Project Management Equals Risk ManagementProject Management Equals Risk Management

Originally Published MDDI August 2003

PRODUCT DEVELOPMENT INSIGHT

Initial risk assessment can benefit product development.

Richard Rosen
Battelle Memorial Institute

Uncertainty is an inherent part of new product development. Project metrics can help project managers actively manage risk (see MD&DI, May 2003, p 54); however, tracking the project metrics associated with risk reduction assumes that the metrics, or dimensions, of risk have already been identified. But how do managers comprehensively identify risks in any new endeavor?

We're all familiar with the deer-in-headlights syndrome that occurs when we're faced with uncertain situations. Unfortunately, in the race to develop new products and market them, this paralysis can have a substantial negative impact on a company's business position and achievement of goals. 

In an already overfilled project agenda, managing risk is sometimes an afterthought. When it is lumped with scheduling, budgeting, allocating resources, staffing, managing technical work, and coordinating with all the various groups involved, it doesn't attract the attention it deserves. 

The time and effort necessary to effectively identify potential risks and define mitigating actions for them is often seen as less worthwhile than dealing with near-term activity. But it's the variability and uncertainty of each of these elements, which the project manager is trying to manage on a day-to-day basis, that manifest themselves as high-risk problems. Those not identified and addressed early enough can have high-cost consequences. 

Risk management can therefore be viewed as the project management glue that binds all elements together in a controllable manner. This unity will promote smooth progress of product development, and those involved will ultimately finish on time, within budget, and with most expectations met. Risk management serves as a project manager's tool for seeing beyond the day-to-day minutiae to make sure that the overall course of the project is correct and free from major problems.

The Defined Risk Management Process

To manage risk, it's important to have a defined process in place. This system should not only allow for the initial assessment of potential risk elements, but also for prioritization, implementation of mitigating actions, and periodic reassessment of risk and mitigation priorities. Figure 1 illustrates a high-level risk management process, which can be implemented in a product development program by including activities to periodically assess risk in the overall program plan.

Key milestones, or stage reviews in a stage-gated product development process, are excellent opportunities for conducting formal risk reviews and assessments. However, to be truly effective, the project manager and team should be reviewing the prioritized list of risk elements and mitigating actions even more frequently.

To aid in the process of managing risk, it is helpful to use a model or methodology for identifying, evaluating, assessing, prioritizing, and capturing mitigation activities. A number of models exist and involve varying levels of detail and complexity. One useful methodology is based on an approach to assessing potential risks associated with a product design. 

Managers with experience in medical product development are likely to be familiar with the general aspects of hazard analysis—a technique required to identify patient-risk issues associated with features of a product's functional design. The risk management method presented in this article draws on many of the principles found in ISO 14971: Medical Devices—Application of Risk Management to Medical Devices. However, the technique considers dimensions of risk expanded well beyond product functionality: risk analysis is done in the context of the total project and business environment. Figure 2 depicts how risk management is seamlessly connected to the overall project development process.

Risk Analysis Methodology

During the conduct of a project, there are a variety of risk dimensions, defined as factors for which undesired variances can have a negative influence on project outcome. The accompanying sidebar presents areas where risk may be encountered. 

Using the dimensions of risk, a project manager can systematically determine project elements that might pose risk. Each identified element can be analyzed to determine what its impact might be on the project. It should be noted that the analysis results are relative in nature, allowing the establishment of priorities and the focus to center on the higher-risk elements. 

For example, with a clear, stable, product definition, one can begin to analyze the associated risk. Without such a definition, the following could occur:

• The product that is designed does not meet user needs and expectations.
• The design activities are performed on features or functions that ultimately are not required.

A fuzzy product definition can affect schedule, performance, and cost. The cause of this risk element might be a lack of clear market requirements, having no market representative on the team, or failing to fully clarify certain critical aspects of the product function that influence its development path. 

Isolating this product definition risk element and considering it in the context of the whole program allow a relative analysis that can be used to establish a priority. The priority, in turn, determines whether or not to address the risk. This particular risk element could be mitigated with an action, such as conducting a user-needs study to generate associated product requirements.

Determining Risk Effects 

For each risk impact, a standard hazard analysis can establish a potential cause or driver. To help decide which risk elements could potentially have the most significant impact on a project, a standard risk assessment analysis technique is applied to each risk element–impact–potential cause combination. That is, if the combination were to occur, what would the severity, probability, risk index, and risk index code be? The answer will help determine the relative impact on the overall project, which will provide input to the project manager's decision-making process.

For each identified risk element, it's important to consider the impact to the project should it occur. Frequently, the result is schedule slip (days, weeks, or months). Along with the schedule slip are increased labor and hardware costs, as well as potential lost-opportunity costs for sales if a market-launch deadline is missed. 

Another potential problem is in the area of performance. Product performance can be affected by the risk element. The determination of each of these impacts can be part of the risk assessment.

A project manager can also assess the risk impacts with a severity index. The severity index and definitions, shown in Table I, are examples of one method to estimate the severity level were the risk element to occur.

Another component of the risk analysis is the determination of the probability of occurrence. The probability index and definitions, shown in Table II, are ways of estimating the probability of the risk element occurring. Where appropriate, an estimate should be made for each possible cause associated with the risk element.

Severity and probability scales can be chosen to suit the company's needs. Tables I and II use a five-point scale in which 1 represents the lowest severity level and smallest probability of the risk element occurring.

To help prioritize the risk impacts, one can multiply the severity and probability indices together to determine an overall risk index. The risk index allows the project manager to evaluate which combinations pose the greatest risk to the project. In essence, the risk index is a filter for finding those risk element–impact–potential cause combinations that have the greatest severity level and highest probability of occurring.

The team that performs the risk analysis can determine a threshold to help focus the risk-mitigation efforts. Table III shows one method for determining such thresholds. 

For risk elements with high risk-index codes, it may be necessary to prioritize those that will be actively managed. In some cases, it will be possible to address all of the risk elements that score high. In other cases, it may be appropriate to select only the top five to 10 risk elements to actively manage. An example of a total risk assessment project is outlined in Table IV.

Conclusion 
Successfully managing risk does not require an ability to predict the future. It relies on preparation for the myriad unanticipated events that can, and do, occur as a program proceeds. Because some events are within the control of the project and business team, some preparation can be built into the program plan. Other potential risks are not so controllable, but must still be considered since they have a very real impact on the project outcome. 

Overall, the time spent managing risk will likely increase the chances of the project being completed on time, within budget, and with all expectations met. 

Post your questions and comments for the author on-line in MD&DI's Author Forums. Select the Author Forums link at www.devicelink.com/mddi.

Copyright ©2003 Medical Device & Diagnostic Industry