• The identification of risks, and the generation of an understanding of their interactions, dependencies and likely significance, drives the identification and development of possible response actions.
• In this way, plans are improved, both reducing adverse risks and exploiting upsides (such as operational or strategic flexibilities), with such actions, and their effects, costs and benefits, being included in a revised plan.
Much benefit can often be achieved even when such processes are only of a qualitative nature, because key individual risks would nevertheless typically be identified, and some consideration of possible risk-response actions would be undertaken. However, quantitative approaches will provide a much larger set of benefits, as discussed later in the text.
When considering the structure of a project or plan, there are generally many possible risk-response measures available. Some risk items are more controllable (or exploitable) than others, and the cost of doing so will be different for each. For example, the variation in oil prices may be essentially uncontrollable (there may be possibilities to hedge or engage in forward contracts in the short term, but in the medium term the impact on a business is typically largely uncontrollable).
In general, one may prioritise and implement measures in some order driven by a cost–benefit analysis of each one, and after implementing some of them, one would arrive at a point where the use of further measures is not economically efficient. For example, the risk of having an accident when crossing the road is rapidly reduced when low-cost measures are implemented (such as looking each way, or perhaps wearing running shoes or reflective clothing) but in many cases it would not be economically efficient, or practical, to eliminate the risk entirely (by having a bridge built): the marginal risk reduction that would be achieved by such a measure cannot be justified by the marginal cost increase that would be needed to implement it.
There may also be interaction between any such measures, so that there may be some measures that would make (economic) sense in isolation, but would not make sense within the wider context of a set of measures. Indeed, whether a particular measure makes sense may depend on which other measures are implemented first.
Further, in practice, risk-response actions may also affect multiple metrics (or line items in a model), so that the making of the appropriate trade-off between them may be non-trivial.
Thus, although the choice of measures to implement could be considered as a quantitative optimisation problem, the use of such approaches in these contexts is usually limited by practical considerations; a mixture of judgement, pragmatic considerations and some basic quantitative analysis is usually sufficient to find a mix of measures that is (close to) optimal.
Once the “risk-optimised” structure has been found, there is still generally residual risk; some risks will not be economically effective to eliminate, even where doing so would be possible. One is still exposed to potentially adverse outcomes, so that the ultimate outcome may not be satisfactory (of course, the chance of a satisfactory outcome should increase as a result of the risk assessment activities).
Nevertheless, it is still of fundamental relevance to understand the extent of residual (or non-controllable) risk that remains after all worthwhile measures (or decisions) have been implemented: the range of possible outcomes will help to establish whether to proceed or not with a particular decision, or to inform the process of modifying targets and setting contingencies. For example, before a decision is made, one may typically wish to know the average outcome, as well as the best or worst 10 % of cases for key metrics (such as sales, cost, cash flow). Risk tolerances therefore come into play when the final decision is being made: one person may reject a decision that has a 10 % chance of a significantly bad outcome (even if all other outcomes would be highly favourable), whereas another person may choose to proceed, in order to generally benefit from the mostly positive outcomes.
Risk assessment also has a key role to play in project management and execution. For example, one may wish to analyse potential risks relating to the schedule, potential delays, specific cost items or on-specification delivery. To some extent, such activities are a continuation of those that may have been initiated at project design and conception: risk considerations relating to project execution should ideally be reflected in the earlier stages of conception and basic design; projects that are expected to be more complex to execute than others should be evaluated less favourably.
However, in practice it is not possible to fully take into account all project execution risks at the earlier stages of project conception:
• Very often, following authorisation, a much more detailed planning procedure is undertaken prior to (or as part of) the implementation: items such as detailed technical planning, obtaining quotes from several suppliers for all outsourced items, conducting contractor negotiations, planning internal resources and making resource trade-off decisions can really only be conducted once decisions to proceed have been finally made.
• In the time period between the authorisation and the implementation of a decision, the external environment may have altered (such as a change in regulations issued by the government, or other risk events materialize, which alter the best possible future course of action). There may often be some change to the scope, or other changes that may have occurred.
• The project may inherently contain phases (or decision gates), where future activities within the project may need to be adapted as the project proceeds; examples include exploration, appraisal and development projects in the oil, gas and resource sectors, as well as in pharmaceutical development.
Most businesses are portfolios of activities or other elements in some way. For example, sales revenues are the sum of those of different product lines, regions, business units, customers, geographies, projects or assets. In general, the constituent components typically have different characteristics in terms of their implications for key business metrics, such as growth rates, capital investment requirements, project delivery timeframe, cost, cash flow, return on capital, etc. (as well as for their associated risks):
• Mature projects (or products that may be generating a fairly dependable stream of revenues or cash flow) may require little ongoing investment or development activity.
• Projects currently in the implementation phase may require significant amounts of cash investment: whilst not yet producing revenues, these may nevertheless be of medium risk, in the sense that future revenues and cash flow may be uncertain, subject to uncontrollable factors, or to overruns in capital expenditure, or to implementation delays.
• Projects in research or early-stage development may currently require fairly small investments, but their success or failure (and associated timeframe) may be crucial to the medium-term performance or to the long-term survival of the business; in that sense, these projects may be considered highly risky.
• There may also be existing joint ventures, potential acquisition possibilities, and so on; each will have its own specific risk profile for key metrics.
In addition, there will be some issues that are important at a corporate (or aggregate) level, even though such issues may be less relevant at the level of individual projects. For example:
• Generally, issues concerning corporate cash flow, financing, debt and equity structures, treasury and tax have to be dealt with at the corporate level, even though the aggregate corporate position is driven by individual projects.
• Although individual projects within a set of investment projects may appear to make sense on a stand-alone basis (for example, each may have a highly positive net present value, resulting from some initial investment and then a series of positive cash flows), in aggregate, the investment requirements for the full set of projects may be too high to allow them all to be implemented simultaneously. There could also be non-financial constraints to their simultaneous implementation, such