Characterizing Risks

The first step to managing project-selection risk is to identify and characterize the risks associated with doing and not doing projects. Typically, a risk involves a source or cause (e.g. some possible event), a mechanism by which the risk source could impact the objectives of the organization, and some level and type of potentially adverse consequences.

A risk can only be evaluated in relation to the objectives that it impacts. Thus, characterizing risks requires understanding the objectives that are threatened by the risk. Part 3 of this paper argued that the fundamental objectives of organizations are creating shareholder value and stakeholder value. and that these overall objectives can only be achieved if certain sub-objectives are achieved. The relevant sub-objectives depend on the organization (as described in Part 3, sub-objectives, along with appropriate metrics, are identified by creating a project decision model). Important objectives typically include some or all of those shown in Figure 28.

Figure 28: (Sub)-objectives (relevant to value creation) that may be impacted by risk.

Risks should be identified and documented. Many tools for project portfolio management have templates for this purpose. A statement of risk should encompass the cause and identify the impacts to the objectives that might occur. For example, a project cost risk might arise if there is some question about whether the project team has all of the necessary skills for some task. Skills that do not match the job, therefore, is a potential source of risk. Cost, obviously, is the objective potentially impacted. If other objectives might also be impacted (e.g. customer satisfaction) then that objective should likewise be identified and an explanation provided for how and what sort of impact might occur. Characterizing the risk includes providing an indication of the nature and magnitude of the potential impact on objectives (e.g. costs could increase by $X, customer Y would be dissatisfied as a result or a two-week delay in obtaining service).

Risks should be characterized using a level of detail sufficient to allow the specific impacts to objectives to be identified and specific actions to address the risk to be evauated. If the risk is identified and understood, ideas may be generated for modifying the project plan to mitigate the risk. Also, routinely identifying and analyzing project risks generates a database of project risks and associated risk-reducing actions, useful when considering similar projects in the future.

Scenario Building

One of the simplest tools for exploring risk is scenario building (Figure 29), a technique originated by the military. In the context of understanding project-selection risk, scenario building involves hypothesizing plausible events or futures that significantly impact the value or success of a project or set of projects. Envisioning the scenarios as mental movies helps to stimulate thinking. Not only does scenario planning help uncover real possibilities, it encourages managers to come up with ways of avoiding potential disasters and ensuring that things turn out reasonably well regardless of which future actually takes place.

Figure 29: Scenario building.

Large oil companies have long been big users of scenario building. The popularity is often attributed to one early success. In the 1970’s, a planning group at Shell Oil generated scenarios that could affect the price of oil, an uncertainty important to many of the company’s projects. One scenario was that prices would remain stable. Another was that OPEC would demand much higher prices. As the latter scenario was developed, it became increasingly clear to the team that the scenario was not just plausible, it was highly likely. However, when the team warned upper management, no changes in company decisions could be observed. So, the team went one step further. They described the logical ramifications of the scenario in terms that leadership would understand it meant slow growth for the industry and the possibility that OPEC countries would take over Shell’s oil fields. When the Arab oil embargo did occur in 1973, only Shell was reasonably prepared. To manage risks highlighted by the scenario, the company had slowed refinery expansions and adapted their refineries to better accommodate alternative types of crude oil.

Qualitative Methods for Addressing Project Risk

The project risks that remain after project plan has been modified to mitigate identified risks are the residual risks that must be considered when selecting projects. For most organizations, factoring risk into project portfolio management involves merely flagging project risks so that they may be considered when decisions to select or reject projects are made. Typically, qualitative methods are used. For example, identified risks might be categorized as high, medium, or low with respect to likelihood and consequence. As shown in Figure 30, this results in a 33 risk matrix defining potential responses. Color codes (e.g. green, yellow, and red traffic lights) may be used to help summarize risk judgments.

Figure 30: Risk scoring checklist and risk matrix.

Qualitative methods may be adequate for screening purposes or in situations where risks are not very serious. The limitation of qualitative methods is that they provide no help for determining the impact of risk on project or portfolio value. In many situations, risk can have a major impact on the value of projects and project portfolios. Using analysis to optimize the project portfolio requires employing quantitative methods to assess and value risk.

Quantitative Methods for Valuing Risk

There are two alternative approaches for valuing risk:

Compute the decrement (or increment) to the worth of the project caused by project and project deferral risk.
1. Adjust the discount rate (cost of capital) to reflect the specific level of project risk for each project.

The former approach, which requires that risks be quantified using probabilities, is described in the next two subsections of this paper. The latter approach involves using project hurdle rates. Hurdle rates are simpler, but as explained below, they have serious limitations.

Be Careful Using Hurdle Rates

Most organizations that account for risks when valuing projects do so using hurdle rates. The hurdle rate is a risk adjusted discount rate typically related to the cost of capital and used to discount future project costs and benefits. Increased hurdle rates are applied to projects considered to be more risky.

Using hurdle rates may be preferable to ignoring risk or treating it as an intangible. However, hurdle rates have limitations. For one thing, hurdle rates only address project risk, they can’t account for project deferral risk. Also, organizations are frequently unclear about what hurdle rate should be applied based on project risk. Studies have shown that the rates used by firms vary considerably. According to finance theory, the correct hurdle rate is the opportunity cost of the investment, which is the return available from investing in securities equivalent to the risk of the project being evaluated. Most companies don’t adjust the hurdle rate for risk nearly enough.

A more fundamental problem is reflected in research on real options showing that the discount rate needs to vary with the project management strategy (e.g. an irreversible project investment would call for a higher hurdle rate) as well as with time (the discount rate is not a constant, but changes depending on when the discounted future outcomes will occur). Using a constant hurdle rate for a project implicitly assumes that uncertainty increases over time in a specific way (i.e. geometrically). Hurdle rates tend to create a bias toward short-term, quick-payoff projects because they severely penalize project benefits that occur in the longer term.

Risk & Risk Management