Risk identification and analysis In this project, as in all other projects of Alpha, a preliminary analysis was performed. The analysis consisted of a three-day evaluation, with the aim of defining the actual picture of the company's infrastructure and understanding the possible interactions between the client's information system and the CRM system to be implemented. Thus, the outcomes of this analysis served as an input for the project planning. During this preliminary analysis, the activities to be performed were ordered by importance in a matrix (deriving from a cost benefit analysis), and the possible risks that may be faced during the project were identified and analysed. Therefore, the first two phases of the PRM process, risk identification and risk analysis, were proactively performed in this first PM phase (i.e., initiation). In particular, for the risk identification, the activities performed - mainly to check the feasibility - were context analysis, stakeholder analysis and risks and opportunities identification, while the main tools used were brainstorming, interviews with experts, SWOT Analysis and the 5 Whys technique. No relevant, technical-operational risks were identified however, if there were any identified in this preliminary analysis, the company would not have accepted the project. In addition to that, as a mitigating action, a clause in the contract signed by the client allows Alpha to interrupt the project if any risks related to the IT structure emerges.

Strategic risks, however, were identified (e.g., the possible issues impeding an effective user adoption), in addition to few organisational risks (i.e., the operational risks) for example, there was a risk of assigning part of the project to an inexperienced or low-skilled software engineer, which, in turn, opens the risk of not delivering the project in time. The client was considered to be reliable from a financial point of view thus, no relevant financial risks were considered. Besides the risks, an opportunity was also identified: to turn this project into a model for future clients in the automotive industry. For this reason, the project manager devoted all his effort towards obtaining a specific CRM model for this industry by the end of the project.

The main obstacle encountered in this phase was understanding what the main risks for the client were. The project manager and the assistant, who were responsible for the PRM, were very concerned about the risk of not satisfying the client because of the potential difficulties that could be faced during the CRM user adoption. Such difficulties could not only jeopardize the project but also threaten the opportunities of making the project a successful case and attracting new clients in the market.

During the risk analysis, the project team focused on analysing the consequences of the risks identified as well as the risks that could arise during the execution of the project. The tools and techniques adopted in this phase were the 5 Whys technique and a cost-benefit analysis, obtaining a qualitative evaluation of the identified risks. No risk prioritization was done in the project. The risk related to the user adoption and the eventual lack of skills of a team member were analyzed. For example, the user adoption was considered a risk with a significant negative impact for the company's strategy in case it occurred, while the lack of knowledge of one of the software engineers could incur into extra working days, which means a loss of money.

Despite all the analysis conducted, they did not create a risk register and, because of a CEO's decision, the risks were not reported in any document. Several difficulties were faced during the risk analysis, and the main ones were the possible unreliable information given by the client and the need to deal with unexpected risk. Given the activities and connected risks, the project manager approved the preliminary analysis and officially started the project. During the project lifecycle, the project manager had the responsibility of having these initially identified risks under control.

Risk treatment The definition of risk acceptance threshold was based on the consultants' feelings and knowledge, without any type of objective or quantitative analysis threshold. Firstly, risk treatment was performed in the preliminary analysis. With the aim to assure project success, every source of technical impediments related to the client infrastructure was accurately considered and, if detected, the project would have been excluded to avoid the risks. Moreover, to transfer other potential technical risks emerging during the project, a clause in the contract allows Alpha to interrupt the project if any risk related to the IT structure, and not initially individuated, emerges. Two specific techniques were used to complete the risk treatment during the project implementation: risk mitigation and, more widely, risk transfer. Both the project manager and the assistant recognised that these actions should be planned in advance nevertheless, as in most of the company's projects, they managed both the risk mitigation and the risk transfer 'live' (i.e., following a reactive approach). For example, in this project, an SMS alert system was implemented in the CRM with a particular template and a timer. While this SMS system was being built, one of the client's managers was replaced by another one, who was not satisfied with the final template nor with the timer configuration and asked for modifications. These changes imply extra working hours for Alpha's engineers therefore, Alpha transferred the risk of extra costs to the user since the specifications of the user requirements were different from what was specified in the contract. As a result, the sales manager created a change request, and the client payed for it.

Another risk that occurred in the project was related to the lack of skills of one of the software engineers. During the second day of the project, a software engineer - as a member of the project team - asked the project manager to leave the project because he was not capable of developing all of the required activities. Since this was an expected risk, the project manager had already considered another person and made a substitution in the project team however, this replacement could not be done immediately so, in the end, two working-days were lost (i.e., approximately 1,500 Euros). In this case the risk was partially mitigated but not completely avoided. A significant difficulty faced in this phase was to involve the client, given his poor availability.

Risk monitoring & control

During this phase, the main two activities carried on were change request monitoring and risk trigger monitoring. To this extent, a risk tracking tool, called 'GIRA', was developed by the software engineers of Alpha using an Agile logic. Through 'GIRA', the project team was able to keep track of any change request and the eventual problems that emerged during the project execution. This tool was also useful to support the project manager to discuss with the client and decide which treatment action to take when needed. The main difficulties faced during this phase were the lack of time, the need of dealing with non-calculated risks and the lack of information provided by the client. Once the project finished, a meeting involving all the project members was held at Alpha, during which they discussed and reported the lessons learned about how to avoid in the future the same difficulties and problems encountered in this project these results were not documented.

PRM Outcomes

According to the consultants, the use of PRM in this project had a very high impact on improving the project planning, increasing the probability of project success and increasing the client's trust. Moreover, the project manager and the assistant also affirmed that PRM has highly contributed in reducing the risk impact and improving the project's performance. Through PRM application, the main risks were avoided, and a significant strategic opportunity was identified thus, pursing this opportunity gave extra motivation for the project team. Besides that, both interviewees affirmed that PRM supported them in the decision-making process, but it was not very significant because there was no risk register, and risk evaluation was not performed in a systematic way. However, the project manager believes that, if the PRM process were more structured and the risk analysis were deeper, the project team would have more reliable information about the project that could considerably contribute in the decision-making process therefore, potential PRM outcomes are even higher than the actual outcomes.

The adoption of PRM had a low impact on improving the evaluation of the budget reserve and on the budget controlling, since there was not a quantitative risk evaluation however, both respondents believed that these outcomes could benefit from an improved application of PRM. The project manager and the assistant believed the PRM benefits obtained overcame the implementation costs (i.e., approximately 3,000 Euros) and the time spent in its analysis (i.e., 5 working days). They also believed that it should be implemented in all types of projects. They further pointed out that the strategic nature of the project gave a strong motivation for the PRM adoption. Among the main obstacles faced during the PRM implementation were: risks not clearly identified at the beginning of the project, difficult communications with the client and time constraints.

DISCUSSION

The project analyzed was successfully completed. From the analysis of the PRM, it was possible to grasp interesting evidence about how to adopt PRM in a SME. Firstly, besides all the qualitative benefits obtained from the PRM, it is important to highlight the positive cost-benefit ratio between the RM outcomes and implementation costs, which can motivate the development of RM also in this type of company. Likewise, the study of Fernando et al. (2017) confirmed that PRM is positively related to PM performance.

In more details, Alpha devoted most of its efforts (i.e., in time and depth of the analysis) in identifying and dealing with the risks of project failure during the very early initiation phase of the project, in order to accept it only if project success is likely attended. This is realised in the preliminary analysis with a proactive approach, revealing the company knowledge and awareness that risks may lead to a complete project failure. Moreover, the projects success gave the company the important opportunity of captivating clients in a new market, which was identified and pursued because of the PRM. This result reinforced the affirmation of Carvalho and Rabechini (2015), who stated that PRM can use a mapping method of the threats and opportunities to develop new models.

This preliminary analysis also disclosed a positive characteristic of Alpha: a strategic vision. According to Carvalho and Rabechini (2015), PM needs to be embedded in strategic thinking on project risks to ensure the completion of the PM activities. The entire project team was involved in the PRM, which was also a positive result since, according to Radnor and Walley (2008), the entire staff should be involved and consulted in order to increase motivation and create conditions for a sustainable implementation.

The analysis also revealed that the main difficulties faced in Alpha's PRM process were the need of managing risks on the job, the unreliable information given by the client and the attempt to involve the client in the PRM process. Among the weak points, the following were highlighted: the lack of a risk register, the unstructured risk acceptance threshold definition (based on the consultants' feelings and experiences), the unwillingness of the top management to invest more time on PRM, the uncalculated cost of risk response and the absence of a document registering the lessons learned. Therefore, many decisions were purely based on the consultants' knowledge and experiences. When analysing the outcomes of the PRM adoption, the consultants presume that an improvement in the PRM process would significantly affect the benefits obtained. In relation to the academic implications, the empirical framework developed for SMEs and tested in the pilot case allows researchers to analyse the PRM main dimensions and to determine the cost-benefit ratio connected with its adoption. After the pilot case, the questionnaire was improved: through its application it was possible to correct incomplete or unclear information and to complete the data collection requiring specific examples for every PM phase emerged. The resulting framework can give a valuable contribution to the literature since, to our best knowledge, this type of framework was not present.

Regarding the practical implications, the Alpha case gives an example of an effective and efficient RM in the preliminary phase of project initiating, assuring project success meanwhile, suggestions to improve the PRM have been highlighted, in order to improve project performance and fully benefit from the PRM adoption. Finally, this study confirmed that PRM adoption is SMEs is still at early stages, as emerged from the literature (Kim & Vonortas, 2014).

CONCLUSION

Although this is a pilot case, limited to a specific industrial sector, it provided first indications about the PRM adoption in SMEs. The strategic vision of Alpha is one of their main strengths. The company concentrates its efforts in managing the risks of project failure to ensure the success of its projects, which is the main fundamental goal to be pursued through a PRM system, followed by optimizing performance and extending a proactive approach to manage the other project risks that, if not carefully managed, often cause an increase in project costs and completion time. As it emerged in the literature review, one of the reasons for SMEs to not apply PRM is that CEOs may believe its costs are not justifiable. However, the positive cost-benefit ratio obtained in this project shows that the benefits obtained from the PRM adoption overcome the related costs.

Source: https://scielo.conicyt.cl/scielo.php?script=sci_arttext&pid=S0718-27242019000100003

Question 1 In project management it is essential to adopt proven principles. Knowing the principles also helps to be proactive in managing project risks. Discuss the risk management principles that OGC, 2009 have provided as pertinent to managing project risks. Apply what effective project risk management involves and the risk management principles that are appropriate in a project context to the case study project.

Question 2 Use the examples of project risks as provided by Mar, 2018 to determine the risks associated with the case study project. Also advise the project manager in the case study how you would have managed these identified risks.

Question 3 Risks can also be identified according to life-cycle phases of a project. In the early life-cycle phases, the total project risk is high because of lack of information. In the later phases, the financial risk is the greatest (Kloppenborg:2015). Use the lifecycle phase risk identification table and record the risks of the case study project. Thereafter, discuss in detail the merits of the information recorded in the table.

Question 4 The primary output of risk identification is the risk register. When complete, the risk register is "a document in which the results of risk analysis and risk response planning are recorded." Design a risk register for the risks identified for the case study project. Thereafter discuss the contents of the risk register in detail.