January 30, 2023

Crucial Success Factors of Project Risk Analysis


Top Challenges Facing Project Risk Professionals
Project risk professionals must address several foundational issues in their working environments before committing to a quantitative cost risk, schedule risk, or integrated cost-schedule risk analysis. Taking schedule as an example, the risk analyst attempts to use the most important risks to drive a Monte Carlo simulation of the schedule to help determine a relatively “comfortable” completion or turn-over date to the customer.

A “comfortable” completion date might be one that the risk analysis predicts is relatively unlikely (e.g., 20% to 30%) to be overrun. Typically, a schedule risk analysis produces a turn-over date that is later than the date created by project scheduling software. The project’s management may object that the “comfortable” date is too late to be acceptable, even before risk mitigation actions are mounted.

A risk analysis system must be strong, supported, and professionally conducted and communicated. Three foundational questions underpin successful risk analysis:

  1. Does the corporate culture support the effort? What are the signs of lack of support?
  2. Do the project controls systems provide a foundational project schedule and cost estimate compliant with best practices?
  3. Does the working environment encourage and enable the gathering of unbiased data on all risks that should be included in the analysis?

Supportive Corporate Culture Begins with an Organization’s Leadership
An organization’s management must support a risk analysis, in part by avoiding actions that would impede professional conduct of the analysis.

  • First, management must be willing to use and communicate the analysis results to others—including the board of directors, joint venture partners, and even the customer—as the best professional estimation about the project, including when it will likely finish and at what cost. This does not mean that management cannot challenge the risk analysis results or methods—such challenges are part of management’s job, and answering challenges is part of the analyst’s job. But a discussion between management and analysts can be conducted with openness and professionalism, leaving each party feeling heard and with an understanding of the other’s concerns.
  • In some organizations, management predetermines and asserts what “acceptable” finish date and cost should result from the risk analysis. These numbers are often agreed to and announced prior to creating a baseline project schedule and cost estimate, let alone a risk analysis. Alternatively, management may reject risk analysis results and require a “do-over” to “make it fit” a different, generally earlier, date. If management, for example, requires the project team to make changes to the schedule that can only be achieved by diverging from scheduling best practices, this compromises the foundation of any professional risk analysis. Risk analysis becomes irrelevant, and the risk analyst is transformed from a professional to simply a data input person.
  • Does management provide sufficient qualified risk analysis resources to support enough analysts to do the work? Does management allow enough time for the analysis to be performed? Are there enough training and mentoring resources for new people to join effectively in the risk analysis team and process? Management support needs to be practical and visible for the risk analysis community to contribute successfully.

The Project Schedule Needs to Comply with Scheduling Best Practices
The project schedule is the foundation of any Monte Carlo modeling and instrumental to deriving quality risk analysis results. Project schedulers are often unaware of scheduling best practices, perhaps because they never learned the fundamentals. Also, many detailed schedules are overly large for a risk analysis exercise.1

Larger schedules often include constraints, lags, incomplete and incorrect logic, and illogical total float, and they may miss coverage of all the work. Each of these failings invalidates a schedule for project management and risk analysis. Accurate risk analysis requires schedules with reliable, correct logic. In Monte Carlo simulation, activity durations change in thousands of iterations as risks do or do not occur based on random selection rules. The durations and logic tying activities together must correctly and reliably determine thousands of completion dates.

Overly large project schedules are often unfit for simulation because too many technical issues (e.g., activities without successors from their finish dates, use of lags and constraints) and substantial issues (e.g., illogical logic) may be buried in them, leading to strangely large total float values. In this case, professional schedulers who are aware of best practices may construct a summary or “analysis” schedule of fewer activities, which they build from the outset with scheduling best practices.

Professional scheduling requires evaluating the schedule against scheduling best practices and against data on historical projects that are similar and recent so that they can be used as benchmarks. Both the owner and contractor must sign off on a summary schedule as representing the project plan before it can serve in a risk analysis.

Project Costs Need to Comply with Estimating Best Practices and Be Entered into the Project Schedule on Activities with Resources
Cost estimating is fundamental to generating estimates of management reserve and contingency. Cost estimating best practices are available and should be followed to develop reliable project cost estimates. Estimators need to possess and apply various skills and avoid being sidetracked by challenges, which include poorly defined assumptions, lack of supporting documentation, lack of benchmarking with appropriate databases of similar projects, inadequate data collection, and inappropriate estimating.2

Cost estimating is also influenced by the mindset of the estimators, who may be optimistic or may be pressured by their organization to produce optimistic estimates. For instance, optimism may manifest as assuming a new technology or component is available when it is not technically ready, or overestimating the strength of the project team. Optimism may include assumptions about the quality and timeliness of logistical support or labor force competence or availability. Competent estimators use appropriate industry data and methods of adjusting available data so it applies to the current project. Submitting the estimate for validation by an independent source review is very important to address some of these problems.

Risk Data Gathering Must Contain All Important Risks and Reflect Honest Estimates of Probability and Impact
A project’s “risk register” is the analyst’s source of risks to model. The conditions associated with gathering information for those risks often compromise the quality of the risk register as a data source for quantitative risk modeling.

Often risk register information is gathered in group settings called risk workshops, where discussions in the presence of others may cause biases that obstruct honest, candid discussion. Fear of negative personal outcomes can stop people from publicly sharing complete responses. Pitfalls of this group dynamic include missing some of the most important and impactful risks, underestimating the probability and impact of risks, and overestimating the beneficial effect of proposed risk mitigation actions.

It is typically more successful to conduct confidential one-on-one interviews to identify key risks that may cause schedule and cost overruns. These interviews consistently uncover risks not represented in the risk register, in part because they are too sensitive or consequential, or their insertion in the analysis would challenge the organization’s published promises or statements to others.

Other benefits of confidential interviews include that:

  • interviews average about two hours each, in contrast to eight-hour risk workshops. Although conducting no more than four two-hour interviews per day may extend the data collection phase beyond a one-day workshop, it reduces each interviewee’s away-from-desk time; and
  • interviewees can discuss their ideas in depth for a full two hours (after a short introduction explaining the confidentiality of the discussion) to an interviewer who seriously wants to hear what they have to say. In a workshop, the only person talking for hours is the project manager, who often has an interest in making the project look good, and who others may not want to contradict in public for fear of retribution.

The completeness and quality of the data used to represent uncertainty and risk in simulations is crucial to produce high-quality analysis, so care in how this data is collected greatly benefits the results.

Integrated Cost and Schedule Risk Analysis3
Cost risk analysis is incomplete without considering the influence of schedule risks on the cost of time-dependent resources. These resources include labor as well as equipment that will be rented by the day, such as heavy earth-moving equipment, scaffolding, drilling barges, and the like. The cost estimate should have a reserve to account for additional labor hours and for renting equipment for longer than expected. As the GAO Cost Guide states, “A risk analysis should be used to determine a program’s contingency funding.”4

Summary of Conditions that Are Foundational to Conducting a Risk Analysis
In summary, it is helpful to train and employ qualified estimators and schedulers and replace risk workshops with confidential two-hour interviews. Of the conditions discussed above, the most important is a supportive corporate culture, yet this is the most challenging to address. Sometimes it is only faced after a dramatic occurrence of a risk that was highlighted but not mitigated—with serious consequences for the project and perhaps the organization’s reputation. Ideally, organizations learn before such an experience unfolds.

Note: Safran Risk published an earlier version of this blog post in connection with the author’s course in Project Scheduling and Schedule Risk Analysis conducted in November 2022.

1     One scheduling best practice explanation and compilation is the Schedule Assessment Guide: Best Practices for Project Schedules, published in 2015, after years of compilation and conferring with industry experts, by the U.S. Government Accountability Office, document GAO-16-89G. This guide is freely available and can be downloaded at https://www.gao.gov/products/gao-16-89g.

2     A compilation of cost estimating best practices is the U.S. Government Accountability Office’s 2020 edition of the Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Program Costs, document FAO-20-195G, available for download at https://www.gao.gov/products/gao-20-195g.

3     A treatment of this subject can be found in Recommended Practice 57R-09, “Integrated Cost and Schedule Risk Analysis using Risk Drivers and Monte Carlo Simulation of a CPM Schedule,” Rev. October 2022, published by the Association for the Advancement of Cost Engineering (AACE) International.

4     GAO Cost Guide, p. 15.


Experience Matters

Our experts are ready to help.

Our extensive international experience includes large, complex, grass roots, revamp, and reconstruction projects incorporating conventional-phased, fast-track, and EPC turnkey concepts.