The ‘3 points estimation’ known as a PERT methodology is relatively simple to use for cost, but for the schedule, it’s more complicated. The fact that some activities are on the critical path means that the volatility of those specific activities, as opposed to the set of all project’s activities, can make a big difference for Monte Carlo Simulation.

Risks and Critical Path

It is well accepted that risks are measured based on the probability of the event (or condition) occurring and the consequences.

The same risk may have different consequences for Time, Cost, Safety, Reputation and other project objectives.

• The time consequence is highly dependent on the criticality of impacted activities. If impacted activities are on the critical path# [including delay], the project is going to be delayed. Otherwise, it will impact some parts of the project but not the overall delivery date(s).
• Risk consequences are not always a stable parameter. Some of them depend on project conditions.
• Risk consequence has to be measured based on future conditions when the risk is likely to occur, not the current situation.
• When the risk is likely to occur project critical path may be different from the current critical path. It could be due to the impact of project uncertainties, other risks, scope changes or any other reasons.
• At that time, there will be only two possibilities: the critical path impacted or not. In other words, the probability (CP) that the risk has a time impact will be 0% or 100%. Do not mix with the Probability of the event, which is not dependent on the critical path.

However, when the risk is assessed, it is not always possible to predict if the impacted activities are going to be on the critical path or not, so the probability (CP) could be different from 0% and 100%.

Probabilistic vs Deterministic Delivery Model

If the Monte Carlo Simulation is performed based on a dynamic PROBOBALISTIC model (aka schedule) that includes data uncertainties and “conditional branches ”, the critical path will be recalculated during each calculation, and only the event probabilities need to be assessed prior to the simulation.

PROBABILISTIC project delivery systems, like Spider Project, could additionally calculate the probability of each activity being on the critical path, which is known as ‘activity criticality index’.

However, if the Monte Carlo Simulation is performed based on a DETERMINISTIC schedule (developed in Primavera, Microsoft Project or another CPM-based scheduling tool) and risk data is collected in a separate risk register, the probability that impacted activities are going to be on the critical path (CP) has to be assessed manually. The accuracy of such an evaluation would be significantly different from calculated probabilities and it will have following effect the results of the Monte Carlo Simulation.

Some risk management tools provide users with an option to define if the critical path is going to be impacted or not with a binary option (Yes/No). Users potentially could assess it’s based on the current critical path, but, with some rare exceptions, it is impossible to say whether the future critical path is going to be impacted or not as it depends on other materialised risks.

Some project Risk consultants just assume that the Critical Path is going to be the same

(Probability (CP) =100% or 0%) and only assess event probability even if the previous similar projects had critical path volatility.

Risk Exposure

If the (time) consequence depends on the Project Critical Path, or to be precisely the probability that impacted activities are going to be on the critical path when risk is materialised, Risk Exposure also depends on this parameter:

Cost Impact

So far, we have discussed only time exposure. What about the cost exposure? Is it also dependent on the critical path? Yes, but in a different way.

Risk cost consequence has two parts: direct cost impact and cost of delay.

Direct cost impact only depends on the Probability (Event) and the cost of delay only depends on Probability (CP).

Summary

The volatility of the Critical path means that risk consequence is not a stable parameter and depends on future project conditions when the risk is likely to occur. It is hard to accuratelly predict which activities are going to be on the Criticla Path at that time.

The results of Time and Cost probability distributions received based on deterministic the CPM-based schedule and predefined risk data could be misleading and should be used for project decisions with caution.

Risk consequences have to be calculated in each simulation. Dynamic probabilistic model with fully integrated risk data is required for reliable Monte Carlo Simulation.

At project management conferences, LinkedIn discussions and even in one of the most recognised Project Risk Management book, I’ve found that uncertainty is just a risk with 100% probability. Not sure what is the origin of this statement, but a risk with 100% probability is an issue, not an uncertainty.

Managing project risks and uncertainties is essential for mature risk management and successful project delivery. Lack of understanding differences between these two concepts creates serious project planning and control issues and often results in project delays and cost overruns. In this post, we will review what is common between these two concepts and where the key differences are.

Project Risk Management Standards

Risk and Uncertainties are interrelated. Risk arises out of uncertainty and generates uncertainty.

Project Management Institute (PMI) and Association for Project Management (APM) used these terms widely in their project management and risk management standards. Both organisations suggest dividing the term Risk into two terms: Risk Event and Overall Project Risk. PMI and APM don’t provide definitions of Uncertainty but mention that the source of uncertainties is complexity, ambiguity, and volatility.

Project Event

Overall Project Risk

Unfortunately, apart from the definitions, both standards don’t provide any methods and techniques to measure and control Overall Project Risk. There is no common acceptance among project and risk managers on what it is the “beast” and how to deal with it.

Success Driven Project Management (SDPM) suggest dividing risks into two major categories: uncertainties and events, where uncertainty is a property of project parameters. Based on SDPM, changes caused by risk are discreet events, while changes caused by uncertainties are continuous.

Let’s look at risks and uncertainties more closely.

Risk

Less formally, risk is defined as the situation of winning or losing something worthy.

In projects, stakeholders are interested in understanding how such situations may impact project objectives, usually represented as the delivery of outputs (or critical deliverables) to the committed dates with the agreed budget. Depending on the type of project, objectives may also include quality, benefits, reputation and other important aspects of the business.

“Worthy” means that while risk events may impact other aspects of the project, these are the only important ones in the context of the overall delivery.

For example, a project team may raise a risk that a particular activity might be running late or next month’s forecast could not be met if a risk event materialised.
While this information still may be necessary for some stakeholders, a project risk usually is raised in a broader context:

• Does it mean that if the activity is late, the project will also be late?
• Does it mean that if the next month’s actuals are more than was forecasted, the project will be over budget?

‘Risk impact’ is a dynamic characteristic, not a stable parameter. A risk may have no impact on the project objective now, but the situation may be different tomorrow, and the risk would become the most critical risk in the project. Without Quantitative Risk Analysis methods, it is not easy to identify such changes timely.

There are many books and risk management standards with recommendations for risk control. While uncertainties are also considered in these books and standards, I think this area of project risk management is less developed and definitely less controlled.

Primary Uncertainty

Uncertainty is a situation where multiple alternatives result in a specific outcome, but the probability of the outcome is not certain.

Any project has hundreds, if not thousands, of situations when the outcome is uncertain. However, any project has quite limited project parameters with uncertainties.
Examples of parameters that may have uncertainties:

• • Volume of Work
  • Resource Productivity Rate
  • Resource Quantity
  • Resource Calendar
  • Activity Calendar
  • Material Quantity
  • Activity Duration
  • Workload
  • Lag Duration
  • Material Cost
  • Unit Cost
  • Currency rate
  • Resource Rate
  • Inflation Rate

There are examples of bottom-level uncertainties, also known as base, or primary uncertainties.

• Most, but not all project parameters, have primary uncertainties.

• Data collection challenges

It is easy to collect primary uncertainty data as each refers to only one project parameter. Three-point estimation is a common practical approach. Usually, the critical constraint for data collection is not the information itself but the lack of opportunity to store it in a project management system. Not many of them are designed to store and apply primary uncertainties to calculate project delivery plans. Spider Project is an excellent example of such a system when primary uncertainties are stored as corporate norms and used to calculate project delivery plans with probabilities to achieve committed project objectives: dates, costs, benefits, etc. 

I believe there is a lack of recognition of the benefits of capturing and applying uncertainty data for the reasons explained below. Many organisations with such experience are in non-English-speaking countries and usually don’t publish results in recognised PM Journals.

Secondary Uncertainties

The outcome of primary uncertainties may result in uncertainties of other project parameters, especially activity duration and cost uncertainties, which are secondary or middle-level uncertainties.

• The secondary uncertainty is the result of one or multiple primary uncertainties.

• Activity duration and cost uncertainty may or may not depend on other primary uncertainties.

So, it could be a primary or secondary uncertainty. It is very confusing, but who said that project management has to be simple?

• Not all primary uncertainties impact duration and cost of activities.

• Result of Monte Carlo Simulation (MCS) highly depends on the type of uncertainties used as a base for analysis.

Project Level Uncertainties

Multiple primary and secondary level uncertainties and related risks result in probability distributions of project commitments. These distributions could be considered as ‘top-level’ or tertiary uncertainties.

• Probability distributions could be considered in the context of individual project objective or with the relationship to other objectives.

Risk Uncertainties

Projects usually estimate risks with probability, as a percentage of the likelihood of the event or condition to occur, and the impact estimated in days and $. However, this information is often subjective as different project stakeholders have different opinions about the probability and impact.

As a result, a risk may have uncertainties in the probability, the impact(s) or both at the same time.

Cost of Knowledge

Both, uncertainties and risks depend on the knowledge of estimators. Sometimes it may be possible to gain this knowledge and reduce uncertainties but usually, it is associated with extra effort and additional cost.

Sometimes it is worth spending extra effort to gain missing information that could help with project decisions, sometimes not. In other situations, the required information may not exist and any effort to clarify the information is a waste of time and money. It is another separate big but interesting topic to discuss.

Portfolios with advanced project management collect historical data and apply more accurate estimations to outstanding delivery and future projects. It is important to mention that, if possible, historical data has to be collected with primary types of uncertainties. If only secondary (activity level) uncertainties are collected, the critical context would be missing, and the historical data could not be applied correctly.

Impacts of Risk and Uncertainties

• Not all uncertainties have an impact to project objectives.
  Sometimes, under current conditions, regardless of the result of the uncertainty, it would be no impact to project commitments.

• A risk is always a threat or opportunity from one perspective (time, cost, etc). Uncertainties could be a threat and an opportunity to the same perspective simultaneously.

• The same risk could be an opportunity for one perspective and a threat for another.

Creeping Normality

Primary uncertainties impact projects via very small changes, but commutatively, they may have a large effect. Such an effect could be even more severe than the impact caused by project risks.

Project control teams usually have less control over activities with sufficient contingency. Positive and negative changes caused by uncertainties slowly and in a non-linear way “eat” available contingency, and when suddenly activities start to be critical and impact project delivery dates, it is already too late to apply mitigation actions. The contingency already has been spent. It is even more applicable to project cost when a lot of minor cost increases slowly “eat” cost contingency.

I think this could be due to “Creeping Normality” cognitive bias, also known as “Landscape amnesia”.

It creates an illusion that ‘risk events’ is the biggest factor in project delay and cost overrun when, in reality, changes caused by uncertainties have a bigger effect caused by project risks.

Projects that document uncertainties and compare them with actuals can notice “patterns” and apply mitigation actions before it is too late.

Relationship Between Risks and Uncertainties

While it is obvious that Risks and Uncertainties are interrelated, the relationship between them is not always obvious.

• Uncertainties in one part of a project may have a negative (or positive) impact on risks in another part of the project.

A risk associated with activities on the critical path is likely to severely impact project delivery dates. Changes caused by uncertainties in another part of the project may have an indirect impact on the risk activities total float and the risk mitigation actions should be changed as well. However, as projects usually don’t control uncertainties, it is hard to notice when the impact of risk is changed. In the future post, I am going to demonstrate this effect with a more detailed example.

Summary

Risk and uncertainties are important elements of Project Risk management. They are interrelated but have critical differences that are not always understood correctly. While Project risk management standards recognise the importance of management of uncertainties and risk, projects across the Globe often don’t have mature control over uncertainties.
For project success, it is not sufficient to only control risks. Mature Risk Management also has to include the management of uncertainties.