Risk Identification, Analysis, Response & Monitoring in Projects

TAKEAWAYS:

• Risk is inevitable: Every project faces uncertainty (technical, financial, external) that must be systematically identified and prioritized.
• Quantitative ≠ qualitative: Use probability-impact matrices for quick prioritization, but calculate NPV/IRR for financial risks tied to project cash flows.
• Response ≠ reaction: Proactive strategies (e.g., contingency reserves) differ from reactive fixes (e.g., crash plans).
• Monitoring is iterative: Risks evolve—track triggers, reassess probabilities, and adjust responses using earned value metrics.
• Nepalese context matters: Pathao’s surge pricing (demand risk) and NTC’s fiber rollouts (technical risk) show how local factors shape risk management.

1. What is Risk in Projects?

Risk is the uncertainty of outcome that can affect project objectives (scope, time, cost, quality). It combines:

• Event: A trigger (e.g., "vendor delay").
• Impact: Financial/operational consequence (e.g., "project delay by 3 weeks").
• Probability: Likelihood of occurrence (0–1 scale).

Why categorize risks? Projects fail due to unknown unknowns (e.g., Daraz’s 2021 cyberattack during peak sales). Categorization helps teams:

• Assign ownership (e.g., "technical risks" to dev leads).
• Tailor responses (e.g., "market risks" need competitive analysis).

mindmap
  root((Project Risks))
    Technical
      Software bugs
      Hardware failure
      Integration issues
    External
      Regulatory changes (e.g., NEPSE’s new disclosure rules)
      Economic downturns (e.g., 2020 COVID-19 impact on eSewa)
    Organizational
      Skill gaps (e.g., lack of DevOps expertise at a startup)
      Resource shortages
    Project Management
      Scope creep
      Poor planning

A labeled diagram showing Identify → Analyze → Respond → Monitor with feedback loops. (Image: Practicalpm, CC BY-SA 4.0, via Wikimedia Commons)

2. Sources of Risk in Software Projects

Worked Example: NTC’s Fiber Rollout Risk

• Risk: Delay in acquiring right-of-way permits (probability: 0.6; impact: high).
• Response:
  • Mitigation: Parallel negotiations with multiple local governments.
  • Contingency: Pre-purchase fiber cables to avoid stock shortages.

3. Risk Analysis Techniques

sequenceDiagram
    participant User as Khalti User
    participant App as Khalti App
    participant Server as Khalti Server
    participant Bank as Nepal Rastra Bank

    User->>App: Initiates Payment (Rs. 5,000)
    App->>Server: Sends Transaction Request
    Server->>Bank: Requests API Access (Risk: 0.3 delay)
    Bank-->>Server: Approves/Rejects (with 70% success rate)
    Server-->>App: Returns Status
    App-->>User: Shows Confirmation

    Note right of Bank: Risk: NEPSE API downtime during peak hours (probability: 0.3, impact: high)
    Note right of Server: Mitigation: Local caching of transaction logs

A. Qualitative Analysis (Fast & Subjective)

1. Probability-Impact Matrix

   • Plot risks on a 3×3 grid (Low/Medium/High for both axes).
   • Example: A Khalti app update failing due to a third-party API change (probability: 0.7; impact: critical).

   | Probability \ Impact | Low  | Medium | High |
   |----------------------|------|--------|------|
   | Low                  | Accept | Monitor | Mitigate |
   | Medium               | Monitor | Mitigate | Escalate |
   | High                 | Mitigate | Escalate | Avoid |
   

2. SWOT Analysis

   • Strengths: Existing team’s experience with Python (for a new AI tool).
   • Weaknesses: No prior cloud deployment (risk: AWS cost overruns).
   • Opportunities: Government grants for green tech projects.
   • Threats: Competitors like Pathao expanding into food delivery.

B. Quantitative Analysis (Data-Driven)

Use financial models to quantify risks tied to cash flows. Two key metrics:

1. Net Present Value (NPV) of Risk

   • Adjust project cash flows by risk probabilities.
   • Formula: $$NP{V}_{\text{risk}}=\sum \frac{C{F}_t\times (1-p)}{(1+r{)}^t}$$ Where $p$ = probability of negative outcome, $r$ = discount rate.

2. Monte Carlo Simulation

   • Run 1,000+ iterations of project timelines/costs with random risk variables.
   • Output: Probability distribution of project completion dates.

Worked Example: Daraz’s Black Friday Promotion

• Risk: Server overload during peak traffic (probability: 0.4; impact: $50K/hr downtime).
• Monte Carlo Result:
  • 90% chance of completing within 6 weeks.
  • 10% chance of 8-week delay (cost: $200K).

4. Risk Response Strategies

5. Risk Monitoring and Control

Tools:

1. Risk Register
   • Track: Risk ID, Description, Owner, Status, Response Plan, Triggers.
   • Example:

     Risk ID	Description	Owner	Status	Response
     R001	Delay in NEPSE API access	Dev Lead	Open	Escalate to PM

2. Earned Value Management (EVM)

   • Compare Planned Value (PV) vs. Actual Cost (AC) to spot cost overruns early.
   • Formula: $$CPI=\frac{EV}{AC}\text{(Cost Performance Index)}$$
     • If $CPI<1$, investigate risks (e.g., overtime costs at a Kathmandu dev firm).

3. Risk Audits

   • Quarterly reviews to check:
     • Are responses still valid?
     • Have new risks emerged? (e.g., a new competitor like FonePay).

In the Real World

1. eSewa’s Payment Failures

   • Risk: High transaction failure rates during Dashain (probability: 0.8; impact: $1M/hr revenue loss).
   • Response:
     • Mitigation: Scaled up servers by 300% pre-Dashain.
     • Contingency: Offered cashback for failed transactions.
   • Outcome: 99.9% uptime during peak season.

2. NTC’s Smart Meter Project

   • Risk: Vendor (Siemens) delay in delivering meters (probability: 0.5; impact: 6-month project delay).
   • Response:
     • Transfer: Signed a penalty clause in the contract ($50K/day late fee).
     • Mitigate: Sourced backup meters from a local supplier (higher cost but faster delivery).

3. Pathao’s Driver Surge Pricing

   • Risk: Driver shortages during festivals (probability: 0.7; impact: reduced supply).
   • Response:
     • Avoid: Partnered with taxi unions to guarantee 10,000 drivers during Dashain.
     • Mitigate: Dynamic pricing to incentivize drivers (e.g., 20% bonus during peak hours).

6. Worked Example: Discounted Payback Period (Exam-Style)

Project Cash Flows:

Discount Rate (r): 10% Goal: Find when cumulative discounted cash flow ≥ initial investment.

Steps:

1. Calculate Present Value (PV) for each year:
   • Year 1: $100,000/(1.10{)}^1=90,909$
   • Year 2: $50,000/(1.10{)}^2=41,322$
   • Year 3: $50,000/(1.10{)}^3=37,565$
   • Cumulative PV after Year 3: $90,909+41,322+37,565=169,796$ (still < 200,000).
2. Year 4:
   • PV = $100,000/(1.10{)}^4=68,301$
   • Cumulative PV = $169,796+68,301=238,097$ (exceeds 200,000).
3. Fractional Year Calculation:
   • Remaining amount after Year 3: $200,000-169,796=30,204$
   • Year 4 cash flow: 100,000
   • Payback Period = $3+(30,204/100,000)=3.3$ years.

Answer: The discounted payback period is 3.3 years.

7. Risk vs. Issue: Key Differences

Exam Tip

1. For calculations (NPV, IRR, payback):

   • Always show step-by-step PV calculations.
   • Use Excel formulas in exams (e.g., =NPV(rate, range)).
   • Memorize:
     • Payback period formula: $\text{Year}+\frac{\text{Remaining Investment}}{\text{Cash Flow in Next Year}}$.
     • IRR: The discount rate where NPV = 0.

2. For definitions:

   • Risk: "Uncertain event with positive/negative impact."
   • Risk Response: "Proactive plan to address risk (avoid/mitigate/transfer/accept)."
   • Contingency Plan: "Backup plan for high-impact risks (e.g., 'If NEPSE API fails, use a local database')."

3. For diagrams:

   • Precedence Network: Draw arrows for dependencies (e.g., "Task B starts after Task A").
   • Risk Matrix: Always label axes (Probability vs. Impact).
   • Critical Path: Highlight the longest path in bold.

4. Real-world tie-ins:

   • Link Nepalese examples to questions (e.g., "How would eSewa handle a cyberattack risk?").
   • Use financial terms like "discount rate" (often 10–12% in exams).

5. Common pitfalls:

   • Ignoring time value of money: Always discount cash flows unless told otherwise.
   • Confusing risk and issue: Issues are already happening; risks are potential.
   • Overlooking qualitative risks: Even if no numbers are given, describe probability/impact in words.

In the real world

• Pathao’s Surge Pricing: Uses risk response strategies (dynamic pricing algorithm) to mitigate demand risk during festivals (e.g., Dashain). The system transfers risk to users via higher fares while accepting minor user pushback as a trade-off.

• Nepal Rastra Bank’s Cybersecurity: Employs risk avoidance by transferring risk to third-party firms (e.g., Nepal Data Center) for secure transaction processing, reducing internal technical risks like DDoS attacks during peak financial transactions.

• Daraz’s Black Friday 2023: Applied quantitative risk analysis (Monte Carlo simulation) to predict server load risks. The team mitigated by scaling AWS instances in advance, avoiding the $200K downtime cost seen in 2021.