Managing threats and opportunities in risk treatment

Developed by Theis Rosenkvist Sørensen

Risk treatment is the final stage in the risk management process. It is used to control and monitor the uncertainties during the project. When managing a project, uncertainties are one of the most important factors to control in order to achieve a successful project. Uncertainties occur when certain events in a project are unpredictable and it will only be possible to guess about a future event. Risk management is used to identify risks in the project that help maintain stability and used to prevent unforeseen events that can be cost, resource or time consuming. By using risk management, it is possible to ensure that the project team achieves the goals they are solving by not encountering many unpredictable obstacles during the project.

The risk management process is a seven-step monitoring process: Communication & Consultation, Establish Context/Scope/Criteria, Identify Risks, Analyze Risks, Evaluate Risk, Risk treatment and Monitoring & Review . This is done throughout the projects lifetime. By managing the project using responses to threats and opportunities, it becomes possible to minimize the impact of the risk. If it can be done in a successful way, better risk management is achieved and it will thus be possible to reduce the impact of the uncertainties in the project. By using Rumsfeld matrix, it becomes possible to reduce the risk by establishing precautions that can prevent or reduce the uncertainties from arising.

When working with risk treatment, there are some limitations. One of the crucial limitations is the lack of knowledge sharing. The lack of knowledge sharing leads to a greater amount of uncertainties that could have been prevented. However, not all uncertainties can be prevented and even perfectly planned projects have their limitations. By having a greater amount of expertise, a higher level of risk treatment can be performed and will minimize the risk by identifying crucial uncertainties in the project.

This paper aims to highlight the importance of the risk management process and more specifically delve into risk treatment process.

Introduction

The Risk Management Process

Figure 1: The Risk Management Process

Risk management is a process that works to manage risks to ensure that it cause the least impact in the project. Risk management is based on assumptions and experience from previous projects. However, many assumptions are uncertain which can have an effect on the project's original scope. The Project Management Institute (PMI), describes risks as "An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives" . By successfully navigating the uncertainty, risk can be managed in a way that is most beneficial to the project scope.

The process involves a "systematic application of policies, procedures and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording and reporting risk" . It should be noted that there can be many different applications of the risk management process, as it can be adapted to a particular project to achieve specific goals within the organization.

When operating the risk management process, take into account that the process is an iterative approach and it is important to go back and assess whether there have been changes in the previous stages that could create new potential risks that the project manager needs to adapt in their risk assessment. The stages are illustrated in Figure 1 .

WILL BE DELETED: ref PMI:

Knowledge and awareness

Figure 2: Knowledge and Awareness

David Hillson describes the difference between risk and uncertainties. He states that "risk" has a set of possible outcomes that are known, but that the precise outcome is not known in advance. In contrast, uncertainties relates to a lack of knowledge about the possible outcomes and are thus an unknown event from an unknown number of possible outcomes .

Based on these descriptions, the relationship between risk and uncertainty can be described as:

"Risk is measurable uncertainty"; "Uncertainty is unmeasurable risk" .

Another way to distinguish the relationship between risk and uncertainty is by looking at the relationship between knowledge and awareness. Figure 2 illustrates four quadrants where knowledge and awareness are either present or absent. The figure is a similar concept to the Johari Window, which describes self-awareness and perception by others . The top right corner of the quadrant certainty is illustrated, where both awareness and knowledge are present. An example could be a known number of square meters on which a building must be built or the appearance of the building so that it fits a certain cityscape. The top left corner illustrate caution, which describe the things that are uncertain. This could be, for example, the weather conditions next week. Under certainty we have amnesia which describes the lack of awareness or a blind spot regarding the knowledge we have. An example of this could be, bad planning, poor communication or acting on intuition and biases. The project manager can practice self-awareness to identify them. The last quadrant is Ignorance, where "we don't know what we don't know". An example of this could be the beginning of a war or an unpredictable natural disaster.

Donald Rumfeld's Unknown-unknowns

The knowledge and awareness figure created by Hillson and the Johari Window is a comparison to the known description used by the former U.S. Secretary of Defense Donald Rumsfeld at a press conference in 2002. He described the types of uncertainties as:

"Reports that say that something hasn't happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know" .

This statement became known as Rumsfeld matrix when the author Mikael Krogerus refers to it in his book "The decision book : fifty models for strategic thinking" . Figure 3 illustrates the connection between Hillson's Knowledge and Awareness figure & Rumsfeld Matrix.

Risk Management Process

abc

Hillson, David. "Effective Opportunity Management for Projects - Exploiting Positive Risk", 2003. Ch. 1. "The case for opportunity management". Marcel Dekker Inc.

Risk Treatment

The importance of risk treatment lies in the fact that risks are decisive for whether a project will be a success or not. By not managing the risks, the consequence can be fatal. Barry Boehm states the consequence as "If you don’t actively attack the risks, they will actively attack you" . Risks can be both threats and opportunities as they can have either a positive or negative impact on the project. This section will describe the response strategies to threats and opportunities.

Threats

Threats are uncertainties and unexpected events that can effect the project negative and threaten the project scope. When reacting to threats as an approach to the Risk Management Process, it becomes possible to reduce the impact to zero by either avoiding, reducing or transferring the risks. Threats can be divided into five categories; Avoid, Transfer, Mitigate/Reduce, Accept, Escalate.

Avoid

Threat avoidance is when the project team seeks to eliminate the uncertainties by making it impossible for the risk to occur or protects the project from its impact by executing the project differently so that the objectives are achieved but avoids the risk so that it has no impact on the project .

Transfer

By transferring the risk, another stakeholder is identified who is better at managing the risk and is responsible for the right action being taken. They are therefore responsible for bearing the risk if it occur . This can be done when the project manager acknowledge his lack in expertise and wants a third party to manage the risk.

Mitigate

When mitigating the risk, action is taken to reduce the impact of a threat or reducing the probability of occurrence. Reducing the size of the risk in early stages will make it more acceptable to the project. "Early mitigation action is often more effective than trying to repair the damage after the threat has occurred" .

The goal of the threat is to acknowledge its existence and deal with it so that it does the least damage to the project. For this, an Impact matrix can be used for the threat, and can be used to take proactive precautions against the threat. The probability impact matrix can be seen in figure XX.

Accept

The acceptance of a threat is when one acknowledges the threat's existence without taking any action against it. By actively accepting a risk, a contingency plan can be made which is triggered when an event occurs. Threat acceptance can also include passive acceptance, which means doing nothing .

Escalate

Escalation is used when a project team agrees that the threat is outside the scope of the project or when the action exceeds the project manager's authority . This could, for example, be change in laws that could have an effect on the project but the project team are not able to do any actions against it.

Opportunities

Opportunities are uncertainties and unexpected events that can effect the project positive and aid the project scope. Opportunities can be divided into five categories; Exploit, Share, Enhance, Accept/Ignore, Escalate.

Exploit The exploit strategy acts to ensure the identified opportunity occur (increase the probability to 100%). "Aggressive measures are taken which seek to ensure that the benefits from this opportunity are realised by the project" . This strategy corresponds to the "avoid" response.

Share

The sharing strategy involves sharing the risk with a stakeholder who is better at securing the benefit of the risk opportunity . This is done when the project manager acknowledge a higher value when sharing the opportunity to another stakeholder.

Enhance

The enhancing strategy seeks to increase the probability of the risk to occur. The opportunity of the risk also aims to increase the impact of the risk in order to maximize the benefit to the project . "Early enhancement action is often more effective than trying to improve the opportunity after it has occurred" .

Accept/Ignore

Accepting or ignoring the opportunities is done when the risk has a minor impact on the project. The existence of the opportunity is acknowledged but no proactive action is planned .

Escalate

Escalation is used when a project team agrees that the threat is outside the scope of the project or when the action exceeds the project manager's authority . This could, for example, be change in laws that could have an effect on the project but the project team are not able to do any actions against it.

Some project management theories exclude the Escalate strategy since in every project you cannot any take actions against them besides identify the risks and recognize that they are outside the scope of the project. This applies to both threats and opportunities.

Priority of Opportunities and Threats

When managing threats and opportunities it is important to prioritize the response strategy of the identified risks. In the previous section, the strategies are prioritized so that the strategies described first are the most important. It can also be seen in Figure XX, which shows the priority order of the responses . When this approach is used, one will initially look at "avoid" and "exploit", as they have the greatest potential and impact on the project.

qcb

Probability Impact Matrix for Opportunities and Threats

abc

ref: Forsberg, K., & Mooz, H. RISK AND OPPORTUNITY MANAGEMENT. (1996). INCOSE International Symposium, pp. 586–598. Retrieved from https://doi.org/10.1002/j.2334-5837.1996.tb02057.x

.

Discussion/conclusion

abc

This paper aimed to highlight the importance of the risk management process and more specifically delve into risk treatment process.

Notes (Do NOT read):

NOTES FOR ABSTRACT:

The goal is to take procortions for the uncertainties and reduce the impact it can we on the project. This can be done by...

In project management there is a lot of uncertainties we need to prepare and take procortions for. By doing this it will be possible to prevent unknown factors that can occure. mannaging thorugout the whole projct.

The 5 steps in risk management

responding to threats - ARTA

Responding to opportunities

Annotated Bibliography

Articles

1. Project Management Institute, Inc. (PMI). (2021). A Guide to the Project Management Body of Knowledge (PMBOK ® Guide) – 7th Edition and The Standard for Project Management. (pp. 114-125). Project Management Institute, Inc. (PMI).
   • DESCRIPTION

1. Danish Standards Association (2018), DS/ISO 31000:2018, Risk management - Guidelines.
   • DESCRIPTION

1. There are unknown unknowns. Retrieved February 10, 2023.
   • DESCRIPTION

1. Hillson, D. (2002). Extending the risk process to manage opportunities. International Journal of Project Management, (pp. 235–240).
   • DESCRIPTION

Books

1. Hillson, David. "Effective Opportunity Management for Projects - Exploiting Positive Risk", 2003. Ch. 1. "The case for opportunity management".
   • Description

1. Krogerus, Mikael. "The decision book: fifty models for strategic thinking", 2012.
   • Description

Transcript

1. Rumsfeld, Donald. "Defense.gov News Transcript: DoD News Briefing – Secretary Rumsfeld and Gen. Myers, United States Department of Defense (defense.gov)". February 12, 2002.
   • A transcript of Donald Rumsfeld gave to a question at a U.S. Department of Defense (DoD) news briefing on February 12, 2002.

References

Made by Theis Sørensen (s195768)