Risk breakdown structure
Encyclopedia
Risk Breakdown Structure (RBS) - A hierarchically organised depiction of the identified project
risks arranged by category.
plans for the work to be done by its staff, but there is the risk that an employee may unexpectedly leave the team.
In Project Management
, the Risk Management Process has the objectives of identifying, assessing, and managing risks, both positive and negative. All too often, project managers focus only on negative risk, however, good things can happen in a project, "things" that were foreseen, but not expressly planned.
The objective of Risk Management
is to predict risks, assess their likelihood and impact, and to actively plan what should be done ahead of time to best deal with situations when they occur.
The risk management process usually occurs in five distinct steps: risk management planning, risk identification, risk analysis
, risk response planning, and risk monitoring and control.
The central point of risk identification and assessment in risk management is understanding the risk. However, this is also where project managers and risk subject matter expert
s (SMEs) get the least help from recognized references, best practice
s, or work standards.
Currently, the Project Management Institute (PMIr) has a team of SMEs working on a Practice Standard for Risk Management. This team has identified one very good tool: the Risk Breakdown Structure (RBS). The RBS helps the project manager, the risk manager, and almost any stakeholder to understand, and therefore be able to identify and assess risk.
Following the concept of the Work Breakdown Structure
(WBS), the Risk Breakdown Structure provides a means for the project manager and risk manager to structure the risks being addressed or tracked. Just as PMI defines the Work Breakdown Structure
as a "deliverable-oriented grouping of project elements that organizes and defines the total work scope of the project..." the RBS could be considered as a "hierarchically organized depiction of the identified project risks arranged by risk category."
Many project managers and risk managers currently use "home-grown" methods for listing, identifying, assessing, and tracking risks in their projects. These methods include: spreadsheet
s, listing, generic risk taxonomy
, based somewhat loosely on various standards and guidelines.
An approach that simply places the risks in a list, a simple table, or even in a database does not provide the strength of using a structured, organized method similar to a Work Breakdown Structure. To fully understand the risks and better identify and assess the risk, a "deep-dive" into each risk, recording as many levels of identification as necessary, may be required. The project value of placing risks in a structure such as this lies in the ability of the project manager and risk manager to then quickly and easily identify and assess the risk, identify the potential risk triggers, and develop a more robust risk response plan
. If all risks are placed in a hierarchical structure as they are identified, and the structure is organized by source, the total risk exposure to the project can be more easily understood, and planning for the risk more easily accomplished.
, which had the following major topics: Product Engineering, Development Environment
, Program Constraints; and an RBS for Construction Design, which has these major topics: Environment, Industry, Client, Project.
Each RBS is broken into "levels", with each level providing a more in-depth "view" of the identified risk. As an example, in creating a RBS for software development, Level 1 of the RBS might be Technical, followed by Level 2, Requirements, followed by Level 3, Functional Requirements
, Informational Requirements, Non-functional Requirements
, etc. If desired, Level 3 can be further refined with Level 4, Stability, Completeness, Functionality, Interfaces, Testability, etc., Level 5, etc.
Once the project team has created its RBS, then individual risks can be identified. Several different techniques for defining the individual risks are available, including brain-storming
, surveys, workshops, etc. Each identified risk needs to be categorized, and placed in the RBS under a specific topic (or topics if the risk spans two or more topics, such as a risk in gathering requirements might span Technical, organizational and project management.
NOTE: the RBS will be different between projects, even projects within the same project area,
e.g., construction, information technology
, environmental remediation, etc.
After the RBS has completed its first "pass" in the creation phase, it can then become an input to qualitative
risk analysis, where probabilities, priorities, and impacts are determined.
to make certain that all topics that might include risk are covered during the risk identification process. Using the RBS, an iterative process can be initiated that will persist throughout the project life-cycle. The frequency and applicability of this iterative process will be different in each phase of the life-cycle
Using a risk identification checklist that is focused on the RBS, using Levels 2, 3 and below, assists in identifying specific and generic risks. This checklist can then become a part of the project managers' and risk managers' tool set for future projects.
Risk identification leads to quantitative
risk analysis, conducted by the Project Risk Manager. Interestingly, sometimes merely identifying the risk will suggest the proper response, which can be entered into the Risk Response Plan.
Using the RBS also offers other valuable understanding into the analysis of the identified risks. Some of these new understandings are:
Another benefit of the RBS is the ability to focus risk responses to the high probability, high impact, high priority risks using the risk topic groupings.
Project
A project in business and science is typically defined as a collaborative enterprise, frequently involving research or design, that is carefully planned to achieve a particular aim. Projects can be further defined as temporary rather than permanent social systems that are constituted by teams...
risks arranged by category.
An Introduction to the Risk Breakdown Structure
When planning a project to meet targets for cost, schedule, or quality, it is useful to identify likely risks to the success of the project. A risk is any possible situation that is not planned for, but that, if it occurs, is likely to divert the project from its planned result. For example, an established project teamProject team
A project team is a team whose members usually belong to different groups, functions and are assigned to activities for the same project. A team can be divided into sub-teams according to need. Usually project teams are only used for a defined period of time. They are disbanded after the project is...
plans for the work to be done by its staff, but there is the risk that an employee may unexpectedly leave the team.
In Project Management
Project management
Project management is the discipline of planning, organizing, securing, and managing resources to achieve specific goals. A project is a temporary endeavor with a defined beginning and end , undertaken to meet unique goals and objectives, typically to bring about beneficial change or added value...
, the Risk Management Process has the objectives of identifying, assessing, and managing risks, both positive and negative. All too often, project managers focus only on negative risk, however, good things can happen in a project, "things" that were foreseen, but not expressly planned.
The objective of Risk Management
Risk management
Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities...
is to predict risks, assess their likelihood and impact, and to actively plan what should be done ahead of time to best deal with situations when they occur.
The risk management process usually occurs in five distinct steps: risk management planning, risk identification, risk analysis
Risk analysis
Risk Analysis may refer to:*Quantitative risk analysis*Risk analysis **Probabilistic risk assessment, an engineering safety analysis*Risk analysis *Risk Management*Risk management tools* Certified Risk Analyst...
, risk response planning, and risk monitoring and control.
The central point of risk identification and assessment in risk management is understanding the risk. However, this is also where project managers and risk subject matter expert
Subject Matter Expert
A subject matter expert or domain expert is a person who is an expert in a particular area or topic. When spoken, sometimes the acronym "SME" is spelled out and other times voiced as a word ....
s (SMEs) get the least help from recognized references, best practice
Best practice
A best practice is a method or technique that has consistently shown results superior to those achieved with other means, and that is used as a benchmark...
s, or work standards.
Currently, the Project Management Institute (PMIr) has a team of SMEs working on a Practice Standard for Risk Management. This team has identified one very good tool: the Risk Breakdown Structure (RBS). The RBS helps the project manager, the risk manager, and almost any stakeholder to understand, and therefore be able to identify and assess risk.
What is a "Risk Breakdown Structure?"
The RBS will prove extremely valuable to better grasp when a project needs to receive special scrutiny, in other words, when risk might happen. The RBS can also help the project manager and the risk manager to better understand recurring risks and concentrations of risk that could lead to issues that affect the status of the project.Following the concept of the Work Breakdown Structure
Work breakdown structure
A work breakdown structure , in project management and systems engineering, is a deliverable oriented decomposition of a project into smaller components. It defines and groups a project's discrete work elements in a way that helps organize and define the total work scope of the project.A work...
(WBS), the Risk Breakdown Structure provides a means for the project manager and risk manager to structure the risks being addressed or tracked. Just as PMI defines the Work Breakdown Structure
Work breakdown structure
A work breakdown structure , in project management and systems engineering, is a deliverable oriented decomposition of a project into smaller components. It defines and groups a project's discrete work elements in a way that helps organize and define the total work scope of the project.A work...
as a "deliverable-oriented grouping of project elements that organizes and defines the total work scope of the project..." the RBS could be considered as a "hierarchically organized depiction of the identified project risks arranged by risk category."
Many project managers and risk managers currently use "home-grown" methods for listing, identifying, assessing, and tracking risks in their projects. These methods include: spreadsheet
Spreadsheet
A spreadsheet is a computer application that simulates a paper accounting worksheet. It displays multiple cells usually in a two-dimensional matrix or grid consisting of rows and columns. Each cell contains alphanumeric text, numeric values or formulas...
s, listing, generic risk taxonomy
Taxonomy
Taxonomy is the science of identifying and naming species, and arranging them into a classification. The field of taxonomy, sometimes referred to as "biological taxonomy", revolves around the description and use of taxonomic units, known as taxa...
, based somewhat loosely on various standards and guidelines.
An approach that simply places the risks in a list, a simple table, or even in a database does not provide the strength of using a structured, organized method similar to a Work Breakdown Structure. To fully understand the risks and better identify and assess the risk, a "deep-dive" into each risk, recording as many levels of identification as necessary, may be required. The project value of placing risks in a structure such as this lies in the ability of the project manager and risk manager to then quickly and easily identify and assess the risk, identify the potential risk triggers, and develop a more robust risk response plan
. If all risks are placed in a hierarchical structure as they are identified, and the structure is organized by source, the total risk exposure to the project can be more easily understood, and planning for the risk more easily accomplished.
Templates for creating a Risk Breakdown Structure
The concept of the RBS is new. The PMBoK (2004), barely references its use; however, the PMI Standards team has incorporated the RBS in the Practice Standard for Risk Management (draft for release in 2009). The PMBoK provides an example graphic of the RBS in Chapter 11, Figure 11.4. This reference has as major topics: Technical, External, Organizational, and Project Management. Another source provides the following major topics: Technical, Management, Organizational, External, and Project Management. Dr. David Hillson, in the proceedings of the Project Management Institute Annual Seminars and Symposium, on Oct. 3-10, 2002, provided several different RBS Structure examples, with topics similar to those already shown. Dr. Hillson broke out two different examples, an RBS for Software DevelopmentSoftware engineering
Software Engineering is the application of a systematic, disciplined, quantifiable approach to the development, operation, and maintenance of software, and the study of these approaches; that is, the application of engineering to software...
, which had the following major topics: Product Engineering, Development Environment
Integrated development environment
An integrated development environment is a software application that provides comprehensive facilities to computer programmers for software development...
, Program Constraints; and an RBS for Construction Design, which has these major topics: Environment, Industry, Client, Project.
Each RBS is broken into "levels", with each level providing a more in-depth "view" of the identified risk. As an example, in creating a RBS for software development, Level 1 of the RBS might be Technical, followed by Level 2, Requirements, followed by Level 3, Functional Requirements
Functional requirements
In software engineering, a functional requirement defines a function of a software system or its component. A function is described as a set of inputs, the behavior, and outputs ....
, Informational Requirements, Non-functional Requirements
Non-functional requirements
In systems engineering and requirements engineering, a non-functional requirement is a requirement that specifies criteria that can be used to judge the operation of a system, rather than specific behaviors. This should be contrasted with functional requirements that define specific behavior or...
, etc. If desired, Level 3 can be further refined with Level 4, Stability, Completeness, Functionality, Interfaces, Testability, etc., Level 5, etc.
Once the project team has created its RBS, then individual risks can be identified. Several different techniques for defining the individual risks are available, including brain-storming
Brainstorming
Brainstorming is a group creativity technique by which a group tries to find a solution for a specific problem by gathering a list of ideas spontaneously contributed by its members...
, surveys, workshops, etc. Each identified risk needs to be categorized, and placed in the RBS under a specific topic (or topics if the risk spans two or more topics, such as a risk in gathering requirements might span Technical, organizational and project management.
NOTE: the RBS will be different between projects, even projects within the same project area,
e.g., construction, information technology
Information technology
Information technology is the acquisition, processing, storage and dissemination of vocal, pictorial, textual and numerical information by a microelectronics-based combination of computing and telecommunications...
, environmental remediation, etc.
After the RBS has completed its first "pass" in the creation phase, it can then become an input to qualitative
Qualitative research
Qualitative research is a method of inquiry employed in many different academic disciplines, traditionally in the social sciences, but also in market research and further contexts. Qualitative researchers aim to gather an in-depth understanding of human behavior and the reasons that govern such...
risk analysis, where probabilities, priorities, and impacts are determined.
Using the Risk Breakdown Structure
The RBS serves as more than just a "database" for identifying risks to the project. When created, the RBS provides a vehicle for risk analysis and reporting, and risk comparison across projects. Most importantly, the RBS is "the" tool for risk identification.Risk Identification
Risk identification will be the first step in determining which risks may affect a project. Identification also provides documentation of the risk characteristics. The first level (Level 1) of the RBS can be used as a sanity checkSanity test
A sanity test or sanity check is a basic test to quickly evaluate whether a claim or the result of a calculation can possibly be true. It is a simple check to see if the produced material is rational...
to make certain that all topics that might include risk are covered during the risk identification process. Using the RBS, an iterative process can be initiated that will persist throughout the project life-cycle. The frequency and applicability of this iterative process will be different in each phase of the life-cycle
Using a risk identification checklist that is focused on the RBS, using Levels 2, 3 and below, assists in identifying specific and generic risks. This checklist can then become a part of the project managers' and risk managers' tool set for future projects.
Risk identification leads to quantitative
Quantification
Quantification has several distinct senses. In mathematics and empirical science, it is the act of counting and measuring that maps human sense observations and experiences into members of some set of numbers. Quantification in this sense is fundamental to the scientific method.In logic,...
risk analysis, conducted by the Project Risk Manager. Interestingly, sometimes merely identifying the risk will suggest the proper response, which can be entered into the Risk Response Plan.
Risk Analysis (Qualitative Risk Analysis)
Risk analysis is more easily achieved if, after identification, the risks are placed in proper perspective within the RBS by categorizing the risks in the various levels. Risk analysis (quantitative risk analysis) involves the use of techniques for prioritizing the risk, determining the probability of the risk, and calculating the impact of the risk. At no point should the project manager or risk manager decide that the total number of identified risks should cause the cancellation of the project. The total number does not take into account the probability with which the risk will occur, nor the impact to the project, should the risk occur. A few risks, with high probabilities and high impact, are far more critical to the overall success of the project than a large number of risks with low probability and minimal impact. Using the RBS, the project manager and the risk manager should create a "risk score" based on the priority, probability and impact of each risk, and with each "group" of risks (according to the appropriate Level of the RBS).Using the RBS also offers other valuable understanding into the analysis of the identified risks. Some of these new understandings are:
- Risk exposure type
- Dependencies between risks
- Root causality of risks
- Most significant and least significant risks
- Correlations between risks
Another benefit of the RBS is the ability to focus risk responses to the high probability, high impact, high priority risks using the risk topic groupings.