Introduction
When starting risk management in a project, the first step is usually setting up a risk register. This involves identifying risks and assessing their impact using the expertise of the project team, the organisation, and sometimes third parties. This process can be time-consuming and complex, especially with many stakeholders involved. Often, once the risk register is complete, teams rush to mitigate the ‘seemingly’ biggest risks.
But what happens when we account for risks in the project schedule? Are the defined impacts still relevant to the project objectives? Do we still need to mitigate the same risks? These questions drive many experts to perform Risk Contribution Analysis, using statistical methods to examine the data.
Enter leading solutions like Safran Risk, which help the risk experts of our industries to communicate risk reports in a way that makes informed decision-making easier. In this blog we will dive into the challenge of risk reporting, and how to effectively perform and communicate the most important risks using Risk Contribution Analysis.
From Analysis to Risk Profiles
The goals of risk management include;- Create awareness of threats and opportunities
and - Incentivising measures to minimise negative impacts.
Effective risk reporting is crucial as it shapes our response to identified risks.
But how do we communicate these risks to stakeholders?
Modern risk tools offer various visualisations, from top risks in the risk register to distribution and tornado analyses. Multiple KPIs throughout the risk management process help set up a comprehensive risk profile for your project.
Keep in mind that when talking about statistical analyses, the focus will be on schedule/time and cost.
Other risk impact types (such as safety, environment, etc.) cannot be analysed through simulations, meaning there are some challenges left for setting up a complete risk profile.
What is a Risk Profile?
A risk profile describes a set of risks for work packages, projects, programs, or even organisations, highlighting issues or events that need additional focus. In a project risk profile, it is common to include a risk register with top risks and an impact scale. Using a risk matrix and risk scores, this information provides quick insights into risks with a large impact on activities.
Figure 1: Example Risk register
To offer deeper insights into a project’s overall goals, such as finish dates or milestones, a risk profile should include results from quantitative risk analysis. For example, distribution graphs or scatter plots can present the feasibility of the project within a certain timeframe or budget. However, these visualisations alone do not pinpoint the most impactful risks or activities.
This is one of the reasons risk tools can also produce tornado graphs, showing which risks or activities have the largest impact on project duration and cost. The challenge for many analysts is effectively communicating these graphs to relevant stakeholders without causing confusion over what the information implies.
Figure 2: Tornado graphs – Risk & Activity Correlation Analyses
Communicating meaningful numbers
In the left graph above, we can see that the top 2 risks are driving most of the project finish date, and in the right graph we can see what activities are most critical and thus drive the project finish date. These insights help us to identify the risks and activities that have the strongest link to the finish date, but they do not give us any concrete numbers that we can act on. Therefore, it is important to make sure people understand the report they are viewing, as it will increase the chances of taking action. A great way in doing so is by performing Risk Contribution Analysis.
The Contribution Analysis (in Safran Risk ‘’Sensitivity Analysis’’) is a powerful tool used to identify and quantify the impact of individual risks on a project’s schedule and cost. While traditional Monte-Carlo outputs focus on correlations between the risks and the schedule, the contribution analysis quantifies the impact of each risk on the project outcomes, providing a more detailed measurement of each risk’s impact.
Like a standard analysis, contribution analysis begins with running a simulation that includes all the given information. Afterwards, it runs another analysis for each risk, excluding that particular risk. By comparing the results of the initial analysis with those excluding one risk at a time, a difference in duration or cost can be calculated to demonstrate the outcome should that risk not occur in the project. This provides us with comprehensible figures instead of hard-to-explain correlation indexes.
With an estimation of the risk contribution to project cost and delay, the project team can start to think about effective mitigation strategies, making sure the cost of mitigating stays beneath the estimated cost of the risk (time and money combined). Hence, including the results of the Contribution Analysis in your risk profile seems to promote data-driven decision-making.
Forgetting Activity Uncertainty
When talking about risk profiles, it’s crucial to address activity uncertainty. Adding uncertainties to your schedule is one the most important steps in preparing the schedule for quantitative analysis. However, when uncertainties are not mentioned in either the risk register or the schedule, they can easily be forgotten.
We cannot assume that our risk register captures all the possible variances to our deterministic schedule; including activity uncertainty to account for inaccuracies and smaller, non-identified events is a necessity. Risk analysis tools such as Safran offers many possibilities to help register, calculate, and visualise uncertainty, and we strongly recommend making use of these functionalities.
For instance, a very useful way of analysing uncertainty is by converting uncertainties to risks and analysing them individually. This helps to see what uncertainty ranges need to be adjusted or perhaps further investigated to be able to estimate the uncertainty more precisely.
Showing schedule uncertainties in your risk profile is essential in risk reporting, since it stresses the importance of that what is non-predictable, promoting a more cautious and prepared approach in the project team. Furthermore, the sensitivity analysis can provide insight into how much buffer is needed to account for various uncertainties in our model if we want to be certain of our finish date.
Customer story: using uncertainties to help gain support for a schedule
In one of our experiences, a customer asked us to present a detailed demolish schedule for two bridges. The bridges are located at an opening of a highly intense traffic area. The two bridges needed to be demolished in one pre-scheduled weekend. The customer requested to see the full schedule, critical path and a tornado graph presenting the activities driving the finish date. Why? The customer explained to us they wanted to know how the results of the analysis relate to their expectations. Adding uncertainty to the risk model helped in identifying what activities landed on the critical path more often, enabling the customer to better understand and trust the presented schedule, and giving them support for focusing on the correct activities.
So, what should we learn from communication strategies?
Understanding and communicating risk profiles effectively is the cornerstone of successful project management. By leveraging tools like Safran Risk, project teams can move beyond ambiguous data to deliver actionable insights and be able to determine fitting mitigation strategies.
A powerful method to do just that is using Risk Contribution Analysis to quantify the impact of individual risks, making complex data comprehensible and actionable for all stakeholders. With an estimation of the cost of the risks (both timely and monetary), it will be possible to determine the right mitigation strategies.
Furthermore, including uncertainties into risk profiles ensures a comprehensive view, addressing both known and unknown factors that can influence project outcomes.
In our experience, clarity in risk reporting builds trust and supports informed actions, ensuring projects stay on track and objectives are met.
Ultimately, effective risk communication fosters a proactive approach, focusing solely comprehensible and useful information. That journey from analysis to actionable insights is essential, transforming how we perceive and manage risks in our projects.
For further information on services offered, please get in touch by email: insight@primaned.com
