Risk & Reward

I'm a risk enthusiast who likes to discuss techniques, tools and models—and use risk as a practical means to make better decisions in project environments. Join me on the ride!

About this Blog


Recent Posts

A Template for Setting Up Your Qualitative Risk Analyses

Preparing for a Schedule Risk Analysis

The GIGO factor

Reward and Risk - why not?

First Things First

A Template for Setting Up Your Qualitative Risk Analyses

Hey everybody!

just posting to let you know my first template upload is available on Projectmanagement.com. It is located here and it is a tool intended for us to conceive a risk register and structure a probability scale, an impact scale and an overall qualitative mapping.

Begin by stablishing your probability scale. Very straightforward, and you can have as low as 5 and as much as 7 levels of probability to be assigned.

Moving on to impact, I added some room for using different scales, so you can have a schedule dimension with four leves (say very low, low, medium and high) and a cost dimension with three (low, medium and high) and you can work these things together in the spreadsheet.

In a severity sheet, you can see the probability x impact severities resultiing from the several dimensions of impact you used on the impact scale. As I mentioned on my article on the risk ruler, I am using an additive way for obtaining the scores, i.e., I am multiplying the probability of the event by the various impacts on each dimension.

There is a sheet called register, with some columns to fill in the description and assess the probability and impacts, as well as planning for mitigation and its impact on the aforementioned components of the severity. There is also a possibility to plot the results in a graph.

I hope you guys like it, your feedback is most welcome.

And, again, thank you for reading and joining the discussion!

Posted on: October 01, 2018 01:03 PM | Permalink | Comments (5)

Preparing for a Schedule Risk Analysis

Recently I posted a poll right here in projectmanagement.com (here) concerning how you prepare a schedule to undertake a schedule risks analysis.

My idea was to understand how you out there see the question of getting a schedule ready for the simulation exercise. I gave you five possible answers:

  • No preparation needed, I just use my regular schedule as is (20 votes)
  • I try to reduce the number of tasks (9 votes)
  • I check the logic links and make sure all tasks are connected (61 votes)
  • I reduce tasks AND check the links (24 votes)
  • I refer to classic audit schemes, like the 14-point assessment (25 votes)

 My answer was number four, “I reduce tasks AND check the links. 17% of the respondents (139 in total) were with me on this. Now let me explain why.

In my case, I usually start with the schedule we use to monitor the progress. It tends to be quite detailed, and have a lot of information that we use to control progress, like issuing reports, preparing for meetings, doing governance, etc. All this tasks go away. Some procurement packages, for instance, have fourty steps and others have ten. I try to harmonize this, so the tasks have some similarity. This reduces a lot of work.

And of course I check the links between tasks, which is a simulation killer, one of the favorite GIGO drivers and a strong sponsor to terrible decision making. With this done, I move on to doing stress analysis and other tests to see which tasks are worthy to model with a distribution. Going further forward, I start consulting experts and doing data crunching to know how exactly I am going to model that. At last, but not surely least, I add events and their mitigation. You can check my series of articles on Qualitative and Quantitative Risk Analyses Integration, starting with this one.

Moving back to our poll, I always thought my answer would win by a landslide, but I understand all the other answers and I will develop a rationale for them, if you allow me:

  • No preparation needed, I just use my regular schedule as is (20 votes, or 14%) – Maybe you have a schedule which is already lean and you the tasks are really balanced. And it is already completely linked. I get that.
  • I try to reduce the number of tasks (9 votes, or 6%) – Reducing the number of tasks is coherent with some best practices in Schedule Risk Analysis. Hulett (2006) is one of the many who advise having a smaller schedule.
  • I check the logic links and make sure all tasks are connected (61 votes, or 44%) – This goes without saying. No logic links means you do not have a schedule. You are not ready to open the door. Go back and get that key!
  • I reduce tasks AND check the links (24 votes, or 17%) – My option, I already said something about it.
  • I refer to classic audit schemes, like the 14-point assessment (25 votes, or 18%) – it is quite interesting to use some methods like the 14-point assessment, which relies on things like logic links, very long or very small tasks, a balance between types of tasks on the schedule and some others. The reason I did not check this one is that I never found one of those schemes who served me completely, without the need for correction. But I completely understand who opted for this, especially if they are under a PMO environment, and things must adhere to a standardized process.

Anyway, thank you for responding to my poll, thank you for reading, and please post comments whether you agree or not with what I said. See you all next time!

Posted on: September 18, 2018 03:19 PM | Permalink | Comments (8)

The GIGO factor

Hello again! Today I am covering what I think is a top five threat in a Schedule Risk Analysis or any simulation / numerical exercise: the destructive power of GIGO. It can send the whole team in a wild goose chase, or calm things down when your foot is halfway into the abyss.

 For those of you who do not know or cannot remember, GIGO stands for Garbage-In-Garbage-Out. Computer models, especially those who rely heavily on assumptions and constraints to run, such as our simulation models, are prone to suffer from that factor. The term dates back to 1957, as far as we can trust Wikipedia for that, with a citation of a weapons specialist saying, “‘sloppily programmed’ inputs inevitably lead to incorrect outputs”. We can observe two main GIGO possibilities when we are simulating our schedules.

 The first one relates to the model itself. That is, if you have a schedule which is faulty, incomplete and lacking the proper detail, no good can come of doing anything but... fixing it! This may be a structural problem and require a review of the WBS and even that very dangerous but necessary question: “What is really the purpose of this Project?” There are tools for detecting a bad schedule, but no straightforward tool for detecting a bad scope. I can easily detect tasks without successors or with hard date constraints, but I cannot, without a real understanding of the Project, state that the scope is ill detailed or the breakdown does not really make sense. It can be a tricky thing.

 The second GIGO factor is the modeling of the simulation itself. Some people are mesmerized by the mere presence of a histogram or a tornado chart. They go: “Wow, so there is a 10 percent chance that we will meet the promised date. I’d better find another job”, or “No way in hell this is right, the modeling is all crooked”. This is why, in my opinion, we must not show any simulation results until the modeling is complete. Until we discussed the distributions, their upper and lower values or other ways to describe them and the risks events, we must hold our instinct to show those beautiful features of the Monte Carlo simulation. What can be worse than having a black box model that shoots numbers left and right? I will tell you: it is having a guided simulation, that is, someone saying, “The modeling doesn’t matter, but the figures for P10, P50 and P90 should be this and this and that”. This is the worst GIGO ever: a confirmation of what is expected just because it is... well, expected!

 Maybe we can model things wrongly just because we lack the training or we are just doing it wrong. That is an honest mistake. However, we must be careful using a tool that powerful, especially when we are in a company with low maturity regarding risk.

I am including a small GIGO-avoiding checklist; feel free to add more items!

  1. Check the schedule before you do anything else;
  2. Have all assumptions and constraints formalized;
  3. Have some quick documentation on the distributions you are using and why, who gave that input, etc.;
  4. Do the same for the events you are modeling;
  5. Make sure whoever models and/or runs the simulation has experience with the software and the technique;
  6. Make sure someone else does a check on the simulation, specially looking for errors and strange results;
  7. Look into the Tornado chart and make sure these correlations, regressions or whatever index you use make sense;
  8. If you are using critical index, evaluate the connection between the values and the ones you observed on step 7;
  9. Prepare a “risk story” for this project: if you were to present it to someone, how would you go about it? Does it make sense for you?
  10. Double-check and validate with external sources, if possible, to avoid the unavoidable biases.

I hope those ten steps help reduce the GIGO issue. Do you have any more tips? Let me know! Thanks for reading!

Posted on: August 22, 2018 04:11 PM | Permalink | Comments (12)

Reward and Risk - why not?

Is that expression common for you? Have you ever heard it like that? I have not and I guess you haven't either. Risk is seen as a negative matter, as a downside, as a hurdle, as a problem to be dealt with. Let us look this question a little closer on this post.

We are constantly warned of the risks in the world. It is something to be careful about. It is something to fear, to work around, to avoid.

Whenever I participate in a risk workshop, somebody says "please, don't forget the opportunities!" In fact, PMBoK states that "project risk management aims to exploit or enhance positive risks (opportunities) while avoiding or mitigating negative risks (threats). A critical success factor for the "Identify Risks" process is the "explicit identification of opportunities" also stating that "the identify risks process should ensure opportunities are properly considered". This is in the Practice Standard for Risk Management, page 38. Nobody needs to tell us to "explicitly identify threats". It is engraved deep into our minds...

Therefore, we need to take a chance, go forward and, well, live a little! I go back to portfolio optimization concepts, when we stablish the efficient frontier for a set of investments, combining risk and return. Of course we should take risks with caution and we should assume risks only should they provide further return for us. The admittance of risk brings return as I said before.

So why can't we see the bright side of life when we are identifying risks? I got one wild guess here.

Could it be possible that we enhance our business case so much when we are trying to get the green light from the board that we already start planning a semi-impossible project and already absorbed the opportunities in the base case? Or are we under so much pressure that we do not allow for things to be even slightly better? It is something to be considered.

Whenever possible, we try to monetize things and bring the decision to a single indicator, the Net Present Value of the Cash Flows, the Internal Rate of Return or another one, but we should always consider the other dimensions. Safety, Social Implications, Governance, Health, Environment, and such.

What I take from my quantitative risk analyses in the last decade or so is that when we consider the risk events, uncertainties, imprecisions and such, we end up so far from the baseline and the agreed upon plan, it is almost a lost battle before it begins! Distributions are always skewed to the downside, reflecting the tendency for things to cost more, to take more time, to use more resources, etc.

Preparing a more feasible business case and have It thoroughly analyzed by a third party with no links to the project area seems like a good idea, but is it actually done by most companies, or people? Or we are just “hoping for the best but expecting the worst”, as Alphaville would say?

No matter what, we should always try to have a realistic point of view of our project, and adjust our plan to match the risky side of life. There is nothing wrong with having a challenging date, but not an impossible one. And make some room for opportunities, for Pete’s sake!

What do you think? Join the discussion! Leave your comment below and I’ll reply. Thank you for reading!

Posted on: August 08, 2018 09:38 AM | Permalink | Comments (7)

First Things First

Hi everybody! This is my first post, so I think I should introduce myself and some of the topics I’d like to discuss in this blog. My name is Guilherme Calôba and I am from Rio de Janeiro, Brazil. I am an Industrial Engineer, a multi-purpose kind of professional that, as we say in Brazil, “plays in the eleven positions in a soccer game”.

I have built an academic career prior to working in a company in a full time job. My time with the university was excellent and I had the opportunity to deal with several companies during this period of my life.

I was introduced to risk in 1998 and I’ve been working with that ever since. I took my Master’s and my Doctor’s degree in Operations Research and, after that, I started working in an oil and gas company.

My experience with projects begun there, and I did a specialization course and did my PMP exam. I am a proud Project Management Professional since 2008! I started out in the R&D center, moving up to the exploration and production area, where I currently make my moves. Most of my latest work involves scheduling and quantitative risk assessments, lots of Monte Carlo simulations, but I am truly fascinated by the whole process, the integration between qualitative and quantitative and the tools we can use to better represent, analyze and support decision-making.

I said it many times; risk is a beautiful thing, as long as it helps the project. It helps when you are protecting yourself from threats, it helps when you are embracing opportunities and it certainly helps when you have a few courses of action and you need to choose just one.

Among the topics I am considering covering on this blog, we have:

  • Qualitative Risk Analysis;
  • Quantitative Risk Analysis;
  • Risk Integration;
  • Financial evaluation of projects;
  • Decision Support tools, their use and abuse;
  • Expert Opinion on Risk Analysis;
  • Perception, Bias and Decision Making;
  • among others


I would like really appreciate your input on your favorite topics to address here. As anything in Project Management, this blog can only gain with your valuable contribution. I will try to keep my contributions here shorter than the white papers I’m publishing (you can check them out, too!)

To finish this first post, I would like to add a little something.  

This blog went live July 26th and as of today, July 31st, I hadn’t posted anything yet. So, you see, it was a risk free environment. I had nothing in it, that is, nothing ventured and, of course, nothing gained. Completely stable, boring and void. Nobody came to see, obviously! Nobody wants to see a blank page when they come for information, and nobody wants (to be part, to sponsor, to be a stakeholder, to manage) a project with no objectives, no goals and no deliverables.

What I am trying to say here is that when you take on a project, a venture, a business opportunity, you are already subject to risk. You could easily put your money on a low yield investment (or under your mattress) and have no financial risk whatsoever. But companies do not grow doing so, projects don’t flourish without a little risk taking and the humanity cannot thrive without considering that results, broadly speaking, may be quite different from what we expect them to be. Risk is life, encompassing uncertainty, opportunities, threats, all of that. Not so boring, for sure!

Thank you for reading! I appreciate your feedback on this and I hope you suggest more themes for us to discuss!

Posted on: July 31, 2018 11:52 AM | Permalink | Comments (16)

The rumors of my death have been greatly exaggerated.

- Mark Twain