Risk Management User Guide

Risk Management User Guide Version 17 December 2017

Contents About This Guide... 5 Risk Overview... 5 Creating Projects for Risk Management... 5 Project Templates Overview... 5 Add a Project Template... 6 Add a Project... 7 Assign a User or a Group Access to a Project... 9 Assign a Project Calendar... 10 Assign a Code to a Project... 10 Set the Data Date for a Project... 11 Change the Status of a Project... 12 Set a Workflow and Form for a Risk Proposal... 13 Delete a Project... 14 Risk Management Integration with P6 EPPM using Primavera Gateway Overview... 15 Synchronize Project Data with P6 EPPM... 15 Developing Risk Assessment Criteria... 16 Risk Thresholds Overview... 16 Create a Risk Threshold Template... 17 Update the Owning Workspace of a Risk Threshold Template... 18 Risk Matrixes Overview... 18 Create a Risk Matrix Template... 18 Configure the Probability and Impact Diagram Settings... 20 Update the Owning Workspace of a Risk Matrix Template... 20 Identifying and Analyzing Project Risks... 21 Qualitative Risk Analysis Overview... 21 Risk Register Overview... 21 Create a Risk in the Risk Register... 22 Add a Risk to the Risk Register... 22 Assign a Manager to a Risk... 23 Assign an Activity to a Risk... 23 Assign a CBS Code and Cost Category to a Risk... 24 Add Risk Details... 24 Create a Risk by Import... 25 Create an Import Template for Importing Risks... 25 Import Risks from Microsoft Excel... 25 Propose a Risk in the Risk Register... 26 Create a View on the Risks Page... 26 Add a Risk View... 27 3

Risk Management User Guide Configure the Risks Columns... 27 Configure the Risks Filters... 28 Configure the Risks Grouping... 28 Risk Scoring Overview... 29 Assign a Risk Matrix to a Project... 31 Assign Probability and Impact Values to a Risk... 32 View the Risk Chart... 32 Quantitative Risk Analysis Overview... 33 Quantitative Risk Analysis Prerequisites... 34 Apply Activity Uncertainty... 34 Run a Risk Analysis... 35 Understanding Convergence... 37 Monitor Background Services... 38 View Risk Analysis Distribution Results... 38 Understanding Distribution Graphs... 39 Distribution Results Field Definitions... 40 View Risk Mean Impact Analysis Results... 43 View Risk Removal Impact Analysis Results... 44 Controlling Project Risks... 45 Add a Risk Response Action... 45 Specify Risk Probability... 46 Specify Schedule Impact... 46 Specify Cost Impact... 47 Legal Notices... 49 4

About This Guide This guide explains how to use the Risk app in Oracle Prime to analyze and manage the impact of risk on a project. Project managers and risk analysts should read this guide. Risk Overview Oracle Prime provides a risk management solution integrated with both qualitative and quantitative risk analysis capabilities to help you determine the impact of risk and uncertainty on your project. Using the application, you can identify and prioritize potential threats and opportunities that exist for your project. For further analysis, you can run a quantitative analysis which examines your project schedule with risks and uncertainties, and calculates the chance that your project will be completed within a given period of time and budget. Key Features Log all project risks in a risk register and manage their details, including descriptions, status, probabilities, impacts, and other information. Use workflows and forms to create and review proposed risks for approval. Prioritize project risks based on risk scoring criteria defined for the project. Run a Monte Carlo analysis using project schedule and risk data to produce probability curves showing expected time and cost outcomes and the probability of achieving each. Develop risk response actions to address project risks and establish post-response contexts. Track risk exposure to CBS codes and have cost information roll up to the project cost sheet. Creating Projects for Risk Management The following tasks are the typical steps you can take when initially creating projects for risk management: 1) Add a Project (on page 7) 2) Assign a User or a Group Access to a Project (on page 9) 3) Assign a Project Calendar (on page 10) 4) Assign a Code to a Project (on page 10) 5) Set the Data Date for a Project (on page 11) 6) Change the Status of a Project (on page 12) Project Templates Overview Project templates are reusable models of projects you can store and use later to save time and standardize your operations. 5

Risk Management User Guide A template includes all the details, best practices, and de facto standards your organization associates with projects of a particular type. Use project templates to create a library of predefined project structures that can later be used as starting points for new projects. For example, say your organization is responsible for managing the construction of store Smith Wholesale in multiple states. The WBSs and resources are essentially the same. A template in this situation enables you to quickly create the project and add any unique requirements for the projects in the different states. A project template can be created from scratch or can be created using an existing project or template. When a template is created from an existing project, all the actual values, including dates, units, and durations, and location fields are cleared. If the data in the project being copied is not included in the parent workspace where the project template exists, the data is promoted to the parent workspace. This data includes resources, roles, configured fields, dashboards, units of measure, calendars, and curves. The following data is not copied into project templates from existing projects: Scope data, including the PBS, scope items, and work packages. matrixes and thresholds stored at the workspace level. Project-level matrixes and thresholds are copied. Add a Project Template Project templates are created when the organization manages similar, repeatable projects. A project template can be created from scratch or can be created using an existing project or template. The following data is not copied into project templates from existing projects: Scope data, including the PBS, scope items, and work packages. matrixes and thresholds stored at the workspace level. Project-level matrixes and thresholds are copied. To add a project template: 2) In the app, Browse to a workspace. 3) In the sidebar, select Projects. 4) On the Projects page, select the group where you want to store the project. Note: The group may be the workspace name or another grouping name if a Group By option is selected for the table. If the table is organized by a group other than workspace, then the new project will inherit the attribute for that group. For example, if the table is grouped by a project code, the new project will inherit the project code for that group. 5) Select the Add Project menu, and select Template. 6) In the Create New Project Template dialog box, complete the following fields: Template Name: Enter the name of the project template. 6

Creating Projects for Risk Management Template ID: Enter a unique identifier for the project template. The ID defaults to the project template name. Workspace: Select which workspace the project template should be added to. (Optional) Copy From Another Project: Select an existing project or template, if appropriate. (Optional) Project Currency: Select a new currency if the default is not applicable to the project template. Exchange Rate: If a different currency is selected, enter the exchange rate. 7) Select Add. Contracts Cost Document Exchange Enterprise Funds Portfolios Resources Scope Strategies Tasks Add a Project A project can be created from scratch or can be created using an existing project or template. The following data is not copied from existing projects or templates: Scope data, including the PBS, scope items, and work packages. matrixes and thresholds stored at the workspace level. Project-level matrixes and thresholds are copied. To add a project: 2) In the app, Browse to a workspace. 3) In the sidebar, select Projects. 4) In the table, select the group where you want to store the project. 7

Risk Management User Guide Note: The group may be the workspace name or another grouping name if a Group By option is selected for the table. If the table is organized by a group other than workspace, then the new project will inherit the attribute for that group. For example, if the table is grouped by a project code, the new project will inherit the project code for that group. 5) Select the Add Project menu, and select Project. 6) In the Add Project dialog box, complete the following fields: Name: Enter the name of the project. ID: Enter a unique identifier for the project. The ID defaults to the project name. Project IDs are unique per workspace. Workspace: Select which workspace the project should be added to. (Optional) Copy From Another Project: Select an existing project or template. (Optional) Project Currency: Select a new currency if the default is not applicable to the project. Exchange Rate: If a different currency is selected, enter the exchange rate. 7) Select Add. Tips Projects can also be added using the Create New menu. The project is set to Active by default. You can create a project collection from the Projects page to easily manage a subset of projects that are important to you or a group. Select multiple projects, select the Context menu, and select Create Project Collection. Contracts Cost Document Exchange Enterprise Funds Portfolios Resources Scope Strategies Tasks 8

Creating Projects for Risk Management Assign a User or a Group Access to a Project Users can be assigned to projects individually or through user groups. Each user or user group must be assigned a project permission set. A user group may have been configured with a default permission set. This permission set can be changed for the project assignment at any time. To assign user access to a project: 3) In the sidebar, select Summary & Settings. 4) On the menu, select Security. 5) Select the Assign menu, and then select User or Group. 6) In the Assign User or Assign Group dialog box, enter the user or group name. 7) Select the name, and select Next. 8) In the Permission Set column, select a permission set for each permission type. Note: If you assigned a user group that is configured with a default permission set, you can keep the default or select another if necessary. 9) Add any other optional permission sets applicable to that user or group. 10) Select Assign. 11) Select Save. 12) In the Summary & Settings panel, select Close. Tips If you added the project in the application, you are automatically assigned access to the project with the Administrator permission set assigned. The Search feature searches the entire list of users for matches. During that initial search, it will stop after finding 500 results, then filter out those who have already been assigned. For this reason, your maximum number of search results might vary. To limit the number of results, be as specific as possible when entering a name in the search field. For example, enter the first and last name of the user. Contracts Cost Document Exchange Enterprise Field Funds Portfolios Resources 9

Risk Management User Guide Scope Strategies Tasks Assign a Project Calendar Each project must have a calendar assigned. The default calendar in the workspace will automatically be assigned as the project calendar. The calendar can be changed to suit the needs of the project. To assign a project calendar: 3) In the sidebar, select Summary & Settings. 4) On the menu, select General. 5) In the Details section, in the Calendar field, select a calendar. 6) Select Save. 7) In the Summary & Settings panel, select Close. Contracts Cost Dashboards Document Exchange Field Files Reports Resources Scope Tasks Assign a Code to a Project Assign codes to projects to help track projects based on attributes they share. When managing a large number of projects, project codes enable you to filter and group information across the organization. To assign a code to a project: 10

Creating Projects for Risk Management 3) In the sidebar, select Summary & Settings. 4) On the menu, select Codes. 5) Select Assign. 6) In the Select Code Value dialog box, expand the code, and select the code value. 7) Select OK. 8) Select Save. 9) In the Summary & Settings panel, select Close. Contracts Cost Document Exchange Enterprise Files Funds Portfolios Reports Resources Scope Strategies Tasks Set the Data Date for a Project The data date is the progress point, or "as-of date," for activities in the project. Project status is up-to-date as of the data date. The data date is also used for updating the dates of scope assignments and work packages when they are not linked to activities. Note: Dates will not change after the Data Date is updated for activities or scope assignments unless you run the Scheduler or Modify Dates feature, respectively. To set the project data date: 3) In the sidebar, select Summary & Settings. 4) On the menu, select General. 5) In the Details section, in the Data Date field, select the date. 6) Select Save. 11

Risk Management User Guide 7) In the Summary & Settings panel, select Close. Contracts Cost Dashboards Document Exchange Field Files Reports Resources Scope Tasks Change the Status of a Project The current status of projects determines how the projects are handled within the application. Project statuses can be set manually or through a workflow, depending on the status type. A new project is set to Active by default. To change the status of a project: 3) In the sidebar, select Summary & Settings. 4) On the menu, select General. 5) In the Details section, in the Status list, select the appropriate status: Proposal: The project is a project proposal and has not been extensively planned nor accrued any costs. A project proposal can only be created using a workflow and a change in status must also be performed through a workflow. Rejected: The project proposal has been rejected and will not be executed as a project. A project can only be marked as Rejected through the use of a workflow. Planned: The project is currently planned for execution. Project managers input expected project costs and other project data during this stage. A change in status can be performed manually or through a workflow. Active: The project is currently active and being executed. A change in status can be performed manually or through a workflow. Inactive: The project has been rendered inactive and will temporarily accrue no costs. A change in status can be performed manually or through a workflow. Complete: The project has been successfully completed and will no longer accrue costs. A change in status can be performed manually or through a workflow. 6) Select Save. 12

Creating Projects for Risk Management 7) In the Summary & Settings panel, select Close. Contracts Cost Dashboards Document Exchange Field Files Funds Reports Resources Scope Strategies Tasks Set a Workflow and Form for a Risk Proposal Determine the workflow and form to use when sending a proposed risk through the approval process. If no form is selected, a default form is used. The default form contains basic risk information such as name, type, and description. If no workflow is selected, the proposed risk is added directly to the risk register. To set a risk proposal workflow and form: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Objects, and then select Risk. 5) Select the Defaults tab. 6) In the Propose Risk section, in the Propose Risk Form field, select the form to be completed when proposing a new risk. 7) Select the Workflow Actions tab. 8) In the Propose row, in the Workflow field, select the workflow that will start after a risk proposal form is submitted. 9) Select Save. 10) In the Summary & Settings panel, select Close. Tips When setting a risk proposal workflow at the workspace level, you can choose to overwrite the current risk proposal workflows set for child workspaces and projects. You can also set workflows for individual projects in the project-level settings. 13

Risk Management User Guide Enterprise Delete a Project Deleting a project will remove relationships with other items, such as project dependencies and portfolios, and will also delete files added to the project. If you delete a project that is synchronized with P6 EPPM, the setting in P6 EPPM that indicates a project is synchronized with Oracle Prime is cleared. The project is not deleted from P6 EPPM. You cannot delete a project that is included on a portfolio budget planning scenario. You must delete it from the scenario first. After a project has been deleted, all rolled up values are recalculated. To delete a project: 2) In the app, Browse to a workspace. 3) In the sidebar, select Projects. 4) In the table, select the project row or rows. 5) Select the Context menu, and select Delete. 6) In the Delete dialog box, choose to delete the project permanently or mark the project as inactive. 7) Select OK. The application will run the deletion process in the background while you continue to work, and you will receive a notification when the process is complete. Contracts Cost Document Exchange Enterprise Funds Portfolios Resources Scope Strategies Tasks 14

Risk Management Integration with P6 EPPM using Primavera Gateway Overview Risk Management Integration with P6 EPPM using Primavera Gateway Overview Integration between Oracle Prime and P6 EPPM using Primavera Gateway enables you to import data from a P6 EPPM project into Prime where you can use the application to perform qualitative and quantitative risk analysis. This can be beneficial in circumstances where you manage your project schedule in P6 EPPM, but you want to take advantage of Prime's advanced risk management capabilities. When you import project risk data into Prime, data that is sent from P6 EPPM to the application includes risk thresholds, risk matrixes, and data from the project risk register. After this data is imported into Prime, you can perform a qualitative analysis to assess and prioritize the risks identified for your project. To run a more detailed quantitative analysis, you must also import schedule data from your P6 EPPM project. The system uses the activity data as inputs for the analysis process to determine how the identified risks can impact the durations and dates of your project activities. When the analysis is complete, key schedule dates returned from the analysis can be exported back to P6 EPPM to update the project in that application. Risk analysis results that can be exported back to a P6 EPPM project include: Pre-response and post-response results computed for the entire project and for each project activity. These results include probabilistic estimates for project start, project finish, activity start, and activity finish dates. Synchronize Project Data with P6 EPPM Synchronize project data when it is necessary to import or export data between Oracle Prime and P6 EPPM. To synchronize project data with P6 EPPM: 2) In the app, Browse to a workspace. 3) In the sidebar, select Projects. 4) In the table, select a project row. 5) Select the Integration detail window. 6) Select the Synchronization Name, and then select Sync. Contracts Cost Document Exchange Enterprise Funds Portfolios Resources 15

Risk Management User Guide Scope Strategies Tasks Developing Risk Assessment Criteria Typically, the first step in the risk management process is to develop Risk Thresholds and Risk Matrixes. A risk threshold is a range of values used to assess a project's tolerance for risk. It is used to create a risk matrix, the overall scoring mechanism used to perform qualitative risk analysis. A risk matrix is a qualitative analysis tool used to calculate the impact of a risk on a project and is required to perform qualitative or quantitative risk analysis. It includes probability threshold values, cost and impact threshold values, and any additional user-defined impact threshold values. These are all used to calculate risk. Risk Thresholds Overview Risk thresholds are scales that you define for rating risks in terms of likelihood, cost impact, schedule impact, and any custom impacts you want to define. Each scale comprises a range of values used to delineate different levels of risk that may face the project. The risk thresholds are the inputs used to create a risk matrix, the scoring mechanism used to compute risk scores for identified project risks. The risk thresholds that are necessary for a risk matrix are: Probability: The likelihood of a risk occurring. : The amount of time the risk will increase or decrease the project schedule, defined as either a percentage of the project's planned duration (by percentage) or as a duration value (by value). Cost: The cost impact if a risk occurs, defined as either a percentage of the project's planned cost (by percentage) or as a monetary value. User-defined: Any optional user-defined impacts configured for your workspace, such safety or environmental impacts. User-defined thresholds use text, rather than quantitative values, to define the impact of the risk. 16

Developing Risk Assessment Criteria Create a Risk Threshold Template Create risk thresholds to define the risk scoring criteria to use for a risk matrix. Risk thresholds are created at the workspace level as templates, making them available to use in child workspaces and projects. You should create risk threshold templates at a level in your workspace hierarchy where they are available to all workspaces and projects that will need them. The risk threshold template data is copied to a project when a matrix is assigned. You can modify the risk threshold at the project level without affecting the template or other projects to which the template is assigned. To create a risk threshold template: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Data, and then select Risk Threshold Templates. 5) In the table, select Add. 6) In the new row, complete the following fields: Name: Enter a name for the risk threshold. Type: Select a threshold type: Probability: Measures the likelihood of a risk occurring. Schedule: Measures the amount of time the risk will increase or decrease the project schedule, defined as a duration value. Cost: Measures the cost impact if a risk occurs, defined as a monetary value. User: Measures the impact of the risk in terms of a user-defined impact. Relative Schedule: Measures the amount of time the risk will increase or decrease the project schedule, defined as a percentage of the project's planned duration. Relative Cost: Measures the cost impact if a risk occurs, defined as a percentage of the project's planned cost. Note: Relative thresholds cannot be used in quantitative risk analysis. Number of Levels: Select a number of threshold levels. 7) In the Levels detail window, configure each level defined for the threshold: Name: Enter a name for the level. Code: Enter a short name or abbreviation for the level. Low: Enter a minimum value for the threshold range. High: Enter a maximum value for the threshold range. (Optional) Color: Select a color for the threshold level. 8) Select Save. 9) In the Summary & Settings panel, select Close. 17

Risk Management User Guide Enterprise Update the Owning Workspace of a Risk Threshold Template Update the owning workspace of a risk threshold template to move it to another workspace that you are assigned. If you move a risk threshold template to a workspace that is higher in the workspace hierarchy, it will be available to more workspaces. To update the owning workspace of a risk threshold template: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Data, and then select Risk Threshold Templates. 5) In the table, select a risk threshold template. 6) Select the Context menu, and then select Change Owning Workspace. 7) In the Select Workspace dialog box, select the new owning workspace, and select Select. 8) Select Save. 9) In the Summary & Settings panel, select Close. Enterprise Risk Matrixes Overview The risk matrix is a tool that helps provide a guide for risk assessment using qualitative metrics. A risk matrix includes probability threshold values, cost and schedule impact threshold values, and user-defined threshold values, which are used in the calculation of the risk score. The risk score is a general indicator of the significance of a risk and whether it requires extra attention. Create a Risk Matrix Template Create risk matrixes to assess and prioritize project risks. Risk matrixes are created at the workspace level as templates, making them available to use in child workspaces and projects. You should create risk matrix templates at a level in your workspace hierarchy where they are available to all workspaces and projects that will need them. When a risk matrix is assigned to a project, the data from template is copied to the project. This enables you to modify the project's risk matrix without changing the template or other project matrixes to which the template is assigned. 18

Developing Risk Assessment Criteria To create a risk matrix template: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Data, and then select Risk Matrix Templates. 5) In the table, select Add. 6) In the new row, complete the following fields: Name: Enter a name for the new matrix. Probability: Select a probability threshold. Cost Impact: Select a cost threshold. Impact: Select a schedule threshold. (Optional) User Impact: Select one or more user-defined thresholds. Note: All impact threshold selections for a risk matrix must contain the same number of levels. 7) In the Scoring Method column, select one of the following risk scoring methods: Highest Impact: The overall impact for a risk is set to the highest of all the impacts assigned to the risk. Average Impact: The overall impact is determined by calculating the average of all impact values. 8) (Optional) In the Description column, enter a summary of the risk matrix. 9) In the Sharing Method list, select Manual or Automatic. 10) Select Save. 11) In the Summary & Settings panel, select Close. Tips The inputs for the risk matrix are the risk thresholds, which you must create on the Risk Threshold Templates page in the workspace. The Matrix Size column is automatically calculated based on your threshold selections. The first number represents the number of levels assigned to the probability threshold and the second number represents the number of levels assigned to the cost, schedule, and user impact thresholds. The Probability and Impact Diagram (PID) is a graphical representation of your risk matrix which is automatically created based upon your threshold selections. Select Settings to modify the PID color settings. Enterprise 19

Risk Management User Guide Configure the Probability and Impact Diagram Settings The Probability and Impact Diagram (PID) is a graphical representation of your risk matrix template which is automatically created based upon your threshold selections. You can adjust the color settings for the PID to color-code risk scores. To configure the PID color settings: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Data, and then select Risk Matrix Templates. 5) Select a risk matrix template, and then select the Probability and Impact Diagram detail window. 6) Select Settings. 7) On the Score Colors tab in the Settings dialog box, do the following to define grid colors for the PID: a. In the Color list, use the picker to select a grid color. b. In the Operator list, select a comparison operator. c. In the Value field, select a risk score value to associate with the selected color. d. (Optional) To define additional grid colors, select Add, and specify the color settings. 8) Select Apply. 9) Select Save. 10) In the Summary & Settings panel, select Close. Enterprise Update the Owning Workspace of a Risk Matrix Template Update the owning workspace of a risk matrix template to move it to another workspace that you are assigned. If you move a risk matrix template to a workspace that is higher in the workspace hierarchy, it will be available to more workspaces. To update the owning workspace of a risk matrix template: 2) In the app, Browse to a workspace. 3) In the sidebar, select Summary & Settings. 4) On the Summary & Settings menu, select Data, and then select Risk Matrix Templates. 5) In the table, select a risk matrix template. 6) Select the Context menu, and then select Change Owning Workspace. 7) In the Select Workspace dialog box, select the new owning workspace, and select Select. 20

Identifying and Analyzing Project Risks 8) Select Save. 9) In the Summary & Settings panel, select Close. Enterprise Identifying and Analyzing Project Risks This stage of the risk management process includes both the identification of potential risks and the evaluation of the potential impact of the risk. As you identify risks, you add them to the risk register and document their characteristics. For each risk, you must assign probability and impact values based on the risk assessment criteria defined for the project. Using the criteria, you can prioritize your project risks. From this prioritization, you can develop a list of the most important risks that can be further analyzed to understand the severity of their potential impact to the project, and the time frame when the impact will occur. You can control the addition of risks to the risk register by establishing a risk proposal process. Build customized proposal forms and workflows to create, assess, and verify potential risks before they are added to the risk register. Qualitative and Quantitative Risk Analysis The application has the capability to perform both qualitative and quantitative risk analysis. Qualitative risk analysis involves ranking project risks based on non-numerical estimates of risk. Quantitative risk analysis is a more detailed analysis in which probabilistic modeling is used to express project risk as a distribution of possible cost and schedule outcomes and their likelihood of occurrence. Qualitative Risk Analysis Overview Qualitative risk analysis consists of using risk assessment tools to prioritize and rank the risks contained in the risk register using a pre-defined rating scale. Risks are scored based on their probability or likelihood of occurring and the impact on project objectives should they occur. Using qualitative analysis, you are able to focus on the most important risk areas. To perform qualitative risk analysis, you must have your risk assessment criteria set up for your project and the risk register must be populated with risk data. Risk Register Overview The risk register serves as a central repository for project risk data. Its key function is to provide project stakeholders with a clear view of the current status of each of the main risks faced by the project. 21

Risk Management User Guide The risk register uses an assigned scoring matrix to compute risk scores. Risk scores quantify the impact of each risk in terms of its total effect on the cost and schedule of the project. Using such quantifiable assessments, you can run a risk analysis to predict likely project outcomes in terms of money or time based on the combined effect of all project risks. Create a Risk in the Risk Register You can create risks manually, from an import template, or by using workflows and forms to control the risk proposal and approval process. To create a risk in the risk register: Add a Risk to the Risk Register (on page 22) Create a Risk by Import (on page 25) Propose a Risk in the Risk Register (on page 26) Add a Risk to the Risk Register Add risks to the risk register to capture potential threats or opportunities that might impact your project. To add a risk to the risk register: 3) In the sidebar, select s. 4) In the table, select Add. 5) In the new row, complete the following fields: Name: The name of the risk. ID: A unique identifier for the risk. Status: The state of the risk: Proposed: The risk is identified and awaits approval. You can include proposed risks in the risk analysis. Open: The risk is approved as a valid risk to the project. Active: The risk is currently impacting the project. Rejected: The risk is not seen as a valid risk to the project and therefore will not be tracked and managed by the project. The data for the risk cannot be modified after it is assigned a status of rejected. Managed: The risk occurred and was successfully managed by the project team and is no longer an active risk. The data for the risk cannot be modified after it is assigned a status of managed. Impacted: The risk occurred, impacted the project and is no longer an active risk. The data for the risk cannot be modified after it is assigned a status of impacted. 6) Select Save. 22

Identifying and Analyzing Project Risks Tips When entering a risk, with a risk matrix assigned to the project, the risk score is automatically calculated based on its probability and impact values and the risk matrix assigned to the risk register. Assign a Manager to a Risk A risk manager is responsible for managing a risk throughout the life of the project. When you add a risk to the risk register you are automatically assigned as the risk manager. You can override the automatic manager assignment and manually assign the risk to another member of your project. To assign a manager to a risk: 3) In the sidebar, select s. 4) In the table, select a risk. 5) In the Manager column, select a manager. 6) Select Save. Note: If the Manager column is not displayed in the risk register, select Settings, and add the column to the page. Assign an Activity to a Risk Assign activities to risks to identify in the project schedule when the risk can potentially impact. This information is also used during the quantitative risk analysis to simulate the impact of risk on project activities during the Monte Carlo analysis. After a quantitative risk analysis has been run, the results calculated for each activity are saved for the activity. Results that are calculated for activities include pre-response and post-response activity dates and durations, as well as the criticality index, which measures the probability that an activity will be part of the critical path. This information can be displayed in the Activities view as columns or as bars in the Gantt chart to identify activities that require special attention. To assign a risk to an activity: 3) In the sidebar, select s. 4) In the table, select the risk, and select the Activities detail window. 23

Risk Management User Guide 5) Select Assign. 6) In the Select Activity dialog box, select the activity, and select Select. 7) Select Save. Assign a CBS Code and Cost Category to a Risk By assigning a CBS code and a CBS cost category, both pre-response and post-response cost impacts are made available on the project's cost sheet. To assign a CBS code and a cost category to a risk: 3) In the sidebar, select s. 4) In the table, select a risk. 5) In the CBS Code and Cost Category columns, select a CBS code and a cost category for the risk. 6) Select Save. Add Risk Details Note: If a column is not displayed in the risk register, select Settings, and add the column to the page. The Risk Details detail window allows you to add, edit, and view additional details for each risk in the risk register. Add a description, cause, and effect to each risk to aid you during various risk management processes. To add risk details: 3) In the sidebar, select s. 4) In the table, select a risk, and then select the Risk Details detail window. 5) Select Edit next to a section header. 6) In the Risk Details dialog box, use a variety of formatting options to complete the following fields: Description: Enter a more detailed description of the risk. Cause: Enter one or more possible causes for the risk. 24

Identifying and Analyzing Project Risks Effect: Enter the potential effects of the risk. 7) Select Apply. 8) Select Save. Tips You can also edit each section by navigating between the tabs in the Risk Details dialog box. Create a Risk by Import Creating risks using Microsoft Excel enables you to use data from an outside system which can save you time from manual entry. To create or update a risk: 1) Create an Import Template for Importing Risks (on page 25) 2) Import Risks from Microsoft Excel (on page 25) Create an Import Template for Importing Risks Create a Microsoft Excel template to use when importing risks. To create an import template: 3) In the sidebar, select s. 4) On the Risks page, select Actions, and then select Download Import Template. Tips The import template is created as a Microsoft Excel file with the default file name RisksImportTemplate. The top two rows of the worksheet are required when importing risks from a spreadsheet. You can delete unused columns, but do not change the data in these rows. Import Risks from Microsoft Excel You can import risks into the application from a Microsoft Excel (.xls or.xlsx) file. After downloading the import template, follow the instructions to create or update risks in the spreadsheet. The import will fail if there are any invalid values in the spreadsheet. You can download the spreadsheet file to view and fix the errors indicated in the error column at the end of each worksheet, and then import the file again. 25

Risk Management User Guide You must have sufficient privileges to perform this task. To import risks from Microsoft Excel: 3) In the sidebar, select s. 4) On the Risks page, select the Actions menu, and then select Import. 5) In the Import Risks dialog box, select Browse, select a file, and select Import. Propose a Risk in the Risk Register You can implement workflows and forms to control the process of adding risks to the register. The risk proposal process is designed to allow a risk manager to collect risks from other parties in a controlled manner. This ensures that risks that may be duplicates, erroneous, or unverified are not added to the risk register. Users submit a proposal form to capture necessary information for a potential risk. After the form is submitted, a workflow is started to move the risk through an approval process. A proposed risk is added to the risk register with a status of Proposed. The risk is not editable until it is approved or rejected through the workflow. To propose a risk in the risk register: 3) In the sidebar, select s. 4) Select the Actions menu, and then select Propose Risk. 5) In the proposal form dialog box, complete the form fields. 6) Select Submit. Tips The workflow performer will receive a notification when the workflow is ready for review. You can also review workflows in the Actions column on the Risks page. If no custom form is set for the proposal process, a default form is used. The default form contains Name, Type, Cause, Description, and Effect fields. If no workflow is set, the proposed risk is added directly to the risk register. Create a View on the Risks Page Create views to define how data is visually displayed on the Risks page. 26

Identifying and Analyzing Project Risks To configure a view: 1) Add a Risk View (on page 27) 2) Configure the Risks Columns (on page 27) 3) Configure the Risks Grouping (on page 28) Add a Risk View When adding a new view, you can add one of three types of views: personal, project, or workspace. Personal views are private and only accessible to the user who created them. Project views are saved at the project level and can be accessed by other members of the project with the necessary security privileges. Likewise, workspace views are saved at the workspace level and are available to other members of the workspace with the necessary security privileges. To add a view: Note: Your security privileges determine your ability to create project and workspace views. 3) In the sidebar, select s. 4) In the View list, select Manage Views. 5) In the Manage Views panel, select a view type (Workspace, Project, or Personal), select the Context menu, and then select Add. 6) Enter a name for the new view. 7) Select Save. 8) In the Manage Views panel, select Close. Configure the Risks Columns Configure columns to select and position the columns of data that appear on the Risks page. To configure columns: 3) In the sidebar, select s. 4) In the View list, select Manage Views. 5) In the Manage Views panel, select the view to configure. 6) Select the Columns tab. 7) In the Available Columns section, select columns and select Add Column to Selected Columns to add them to the Selected Columns section. 27

Risk Management User Guide 8) Use the up and down arrows to change the positioning of the columns in the Selected Columns section. 9) Select Save. 10) In the Manage Views panel, select Close. Configure the Risks Filters Configure filters to limit the risk data that is displayed in the risk register. To configure filters for the risk register: 3) In the sidebar, select s. 4) In the View list, select Manage Views. 5) In the Manage Views panel, select the view to configure. 6) Select the Filtering tab. 7) In the Match list, select an option to define the filter conditions: All of the following: Data is filtered only if it matches all the specified rules. Any of the following: Data is filtered if it matches any of the specified rules. 8) Select Add a filter condition. 9) In the first row, use the following fields to define a filter rule: Field: The data field to which the rule is applied. Operator: The comparison operation for the rule. Value: The value against which the rule compares the data field. 10) (Optional) Add rows for each filter rule you want to define. 11) (Optional) Use the Context menu to add filtering rules. 12) Select Save. 13) In the Manage Views panel, select Close. Configure the Risks Grouping Configure grouping options for views to specify how data is grouped on the Risks page. To configure grouping: 28

Identifying and Analyzing Project Risks 3) In the sidebar, select s. 4) In the View list, select Manage Views. 5) In the Manage Views panel, select the view to configure. 6) Select the Grouping tab. 7) In the Group By section, select your grouping options: Group By: Defines how data is grouped together on the page. Sort Order: Defines how data is sorted within groupings. 8) In the Band Options section, select Show field title to display the title of the field by which data is grouped in a band. 9) Select Save. 10) In the Manage Views panel, select Close. Risk Scoring Overview A risk score is calculated for each risk entered in the risk register when a risk matrix is assigned to a project. The risk score is used to indicate the general significance of a risk. The higher the risk score, the higher the risk level associated with the item. The risk score is calculated based upon the probability and impact values assigned to each risk. It is calculated by multiplying the risk probability by the overall impact value. The overall impact value is calculated based upon the scoring method assigned to the risk matrix. The overall impact value is calculated using one of the following two methods: Highest Impact: The overall impact for a risk is set to the highest of all the impacts assigned to the risk. Average Impact: The overall impact is determined by calculating the average of all impact values. Below is an example demonstrating how risk scores are calculated using the two scoring methods. 29

Risk Management User Guide Risk Scoring Example The City Center Office Building Addition project is a long-term facility upgrade project for which several risks have been identified and added to the risk register. For each risk, a risk score is automatically calculated based upon the probability and impact values, and the assigned risk matrix. The following image depicts the probability and impact diagram for the risk matrix that is assigned to the City Center Office Building Addition project. This matrix uses the Highest Impact scoring method to calculate risk scores. Using the probability and impact diagram as a reference, review the following table to understand how the score was calculated for risk R3: Delay in land surveys undertaken, and how the score changes depending on the risk scoring method assigned to the risk matrix. Method Calculation Details Score Highest Impact The highest impact for the risk is the schedule impact, which is marked as High. High is equivalent to Severity 4 in the Probability and Impact Diagram (PID). Using the PID, a Severity 4 and a High Probability gives this risk a score of 28. 28 30

Identifying and Analyzing Project Risks Average Impact The overall impact for this risk is the sum of 4 (high schedule impact) plus 2 (low cost impact) divided by 2 (number of impacts) equals 3. In this example, the 3 represents a Medium impact and is equivalent to Severity 3 in the PID. Using the PID, a Severity 3 and a High Probability gives this risk a score of 14. 14 Assign a Risk Matrix to a Project Assign a risk matrix to a project to use to calculate risk scores for risks added to the risk register. The assigned risk matrix copies its data from a risk matrix template at the workspace level. To assign a risk matrix to a project: 3) In the sidebar, select Summary & Settings. 4) On the menu, select Data, and then select Risk Matrix. 5) On the Risk Matrix page, select Assign. 6) In the Assign Risk Matrix dialog box, select a risk matrix to assign to the project, and select Select. Tips The Copied From section displays the name of the risk matrix template from which the assigned matrix data is copied, even if the matrix template is changed or deleted. The Matrix Size section displays the size of the assigned matrix. In the Scoring Method list, select one of the following risk scoring methods: Highest Impact: The overall impact for a risk is set to the highest of all the impacts assigned to the risk. Average Impact: The overall impact is determined by calculating the average of all impact values. The Probability and Impact Scores tab displays a graphical representation of your risk matrix which is automatically created based upon your threshold selections. Modify individual scores according to your project needs. Select Settings to modify the color settings. The Thresholds tab displays a list of the thresholds copied from the assigned risk matrix template. Select the Context menu to add a new user threshold, add an existing user threshold from another workspace, or replace an existing threshold with a threshold from another workspace. The Levels detail window displays the level details of the selected threshold. Modify level names, codes, low and high values, description, and associated color value. You can toggle the threshold colors for probability and impact cells on the Risks page. 31

Risk Management User Guide Assign Probability and Impact Values to a Risk The probability, schedule, and cost impact values entered for each risk are used to calculate the risk score. Choose from a selection of threshold values determined by the assigned risk matrix. Use the risk register to define risk values for pre-response and post-response contexts. To assign probability and impact values to a risk: 3) In the sidebar, select s. 4) In the table, select a risk. 5) In the Pre-Response Probability column, select a probability threshold. Note: If the Pre-Response Probability column is not displayed in the risk register, select Settings, and add the column to the page. 6) In the Pre-Response Schedule column, select a schedule threshold. 7) In the Pre-Response Cost column, select a cost threshold. 8) Select Save. Tips Select Threshold Colors to enable threshold level colors in the probability and impact cells. To override the probability or impact threshold values in the risk register, you can manually enter values in the Probability, Schedule Impact, and Cost Impact detail windows. View the Risk Chart The risk chart provides an alternate view of the risk register, highlighting important risk data from several different perspectives. The Summary section represents the project's risk profile, displaying the total risk score and summarizing all the project risks, broken down by status and type. The Risk Score section displays all the project risk scores plotted against the probability and impact diagram for the risk matrix assigned to the project. The Risk Count section displays the number of project risks, plotted against the probability impact diagram, according to their risk level. The Probability and Impact Diagram section displays, as a reference, the probability and impact diagram for the risk matrix assigned to the project. To view the risk chart: 3) In the sidebar, select s. 4) Select Chart. 32

Identifying and Analyzing Project Risks Quantitative Risk Analysis Overview Quantitative risk analysis is a way of numerically estimating the probability that a project will meet its cost and time objectives. Quantitative risk analysis can also help you pinpoint where your biggest risk exposure lies and when in the project schedule it is most likely to occur. Oracle Prime gives you the ability to run a quantitative risk analysis on a project based on a simultaneous evaluation of the impact of all identified and quantified risks, as well as the impact of general activity uncertainty. The application uses the Monte Carlo method to perform the quantitative risk analysis. Monte Carlo is a probabilistic simulation modeling technique to quickly generate multiple runs simulating real project progress. During the analysis, the system uses varied combinations of input variables to build its model, including project schedule, risk, and cost data within their statistical constraints. Using the data, each simulation run generates a duration for each project activity, given its associated risks and general uncertainty. The system also records all project schedules and critical paths during progress to calculate the many possible project completion dates and project costs. The results of the Monte Carlo analysis are statistical distributions of cost and schedule estimates for the entire project. The analysis also produces statistical distributions of schedule estimates for individual activities. Based on the calculated distributions, it is possible to determine the chance that the project or an activity will be completed on a certain date. You can also determine the chance that the project will be completed within a certain cost. Optionally, the Monte Carlo analysis also produces a list of the risks that most critically affect (positively or negatively) the finish date and cost of the project in the form of tornado charts. Known as a risk removal impact analysis, results include the potential impacts of individual risks as well as the average estimated impacts that each activity or risk may have on the finish date and cost of the project. Pre-Response and Post-Response Analysis Overview When you enter risks in the risk register and specify probability and impact values for them, you establish a pre-response risk context for your project. This represents your project risk profile before any measures are implemented to mitigate the effect of the risks on the project objectives. To control project risks, you can add risk response actions and define post-response probability and impact values to characterize how response actions can mitigate the effect of risk. When you add risk response actions and enter post-response probability and impact values, you establish a post-response risk context. This represents your project risk profile after risk mitigation techniques have been implemented. You can run risk analyses against the alternate response contexts to determine the effectiveness of your risk response actions. 33