Analysis of Risk in Project & Procurement Management - Business

This report provides a comprehensive analysis of risk management within the context of project and procurement management. It begins by defining the concept of risk and differentiating between endogenous and exogenous risks. Various types of risks, including country risk, political risk, operational risk, technological risk, environmental risk, and strategic risk, are examined in detail. The report outlines the stages of risk management, including risk identification, quantification, analysis (using qualitative and quantitative methods), treatment, and documentation. It also emphasizes the roles and responsibilities of management in risk management. Furthermore, the report explores the application of risk management principles in procurement management, covering aspects such as setting objectives, evaluating capital outlay, analyzing options, obtaining legal approvals, preparing procurement documents, assessing tenders, negotiating contracts, implementing projects, and conducting reviews.

June 18th 2018
Project Risk and Procurement Management

REPORT 1
Abstract
Risk Management is the process by which the various risks governing an organisation are
identified, quantified and analysed, accepted and managed by either mitigating them or
controlling them. There are many benefits to risk management. The key benefit from the risk
management exercise is that it enhances the effectiveness and efficiency of the operations and
aids in the strategic decision making. Though the businesses face similar types of the risks,
but the risk management policy and the processes are different for each organisation. Over
the years the process of procurement management has gained a lot of significance. While the
process itself is a collection of a number of processes such as inviting tenders, vendor
negotiations, policy documentations and many more, therefore the degree of risk involved is
high and it occurs at each and every stage. The assignment defines the concept of risk, along
with analysis of various types of risk, the procedure for risk management, the roles and
responsibilities of management, significance and their application in the procurement
management.

REPORT 2
Table of contents
1. Introduction...................................................................................................................................3
2. Risks and Businesses.....................................................................................................................3
2.1 Country Risk................................................................................................................................4
2.2 Political Risk...............................................................................................................................4
2.3 Operational Risk..........................................................................................................................4
2.4 Technological Risk......................................................................................................................4
2.5 Environmental Risk.....................................................................................................................4
2.6 Strategic Risk...............................................................................................................................4
3. Risk Management.............................................................................................................................5
3.1 Identification of risk....................................................................................................................5
3.2 Quantification and analysis of risk...............................................................................................5
3.2.1 Qualitative methods..............................................................................................................5
3.2.2 Quantitative Methods............................................................................................................6
3.3 Treatment of risk.........................................................................................................................7
3.3.1 Identification of Options.......................................................................................................7
3.3.2 Action Plan Development.....................................................................................................8
3.3.3 Approval and Implementation of Action Plan.......................................................................8
3.4 Identification and Acceptance of residual risk.............................................................................8
3.5 Documentation of Risk Management Process..............................................................................9
3.6 Risk Management Responsibility..............................................................................................10

REPORT 3
4. Risk Management and Procurement Management...........................................................................10
4.1 Setting out the objectives and the requirements of the project procurement..............................11
4.2 Evaluation of capital outlay.......................................................................................................11
4.3 Analysis of options....................................................................................................................11
4.4 Obtaining legal approvals if any................................................................................................11
4.5 Preparation of procurement documents.....................................................................................12
4.6 Inviting and assessing tenders....................................................................................................12
4.7 Evaluation and selection of the tenders......................................................................................12
4.8 Negotiation and signing of the contract.....................................................................................12
4.9 Implementation of the projects..................................................................................................12
4.10 Review and Documentation.....................................................................................................12

REPORT 4
1. Introduction
CONCEPT OF RISK
In Latin language, as stated by Luhmann in 1993, the word risk has been derived from the
word “riscum”, which means the challenges faced by the sailors on desert (Nichita, 2015). In
Arabian language, as stated by Althaus in 2005, the word is derived from the word “risq”,
which means everything that God gave you, in order to take advantages (Nichita, 2015). Thus
from the above definitions it can be concluded that risk is a situation where exists some
possibility of danger. The concept of risk is all pervasive and can be assigned to any activity
with unknown consequences. Risk can be measured at individual, business and financial
levels (Jeynes, 2012). An organisation operates within a framework of different kinds of risks
characterised at macro, mezzo and micro levels. At macro levels, there are risk of
geographical crises, collapsing of financial markets, natural disasters, economic downturns
and many more. At mezzo level, there can be shift in the market supplies, changes in
consumer tastes and preferences, or introduction of the scarcity or complementary goods. At
micro level, risk pertains to events like labour safety, changes in policies or regulations by the
government, failure or impairment of equipment and may more. The report gives an insight
of various types of risk, the procedure for risk management and the role of risk management
in procurement management.
2. Risks and Businesses
CONCEPT OF RISK IN BUSINESS
Business risk can be broadly classified into two types, depending upon the environment of an
organisation. These are endogenous risk and exogenous risk (Tho, 2012). Endogenous risk
refers to the risk generated from the shocks that are part of the business system. Exogenous
risk is in contrast with that. Exogenous risk refers to risk arising out of shocks that arrive

REPORT 5
from outside the system. While the endogenous risks are controllable to certain extent for the
management, exogenous risks are easy to anticipate by evaluation of different industrial
factors. A business entity operating internationally is typically exposed to various types of
risk. These can be listed as country risk, political, operational, technological, environmental
and strategic risks. These are described in the following segment.
2.1 Country Risk: It refers to the risk associated with investing in the business in a foreign
country (Toksoz, 2014). The risk is a collection of political risk, exchange rate risk, economic
risk, sovereign risk, transfer risk and payment risk. Country risk a critical concept in today’s
global economy as the entities are functioning across the borders. As a result, various changes
in the country of operation of an entity can lend bundle of shockwaves to the business.
2.2 Political Risk: Political risk refers to the potential negative impacts of political actions
on the firm’s functioning and the value (Sottilotta, 2016). Political actions have a direct
impact on the business income and eventually the sentiments of the stakeholders. Political
actions refers to the decisions in relation to the societal organisation of an economy, i.e.
decisions in respect of formulation and enforcement of laws, industry specific regulations,
taxation system and may more.
2.3 Operational Risk: According to the Basel Committee, operational risk is defined as the
risk of loss or gain to a business unit arising out of insufficient operational elements i.e.
people, processes, systems or the external events (Tattam, 2017).
2.4 Technological Risk: Technology risk deals with the availability, reliability, safety,
confidentiality, integrity, and overall maintainability of the technological equipment and
processes and the related effects on the processes and results (Anderson and Felici, 2012).
The risk also deals with the obsolescence of the technologies possessed by the entity over
time.

REPORT 6
2.5 Environmental Risk: It refers to the potential threats to the surrounding environment
because of the business operation, eventually resulting into financial liability (Pritchard,
2014). Enterprises must operate in a manner that addresses issues of sustainability and aims
towards reduction of the potential hazards by use of chemicals, effluents and unhealthy
processes.
2.6 Strategic Risk: This refers to the potential loss arising out of the failure of the
management policies and strategies (Collins and Ruefli, 2012).
3. Risk Management
PROJECT RISK MANAGEMENT STRATEGY AND ITS DIFFERENT STAGES
Risk Management is the process by which the various risks governing an organisation are
identified, quantified and analysed, accepted and managed by either mitigating them or
controlling them (Kendrick, 2015). There are many benefits to risk management. The key
benefit from the risk management exercise is that it enhances the effectiveness and efficiency
of the operations and aids in the strategic decision making. Adequate risk analysis also avoids
expenses on account of sudden circumstances arising out of risky situations. Effective risk
management also provides credible information of the feasibility of the projects. And if the
projects are not feasible, the same should be aborted, avoided or at least modified at initial
stages itself. The different stages of risk management have been described in the following
segment.
3.1 Identification of risk: The very first stage of risk management involves the
identification of the potential threats that can affect the successful delivery of the project.
Identification of the risk is a critical activity as a whole (Hillson, 2016). It is the collection of
various activities such as defining the objectives of the projects, gathering the related
information, application of risk identification tools and techniques, documentation of the

REPORT 7
gathered data along with the process and finally assessing the effectiveness of the project in
light of the availability of the budget and the objectives of the organisation.
3.2 Quantification and analysis of risk: (METHODS FOR QUANTIFICATION AND
ANALYSIS OF RISK) It refers to the process through which the collected data is gathered in
such a way so as to produce useful information in order to respond to the risks. Risks are
quantified with the help of various statistical tools or through use of intuition. There are two
kinds of methods for the analysis of the risk. These are Qualitative methods and Quantitative
methods.
3.2.1 Qualitative methods: This analysis method is used to make the decisions with regards to
the business projects where proprietors analyse the risk according to their experience and
judgements, followed by intuition (Heldman, 2010). The method is beneficial only in the
cases, where the level of business risk is comparatively low and the requirement of the time
and resources in order to make the analysis is low. The use of these methods also becomes
relevant in the situations where the numerical data provides inadequate information for the
analysis. These methods comprise of various techniques such as use of interview results,
questionnaires, brainstorming, consultation with experts and consideration of the judgements
made by the specialists.
3.2.2 Quantitative Methods: These methods are useful in the scenarios where a specific
number or value has to be assigned to the level of the risk such as high, medium or low and is
relevant especially where the level of risk is high. In order to assess the level of risk
quantitatively various techniques have been prescribed, for example Monte Carlo Simulation
method, Network analysis, Cost Volume Profit analysis, Ratio analysis, Investment Appraisal
methods and many more (Ostrom and Wilhelmsen, 2012). The Monte Carlo Method
represents the real situations through use of mathematical tool of probability and by assigning

REPORT 8
random values to the variables of the model in different scenarios such that different results
are obtained (Thomopoulos, 2012). The method is repeated over a sufficient number of times
such that the sample of the result is sufficient enough to represent the real situations. The
results obtained are further analysed with the help of various statistical tools such as
calculation of mean, standard deviation, minimum and maximum values and variances, so as
to determine the level of risk. The network analysis makes use of the techniques of PERT
and CPM, so as to analyse the gestation period i.e. the period of commencement of the
project and the time from which the benefits will be yielded, accordingly risks are assessed.
In cost volume profit analysis is done to determine the operating attributes of the project. This
method deals with the assessment of the breakeven point i.e. the least risky point or the no
profit- no loss level in the project, such point is later on expressed as the percentage terms for
the project. In ratio analysis, as the name suggests, various ratios are computed and compared
with that of the other available options. The project depicting the better ratios are selected.
The better the ratios, the least the risks involved. Various investment appraisal techniques
such as net present value method, payback period method, computation of internal rate of
return, profitability index method and accounting rate of returns are computed in order to
evaluate the viability of the projects for the entity.
3.3 Treatment of risk: Risk Treatment is the procedure by which measures are selected and
implemented to modify the existing risks in the businesses. The treatment of the risk may
include following actions such as avoidance, optimization, transfer or retaining of risk.
Treatment of risk involves the following activities:
3.3.1 Identification of Options: After the identification and the evaluation of the risks, the
next step is to identify the appropriate course of action to be selected for the management of
such risks, evaluation of the results obtained and implementation of the actions.

REPORT 9
Various options to treat the identified risks are
 Starting a new activity.
 Continuing an already existing activity that is yielding positive results.
 Deciding to stop or cancelling a project.
 Sharing of the risk with other parties by entering into arrangements like insurance,
partnerships and joint ventures.
 Deciding to postpone or divert the project.
 Retaining the residual risk.
The basic aim of efficient treatment of the risk is that cost of managing a risk must be in line
with the benefits obtained or expected. All the direct and indirect costs and benefits whether
tangible or intangible must be considered and should be measured in financial terms or other
terms. One option or the combination of more than one options can be considered to manage
the risk. For example a project manager can decide to continue with the projects seeing the
benefits to be reaped but he can enter into the insurance contract at the same time to mitigate
the risk to keep the overall risks at an acceptably low level. In the event of budget constraints,
a proper order of priority must be set up as to what actions must be undertaken first.
3.3.2 Action Plan Development
A plan must be devised on the lines of the decided action by the management. The plan
should be a detailed one comprising of all the necessary information about:
 Proposed actions, priority list of actions and time for the same.
 Resources required.
 Roles and responsibilities of the parties involved.
 Reporting and controlling parameters.

REPORT 10
3.3.3 Approval and Implementation of Action Plan
With regards to the risk management process, initial approval must be combined with the
throughout support of all the stakeholders specially that of the top management. The action
plan must be in line with important practices of the organisation and the related processes, so
that the risk management process becomes relevant, effective and efficient. Some of the
important business processes that need to be in line with the action plan are audit, asset and
environmental management, internal control practices, human resources and investment
management.
3.4 Identification and Acceptance of residual risk: Residual risks are defined as the risks
that exist even after the identification of the risk management options and implementation of
the action plans. Certain types of risk are unavoidable in the business situations and therefore,
such types of risk are accepted along with the cost of managing them. Residual risks may be
different for different entities and the nature of the projects, and inherent limitations of the
industry in which the business is operating. Also the cost of avoiding such risks is very high.
The level and the extent to which risks are accepted, is a critical management decision and an
important parameter in the risk management process. It is important that the top level
management of the entity and all the key managerial persons are aware about the nature and
extent of the residual risk. The management of the risk depends on the degree of the
acceptance of the residual risks or the risks that cannot be avoided by the entity. The higher
the level of the acceptance of the residual risks, the less is the requirement of managing such
risks and vice versa.
3.5 Documentation of Risk Management Process
The document of risk management must clearly and comprehensively set out the objectives
of risk management process and a statement of commitment to risk management. The content

REPORT 11
of risk management policy of an enterprise includes aim and rationale for managing risk,
linkage of the vision of the entity and the risk management policy, the nature, timing, type
and extent of the risks and opportunities encountered by the entity, details of the in house
capacities and strengths to deal with such risks and opportunities, processes undertaken to
manage the risk, persons accountable for each such processes, extent of expert judgements
and suggestions sought, nature of the residual risks and how the management is dealing with
the same, review policy for the risks and a declaration or the statement of commitment to the
policy by directors and the organization’s executive. The publishing and communicating such
a statement is essential for the stakeholders to be informed about the internal and external
environment of the enterprises and also demonstrates the commitment of the top level
management towards the risk faced by the organisation on project basis or as a whole. Also it
clearly defines the accountabilities and responsibilities at individual level.
3.6 Risk Management Responsibility
The board of directors of an entity are responsible for defining, implementing, documenting
and approving the policy for managing the various risks related to a project. It is an important
responsibility for clear definition of the risk and resources needed. Also it’s the responsibility
to provide the necessary finance and resources for Risk Management. The resources include
personnel, necessary processes, information systems, finance and other resources.
4. Risk Management and Procurement Management
RELEVANCE OF CONCEPT OF RISK MANAGAEMNT IN PROCUREMENT MANAGEMENT
In the 1990s, the concept of the purchase evolved to be called as procurement management. It
refers to the systematic process of deciding what to purchase, how to purchase and when to
purchase (Baily, et. al, 2008). The process also deals with the quality and time considerations,
cost comparison, vendor selections and negotiations (Wu and Blackhurst, 2009). The