At project management conferences, LinkedIn discussions and even in one of the most recognised Project Risk Management book, I’ve found that uncertainty is just a risk with 100% probability. Not sure what is the origin of this statement, but a risk with 100% probability is an issue, not an uncertainty.
Managing project risks and uncertainties is essential for mature risk management and successful project delivery. Lack of understanding differences between these two concepts creates serious project planning and control issues and often results in project delays and cost overruns. In this post, we will review what is common between these two concepts and where the key differences are.
Project Risk Management Standards
Risk and Uncertainties are interrelated. Risk arises out of uncertainty and generates uncertainty.
Project Management Institute (PMI) and Association for Project Management (APM) used these terms widely in their project management and risk management standards. Both organisations suggest dividing the term Risk into two terms: Risk Event and Overall Project Risk. PMI and APM don’t provide definitions of Uncertainty but mention that the source of uncertainties is complexity, ambiguity, and volatility.
Project Event
Risk Event Definition by PMI:
Risk is an uncertain event or condition that, if it occurs, has a positive or negative impact on at least one project objective. (The Standard for Risk Management in Portfolio, Program, and Projects)
Risk Event Definition by APM:
A risk event is an uncertain event or set of circumstances that, should it occur, will have an effect on achievement of one or more of the project’s objectives. (Project Risk Analysis and Management Guide)
Overall Project Risk
Overall Project Risk Definition by PMI:
Overall project risk is the effect of uncertainty on the project as a whole, arising from all sources of uncertainty. This includes individual risks and the exposure to the implications of variation in project outcome, both positive and negative. Overall risk is often a function of complexity, ambiguity, and volatility. (The Standard for Risk Management in Portfolio, Program, and Projects)
Overall Project Risk Definition by APM:
Overall project risk is joint effect of risk events and other sources of uncertainty. Project risk results largely from the accumulation of a number of individual risk events, together with other sources of uncertainty to the project as a whole, such as variability and ambiguity. (Project Risk Analysis and Management Guide)
Unfortunately, apart from the definitions, both standards don’t provide any methods and techniques to measure and control Overall Project Risk. There is no common acceptance among project and risk managers on what it is the “beast” and how to deal with it.
Success Driven Project Management (SDPM) suggest dividing risks into two major categories: uncertainties and events, where uncertainty is a property of project parameters. Based on SDPM, changes caused by risk are discreet events, while changes caused by uncertainties are continuous.
Let’s look at risks and uncertainties more closely.
Risk
Less formally, risk is defined as the situation of winning or losing something worthy.
In projects, stakeholders are interested in understanding how such situations may impact project objectives, usually represented as the delivery of outputs (or critical deliverables) to the committed dates with the agreed budget. Depending on the type of project, objectives may also include quality, benefits, reputation and other important aspects of the business.
“Worthy” means that while risk events may impact other aspects of the project, these are the only important ones in the context of the overall delivery.
For example, a project team may raise a risk that a particular activity might be running late or next month’s forecast could not be met if a risk event materialised.
While this information still may be necessary for some stakeholders, a project risk usually is raised in a broader context:
- Does it mean that if the activity is late, the project will also be late?
- Does it mean that if the next month’s actuals are more than was forecasted, the project will be over budget?
‘Risk impact’ is a dynamic characteristic, not a stable parameter. A risk may have no impact on the project objective now, but the situation may be different tomorrow, and the risk would become the most critical risk in the project. Without Quantitative Risk Analysis methods, it is not easy to identify such changes timely.
There are many books and risk management standards with recommendations for risk control. While uncertainties are also considered in these books and standards, I think this area of project risk management is less developed and definitely less controlled.
Primary Uncertainty
Uncertainty is a situation where multiple alternatives result in a specific outcome, but the probability of the outcome is not certain.
Any project has hundreds, if not thousands, of situations when the outcome is uncertain. However, any project has quite limited project parameters with uncertainties.
Examples of parameters that may have uncertainties:
- Volume of Work
- Resource Productivity Rate
- Resource Quantity
- Resource Calendar
- Activity Calendar
- Material Quantity
- Activity Duration
- Workload
- Lag Duration
- Material Cost
- Unit Cost
- Currency rate
- Resource Rate
- Inflation Rate
There are examples of bottom-level uncertainties, also known as base, or primary uncertainties.
- Most, but not all project parameters, have primary uncertainties.
Example:
Office calendars, compared to construction calendars, don’t depend on weather conditions.
- Data collection challenges
It is easy to collect primary uncertainty data as each refers to only one project parameter. Three-point estimation is a common practical approach. Usually, the critical constraint for data collection is not the information itself but the lack of opportunity to store it in a project management system. Not many of them are designed to store and apply primary uncertainties to calculate project delivery plans. Spider Project is an excellent example of such a system when primary uncertainties are stored as corporate norms and used to calculate project delivery plans with probabilities to achieve committed project objectives: dates, costs, benefits, etc.
I believe there is a lack of recognition of the benefits of capturing and applying uncertainty data for the reasons explained below. Many organisations with such experience are in non-English-speaking countries and usually don’t publish results in recognised PM Journals.
Secondary Uncertainties
The outcome of primary uncertainties may result in uncertainties of other project parameters, especially activity duration and cost uncertainties, which are secondary or middle-level uncertainties.
- The secondary uncertainty is the result of one or multiple primary uncertainties.
Example:
An activity has uncertainty in the volume of work and productivity of assigned resources. Uncertainty in the duration and cost of the activity is the result of both uncertainties.
- Activity duration and cost uncertainty may or may not depend on other primary uncertainties.
So, it could be a primary or secondary uncertainty. It is very confusing, but who said that project management has to be simple?
Example:
An external project review takes 24-40 hours. It means that the ‘volume of work’ of this task is measured in hours, and in the worst-case scenario, the report is going to be completed when 40 hours of effort, even if the quality of the report needs to be compromised.
- Not all primary uncertainties impact duration and cost of activities.
Example:
‘Resource Quantity’ uncertainty may impact the order of planned activities but not in their durations and cost.
- Result of Monte Carlo Simulation (MCS) highly depends on the type of uncertainties used as a base for analysis.
Example:
Results of MCS analysis performed based on secondary uncertainties may significantly vary from the analysis performed based on primary types, as important correlations between project parameters are missing. This is another big topic to discuss, and I’m planning to cover it in a separate post under the “Monte Carlo Simulation challenges” posts.
Project Level Uncertainties
Multiple primary and secondary level uncertainties and related risks result in probability distributions of project commitments. These distributions could be considered as ‘top-level’ or tertiary uncertainties.
Examples of top-level uncertainties include:
• Delivery date of committed output
• End of the design phase
• Cost of project
• Probability distributions could be considered in the context of individual project objective or with the relationship to other objectives.
Risk Uncertainties
Projects usually estimate risks with probability, as a percentage of the likelihood of the event or condition to occur, and the impact estimated in days and $. However, this information is often subjective as different project stakeholders have different opinions about the probability and impact.
As a result, a risk may have uncertainties in the probability, the impact(s) or both at the same time.
Cost of Knowledge
Both, uncertainties and risks depend on the knowledge of estimators. Sometimes it may be possible to gain this knowledge and reduce uncertainties but usually, it is associated with extra effort and additional cost.
Sometimes it is worth spending extra effort to gain missing information that could help with project decisions, sometimes not. In other situations, the required information may not exist and any effort to clarify the information is a waste of time and money. It is another separate big but interesting topic to discuss.
Portfolios with advanced project management collect historical data and apply more accurate estimations to outstanding delivery and future projects. It is important to mention that, if possible, historical data has to be collected with primary types of uncertainties. If only secondary (activity level) uncertainties are collected, the critical context would be missing, and the historical data could not be applied correctly.
Example:
An activity has uncertainty in duration due to the uncertainty in the productivity of the planned resource: new bulldozer. The uncertainty is clarified during project execution and, in theory, next projects could use this information to reduce volatility. However, if only duration uncertainty was documented and another bulldozer with a different productivity rate is assigned to perform the same type of work, the historical data would be misleading as the critical context is missing to understand that this type of work has a different duration now.
Impacts of Risk and Uncertainties
- Not all uncertainties have an impact to project objectives.
Sometimes, under current conditions, regardless of the result of the uncertainty, it would be no impact to project commitments.
Example:
Next month, a project must pay for materials in a different currency. There is uncertainty about next month’s currency rate. This uncertainty could be an opportunity, treat or has no impact to project cost at all. It depends on:
- Which way does the currency rate go? Maybe it is an opportunity, not a threat?
- Currency rate the project forecasted. Maybe it was forecasted based on the worst rate?
- Conditions in the contract. Maybe the project has a fixed currency rate?
- A risk is always a threat or opportunity from one perspective (time, cost, etc). Uncertainties could be a threat and an opportunity to the same perspective simultaneously.
Example:
There is uncertainty in the volume of work that will impact the duration and cost of the activity. The uncertainty was estimated as a range (100 – 150 m2). If the project plan has 125 m2 as a base, it would be an opportunity to complete the activity ahead of schedule or a threat of delaying the completion.
- The same risk could be an opportunity for one perspective and a threat for another.
Example:
The bulldozer with certain productivity is planned to be assigned to work. There is a 20% chance that this bulldozer is not going to be available, and the project needs to hire another more expensive but also more productive bulldozer. If the risk is materialised, it will be a threat to the project cost, but also an opportunity to project delivery date (if planned work is on the critical path). So, this risk is a threat to cost and an opportunity to time. When a project uses a risk register and classifies all risks as a threat or opportunity, the mitigation actions may solve some potential issues but generate others.
Creeping Normality
Primary uncertainties impact projects via very small changes, but commutatively, they may have a large effect. Such an effect could be even more severe than the impact caused by project risks.
Project control teams usually have less control over activities with sufficient contingency. Positive and negative changes caused by uncertainties slowly and in a non-linear way “eat” available contingency, and when suddenly activities start to be critical and impact project delivery dates, it is already too late to apply mitigation actions. The contingency already has been spent. It is even more applicable to project cost when a lot of minor cost increases slowly “eat” cost contingency.
I think this could be due to “Creeping Normality” cognitive bias, also known as “Landscape amnesia”.
Creeping normality is a process by which a major change can be accepted as normal and acceptable if it happens slowly through small, often unnoticeable, increments of change. The change could otherwise be regarded as remarkable and objectionable if it took place in a single step or short period.
It creates an illusion that ‘risk events’ is the biggest factor in project delay and cost overrun when, in reality, changes caused by uncertainties have a bigger effect caused by project risks.
Projects that document uncertainties and compare them with actuals can notice “patterns” and apply mitigation actions before it is too late.
Relationship Between Risks and Uncertainties
While it is obvious that Risks and Uncertainties are interrelated, the relationship between them is not always obvious.
- Uncertainties in one part of a project may have a negative (or positive) impact on risks in another part of the project.
A risk associated with activities on the critical path is likely to severely impact project delivery dates. Changes caused by uncertainties in another part of the project may have an indirect impact on the risk activities total float and the risk mitigation actions should be changed as well. However, as projects usually don’t control uncertainties, it is hard to notice when the impact of risk is changed. In the future post, I am going to demonstrate this effect with a more detailed example.
Summary
Risk and uncertainties are important elements of Project Risk management. They are interrelated but have critical differences that are not always understood correctly. While Project risk management standards recognise the importance of management of uncertainties and risk, projects across the Globe often don’t have mature control over uncertainties.
For project success, it is not sufficient to only control risks. Mature Risk Management also has to include the management of uncertainties.
Alex Lyaschenko
PMO | Portfolio Planning & Delivery | PMP | P3O Practitioner | AgilePM Practitioner | Six Sigma
