Risk Analysis of Acme Medical Device Company's IT Projects

Acme Medical Device Company is currently running a portfolio of 8 IT projects that are facing challenges or risks. Each of these risks can affect the cost of project concerned as well as other projects in the portfolio. A risk analysis of the same has been done involving both the qualitative and quantitively analysis methods and the results are presented in the report to identify if the possibility of completing projects within given budget is there and if not, then which projects would need the contingency amount to be added in order to ensure the completion. The report also explores if the current conditions of the projects could affect other ongoing project of the company.

Executive Summary
Acme Medical Device Company is currently running a portfolio of 8 IT projects
that are facing challenges or risks. Each of these risks can affect the cost of project
concerned as well as other projects in the portfolio. A risk analysis of the same has
been done involving both the qualitative and quantitively analysis methods and the
results are presented in the report to identify if the possibility of completing
projects within given budget is there and if not, then which projects would need the
contingency amount to be added in order to ensure the completion. The report also
explores if the current conditions of the projects could affect other ongoing project
of the company.

1
Contents
BACKGROUND...........................................................................................1
RISK ANALYSIS TOOLS AND TECHNIQUES……………………….3
QUALITATIVE RESEARCH APPROCH................................................1
QUATITATIVE APPROACH.................................................................1
CONCLUSION..............................................................................................1
REFERENCES..............................................................................................1

2
BACKGROUND
Risk management refers to identification of risks that can occur on the
project, assessing possible impacts and planning mitigation so that the risks do not
affect the project deliveries much (Aven, 2016). Risks can be analysed using
quantitively or qualitative methods and, in either case, some of them can be
difficult to predict the impact while other could be easy to comprehend (Almalki,
2016).
Acme Medical Device Organization is running 8 IT projects that are
utilizing the limited resources and a number of different problems have been faced
by the company (Agca et, al., 2016). In order to understand how the risks can
affect the organization and how they can be managed each of these problems are
required to be assessed qualitatively and quantitatively so that the assessment can
reveal possibilities of impacts and the mitigation of the risk impacts (Ahmed, El-
Karim, Aly, Nawawy, & Abdel-Alim, 2017).
RISK ANALYSIS TOOLS AND TECHNIQUES
The research can use of tools and techniques for the analysis of the likely risks
such as:

3
Documentation Reviews: Project documents can be reviewed to identify the risks
in the case which has been done for each project. The project progress has been
analysed and the risks are identified along with the suggested solutions (Australian
Development Corporation, 2009).
Brainstorming: This can help understand the problems or risks by discussing the
same with people. The outcome of a discussion already some with the stakeholders
has been recorded in the case and has been used in the analysis of the projects
managed by the company (MacPherson & Tonning, 2015).
Interviewing: This could be done with individual stakeholders to understand the
possibilities of risks on a project (OECD, 2014).
Root Cause Analysis: This involves identification of specific risks faced by
projects and the determination of the causes that are behind these issues. This
analysis has revealed problems like delays in the project that were caused by
specific issues for each project based on which the impacts have been assessed
(Maack, 2000).
Swot Analysis (STRENGTH, Weakness, Opportunities and Threats): This tool
can be used for identifying specific risks that the company is likely to face on
different projects (ISU, 2009).
Risk Register: This is the document which records all the risks that are faced on
the project and have details like risks, potential responses, causes, and risk
categories (AG, 2013).
Probability And Impact Matrix: This matric can help identify the risks on the
project and determine the immediate response that may be taken in the case of their
occurrence (Wickboldt, 2011).
Risk Data Quality Assessment: For the assessment of the quality of the risks
occurring, the risks have to understood by exploring the data available on the same
(Wirthmann A, B., & F., 2015).
The current research is based on both the quantitative and qualitative
approach for determining mitigation measures and it has been supported by a
quantitative analysis on cost parameters to determine contingency fund
requirements.

4
A survey has been conducted on the project team members to gather the data
on their experiences through a quantitively survey and for the collection of the
qualitative data, interviews have been conducted with the project managers of each
of the IT projects to get the data on the risks that are being faced by each project.
QUANTITATIVE APPROACH
Galway (2004) discusses three risk elements that concern project management:
 Schedule – will the project be completed within the planned timeframe?
 Cost – will the project be completed within the allocated budget?
 Performance – will the output from the project satisfy the business and
technical goals of the project?
Where possible, these risks should be quantified to enable the project team to
develop effective mitigation strategies for the risks, or to include appropriate
contingencies in the project (GALWAY, 2004)
 How long you are working in Acme Medical Device Organization?
Options Response % Respondents Total no of
respondents
Less than 6
months
18.18% 10 55
6 months- 1
year
27.27% 15 55
1 year- 2 years 36.36% 20 55
2 years- 5 years 18.18% 10 55

5
More than 5
years
18.18% 10 55
Findings and analysis
From the above table, it can be clearly stated that most of the employees
working in Acme Medical Device Organization are working since 1year to 2 years.
However, same numbers (18.18%) of people working in the company are working
less than 6 months, 2 to 5 years, or more than 5 years.
Hence, it is required to take the opinion of the employees and take suitable
actions so that the risks can be mitigated easily and timely.
 How far do you agree that risk management is one of the most important
aspects for project development?
Options Response % Respondents Total no of
respondents
Strongly agree 27.27% 15 55
Agree 50.90% 28 55
Neutral 3.63% 2 55
Disagree 9.09% 5 55
Strongly
disagree
9.09% 5 55
Findings and analysis
In the survey, most of the respondents are agreed that that risk management
is one of the most important aspects for project development. However, 9.09%
respondents are strongly disagreed on the matter. Hence, the management of Acme

6
Medical Device Organization needs to emphasize on implementing effective risk
management technique.
 How far do you agree that implementing technology is a vital option for
managing risks successfully?
Options Response % Respondents Total no of
respondents
Strongly agree 20% 11 55
Agree 32.72% 18 55
Neutral 16.36% 9 55
Disagree 21.81% 12 55
Strongly
disagree
27.27% 15 55
Findings and analysis
The above table suggests that most number of respondents is agreed that
implementing technology is a vital option for managing risks successfully.
However, 27.27% respondents in the survey are strongly disagreed on the
particular matter. Thus, the organization needs to focus on technology for risk
management.

7
 How far do you agree that effective project management is helpful for
managing risks successfully?
Options Response % Respondents Total no of
respondents
Strongly agree 30.90% 17 55
Agree 30.90% 17 55
Neutral 10.90% 6 55
Disagree 18.18% 10 55
Strongly
disagree
27.27% 15 55
Findings and analysis
The above table indicates that most number of respondents is agreed that
effective project management is helpful for managing risks successful. However,
27.2% respondents out of total number of respondents are disagreed about the
effectiveness of project management for risk management. Hence, project
management needs to be completed successfully for mitigating the risks from the
project.

8
Cost Estimation
The data was also collected on the estimated costs for each of the project and
the possible contingency funds that can be allotted for each project was also
computed. Costs that are incurred on any project can affect the budget utilization
and thus, pose risks if they grow higher than the budget. Thus, it is essential keep
tab on the costs parameters so that it can be ensured that the project is completed
within budget. In the current case, various decisions taken by the company would
affect the costs. A simulation model has been prepared in order to understand this
impact. This involved collection of the project data including the phase it is in, the
project team assigned, possibility of completion on time, and associated cost
estimates. The model can help in developing an understanding of whether the
project would be completed within the budget in the given time and if there are
possible risks or delays or cost fluctuations then what is the extra budget
requirement that must be met in order to ensure that project is completed smoothly.
Cost elements Base case $k Minimum Most Likely Maximum Minimum Most Likely Maximum
Land 2,000 90% 100% 125% 1,800 2,000 2,500
Buildings 5,000 90% 100% 125% 4,500 5,000 6,250
Raw Mats 4,000 90% 100% 125% 3,600 4,000 5,000
Salaries etc 2,000 90% 100% 125% 1,800 2,000 2,500
IT 1,000 90% 100% 125% 900 1,000 1,250
Vehicles 500 90% 100% 125% 450 500 625
Marketing 1,500 90% 100% 125% 1,350 1,500 1,875
Other general overhead 2,500 90% 100% 125% 2,250 2,500 3,125
Total 18,500 16,650 18,500 23,125
The table above shows the statistics of the project highlighting the
probabilities of completion of the project below the budgeted amount, within the
budget and above the budgeted amount.

9
QUALITATIVE RESEARCH APPROCH
Qualitative research approach would be helpful to generate effective
outcome in the research. Acme Medical Device Organization is presently
experiencing several types of manufacturing issues. In the organization, frequently
bringing new as well as enhanced products to the consumers needs important
manual reconfiguration in manufacturing machinery as well as outdated system of
manufacturing. Lifecycle of the products are shortened for competition as well as
new products (Aven 2016). The outcomes are required for manufacturing
equipment. There are two steps involved in this:
1. RAM: RAM that is able to define the rating scales and its impact. In
qualitative analysis, probability is measured utilizing relative scale.
2. PROGRAM MANAGEMENT STRUCTURE: the program manager
has an important program management structure that helps to analyze
the key projects. Program management is helpful to manage the
complexity as well as interdependency of the activities, deliverables and
milestones that requires setting a program that assists for the program
and making better coordination effect. Optimizing manufacturing in
Acme Medical Device Organization is one of the key aspects that help
to make important information system of manufacturing need to be
considered in the process.

10
3. UPGRADE THE SYSTEMS: It is required to upgrade information
system for managing as well as controlling the systems are complied
with stringent patient data with the security standards, controlling as
well as managing the business systems.
Risk Impacts
Using the qualitative approach, interviews were conducted with the project
managers for each IT project and the outcome of the same were the discussion on
the problems faced on each of the project. The analysis of the risks identified this
way and the possible impacts they could cause on the project and its costs has to be
determined (Dinsmore & Brewin, 2010).
This section would explore how risks can impact a project portfolio buy
considering the case of a company that is currently managing 8 IT projects, each
presenting different risks and challenges that can affect their costs as well as other
projects (Hopkinson, Close, Hillson, & Ward, 2008).
Considering the risks that the projects are currently facing, the probability of
completing the project within these estimates can be affected positively or
negatively (Kärri, 2014). In the current situation, the following risks have been
faced and the impact they would have on the costs of different projects can be
explained as below:

11
Infrastructure Upgrade Project: The servers are expected to be delivered
three weeks later than the original allotted date of delivery and the computers have
been delayed even further which would affect the whole project by adding the
delay to all the processes dependent on the delivery of server and computers such
as infrastructure program, server software installation, testing of servers, and user
acceptance testing. As the project team would be involved in the work for three
weeks longer, it would add to the cost of them working for additional days. The
cost involved in building, testing, and roll out would thus increase. Thus, an
additional contingency budget of 25% would be needed such that the total budget
would increase from $18,500 to $23,125. With this additional amount invested,
there is still a possibility of curing the delay to not affect other IT projects handled
by the company (Langley, 2015).
System Security Upgrade: The team is of the view that the estimation on
testing about the time were too optimistic and thus, testing may need more time to
complete. The additional work would need more resources to be hired without
which the project would not be completed on time. However, the project needs to
be completed fast as the company had faced a security hack and can risk facing it
again if the move is not taken fast. Thus, additional funds have to be allotted for
the additional resources. Thus, additional 25% would be added for the testing
phase of the project (Ho et. al, 2015).

12
ESB Implementation: The IT equipment’s have arrived late yet the team
can work overtime to finish the project on time such that no additional cost would
be incurred. Thus, no additional funds may be incurred for this project (Hopkin,
2018).
MIS Upgrade: The delays have been caused due to delay in delivery of
servers and thus, software could not be installed on them on time. Also, because of
inability of the staff to completely understand the system, some workshops had to
be repeated. Further, the need for hiring a CRM analyst was also recognized
considering the complexity of the project. This would add both the direct cost and
cost of the delay in completion of the upgrade. This can be a major cost and the
company may need to keep an additional contingency fund of 25%. It would also
increase the workload on the team unless the hiring is done fast enough. However,
hiring would take time as it has to be done by the people who may be working on
other projects such that their involvement in the current project would also affect
the other projects thereby causing delays ( Hillson et. Al., 2017).
ERP Upgrade: ERP team could not complete the training on time which
added delays to the project, Also, after attending the workshops late, they still
realized that there was also a need to attend more workshops for CRM. This can
also affect the MIS upgrade option where the project team is in the process of
attending similar workshops. If the workshops could be combined for the two
projects, some time could be saved for both the projects. However, this would

13
require some integration between the team which is challenging. However, the
costs would be reduced and with additional continency funds, both projects would
still be completed (Col, 2017).
PMO establishment: This project was fairly completed on time with all
activities as listed but the quality of documents produced was not even as they had
variations in designs and quality. This would mean that the impact of the
establishment would not be as expected and this could affect all the other projects
(Bromiley, 2015).
IT operations management: A 6 sigma study was planned for brining
improvements but many in the team feel that there is no further need for
improvement as they have already been made and thus, the training can be
avoided. This would save on the cost of the project which would leave the positive
funds to be utilized on other projects such that the management of the funds for
managing contingencies for other projects would not remain a problem (Bressis,
2015).
IT reorganization: Several teams have to work on multiple projects and
often they would need some common skills such as designing and thus, IT
reorganization has been planned to help the teams gain collective knowledge in
various ways so that their skills are enhanced which could be used for management
of all the projects. This reorganization can bring in long term results but at the

14
same time can affect all other projects as the involved team members would have
to be put on these trainings. However, if their idle time is utilized for these
trainings, the project compromises can be avoided. However, this would
compromise the reorganization and would cause delays and possible cost
escalations. However, as suggested by COO, the scope of some projects can be
reduced to save on time and help the reorganization project. Reduction in scope of
some project would also help release resources fast so that they can be utilized on
other projects that otherwise would need additional hiring. This would save on the
project costs (BENAIJA1 & KJIRI, 2013).
CONCLUSION
The above study concludes that risk management is an important aspect that
every company needs to process successfully so that the organization can retain its
position by gaining competitive benefits. Identification of the risks is one of the
important aspects through which it is kept properly. It is important to keep in mind
that identification of the risks in a business process is important. In the present
study, Acme Medical Device Company needs to implement proper risk
management obtained from the qualitative and quantitative analysis.

15
REFERENCES
Agca, R., Heslinga, S.C., Rollefstad, S., Heslinga, M., McInnes, I.B., Peters, M.J.L.,
Kvien, T.K., Dougados, M., Radner, H., Atzeni, F. and Primdahl, J., 2016.
EULAR recommendations for cardiovascular disease risk management in
patients with rheumatoid arthritis and other forms of inflammatory joint
disorders: 2015/2016 update. Annals of the rheumatic diseases, pp.annrheumdis-
2016.
Aven, T., 2016. Risk assessment and risk management: Review of recent advances
on their
foundation. European Journal of Operational Research, 253(1), pp.1-13.
Bessis, J., 2015. Risk management in banking. John Wiley & Sons.

16
Bromiley, P., McShane, M., Nair, A. and Rustambekov, E., 2015. Enterprise risk
management: Review, critique, and research directions. Long
range planning, 48(4), pp.265-276.
Cole, S., Giné, X. and Vickery, J., 2017. How does risk management influence
production decisions? Evidence from a field experiment. The Review of
Financial Studies, 30(6), pp.1935-1970.
Hillson, D. and Murray-Webster, R., 2017. Understanding and managing risk
attitude. Routledge.
Ho, W., Zheng, T., Yildiz, H. and Talluri, S., 2015. Supply chain risk management:
a literature review. International Journal of Production Research, 53(16),
pp.5031-5069.
Hopkin, P., 2018. Fundamentals of risk management: understanding, evaluating
and implementing effective risk management. Kogan Page Publishers.
Larson, E.W. and Gray, C.F., 2015. A Guide to the Project Management Body of
Knowledge: PMBOK (®) Guide. Project Management Institute.
Wynne, B., 2016. Misunderstood misunderstanding: Social identities and public
uptake of science. Public understanding of science.

17
AG. (2013). Monitoring, review and evaluation. Australian Government.
Ahmed, M. S., El-Karim, A., Aly, O., Nawawy, M. E., & Abdel-Alim, A. M. (2017).
Identification and assessment of risk factors affecting construction projects. HBRC
Journal, 202-216.
Almalki, S. (2016). Integrating Quantitative and Qualitative Data in Mixed Methods Research—
Challenges and Benefits. Journal of Education and Learning, 288-296.
Australian Development Corporation. (2009). Guidelines for Project and Programme
Evaluations. Australian Development Corporation.
BENAIJA1, K., & KJIRI, L. (2013). Project portfolio selection: Multi-criteria analysis and
interactions between projects. ENSIAS.
Dinsmore, P. C., & Brewin, J. C. (2010). The AMA Handbook of Project management.
AMACOM.
GALWAY, L. (2004). Quantitative Risk Analysis for Project Management. Rand Corporation.
Hopkinson, M., Close, P., Hillson, D., & Ward, S. (2008). Prioritizing Project Risks. APM.
ISU. (2009). Analysis of Strengths, Weaknesses, Opportunities and Threats (SWOT) : Strategic
Planning Process . Indian State University.
Kärri, T. (2014). Creating risk measurement model to project portfolio management in
construction company. LAPPEENRANTA UNIVERSITY OF TECHNOLOGY.
Langley, M. A. (2015). Delivering on Strategy: The Power of Project Portfolio Management.
Deloitte.

18
Maack, J. N. (2000). Scenario Analysis: A Tool for Task Managers. World Bank.
MacPherson, C., & Tonning, B. (2015). Engaging and Involving Stakeholders in Your
Watershed. Tetra Tech, Inc.
OECD. (2014). Risk Management and Corporate Governance. OECD Publishing.
Wickboldt, J. A. (2011). A framework for risk assessment based on analysis of historical
information of workflow execcution in IT systems. LUME.
Wirthmann A, K. M., B., K., & F., R. (2015). Structuring risks and solutions in the use of big
data sources for producing official statistics –Analysis based on a risk and quality
framework. EC Europe.