Previous heading | Top | Next heading

Risks and assumptions

Better Practice results: Risks and assumptions – particularly at a strategic level – are accurately identified and made visible to decision-makers, allowing them to bring their experience to bear on the feasibility of the project.

Two common causes of shortfalls in projects are assumptions which turn out to be unrealistic, and reasonably foreseeable risks not being addressed during planning.²⁸ So that the business case provides a reliable basis for decision-making, it is better practice for the project sponsor to:

• provide guidance to the business case team on risks and assumptions at a strategic level (such as the policy environment, and organisational directions);
• gain assurance on the identification of risks and assumptions (see the table of review questions at the end of this sub-section);
• gain assurance that ongoing monitoring and adequate responses to identified risks and assumptions are included in the costing and activities in the business case; and
• help identify those significant risks and assumptions that should be made visible to decision-makers (including any important residual risk, as discussed at page 79).

Risks and assumptions are closely related concepts:

• Risks are uncertain events which may have an impact on the project. For example, the uncertain event may be the unexpected absence of specialist staff, and the impact if this happened would be a delay to the project.
• Assumptions are expectations about the future which, if not fulfilled, will have an impact on the project. For example, an assumption may be that the entity will have a single service provider in each region. If this changes, the impact may be the need to add additional functions to the ICT system which manages service delivery. There may also be assumptions underlying a project on issues of cause and effect. For example, an assumption that savings achieved will be similar to a project undertaken several years earlier.

Risks and assumptions can be assigned a relative importance by considering the potential impact and its likelihood. Generally, the more important risks and assumptions will be included in the body of the business case for management attention, with the details of all the identified risks and assumptions held separately, or provided as attachments.

The term assumption is sometime used to refer to parameters which affect cost and benefit analysis, such as the number of clients and discount rates. While there is no definitive answer to such variations in terminology, it is useful to have consistency of approach within an entity. Grouping types of assumptions on a like-with-like basis in the business case makes analysis easier and more reliable. For example, it would be useful to group together ‘assumptions’ which affect the design of solutions – such as number of clients to be handled, or required unit operating costs – as part of the requirements statement. Some of these requirements will also be used for cost calculations.

Identifying risks and assumptions in distinct categories will help increase confidence in the completeness of the analysis. Common categories are:

• policy environment;
• organisational direction and priorities;
• project environment – for example stakeholders, suppliers, and ICT;
• basis of cost estimation – for example, relevance of prior experience; and
• resources – technical, financial and human, including:
  • the likely availability of resources not currently on hand; and
  • the potential loss of current resources – particularly key people with uncommon knowledge and skills.

The following table provides some questions that project sponsors can use to help review²⁹ the risks and assumptions in a proposed business case.

EXECUTIVE REVIEW QUESTIONS FOR RISKS AND ASSUMPTIONS
Novelty: Which parts of the project involve activities that the entity has not successfully done before? Are there elements new in Australia, or internationally?	If part or all of the project is breaking new ground, this deserves to be made visible. The goal is not to avoid innovation, but to undertake novel approaches in a thoughtful way, and for the decision-makers to be aware of the extent of any risk involved.
Impact: Which assumptions have the greatest impact on the design of project products – such as an ICT system?	In most cases, business cases have been developed logically from their assumptions. So a common risk to project success is untested assumptions. It is useful for project sponsors to be aware of the assumptions with the greatest potential impact – so they can assess them using their own perspective on policy directions, program delivery strategy and organisational arrangements.
History: Which risks have most impacted on similar projects? Why won’t they have a similar effect on this project?	Sometimes known risks are neglected during planning. Perhaps the risk has been assumed to be covered, or there may be reluctance to discuss and deal with the risk. By fostering an environment where risks can be openly discussed and dealt with, project sponsors can increase the prospects of successful implementation.
Scrutiny: Who has independently reviewed the risks and assumptions?	Given the risk of inadvertent oversight by even the most attentive planning team, it is often useful to have an independent review – particularly of whether the business case adequately identifies and responds to risks and assumptions.
Tailoring: Have generic risks been made project specific?	Check that generic risks, like ‘staff loss’, are considered specifically to the project in their likelihood, impact, and realistic mitigation.

---

Previous: Options

Next: Operational requirements