An Oracle White Paper

July 2013

A Standardized Approach to Risk Improves

Project Outcomes and Profitability
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

Executive Overview
Every project has risks. Organizations that succeed are the ones that plan for those risks
- anticipating, mitigating, and providing response and contingency plans for negative
events that may or may not occur. Risk Analysis solutions provide the tools for doing just
this, enabling companies to identify, assess and model risks - and, in the process, taking
much of the uncertainty out of project and portfolio management.

Introduction
Well-known project failures - such as the problem-prone automated baggage handling
system that delayed the opening of the Denver Airport by over a year - have drawn
attention to the risks inherent in every large project. The dangers and consequences
associated with risk have increased along with the strong headwinds faced by companies
in today's uncertain economy. Traditional informal approaches to risk management force
project managers into the role of firefighters who race around responding to problems as
they arise rather than avoiding them in the first place.

A new generation of risk management solutions delivers a standardized approach that

fully analyzes the risk sensitivity of the project, so that the impacts of risks can be fully
understood. The effects of alternative mitigation strategies can be evaluated at any stage
of the project lifecycle, ensuring that the project is managed proactively to avoid the most
potentially damaging risks. Risk management can be integrated with enterprise project
portfolio management (EPPM) and scheduling solutions, providing input and visibility of
risk to the entire project team. As a result, the risk management process helps ensure
that mission-critical projects come in on time and within budget.
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

The Consequences of Project Failure

The Denver Airport baggage handling system installed in the mid 1990s is one of the most
notorious examples of failure to effectively manage project risk. The system was originally
planned to support all three concourses but was never able to operate at this level due to an
underestimation of the complexity of the new technology and the failure to build in a back-up
process to handle situations in which part of the system failed. The result was that the opening of the
airport was delayed by 16 months, adding $560 million to the cost of the airport. The system
was made operational only by drastically reducing its scope to handling outboard flights from a
single concourse. About a decade after it was installed, the automated system was scrapped
entirely because it was determined that a manual system could do the job at a lower cost.1
The importance of risk management to project and business success has become even more
important in the years since this dramatic project failure. Projects are becoming increasingly more
complex and costly, making it even more difficult to analyze and mitigate risks using informal
methods. The weak economy creates slack demand which in turn greatly reduces the chance that
cost and schedule overruns can be recovered through higher pricing. Credit constraints mean
that project budgets are tighter than ever and reduce the possibility that additional capital can be
allocated to compensate for unforeseen circumstances. Environmental factors, market shifts,
unforeseen engineering challenges, improper planning, skilled talent issues and a wide range of
other possible problems all have the potential to cause projects to financially underperform, incur delays
and exceed budget.
Traditional risk management methods are not up to this challenge. "Many poorly performing
companies don't have any formal risk management process," notes Bob Prieto, senior vice-
president of Fluor Corporation. "They may discuss risk but it's more about contingency
planning."2 The traditional approach relies upon individuals to subjectively analyze risks. One typical
approach is to build a standard contingency factor into the budget and schedule. This
approach tries to estimate but not to identify, assess or mitigate the specific risks on a particular
project. If there is a land mine hidden in this project that threatens its profitability, simple
contingency factor estimation will do nothing to identify or mitigate it. Also, a contingency factor

1Calleam Consulting. "Case Study - Denver International Airport Baggage Handling System - An
illustration of ineffectual decision making." 2008. http://calleam.com/WTPF/wp-
content/uploads/articles/DIABaggage.pdf

2Sarah Fister Gale, "Closing the Gap: The link between project management excellent and long-term
success." Economist Intelligence Unit Ltd. 2009

2
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

that is not attached to specific risks may have a tendency to encourage inefficiency simply because
it is available to be drawn upon.

Benefits of a Standardized Approach to Risk Management

Risk management solutions enable a standardized approach for identifying, assessing and
mitigating risk throughout the project lifecycle. A collaborative risk identification process helps create
buy-in on project assumptions and spreads awareness throughout the organization. Risk analysis
provides visibility into potential delays and cost overruns. Project managers can easily
compare the effects of alternative responses in order to develop an optimal risk mitigation
strategy. The result is better project outcomes including a greater likelihood of on-time and within
budget delivery. Risk analysis also generates lessons learned that can be leveraged to
improve the outcome of future projects. The latest generation of risk management solutions
integrates with a range of scheduling tools. The integration of risk management with enterprise
project portfolio management makes it possible to consider risk as an integral part of the project
management process.

A Standardized Risk Management Methodology

Risk Planning
Identifying risk in the planning stage enables better project selection decisions and more accurate
budgeting and scheduling. A standards-based risk register or risk tracker plays a key role by
tracking information on all the risks associated with the project. The risk register includes
information such as the risk owner, cause, effect, status, probability, impact of the risk on the project
cost, schedule and customer. Users can configure the matrix to match their corporate standards,
ensuring consistent use of standards throughout the organization.
During the planning stage, a schedule quality check feature can be used to evaluate how common
scheduling problems can affect deterministic schedules. For example, if an activity is expected to
take an extra 10 days if a risk event occurs, the quality check makes sure that the schedule is
updated when the effect of the risk is measured. This approach delivers better quality schedules that
adhere to industry best practices.
A leading multinational energy company with revenues of more than $160B uses risk
management to improve corporate governance of project risk and provide a standard risk
management environment. Probabilistic schedules are created from repeatable risk registers,
resulting in better project intelligence, reduced errors and replicable processes. As a result the
company reduced unexpected delays and costs. The company improved collaboration among
project team members, enabling more effective risk management and project intelligence
processes. In addition, project consistency has been increased due to the centralized ownership

3
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

of the processes for risk identity, monitoring and reporting. One of the company's senior
planning engineer notes that: "running risk scenarios helps us better identify potentially severe
events and build contingencies that can be quickly implemented to mitigate impact."

Risk Identification
The new generation of risk management solutions provides a consistent and methodical
approach to identify risks. Users enter risks using pre-defined risk registers that incorporate
company best practices and can also define risk registers on the fly. The risk register applies
estimates in a consistent way each time while documenting the rationale, facilitating review and
enabling other members of the project team to review estimates and provide input. The risk
register automatically integrates identified risk events into the schedule by creating a risk event
plan that users can then analyze to determine both key risk drivers and the cost-effectiveness of
the identified mitigation strategies. Risk templates provide another method for modeling risk
uncertainty against the schedule. Templates can be created to apply risk to activities based on a
variety of attributes such as work breakdown structure (WBS), activity codes, user defined
functions, etc. For example, weather risks such as ice windows, hurricanes and environmental risks
can be modeled and incorporated into the risk plan.
A major global provider of engineering and infrastructure services uses risk management to
identify risks or issues that may slow down project delivery. Users can identify subsets of work
that need to be achieved to keep the project progressing. Project managers and supervisors have
a snapshot view of the project's status in an easy-to-understand format. This capability reduces the risk
of the project failing due to lack of communication between stakeholders and ensures that the
company can take steps to keep the delivery moving if there are issues. For example, if
the delivery of flooring for a building is delayed, project managers use the risk management
system to determine how the setback is going to affect the project's schedule. A formal approach to risk
management helps bring the project back into line and reschedule other work that may be affected.

Risk Assessment
Risk assessment is critical to understanding the impact of risk and uncertainty on project
schedule and cost. Simple three-point estimates do not distinguish between the reasons for
different outcomes, making it very difficult to determine the probability for these outcomes. On the
other hand, the industry-standard approach maps risks to tasks in WBS items and defines the impact
each risk has on each task or WBS item to which it is mapped. Risk registers are thus able to quantify
the schedule and cost impact of each risk on the project. Monte-Carlo based cost and schedule analytics
realistically depict the probability of achieving a range of finish dates and costs.
For example, the analysis may show a 10% chance of finishing a month early and a 30% chance
of finishing a month late. The analysis identifies key activities and risks that drive the schedule and
have the potential to have the most impact on the schedule and cost of the project. Users

4
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

can also conduct risk analysis at the project portfolio level to make strategic decisions about project
selection.
A major electric power generator uses risk management to improve the accuracy of risk
assessments undertaken prior to power plant shutdowns for routine inspection and maintenance. The
power generator identifies, quantifies and manages both probabilistic and unknown areas of
risk and uncertainty throughout the entire project lifecycle. The company creates a full-risk
matrix and a risk-adjusted schedule incorporating mitigation plans during the outage and return to
commercial service. Multidimensional algorithms and contingency responses are used for risk
control, scoring and schedule management. The risk management solution's intuitive tools predict
the likelihood and impact of primary and specific risks, such as the actual physical condition of
plant and machinery. Advanced computational modeling is used to assess the impact of secondary
and generic elements, such as industrial action or bad weather on the
duration and cost of shutdowns. The company reduces exposure to volatile energy prices by
accurately determining the outage shortfall, making it possible to obtain replacement power at the
best prices. According to a company spokesperson: "Oracle's Primavera Risk Analysis has
given us a massive, immediate, and sustainable return on our investment." By using the solution they
were able to complete an overhaul and return to service project five days ahead of schedule,
increasing their profit by US$1.6 million more than the initial plan. The company achieved a
thousand-fold return on its software investment.

Risk Response
Once risks are identified and assessed, the next step is to develop a response plan. Typical
mitigation actions include adding time to the schedule, deploying more resources on the project,
bringing in outside expertise, increasing the budget, etc. The risk register tracks the actions used to
mitigate the probability and impact of risks using a mitigation plan and waterfall charts. Users
can compare alternative mitigation scenarios and create and compare custom risk plans. The
project team can then run another round of simulations to evaluate alternative approaches for
reducing the impact of a risk event. With the project underway, the mitigation plan can be
tracked against actual project data to evaluate its effectiveness and make course corrections if needed.
One of the largest integrated oil companies in the world implemented a full lifecycle risk
management solution for a major drilling project. Risk management provides a comprehensive
means of determining confidence levels in schedules together with quick and easy techniques for
establishing contingency and risk response plans. Risk management provides more realistic
scheduling that helps maximize the use of expensive resources such as drilling rigs. Pre-
production activity and first oil production dates can be more accurately predicted, improving
early resource planning in those phases. The accuracy of overall volume forecasts is also
improved. More realistic scheduling of drilling rig use alone can potentially save many hundreds of
thousands of dollars a day.

5
 Oracle White Paper — A Standardized Approach to Risk Improves Project Outcomes and Profitability

Reporting
Reporting helps understand the impact of the various risks and how to prioritize the resources of
the organization in addressing them. Reporting also helps to quantify the impact of risks on
project cash flow and track and allocate schedule and cost contingencies. Histograms or
distribution graphs show the range of possible outputs, for example the projected project
completion dates considering all of the risks that have been modeled and applied to the schedule.
Histograms can be used to determine confidence levels, probability schedules and schedule and cost
contingencies. For example, histograms can report confidence levels with respect to finish
dates, costs, float, internal rate of return and net present value. Tornado graphs help identify key
risk drivers and pinpoint the task or event that is preventing the schedule or budget from
performing as planned. Users can also use cost sensitivity reports to isolate the most cost critical tasks
or risk events. Scatter plots can be used to determine the combined probability of achieving given
budgets and completion dates as well as to perform what-if analyses by interactively varying cost and
schedule thresholds to reveal the resulting chances of success.
A leading international facilities and infrastructure solution provider uses risk management to
help improve corporate budgeting accuracy by incorporating risk-adjusted forecasts into
budgeting for multiple business units. In addition, the solution enables them to calculate both the
predictable and random elements of business activities to more accurately determine investment
performance. As a result they are able to report accurate, real-time adjusted "best and worst"
outcomes and "predicted versus actual" performance figures to the board and company
shareholders. Ultimately, the company has benefited from the intelligence extracted from the
solution to generate predictable, long-term returns from a diversified portfolio of investments.
"Oracle's Primavera Risk Analysis increases our confidence in our ability to understand risk and deliver on
our reported budgets," says the company's head of enterprise risk management.

Conclusion
Every project has risks and the way that these risks are identified, assessed and mitigated plays a
critical role in the project outcome. Risk management solutions, like Oracle's Primavera Risk Analysis,
enable the implementation of a formal process for managing risk throughout your
company's complete project portfolio. Analytical tools are provided to evaluate the impact of
various risk scenarios and develop contingency and risk response plans. This approach
substantially reduces the uncertainty of projects and portfolios, helping to ensure that mission critical
initiatives come in on-time and within budget.

6
A standardized Approach to Risk Management Copyright © 2013, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the
Improves Project Outcomes and Profitability contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other
July 2013 warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or
fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are
formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any
Oracle Corporation
means, electronic or mechanical, for any purpose, without our prior written permission.
World Headquarters
500 Oracle Parkway
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
Redwood Shores, CA 94065
U.S.A.
AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices.
Worldwide Inquiries: Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license
Phone: +1.650.506.7000 and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open
Fax: +1.650.506.7200 Company, Ltd. 1010

oracle.com