- It can be used by any project, organization regardless of its size.
ISO 31000 summarizes all the central activities and main points, which an organization might go through to manage their risks effectively and increase their chance to reach their goals. It doesn’t contain any specific techniques in order to use, but it mentions that an organization must follow risk identification tools and techniques, that match the projects and its goals. Another ISO standard application is ISO/IEC 31010, Risk Management, which contains of some risk assessment techniques and steps that gives an understanding of the risks, which can have a negative impact on an organization’s achievement of its goals and the adequacy and effectiveness of controls already in place. Risk assessment helps decision makers to take the correct decisions, for example which tools and techniques must be used to treat the risks and how to choose the best opportunities. The following techniques described on ISO 31010

* Risk identification
* Risk analysis - consequence analysis
* Risk analysis– qualitative, semi-quantitative or quantitative probability estimation
* Risk analysis – assessing the effectiveness of any existing controls
* Risk evaluation
* communication and consultation, and monitoring and review

Each step has described in detail on ISO 31010. Compare to M_O_R, and then M_O_R is much extensive application, which provides a detailed guidance on how to implement risk management. M_O_R stands for Management of Risk and it is a framework for the management of risk across all parts of an organization such as Strategic, programme, project and operational level. It includes all the activities required to identify and control the risks, both negative and positive, which may have an impact on the achievement of an organization’s objectives[M_O_R].It is also a framework for how to make informed decisions about risks respectively strategic, program, project and operational level in order to identify, assess and manage the key risks in order to deliver the expected advantages [M_O_R]. It describes deeply both what needs to be done through some principles, activities and roles and how to begin the activities.
In some ways, ISO31000 and M_O_R are very similar and use some common definition and methods. M_O_R is designed for practical application of risk management techniques and based on 4 core concepts: principles, approach, process and embedding and review, while ISO31000 is designed more to assess how completely the risk management techniques have been applied [Best Management Practice], The difference is that ISO3100 based on framework, principles and process. It prescribe how an organization should implement risk management and manage the risk by using any tools, that suits its goal and organization, while M_O_R allows it to customize its approach within the guidelines to suit its operating environment and process. Both are useful tools and can be used for managing the risks.

=Risk Management in Practice=

[[File:Risk management.png|frameless|right]]

To identify the projects risk, you can start with brainstorming, the first step is to list the main categories such as technologies, goal, stakeholder, communication, cost, environmental, resources, reliability, which is indicated with blue color in below figure. The next is to identify the risks, which is associated to the main categories. By brainstorm the risks, you can find 50-100 risks, depending to the projects size, therefore the third step is to estimate what the potential impact could be by using the Risk Matrix.

[[File:Mathrix.png|frameless|right]]

Each high priority or high impact risk should be assigned to a group member after their experience and skills, so they could study and evaluate the risks. Cost risks might for example assign to someone in the finance department than one from IT- department. The new technology might assign to someone from IT- department. The project manager should be assign for all the risks process, the most important part of risk process is the schedule with deadline and the risks list, which should only edit, added, re-prioritized and control by the project manager during the project.
To reduce the risks, the project manager should communicate the risks list to all the project stakeholders regularly, at least once a week. All the changes should be registered to the risk map and at the end of the project the results can be used to do a retrospective. What did you learn from it, what should be different in next project and how to control the risks from the beginning?

[[File:File|frameless|right]]

=Reference=

[1] Why projects fail: Avoiding the Classic Pitfall, An Oracle White Paper, October 2011 and Calleam Consulting LTD 2014: Why Projects Fail. And Tom Carlos, PMP: Reasons Why Projects Fail.

[2] Oehmen et. al.2012 and Zwikael and Ahn 2011, Oehmen, J., et al., Analysis of the effect of risk management practices on the performance of new product development programs. Technovation (2014),

[3] Oxford English Dictionary

[4] Innovation and Product Management 2009: A holistic and Practial Approach to Uncertainty Reduction,Kurt Gaubinger, Michael Rabl Scott Swan, Thomas Werani

[5] Frank Knight 1921: Risk, Uncertainty and profit, Imperfect competition through Risk and Uncertainty, Part III, Chapter VII

[6] Ariane Chapelle: The three levels of Operational risk management, May 2012

[7] Risikosamfundet: 1997, Tara Duggan, Demand Media: Why Is Risk Management Important to Project Success?

[8] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/

[9] Luce's Paradigm for Decision under Uncertainty, Luce and Raiffa, 1957

[10] Risk Management, concepts and methods: Club De La Securite De L’information Francais

[11] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[12] http://www.management-of-risk.com/what-is-management-of-risk.asp

[13] http://www.rovsingmanagement.dk/kurser/m_o_r%C2%AErisikostyring/?gclid=CM21qKLRjsICFeXUcgodGqEARQ

[14] Best Management Practice: Management of Risk.Guidance for practitioners and the international standard on risk management, ISO 31000:2009 of Michael Dallas, Dictor, APM Group Ltd.

[15] Jacob and Kwak (2003) and Raz et al.2002

[16] Article: Overview of risk management Henrik K. Søndergaard

[17]. Power in projects & portfolio of Mette Lindegaard, and John Ryding Olsson

[18] http://www.chapelleconsulting.com/the-three-levels-of-operational-risk-management/.

[19] http://strikingprojectmanagement.com/qualitative-risk-analysis/

[20] http://projectmgmt-annualwarehousesale.blogspot.dk/

[21] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[22] http://www.bestmanagementpractice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[23] http://tcgen.com/risk-mapping/#.VGidavnF-oO

[24] http://www.modst.dk/~/media/Files/%C3%98AV/Vejledninger/%C3%98konomistyring/Risikostyring_vejledning_maj07%20pdf.ashx

[25] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[26] http://www.vlv.dk/downloads/Artikel_RM1_Risk_Management.pdf

[27] http://www.clearrisk.com/what-is-risk-management/

[28] http://www.vlv.dk/downloads/rm1.htm

[29] http://www.soc.aau.dk/fileadmin/user_upload/FoSo/Arbejdspapirer/Nr._10_Risiko_risikovurdering_risikoformidling_og_helhedssyn.pdf

[30] http://klk.kl.dk/PageFiles/156494/Projekth%C3%A5ndbogen.pdf

[31] http:///C:/Users/Samira/Downloads/Projekth-ndbog%20(1).PDF

[32] http://www.digst.dk/~/media/Files/Arkitektur%20og%20standarder/Sikkerhed/Vejledning%20om%20risikovurdering.ashx

[33] http://www.best-management-practice.com/managementofrisk_demo/content.aspx?page=mor_17&showNav=true&expandNav=false

[34] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html

[35] http://dx.doi.org/10.1016/j.technovation.2013.12.005i

[36] http://smallbusiness.chron.com/risk-management-important-project-success-56920.html