Managing Project Risk, Uncertainty and the Unexpected

Transcription

1 Managing Project Risk, Uncertainty and the Unexpected THE ROLE OF PROJECT GOVERNANCE PMI-MN Dinner 18 March 2013 Minneapolis, MN Keith D. Hornbacher, MBA, Affiliated Faculty Organizational Dynamics Graduate Programs, School of Arts and Sciences University of Pennsylvania Phone: Founder and Principal Consultant - Hornbacher Associates 2013 Keith D. Hornbacher, Hornbacher Associates

2 Acknowledgements Materials presented in this document and that are discussed in this session have been compiled in accordance with all provisions governed by non-disclosure agreements now in force. Sources are cited and are available to the public. SOFIA: NASA Schedule Management Handbook : GAO Cost Estimating and Assessment Guide: Hanford:

3 Introduction Today we will consider several aspects of our subject Context and evidence Value propositions Some drill-down examples Premise: Sustainable Project Governance will be defined in a context of managing project risk Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

4 Context and evidence

5 The best way to predict the future is to create it. - Peter F. Drucker

6 What role does project governance play? The simple answer Provides a framework within which we operate projects Extends organizational strategies Organizational cultures and environments 1. Compliance innovation - invention 2. Domains and formality 3. Three general models We will drill down into detail as time permits Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

7 Governance lost! Multiple failures Checks and balances circumvented External intervention absent Criminal behavior requires extraordinary oversight Not our focus today ENRON AIG Wall Street BP Who s next...?

8 We ll discuss several perspectives today Context project risk, uncertainty, and unexpected Characteristics of organizations and their team members Project governance What does it mean in this context? Roles of independent review Benefits, costs, and how much is enough? Sources include material from my course at Penn (syllabus detailing references and content available)

9 What is our value proposition? The PMBOK Guide (5 th ed.) mentions governance about 50 times do you recall what it says? Trade-offs are evident in differing contexts To be valuable there needs to be net add to the organization s performance, structure, behavior... How much formality is enough? Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

10 Here s a model for Software Intensive Systems Agile ~ Plan-driven home grounds (Boehm and Turner) Criticality (Loss due to impact of defects) a: many lives b: single life c: essential funds d: discretionary funds e: comfort a Size (# personnel) b Personnel - Capabilities (% Level 1B) (% Level 2&3) c 300 d e Dynamism (% Requirements change/month) Culture (% thriving on chaos vs. order) See Balancing Agility and Discipline, A Guide for the Perplexed, Barry Boehm and Richard Turner, Addison-Wesley,2004;. Barry Boehm, p6, Some Future Trends and Implications Keith D. Hornbacher, for Systems Hornbacher and Software Associates Engineering keithh@sas.upenn.edu Processes, Systems ph Engineering, Vol. 9, No. 1, 2006

11 Is your organization on this map?

12 Role of managing project risk, uncertainty, and he unexpected.... Quick refresher...

13 Project Risk let s define what we mean Project Risk... an uncertain event or condition that, if it occurs, has a positive or negative effect on a project s objectives (Practice Standard for Project Risk Management, 2009)... such as time, cost, scope, or quality... and is defined by two attributes, likelihood of occurrence and impact if it occurs... (PMBOK Guide, 3 rd ed., 2004) - Project Management Institute (PMI ) Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

14 ISO 31000:2009 suggests some benefits Increase the likelihood of achieving objectives; Encourage proactive management; Be aware of the need to identify and treat risk throughout the organization; Improve the identification of opportunities and threats; Comply with relevant legal and regulatory requirements and international norms; Improve mandatory and voluntary reporting; Improve governance; Improve stakeholder confidence and trust - ISO 31000:2009, Keith D. Hornbacher, Hornbacher Introduction, Associates Pages keithh@sas.upenn.edu v-vi [emphasis added] Establish a reliable basis for decision making and planning; Improve controls; Effectively allocate and use resources for risk treatment; Improve operational effectiveness and efficiency; Enhance health and safety performance, as well as environmental protection; Improve loss prevention and incident management; Minimize losses; Improve organizational learning; and Improve organizational resilience.

15 PMI boils it down for us into 6 steps 1. Plan 2. Identify 3. Analyze Qualitative 4. Analyze Quantitative 5. Plan Responses [ treatment per ISO and Systems Engineering] 6. Monitor and Control - Practice Standard for Project Risk Management, PMI Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

16 The project risk analysis model Identify List Assess, Analyze Prioritize Plan Risk Register Initial Prob. VHI ATTENTION ARROW Threats Opportunities Prob. VHI Respond HI HI MED LO MED LO Risk Register Updated VLO VLO VLO LO MED HI VHI VHI HI MED LO VLO Impact Impact Risk Breakdown Structure (RBS) Qualitative Trigger Parameters? Quantitative Plan and Manage the Process DYNM 605 Managing DYNM 605 Managing Project Keith D. Project Risk, Hornbacher, Uncertainty, Risk, Hornbacher and Associates and the Unexpected Keith Keith Hornbacher ph Hornbacher All rights reserved All rights reserved RBS Risks Grouped

17 Evidence of an organization s project risk management maturity

18 Project Risk Management Maturity Matrix* Observable characteristics Definition Culture Process Experience Application Levels of maturity 1. Ad Hoc 2. Initial 3. Repeatable 4. Managed *Source: Collaboration Group (INCOSE, PMI, APM) Keith D. Hornbacher, Hornbacher Associates ph

19 Organizational Risk Management Maturity Matrix Project Risk Management Level 1 Ad Hoc Level 2 Initial Level 3 Repeatable Level 4 - Managed Unaware of the need for management of uncertainties (risk). Experimenting with risk management through a small number of individuals. Management of uncertainty built into all organizational processes. Risk-aware culture Definition No structured approach to dealing with uncertainty. No structured approach in place but considering Risk management implemented on most or all projects. Proactive approach to risk management in all aspects of the organization. Repetitive and reactive management processes. Little or no attempt to learn from past projects or prepare for future projects. Aware of potential benefits of managing risk, but ineffective implementation. Recogized Need to Accumulate Historical Uncertainty Data Benefits understood at all organizational levels, although not always consistently achieved. Historical Lessons Captured, Use Limited to Some Projects Active use of risk information to improve organizational processes and gain competitive advantage. No risk awareness. Risk process may be viewed as additional overhead with variable benefits. Accepted policy for risk management. Top-down commitment to risk management, with leadership by example. No upper management involvement. Upper management encourages, but does not require, use of Risk Management. Benefits recognized and expected; risk viewed as opportunity as well as threat Executive management uses risk information in decision-making. Culture Resistant/reluctance to change. Risk management used only on selected projects. Executive Management requires risk reporting. Proactive risk management encouraged and rewarded. Tendency to continue with existing processes even in the face of project failures. Dedicated resources are funded to perform risk management. Project managers' career path includes risk management training, experience. Shoot the messenger. Bad news risk information is tolerated. Organizational philosophy accepts idea that people make mistakes. Organizational philosophy encourages innovation. No formal process. No generic formal processes, although some specific formal methods may be in use. Generic processes applied to most projects. Risk-based organizational processes. Process No Risk Management Plan or documented process exists. Process effectiveness depends heavily on the skills of the project risk team and the availability of external support. Formal processes incorporated into quality system. Risk Management culture permeating the entire organization. None or sporadic attempts to apply Risk Management principles. All risk personnel located under project. Active allocation and management of risk budgets at all levels. Regular evaluation and refining of process. Adapted from Collaboration among INCOSE Risk Management Working Group,PMI RiskSIG, UK Association for Project Mgt, RiskSIG, April 2002

20 Organizational Risk Management Maturity Matrix Project Risk Management Level 1 Ad Hoc Level 2 Initial Level 3 Repeatable Level 4 - Managed Attempts to apply Risk Management process only when required by customer. Limited need for external support. Routine risk metrics used with consistent feedback for improvement. Process (Cont'd) Risk metrics collected. Key suppliers participate in Risk Management process. Key suppliers and customers participate in the Risk Management process. Direct formal communication channel to organization management. Informal communication channel to organization management. No understanding of risk principles or language. In-house core of expertise, formally trained in basic risk management skills. All staff risk aware and capable of using basic risk skills. Experience No understanding or experience in accomplishing risk procedures. Limited to individuals who may have had little or no formal training. Development and use of specific processes and tools. Learning from experience as part of the process. Regular training for personnel to enhance skills. No structured application. Inconsistent application of resources. Routine and consistent application to all projects. Risk ideas applied to all activities. No dedicated resources. Qualitative risk analysis methodology used exclusively Dedicated project resources. Risk-based reporting and decisionmaking. Application No risk management tools in use. Integrated set of tools and methods. State-of-the-art tools and methods. No risk analysis performed. Both qualitative and quantitative risk analysis methodologies used. Both qualitative and quantitative risk analysis methodologies used with great stress on having valid and reliable historical data sources. Dedicated organizational resources. Adapted from Collaboration among INCOSE Risk Management Working Group,PMI RiskSIG, UK Association for Project Mgt, RiskSIG, April 2002

21 Different Models of Project and Risk Management Governance

22 Models of risk management governance 1. Internal to Program/project Key team members represent all constituencies Senior stakeholders actively engaged Primary responsibility and accountability 2. External to Program/project (same organization) Subject matter experts (SMEs) respected by team members May have advocate or intervention role 3. External to Program/project organization Membership similar to 2., above Independent from senior executives/stakeholders

23 Type 1. Role of senior stakeholders includes reviewing and monitoring Risk Management Board Identify Risks Monitor/Track Risks Evaluate/Assess, Prioritize Risks Handle, Respond to Risks

24 Type 1. Actual Risk Management Board Prime Core Team Responsibility FAA (Advisory) FAA Counterparts Program Manager Member, Chair Member Program Manager Technical Director Member Member Chief Scientist Communications, Associate Program Mgr (APM) Member Member Communications, Team Leader System, APM Member Member System, Team Leader Software, APM Member Member Software, Team Leader Fielding, APM Member Member Fielding, Team Leader Resource Management, APM Member Member Resources, Team Leader Safety, Lead Member Member Safety, Team Leader Quality, Lead Member Member Quality, Team Leaders Contracts, Manager Member Member Contracts, Team Leader Risk, Manager (process owner) Member, Coordinator Member Resources, Deputy Team Leader

25 Independent (from the project) models NASA Internal, collaborative vs. confrontational Independent Program Assessment Office (IPAO) Standing Review Board (SRB) of experts SOFIA ICESat-2 Government Accountability Office (GAO) External, independent watchdog Capitol Visitors Center Department of Energy (DoE), Audit of selected Hanford (Washington) projects

26 Two Examples of different models NASA Internal, collaborative vs. confrontational Independent Program Assessment Office (IPAO) Standing Review Board (SRB) of experts SOFIA ICESat-2 Government Accountability Office (GAO) External, independent watchdog Capitol Visitors Center Department of Energy (DoE), Audit of selected Hanford (Washington) projects

27 Independent Program/project Assessments NASA Standing Review Boards Subject Matter Experts Periodically engage Program/projects Documents Interviews Site visits Exercise tools separately Discussions among experts Produce findings Brief Program/project teams Report findings to organizational components

28 Independent Program/project Assessments NASA SOFIA ICESat-2

29 Two Examples of different models NASA Internal, collaborative vs. confrontational Independent Program Assessment Office (IPAO) Standing Review Board (SRB) of experts SOFIA ICESat-2 Government Accountability Office (GAO) External, independent watchdog Capitol Visitors Center Department of Energy (DoE), Audit of selected Hanford (Washington) projects

30 GAO Home Page The U.S. Government Accountability Office (GAO) is known as "the investigative arm of Congress" and "the congressional watchdog." GAO supports the Congress in meeting its constitutional responsibilities and helps improve the performance and accountability of the federal government for the benefit of the American people.

31 Timing and Perspective Capitol Visitors Center

32 Environmental Cleanup Hanford (Washington State)

33 Governance models discussed today Internal organizational project review Risk Management Board Independent Program, Project assessment examples NASA SOFIA and ICESat-2 Joint Review Boards GAO Audits performed for US Congress (conducted by teams of reviewers) Foundation of well defined policies, processes, and procedures

34 The path forward Where is your organization on the learning curve? How mature are your project risk management policies, processes, procedures? Do your project teams operate in an ad hoc manner?... in repeatable or managed manners?

35 Overarching Context How it all fits PEOPLE, ATTITUDES PROCESS, PROCEDURE TOOLS, TECHNIQUES, TRAINING ORGANIZATIONAL CULTURE Governance Strategy

36 For more information, please contact Keith Hornbacher, MBA, Affiliated Faculty Organizational Dynamics Graduate Programs School of Arts and Sciences, University of Pennsylvania Tel: , Managing Project Risk, Uncertainty, and the Unexpected (Course: DYNM-605)

37

38 Background

39 Institutional context University of Pennsylvania is located in Philadelphia Recognized as America s first university Founder Benjamin Franklin,1740 ~ 1751 Students (Fall 2011), Total ~ 25, % of applicants for class 2015 were offered admission Student to faculty ratio is 6:1 Schools Undergraduate (4) Graduate and Professional (12) Private university (not part of state system) Source: Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

40 Organizational Dynamics School of Arts and Sciences Graduate degrees MSOD and MPhil Six areas of concentration graduate studies in Coaching and Consulting Global Organization Leadership/Management Practitioner/Development and Change Sustainable Development Projects, Programs, and Portfolios Source: Keith D. Hornbacher, Hornbacher Associates ph

41 Organizational Dynamics School of Arts and Sciences Projects, Programs, and Portfolios (P 3 ) in 7 th year Limit of 20 per course (enables interactive dialogue) Core Courses Organizational Project Management Program Leadership Managing Project Portfolios Managing Project Risk, Uncertainty, and the Unexpected (DYNM-605) Teams of students project selected is used throughout semester Introduced Palisade tools Fall 2011: Decision Tools Suite for Project Various tools are discussed at Penn for context Electives, Practicum, and Capstone MS concentration; and certificate P 3 Leadership Professional (PLP) Source: Keith D. Hornbacher, Hornbacher Associates keithh@sas.upenn.edu ph

42 DYNM-605 student demographics include Mid to senior level career professionals (domestic and foreign) seeking graduate degrees Pharmaceuticals Aerospace/defense Public utilities Healthcare Financial institutions (banks, insurance, investment, M&A firms) High tech Other Penn graduate programs Governmental bodies (local, state, federal) Keith D. Hornbacher, Hornbacher Associates ph

43 Managing Project Risk, Uncertainty and the Unexpected THE ROLE OF PROJECT GOVERNANCE PMI-MN Dinner 18 March 2013 Minneapolis, MN Keith D. Hornbacher, MBA, Affiliated Faculty Organizational Dynamics Graduate Programs, School of Arts and Sciences University of Pennsylvania Phone: Founder and Principal Consultant - Hornbacher Associates 2013 Keith D. Hornbacher, Hornbacher Associates