The management of cost and schedule risk is a topic that must be addressed for any project's success. If the project schedule and cost estimates have no margin, then you are late and over budget before you start.
Here's some clips from a recent week long training session on a defense program for getting the Control Account Managers up to speed on what Program Controls does during the development of the Performance Measurement Baseline (PMB).
Let's start with the fundamental principle of programmatic risk management. We must have a clear understanding of the risks and how to deal with them. This means seeking out all possible risk, from the Known obvious ones (which are likely to be issues instead of risks) to the Unknown risks. Only if the risk is Unknowable do we stop searching for possible risks on mission critical projects. If you say there are Unknown Unknowns, then the project better have a fail safe mode. This is usually "handled" by a cancellation and a restart of the project.
There are many kinds of programmatic risk, along with all the technical risks. Seeking the technical risks and managing them is for another time. But here is a start at the programmatic risks.
When we place these programmatic risks in the Integrated Master Schedule (IMS) they look like this. This example looks at the duration risk. Remember any single point is wrong without a statement of the variance. (Hence the single point estimate). The development of the upper and lower limits of the defined probability distribution is another topic as well. For now let's assume we have all three pieces of information.
When we run the Monte Carlo simulator we get outputs that look like this. This is the Probability Distribution Function (PDF) of the possible task durations generated from the Monte Carlo tool. The Cumulative Distribution Function (CDF) shows the probability of completing "on or before" a date and that probability value.
So now we need to define a schedule margin to "protect" the deliverable. This is done by running the Monte Carlo tool with all the schedule margin removed - a zero slack deterministic schedule - and watching the desired deliverable date to see where it says the probability of completion is. In the world we work, an 80% confidence of completing "on or before" the desired date is common. The duration between the probabilistic date (80% confidence) and the deterministic date (zero slack) is the needed margin (probabilistic value) to "protect" that date.
This margin can be place "in line." Or if there is a named risk in the Risk Registry, then the Plan B for that deliverable is placed in the IMS once the risk is accepted by the Risk Management Board (RMB). This is show below.
When Plan B is turned to "execute" the IMS needs to have already planned for this as shown above. But if the margin is no used - the Risk, although planned never came true, the IMS needs to absorb the unused risk margin for the future. This means moving unused margin forward. If this margin can not be moved forward, then the IMS is probably not well structured and some re-planning is needed.