RESEARCH ARTICLES

 

Risk management and the role that certain risks play

 

 

CM Blake

University of Johannesburg

 

 

---

ABSTRACT

Risks and the management thereof are seen to be a crucial part of project management. The unsuccessful management of risks could lead to the downfall of an otherwise successful project. Therefore it is the purpose of this article to define risk and to understand the concept of risk.
Cashane Vending is a sole owned enterprise that owns and services various cold drink and snack machines within the greater Rustenburg area. The company is currently attempting to shift its focus to mobile advertisement boards and as a result has initiated a project to that effect. Using Cashane Vending as a basis, the tools and techniques of how to identify risks will be explored along with the various categories of risks. The probability and impact of each risk identified within Cashane Vendings project will be discussed and a severity risk matrix will be constructed. Finally risk monitoring and control will attract some attention. The various strategies that Cashane Vending can use should their risks materialise will also be examined.

Key phrases: projects; risk control; risk impact, Risk management; risk monitoring, risk probability

---

 

 

"In this world nothing can be said to be certain except death and taxes"

Benjamin Franklin

 

INTRODUCTION

According to Kolb (2004:Internet) a risk is a potential event with negative consequences that has not happened yet. ACCA (2002:4) defines risk as the possibility that actual results will turn out differently from what was expected. Ferrell (2004:Internet) on the other hand defines risk as a future event (or series of events) with a probability of occurrence and the potential for loss or impact on objectives. PMBOK (2000:182) then argues that project risk is an uncertain event or condition that, if it occurs, has a positive or a negative effect on at least one project objective. The most comprehensive definition of risk comes from Conrow (2003:21), which defines risk as a measure of the potential inability to achieve overall program objectives within defined cost, schedule and technical constraints and has two components: 1) the probability (or likelihood) of failing to achieve a particular outcome and 2) the consequences (or impact) of failing to achieve that outcome.

Within the scope of a project, project managers are faced with risks on a daily basis. Therefore it is of the utmost importance that project managers commission the investigation of as many risks as possible. Risks that have been identified and analysed, make it far easier to plan for and manage, however, unknown risks cannot be managed efficiently whilst developing contingency plans for these unknown risks become more difficult.

The management of project risk can be seen in the following processes (PMBOK 2000:182):

· Risk management planning

· Risk identification

· Qualitative risk analysis

· Quantitative risk analysis

· Risk response planning

· Risk monitoring and control

Although the focus of the article is not to describe each step in detail but rather to focus on what type of impact can be expected by certain types of risk on the budget of a project. Risk monitoring and control will attract some focus at a later stage.

According to Heldman (2004:5) a project can be classified as an activity that is unique to the company. It has a definite ending date and the project is considered complete when the project goals are achieved.

 

CASE STUDY

Cashane Vending is a sole owned enterprise. Mr. D van Heerden started this venture in 1997, where he operated one Coca Cola vending machine after hours while still working as an accountant.

In 1998, Sun Crush Ltd (which was eventually taken over by ABI Ltd) bought a number of vending machines and Mr. DJ van Heerden was allocated 35 Coca Cola vending machines. This was the year that he decided to resign from his job and move into the vending business on a more permanent basis.

Since then Cashane Vending has grown from strength to strength and presently operates 115 Coca Cola vending machines. Their operational area extends from Rustenburg to Mooinooi to Thabazimbi.

In 2000 Mr. van Heerden approached Nestle. He now operates 20 snack machines. These snack machines sell brands such as Willard's Curls , Willard's Vita Snacks, Willard's Diddle Daddle popcorn, Big Corn Bites, Bar One Golds, Kit Kat chunky, Tex and Chocolate Log , to name only a few.

Over the years Cashane Vending has experienced a substantial drop in turnover over the winter months. Yet the overheads have virtually stayed the same. The drastic increase in the petrol price has aggravated the situation.

To alleviate this problem/shortfall on the budget, a project was initiated in a totally different field. This unrelated diversification's purpose is to have a cash flow/income that is not dependent on the weather.

The uniqueness of this project stems from the fact that the company wants to move from currently doing vending in cold drinks and snacks to advertising space on mobile advertisement boards. It is something that the company has never done before.

The deadline of the project is to have three trailers up and running with all the advertisement space sold before the 1^st July 2005. It is then that the turnover of the company is most affected due to the winter months and the new income from the project is most certainly needed.

The project will therefore be considered completed when the advertisement spaces on all three trailers have been sold and the project will be terminated by including the project into every day operations.

From Heldman's (2004:5) definition of a project, it is clear that Cashane Vending's project can truly be called a project.

The following budget for Cashane Vending's project was provided by Van Heerden (2005: Interview).

 

TOOLS AND TECHNIQUES TO IDENTIFY RISKS

There are many tools and techniques that a project manager can employ to identify the various categories of risk. Conrow (2003:191) suggests the following tools and techniques, but the list is not limited to the following:

· Lessons learned

· Checklists and expert opinion

· Fishbone diagrams

After the completion of a project, the administrative closeout usually takes place. It is here that all the lessons learnt from the project in terms of the effectiveness of processes and the management of risks are documented. When preparing for your current project it is then possible to refer back to this documentation. It is important to ensure that the two projects are similar in nature in order to avoid any form of bias. By learning from past lessons, one has almost gained an advantage point in identifying possible future risks.

In the case of checklists and expert opinion, the process starts with historical information. From this information, lists of carefully worded questions are given to all stakeholders. Their responses to these carefully worded questions may be sufficient to indicate a medium or higher risk. This then warrants performing a risk analysis on the item in a timely manner. This tool should never be used as the sole form of risk identification as it is possible that important risks could be overlooked.

Fishbone diagrams were originally developed by Kaoru Ishikawa. The diagram determines components of a process that feed into the core process and which eventually feeds into the final effect (final product). This diagram enables the project manager to focus on the components that contribute to the operation's success. By focusing on each component in depth, it is here that possible risks can be identified.

Cashane Vending has never undertaken a project similar in nature and therefore making use of lessons learned would be inappropriate and a form of biases could evolve. As for checklists and expert opinion, again there is very little historical information available to make use of. But by constructing a list of possible questions and asking other experts outside of the company to assist in the process, it could be possible to make use of this tool.

Frame (2003: 50) provides the following tools and techniques for identifying possible risks:

· Brainstorming sessions

· Regular meetings

When brainstorming, a group of people get together and ask: "What can we imagine happening in our operations?" It is here that colleagues are expected to come up with crazy possibilities. The more ideas (risks) that are generated the better. Each idea (risk) is written down and then critically evaluated. The risks may then be ranked in order of priority and contingency plans for these risks may be developed.

During regular meetings, team members of the project have the opportunity to share experiences and provide key information where necessary. Collectively it provides the team members with the opportunity to identify any risks that might have been originally overlooked or provide current information on the risks that were identified.

It is believed that brainstorming sessions and regular meetings would provide the most suitable way of identifying risks within Cashane Vending's project. A task team of colleagues who are all involved with the project was established. Through brainstorming techniques and regular meetings the team was able to identify various risks that could pose as problems for the project. The risks that were identified will be discussed at a later stage.

 

CATEGORIES OF RISK

It is believed that there are two main categories of risk, one being business risk and the other being non-business risk. Business risk can be described as the uncertainty that rises from the nature of the business. Non-business risk can therefore be defined as the uncertainty that arises from events that are beyond the control of the business.

According to ACCA (2002:6), business risk can then be broken down into smaller categories namely:

· Product risk - this arises because the success of a company's products might differ from the expected level

· Macro-economic risk - arises from unexpected changes in the condition of the economy

· Technological risk - arises due to unexpected changes in technology that alter the nature of the business environment

Non-business risk can also be broken down into smaller categories namely:

· Financial risk - This arises from actual financial conditions that might differ from the conditions expected. This may included: market risk, foreign exchange risk, interest rate risk, cash flow risk.

· Event risk - This risk is seen as the actual results will differ from expectations because of an unexpected event. Within event risk a number of other risks can be categorised, namely:

o Disaster risk - the possibility of a physical disaster (fire, flooding, terrorist attacks)

o Political risk - arises from the possibility that the government will introduce new legislation that might have an effect on the expected outcome

o Legal risk - is the risk of unexpected losses due to unfavourable legal decisions

o Reputational risk - that can be seen as the risk to the reputation of an organisation and the consequences that it might have on the business

· Operational risk - can be defined as the risk of losses from failed or inadequate systems or human error

By using brainstorming techniques and regular meetings as tools to identify risks, the task team identified the following risks for the project that Cashane Vending is initiating:

1. Product risk - Customers might not derive the expected benefits from advertising on the mobile advertisement board. As a result they may not re-new their six month contract.

2. Macro-economic risk - Should the economy slip into a recession certain companies may feel it necessary to focus on their core activities. Advertising may or may not be one of their core activities.

3. Technological risk - The increase of electronic advertisement boards may pose as a risk for this project.

4. Interest rate risk - The financing of the trailers are done through a general overdraft facility at the bank. The fluctuating of the interest rate (upwards / downwards) can pose as a risk or an opportunity for Cashane Vending.

5. Cash flow risk - Cashane Vending runs the risk of not acquiring sufficient income from the advertising space sold in order to cover the petrol and capital repayment expenses.

6. Disaster risk - While moving the trailer to a new location, it may be involved in an accident. A fire or possible flooding could also pose as a risk to the project.

7. Political risk - Should the South African government stipulate that Company X may no longer advertise, it could pose a risk to Cashane Vending if Company X was a substantial customer of Cashane Vending. This was the case with the Tobacco companies.

8. Operational risk - Whether or not the sales consultant of Cashane Vending sells the required amount of advertising space will also pose as a risk.

9. Macro-economic risk - The price of petrol could continue to rise indefinitely.

After identifying and categorising these risks it is important that the process is taken one step further, and attempting to determine the probability of the risk occurring as well as the consequence of the specific risk occurring needs to be done.

 

THE PROBABILITY AND IMPACT OF THE RISKS OCCURRING

Heldman (2004:194) summarises probability as the likelihood that an event will occur while Martin & Tate (2002:35) summarises impact as the effect a risk will have on the project if it does occur.

It is of the greatest importance that the risks identified are ranked according to the likelihood that they might occur as well as the impact that these identified risks might have on the project at hand. Once this task is completed, one can develop contingency plans for how to deal with the risks that have the highest probability and impact rate.

The ranking of the risks in terms of impact and probability can be done through subjective or quantitative risk assessment methods. Expert opinion or "gut feeling" would classify as subjective assessment. It may be the most used way of assessing risks but it also comes with unreliability due to the fact that the assessment depends on the skill of the person making the judgement call. On the other hand quantitative methods require more detailed analysis of facts and tend to be more reliable. These methods may include ratio analysis, probability analysis and sensitivity analysis. These analyses usually require serious data collection and are found to be low in acceptance amongst certain levels of practicing managers.

Due to the fact that Cashane Vending is a small organisation it is believed that there are no financial resources to conduct the necessary data collection needed to analyse the risks. It therefore stands to reason that the only option available is for the task team to use their "gut feeling" in order to assess the impact and probability of the risks.

Probability and Impact Ranking

The task team of Cashane Vending took each previously identified risk and allocated a probability ranking and impact racking to each.

Each risk is ranked on a scale of 1 to 5 in terms of the likelihood of the risk occurring and the consequence that it will have on the project, with 1 = Low and 5 = High

 

 

Once the probability and impact of the risks have been identified, each risk can then be plotted on a risk severity matrix. This matrix gives a graphical representation of each risk along with its probability of occurring and the impact thereof.

The matrix is divided into red, yellow and green zones. The red zone represents major risks while the yellow zone represents moderate risks and finally the green zone represents the minor risks. The red zone indicates high impact and high probability while the green zone in turn indicates low impact and low probability.

According to Gray & Larson (2003:212) the impact of the risk is considered more important than the probability of the risk occurring.

The risk severity matrix provides a basis for prioritising which risks are to be given the greatest attention. It is clear that due to the fact that the red zone is characterised by high impact and high probability it is these risks that lie within this zone that should receive immediate attention. The risks that lie within the green zone are typically ignored until if or when their status changes. Risks that lie within the yellow zone need to be monitored carefully as these risks may develop over time and could therefore at a later stage be classified in the red zone.

 

 

From the risk severity matrix and the task team of Cashane Vending, the fluctuating of the interest rate (upwards) is considered a major risk. Not acquiring sufficient income from the advertising space sold as well as whether or not the sales consultant of Cashane Vending will sell the required amount of advertising space are also considered major risks. Finally, the increase in the petrol price would also constitute a major risk.

The trailers for the mobile advertisement boards are financed through a general overdraft facility at the bank. Should the interest rate fluctuate upwards it would mean that the capital repayments would increase from R1000 per month. Assuming that the income from the advertisement space sold remains the same as well as all the other expenses remain the same, the increase in the interest rate would result in a lower net profit.

Not acquiring the anticipated income from the advertisement space sold would mean the possibility of Cashane Vending defaulting on their capital repayments and increasing their overdraft facility in order to pay the commission and petrol expenses that still need to be made irrespective of whether or not the income from customers have been received.

The sales consultant of Cashane Vending is required to sell 23 advertisement spaces in the month of April, while in turn she is required to sell 45 spaces in the month of May. Although the expense of paying commission to the sales consultant is determined by how many spaces are eventually sold thus making it a variable expense, the expense of capital repayments still need to be paid irrespective of how many spaces were sold at the end of each month. Therefore, should the sales consultant not sell the required amount of advertising space per month, the net profit could be substantially lower than originally predicted.

The risk of the ever increasing petrol price would in the long run increase the expenses of the project and as a result would decrease the net profit. For every extra cent that is spent on petrol it is one less cent of net profit that is earned.

 

RISK MONITORING AND CONTROL

Once the project's risks have been identified and the probability along with the impact of each risk is understood, it follows that the logical step would be to monitor each risk and attempt to control the risk when it eventually occurred.

Conrow (2003:32) believes that risk monitoring is proactive technique to obtain objective information on the progress to date in reducing risks to acceptable levels.

Risk monitoring is often done in an informal manner. When doing their jobs, people should be sensitive to the things that are around them that just do not seem to be right. Frame (2003:151) suggested that apart from the informal monitoring that can be done there are also formal monitoring activities that can take place. The four commonly used activities include, status reports, the conducting of evaluations, the use of issues logs and the use of periodic risk audits.

Status reports tend to focus on the variances from the project plan, while evaluations are conducted to see whether the fundamental objectives of the project are still being achieved. Issues logs can be split into two sections, namely pending issues and resolved issues. Pending issues are points of discussion that need to be addressed because they might be sources of problems. On the other hand resolved issues are previous pending issues that have now been taken care of. A team of highly skilled men and women who are experienced and trained in the best risk management practices attempt to conduct risk audits. They systematically examine the organisation's projects and risk management procedures to determine whether things are progressing smoothly or whether there are potential problems.

Frame (2003:155-156) believes that in order for risk monitoring to be successful, three conditions need to be met, namely:

· The monitoring effort must be focused on the right sources of information.

· The information must be timely.

· The people reviewing the information must be able to make sense out of it.

Conrow (2003:30) refers to risk control as not an attempt to eliminate the source of risk but rather to manage the risk in a manner that reduces the likelihood and/or impact of its occurrence on the project.

Conrow (2003:30) goes on to suggest that there are common risk control approaches that one could follow. The list is by no means limited to the following:

· Alternative design - isa backup design option that should use a lower risk approach.

· Early prototyping - is used to build and test prototypes early in the system development.

· Incremental development - is initiated to design with the intent of upgrading system parts in the future.

· Modelling / Simulation - can be used to investigate various design options and system requirement levels.

· Reviews, walkthroughs and inspections - are three actions that can be used to reduce the likelihood and potential consequences of risks through timely assessment of actual or planned events.

It is felt that Cashane Vending would make use of reviews, walkthroughs and inspections in their attempt to reduce the likelihood and impact of the risks on the project. By constantly reviewing whether or not the company has actually received payment from their customers will help reduce the likelihood of not acquiring the anticipated income from the advertisement space sold.

Should one or all of the identified risks actually materialise there are various ways to deal with the risk at hand. Heldman (2004:205) mentions that there are four strategies that one can use when dealing with negative risks. These strategies would include avoidance, transference, mitigation and acceptance.

Avoidance involves trying to avoid the risk at all costs. This could be done by eliminating the cause of the risk or one could attempt to change the project plan to protect the objectives of the project from the potential risk. It is far easier to avoid the potential risk earlier on in the project. This can be done by improving communications, refining requirements or assigning extra resources to the project. The increasing petrol prices, along with the interest rate fluctuating (upwards), are risks that simply can not be avoided. The only way that these risks could be avoided is if Cashane Vending was not to make use of petrol or was not to finance their trailers by using an overdraft facility. However, it is clear that these options are simply impossible to implement.

Transference is then the attempt of transferring the risk and the consequences of the risk to a third party. The risk has not disappeared but the responsibility of managing the risk now lies with someone else. The possibility of customers not paying for their advertisement space and thus the risk of not acquiring the anticipated income need could perhaps be passed on to an insurance company. However, should the insurance company be willing to except the consequences of the risk, they would only do so for a fee. This fee would then need to be included in the initial budget of Cashane Vending.

Mitigation attempts to reduce the probability of a risk occurring as well as attempting to reduce the impact that the risk might have on the project. The idea is not to remove the risk but simply to reduce it to an acceptable level. This is done so that the risk becomes more acceptable to a company. Cashane Vending can attempt to mitigate the probability of not acquiring sufficient income from customers by providing excellent after sales service, thereby reducing the probability of non payment. One could attempt to mitigate the possibility of the sales consultant not selling the required amount of advertising space by providing incentive bonuses for every milestone reached. This extra cost should then be included in the original budget of Cashane Vending.

Acceptance of risks means that the company will not make any plans to try to avoid or mitigate the risk. The company is therefore willing to accept the consequences of the risk occurring. It could also mean that the company could not find a suitable solution to the possible risk. The ever increasing petrol price, as well as the fluctuating of the interest rate (upwards) are risks that most companies simply have to accept.

PMBOK (2000:204) argues that not only are there strategies for risks that have negative consequences but there are also strategies for risks that have positive consequences. Some of these strategies may include, exploiting, sharing or enhancing.

The aim of exploiting is to eliminate the uncertainty associated with a particular upside risk by making sure the opportunity materialises. Sharing a positive risk involves allocating the ownership of the positive risk to a third party. This party is someone who is able to materialise the opportunity for the benefit of the project. Enhancing on the other hand attempts to modify the size of an opportunity by increasing the probability and the positive consequence of the risk by identifying the key drivers and then attempting to maximise these key drivers.

All the risks that the task team of Cashane Vending identified have negative consequences and therefore the strategies of exploiting, sharing and enhancing would be of no use to the project at this stage.

 

CLOSURE

Risk plays such a vital role in whether or not a project is successful or not. Should a project manager choose to ignore certain risks, it could pose detrimental to not only the success of the project but also his career as a project manager.

Therefore it is of the utmost importance that project managers strive to practice risk management. For every project that is undertaken, the risks to the project need to be identified. Project managers can choose amongst the various tools and techniques to assist them in this regard.

Recognising and understanding the probability of the risks occurring as well as the impact that those risks would have on the project are areas that the project manager must focus on. Greater attention should be given to those risks that have a high probability and high impact of occurring as these risks, should they occur, will have the greatest influence on the manager's project. Risks that have a low probability and impact are risks that should not be ignored all together. These risks should be monitored and should the circumstances change, these risks should then be re-evaluated. Risk management is such a vital part of project management and emphasising it on a continued basis is important.

 

BIBLIOGRAPHY

ACCA. 2002. Diploma in Financial Management: Study Text. 2^nd ed. London: BPP.         [ Links ]

CONROW EH. 2003. Effective risk management: some keys to success. 2^nd ed. Virginia: American Institute of Aeronautics and Astronautics.         [ Links ]

FERRELL G. 2004. Providing expertise in planning and implementing information systems. [Online] Available from: www.jiscinfonet.ac.uk [Downloaded: 2005-04-02].         [ Links ]

FRAME JD. 2003. Managing risk in organizations: a guide for managers. San Francisco, CA: Jossey-Bass.         [ Links ]

GRAY CF & LARSON EW. 2003. Project Management: the managerial process. 2^nd ed. New York: McGraw Hill.         [ Links ]

HELDMAN K. 2003. Project Management Professional: study guide. 2^nd ed. Alameda, CA: Sybex.         [ Links ]

KOLB P. 2004. Introduction to Risk Management for Outsourcing Projects. [Online] Available from: www.pmi.org.uk/events/archive/downloads/hillsonslides0304.pdf [Downloaded: 2005-04-02]        [ Links ]

MARTIN PK & TATE K. 2002. A step-by-step approach to risk assessment: basic & intermediate CORE Project Management methods. Cincinnati, OH: The Griffin Tate Group.         [ Links ]

PMBOK see PROJECT MANAGEMENT INSTITUTE

PROJECT MANAGEMENT INSTITUTE. 2000. A guide to the Project Management Body of Knowledge. Pennsylvania: PMI Publications.         [ Links ]

VAN HEERDEN DJ. 2005. Verbal communication with the author. Cashane Vending, Rustenburg. (Transcript / notes in possession of author).         [ Links ]