Risk Management in Projects and Programs
Project and program risk questions test whether you can separate project uncertainty from enterprise risk, run the risk process across a lifecycle, and quantify exposure without pretending precision.
Project risk process
Plan risk management, identify risks, perform qualitative analysis, perform quantitative analysis where warranted, plan responses, implement responses, and monitor. Use a risk breakdown structure, a risk register with owners, causes, triggers and responses, and a RAID log that distinguishes risks, assumptions, issues and dependencies. Risks are uncertain; issues have occurred and need action, not probability.
Reserves and quantification
Expected monetary value (EMV) = probability × impact. Decision trees compare options. Monte Carlo simulation models ranges and correlations for cost and schedule. Contingency reserves cover identified risks (known unknowns); management reserves cover unidentified risks (unknown unknowns). Reserves should be revisited as risks change.
Programs and portfolios
Programs aggregate related projects, so interdependencies, common causes and escalation matter. A risk acceptable in one project may be unacceptable at portfolio level. Portfolio views show concentration and correlation. Contracts allocate risk, but allocation should follow the party best able to manage it.
Worked example
A project faces a 60% chance of an $800k delay cost if a permit is late. Do nothing: EMV = 0.6 × $800k = $480k expected cost. Option B spends $150k on early legal review and reduces the probability to 20%: expected delay cost 0.2 × $800k = $160k, plus $150k = $310k. Reasoning: Option B has the lower expected cost, saving $170k, and also reduces schedule variance. The $150k is a treatment cost; the remaining $160k exposure should be covered by contingency reserve. The decision and assumptions go in the register, and the probability is re-estimated when the permit authority changes its guidance.
Traps that cost marks
Calling the risk register an issue log; naming the risk manager as owner of every risk; using management reserve for identified risks; skipping qualitative analysis and jumping to simulation; ignoring opportunities; leaving reserves unchanged after treatment; assuming program risk is the sum of project risks; allocating contract risk to the party least able to control it.