Risk Management For ERP Implementation Project: Internal Risks Assessment

Importance of Risk Management in Project Management

Question:

Describe about the complete risk management strategy to support the implementation of Grunfolds?

Risk management is essential for any project Grunfolds World of Water Pumps is running their business successfully for years. Now they are expanding their business across the continents. So, they needs an integrated sales and manufacturing process, number of decision making approaches to analyze the performance of their business. Thus they are interested in implement an ERP system for their business.

ERP systems can be proven beneficial for their business but they need to implement it properly and manage the project well. As a part of their project management they will need to build and follow some risk management process along with the project management process. There are several critical risk factors behind the project and organization, an efficient risk management should uncover those risk factors and associated risks. (Frenkel, Dufey, Hommel, & Rudolf, 2005)

Project management needs lots of resources and tasks to be completed within some stipulated time frame. It is not possible to foresee the risks in a project that may come in future. Hence, it needs a parallel risk management process. Regarding project schedule, cost and other resources there may be different types of risk. Risk management is the process of identifying risks, assessing those and finally following the risk management strategies developed from the risk assessment. There may be some risks that are called ‘residual risks’ and these are harder to ignore. But a proper risk management strategy can optimize the impact of the risk on the project.

Risk management process can be reactive or proactive. In this report, it will focus on proactive risk management. In project management and risk management, a risk is represented by a calculation of probability of occurrence of the risk as an outcome of the negative consequences that may occur in the project. So, in case of quantitative risk assessment, it calculates a risk as a function of its impact (represented as loss of revenue from the outcomes of the risk, if it happens) and the probability of occurring of the risk or likelihood of the risk. Now a risk creates hazards when it occurs, but a proactive safeguarding can reduce the amount of hazard from the risk. (McNeil, Frey, & Embrechts, 2010)

For any project there is a dedicated team of professional called project management team. Other than that there are some organization, staffs of those organization etc. that are also connected to the project. A risk can come from inside of a project team, organization or from outside of the organization. In any case it may harm the project. A risk coming from within the organization is called internal risk and a risk coming from outside of the organization is called external risk. In risk assessment both should be classified and assessed.

In risk management process for some project, it should identify the internal risks of the project, prioritize those risks and do risk assessment. There may be different types of internal risks to a project. Such as financial solvency of the organization, availability of resources including staffing, equipment etc. There may be issues with personnel and their availability. For an information system related project like Grunfolds World of WaterPumps’ ERP implementation project additional internal risks may be associated with availability of IT resources like systems, applications, software, supply of electricity etc.

Project Management and Risk Management

Understanding and management of internal risks is necessary for a business because these risks are harder to find out. Generally internal project risks are stemmed from the organization, its structure, culture, policies, rules, decisions, behaviors, processes, actions etc. There may be many forms of internal risks. But in most of the cases these risks are associated to human behavior. Thus it is hard to manage. There are several hidden factors behind human behaviors and these factors controls the internal risks to some significant extent. Some of these hidden factors are, human beliefs, values, mental models etc. Predicting these factors earlier and making decisions based on those, is problematic. Thus estimation of prioritization will be also difficult. (Barber, 2005) All these risks tends to be unreliable and subjective. So, the characteristics of internal risks that makes those important to consider are,

• These risks are very common.
• Those can effect projects significantly and there are various human and hidden factors behind such risks.
• In most of the cases, the management of these internal risks are not very efficient and sometimes it leads to poor risk management.
• The maturity, culture, structure etc. of the project organization plays pivotal role behind internal risks.
• Internal risks are intangible and herder to be quantified. Using quantitative risk management process, it is harder to manage those risks easily. Describing, classifying and assessing such risks are very difficult. Sometimes organization overlook such risks without even understanding the significance of these risks.
• Some organization and project management teams considers internal risks with human factors as simple waste of time. Thus it leads to poor risk management.

In this report, there will be discussion on different risk management models, risk registers and risk assessment.

Risk assessment is the process of identifying, evaluating and estimating the levels of risks that are associated to some project. The assessment is carried out by comparing the risks and outcomes against some benchmarking and determinants for the risk levels.

In project management, risk assessment covers up the quantitative and qualitative value assessment of the risks. In project management there may be two types of risks positive risks and negative risks. Positive risks are considered as opportunities and the negative risks are considered as threats.

Risk assessment process determines the impact of risks in either quantitatively or qualitatively. In Quantitative risk assessment process it required calculation of probability of risk and the cost for the risk. Cost is the magnitude of losses from the occurrence of the risk. An acceptable risk is a risk that is tolerated because the cost of implementation of the countermeasure of the risks is beyond the expected losses from the risk or the difficulty of implementing the countermeasures for the risks is high.

As it has been already said, internal project risks come from inside of the organization. It can come from human and non-human factors related to the project.

In the context of internal risk assessment for Grunfolds World of WaterPumps, we need to consider the organization, its span, the structure, culture, staffing, business processes and the ERP implementation project.

The significant internal risks are,

The structure of the organization is spanned over multiple geographically separated locations beyond the boundaries of country and continent. Management of such an organization and implementation of an integrated ERP system across the organization connecting sales, procurement, business analytics etc. is a challenging work. The head quarter of the company is in Australia. Currently the business has expanded to China and planning to move to third world country like India. Each of the business sites has its own sales and manufacturing plants.

ERP is a centralized and integrated system that integrates the business processes and IT for an organization. Business processes can range from CRO, SCM, HR, Business analytics, Finance, Accounts and many more.

Internal Risks in Project Management

Now, in the current scenario the organization, there will be multiple business processes at each of these business sites. Integration of those will be difficult. The project management team have to identify business processes at each site, analyze those. This will be a time consuming process. Thus there are chances of schedule slippage, cost overrun etc. for extended and lengthy system analysis process. (A.M., E., F., V., & M.A., 2000)

This case study is a successful implementation of ERP (SAP) at a multi-national pharmaceutical company. The company has more than 100 thousands staffs and during 2004 (during the ERP implementation) the yearly turnover was $25 billion. There are multiple secondary sites of the business at multiple remote geographical location and there is a central site acting like the headquarter for the business. ERP was implemented at the secondary sites already, the business wanted to implement ERP at the primary site. The scope of the project was integrating business processes like manufacturing, procurement, planning, sales and distribution, engineering, finance, quality control management for the local secondary business sites. As a part of the project, their SAP implementation was supposed to roll out to their all business sites within next 5 years. There were total 18 secondary sites. The project leadership was given on the global core team, local project team and local steering committees. The project managers were chosen from the local sites and the team was available to the project for 18 months with a 100% availability rate. Around 40 to 70 people in the team were chosen locally and rest 45 people were in the core team. The core team was responsible to go to the local sites and working in the rolling out process there. This was independent of the IT organization. (Carton, Adam, & Sammon, 2008)

This case is an example of successful ERP implementation and they followed different best practices of the PMBOOK framework. The case study is an example of good project governance. This is very much needed for a multi-level and multi-site organization that is spanned globally. The structure of the project governance ensures that the ERP implementation was focused on reducing the possibilities of schedule slippage, delay, lack of direction etc. as a result the risks from these factors were also reduced significantly. In this case the structure of the organization helped in making decisions wuckly and wisely. This the possibilities of the risks were eliminated at the first place.

This case sturdy is also an example of how good project team should be. They had given importance to all local and global sites and made those sited involved in the project. (Carton, Adam, & Sammon, 2008)

This case study have been selected because, there are some similarities in the organizational structure between the company in the case study and the Grunfolds World of water pumps. Hense, in terms of building project team or project governance the Grunfolds can have lessons from this ERP implementation success case study.

Because of the organizational structure of the organization. Different business sites at different locations runs as semi autonomous business units. At each of the semi-autonomous business units, there will be different managerial, sales, HR, manufacturing processes. Also all sites does not manufacture same products, because in different geographical locations the market for the products differ, for example, in a third world country like India, the market for green water pump is not very developed yet.

Types of Internal Risks

Now, ERP will integrated all the business processes of different sites into a unified and centrally controlled business process. Thus, many of the business sites will require reengineering of their current business processes to fit into the ERP. So, reengineering of the business processes will need good change control management otherwise there are several risks like employee resistance, incompatibility with legacy systems, cost, time, lack of co-operation from management, lack of support from end users etc. (Valverde, 2012)

Also, the company is focused on value added services and products to the customers. Thus there will be differences among customers at different geographical locations. So their requirements and choices will also be different. The centralized ERP system implementation will need to consider all such cases. (Al-Shamlan & Al-Mudimigh., 2011)

The company has some unique sales and procurement process. It procures raw material from Korea, china etc. so that the costing for the raw materials are reduced. The sales is done in different countries also. Thus there is no centralized system for sales and procurement across different business sites. There are separated and legacy information systems at different business sites that deals with the sales and procurements at those locations.

Now the company wants to have a central sales and procurement management system, a centralized decision making system that will allow them to analyze sales of a product at different locations, demands of the same etc.

For that purpose, the ERP implementation will need to integrate all sales and procurement processes from different sites to a single and central systems. Now this task is significantly difficult. Because, the sales data at different legacy systems at different sites will have different formats. So, fetching those data, cleaning those and storing the same is a time consuming process. But this is necessary for implementation of decision making processes in the ERP implementation. (Leon, 2008)

Each of the business sites of Grunfolds World of water pumps have diversity in their organization structures and cultures. For example, there may be different types of organizational structures at different sites. And the cultures at different sites will be different because the workforce at different countries will belong from different background, each country will have their own culture and the people will follow that. Thus there will be diverse range of organizational structure and culture. ERP is not just an information system. It integrates business with IT. And business process consists of human factors as well. As it has been already said, behind internal risks in projects, these human factors play critical roles. (Grabski, Leech, & Lu, 2001)

There may be different kind of risks like, communication gap between the management and the workforce, lack of participation of the users, fear of losing their jobs due to the ERP implementation etc. Organizational structure can be changes in an easier way than the culture. Because culture is more related to the beliefs and behaviors of the humans.

Also there are high chances that, after enjoying years of semi-autonomous control, the management and staffs at different business sites may not be willing to changes of the business processes and control. So there may be chances of rising issues with lack of support and participation of management, employee resistance etc. (Epstein & Buhovac, 2006)

Factors Contributing to Internal Risks

Each organization have its own set of internal policies and controls to manage its business processes. Organizational culture and structure plays and important role in making and implementing these controls. So there are chances that there will be different sets of internal policies and control at different business units.

In the ERP implementation project at Grunfolds World of WaterPumps, there are risks that may rise from mismatches among the internal policies and control across the business units and implementation of the same at different units. Other than the internal rules and policies there may be many other changes on those due to governmental rules and norms in different countries. For example, there are different kind of labor rules at different country. Based on those the business units at different countries will customize their business controls. (DARPG, 2011)

There are huge chances of managerial risks in the project. Because, it will need participation of all management representatives from different business units, departments and headquarters. Now, according to the basic structure of the company. Each of the business unit manages their operation in their own way till now. On the other hand, each of the business units have sales and manufacturing units. Essentially there are different kinds of management for the same business process across the country. There are chances that there may be frictions among the opinions of the management from different business units, lack of co-operation and participation from them in the project. (Iskanius, 2009)

Another risk in communication gap between the workforce and the management, between low level management and top level management. For example, the management across the business sites may not welcome the central control through ERP from the headquarter, because they are habituated with the other way. So there may be communication gap and that can harm the project.

On the other hand, projects like ERP implementation, business process reengineering etc. creates confusion and fear about the job loss among the employees. Employees tends to resist the change. This is basic human nature. The management should handle this internal issue very carefully through proper meeting and communication with the employees. (Isaca, 2009).

A useful tool used in risk management for projects, is called a risk register. It can also be used for compliances with the risks in a project. In case of project and risk management, a risk register is similar to a ‘risk repository’. It holds information about all risks that have been identified and details about each risk. For an organization the risk register includes, each risk, its impact, probability of occurrence, mitigation method etc. (Hopkin, 2014)

The risk register for the internal risks identified in case of Grunfolds World of WaterPumps are,

Risk Event	Probability of Occurrence	Impact	Mitigation
Lack of funding	Low	Lack of funding may have severe negative impact on the project. As an outcome of this risk, the project may get delayed or even stopped.	The mitigation process for the risk is, analysis of business process requirement, project planning, and cost-benefit analysis very carefully from the beginning of the project. (Wallace & Keil, 2004)
Schedule slippage	Medium	As a result of the schedule slippage the whole project plan may breakdown. And there may be serious consequences like wastage of effort and funding, lack of resources etc. This can also delay the project or in extreme case, the project may stop.	The countermeasures for this risks can be planning and scheduling the project very carefully. There should be a proper risk assessment and risk management process. It will help to carry on the project successfully by revealing the risks before those happen.
Employee resistance	High	Employee resistance can impact a project very badly. It can delay the project, the ERP implementation may fail to capture the business requirements properly as there may be lack of participation of end users. Thus the ERP system may not be even used by the employer. As the result the business process will suffer and there will be loss of lots of revenue.	It needs proper change control management, communication with the employees etc. Employees need to be assured about the security of their job, they should get answer for all of their queries about the project. (Wallace & Keil, 2004)
Lack of communication across the business sites	High	Lack of communication may delay the project, the ERP system may not be developed properly thus there will be wastage of money and effort.	There should be proper communication plan and it should be implemented well. Communication in a project movement is very serious issue thus it should be handled very carefully.
Managerial issues	High	It may delay the project, even may stop the project.	The organization should have a strong organization structure and administration to deal in such cases.
Lack of resources	Medium	Lack of resources can delay the project, needs more cost.	Proper use of resources is needed through resource planning and usage strategy.
Mismatches in internal controls	High	It may delay the project, even may stop the project.	There should be a proper change control and risk management framework and process to deal with such cases.
Mismatches in data, information system etc.	Very High	It may delay the project.	This is a technical issue thus it needs good technical support from professional to handle the issue in the best possible way.

Thus the risk management strategy in case of Grunfolds will have the following process,

1. Analysis of risks
2. Classification of risks
3. Assessment of risks
4. Monitoring and controlling of risks
5. Application of counter measures to deal with the risks.

In this report, the risk management process have been discussed in detailed by focusing on the risk management in the ERP implementation project at Grunfolds World of WaterPumps. In the process, the internal risks factors and risks are mainly discussed. During the risk identification process, six risk factors and corresponding risks have been identified. Then a risk assessment process using risk register have been used to summarize the risks, impacts of the risks, probability of occurrence and possible mitigation policies.

Grunfolds World of WaterPumps will be beneficial if they follow the risk management process described in the report. It will help them to uncover and understand the risks associated with the ERP project and save from severe losses from the risks. (Hopkin, 2014)

References

A.M., A., E., C., F., C., V., L., & M.A., R. (2000). Analysis of external and internal risks in project early phase.

Al-Shamlan, H. M., & Al-Mudimigh., A. S. (2011). he Chang management strategies and processes for successful ERP implementation: a case study of MADAR. International Journal of Computer Science, 431-435.

Barber, R. B. (2005). Understanding internally generated risks in projects. International Journal of Project Management, 23, 584–590.

Carton, F., Adam, F., & Sammon, D. (2008). Project management: a case study of a successful ERP implementation. International Journal of Managing Managing, 106-124.

DARPG. (2011). Internal Control and Risk Management Framework: Volume 1.

Epstein, M. J., & Buhovac, A. R. (2006). The Reporting of Organizational Risks for Internal and External Decision-Making. CMA.

Frenkel, M., Dufey, G., Hommel, U., & Rudolf, M. (2005). Risk Management: Challenge and Opportunity. Springer .

Grabski, S. V., Leech, S. A., & Lu, B. (2001). Risks and Controls in the Implementation of ERP Systems. The International Journal of Digital Accounting Research, 47-68.

Hopkin, P. (2014). Fundamentals of Risk Management. Kogan Page Publishers.

Isaca. (2009). The Risk IT Practitioner Guide. Isaca.

Iskanius, P. (2009). The ERP Project Risk Assessment A case study. Proceedings of the World Congress on Engineering 2009.

Leon, A. (2008). Enterprise Resource Planning. McGraw-Hill.

McNeil, A. J., Frey, R., & Embrechts, P. (2010). Quantitative Risk Management: Concepts, Techniques, and Tools. Princeton University Press.

Valverde, R. (2012). Information Systems Reengineering for Modern Business Systems. IGI Global.

Wallace, L., & Keil, M. (2004). Software Project Risks and their effect on Outcomes. Communication of the ACM , 68-73.