COMP 3001 Technology Management Professional Issues Project Management

COMP 3001 Technology Management & Professional Issues: Project Management Risk Management Lecture 9 Graham Collins, UCL graham. collins@ucl. ac. uk

Risks mentioned q q q q q Lack of appropriate communication to client Lack of ‘buy-in’ Delivering the project, on time on budget to the required performance can still result in the project being considered a failure Scope creep, the project may be delayed and over budget Lack of understanding of the requirements, how the work fits into the wider picture (WBS) or how this links into the process (the series of linked development stages) or life-cycle, the main phases of the project Lack of understanding of progress Lack of understanding of capability, the individual, team or the organisation Sometimes it is useful to categorise risks using a framework mentioned PESTEL, otherwise categories of risks may be ignored As with metrics, it is useful to keep data and discuss in a review session.

Discounting future performance measures q Poor communication q Lack of technical understanding q Intrinsic uncertainty q Different interpretations q Different assumptions q Multitude of variables q Problem compounded by linking to options

Plotting V as a function of D 2000 0 2 4 6 D, the real discount rate -2000 V, the value of deferral less proceed now cash flows -8 000 -10 000 proceed now is the preferred choice deferral is the preferred choice Uncertainty about cash flows can be examined using sensitivity analysis on a few key variables Based on Chris Chapman & Stephen Ward, Managing Project Risk and Uncertainty: A Constructively Simple Approach to Decision Making, John Wiley 2002.

M_o_R Strategic framework for the Management of Risk Define a framework Identify the risks Embed and review Identify probable risk owners Gain assurances about effectiveness Evaluate the risks Implement responses Set acceptable levels of risk tolerance Identify suitable responses to risk Based on: Management of Risk: Guidance for Practitioners, OGC, HMSO, 2002 originally adapted from the HM Treasury Orange Book

Definitions from M_o_R Risk - uncertainty of outcome (whether a positive or negative threat). It is the combination of the chance of an event and its consequences q Risk management – the task of ensuring that the organisation makes cost effective use of a risk process. Risk management requires: processes in place to monitor risks; access to reliable up to date information about risk; the right balance of control in place to deal with those risks; decision making processes supported by a framework of risk analysis and evaluation. q Risk register – a product used to maintain information on all the identified risks pertaining to a particular activity (project or programme) q Risk appetite – the amount of risk the organisation is prepared to tolerate (be exposed to) at any point in time. q

Risk Management - Stages Risk awareness 2. Risk identification 3. Risk owner identification 4. Qualitative assessment 5. Quantification of probability 6. Quantification of impact (severity) 7. Exposure rating 8. Mitigation 9. Contingency provision 10. Risk register 11. Software usage (if any) 12. Monitoring and reporting 1. Based on Albert Lester, Project Planning and Control, third edition, Butterworth-Heinemann, 2000

Risk Profile Models The project profile model www. ogc. gov. uk H Risk tolerance line Unacceptable risks M Probability L Acceptable risks L M Impact (effect) H Typically this grid incorporates, categories VL and VH on both scales

Status flags may also be used. Identified in terms of red/amber/green (or RAG status) q The use of RAG status can be useful for incorporating the status reporting from risk registers into the risk profiles q Measure of risk RAG status, reflects the level of exposure that the risk represents to the project q Action RAG status, reflects the effectiveness of the action applied to the risk. q

Risk register Project: ………………. . Key: H – High; M – Medium; L - Low Type of Risk Description of Risk Prepared by: ……………. . Probability H M Impact L Reference: ………. . . Date: ………………… Risk reduction Contingency plans Perf. Cost Time strategy Risk owner Based on A. Lester, ibid. Other categories could be added i. e. trigger, (which would be synonymous to input in a process diagram) or proximity indicating which phase the risk is likely to occur.

Solar heating exercise Please work in pairs You are the owner of a semi-detached house (your partner in the exercise owns the adjacent property) You decide to replace part of the roof with solar panels to save on your hot water heating bill. Identify the risks involved in this project, and ways in which you could manage each of these risks. I hope to display some of your ideas for the class to discuss, after 10 minutes.

Risk Management Risk Probability Impact Insufficient number of skilled OO developers H H Demo not ready for OOP conference Munich M H Then develop a management plan on wall, ie risk, actions, owner, status

Visible models Risk Insufficient number of skilled object-oriented developers; thus slow development and poor design … Actions Owner Status Proactive Hire temporary consultants Design and program in pairs Classroom education and mentoring The key concept is to keep the models such as the risk register (here it is the risk list with associated actions and status) as visible as possible, using whiteboards on the wall of the project room, and then transfer via digital camera to a Wiki web-page (project web-page).

Personal view Shared responsibility for risk i. e. the team are responsible for risk reporting (as well as joint planning, estimating, reporting progress and sharing the rewards). Where possible teams of two are not only involved in codevelopment (pair programming) but also keeping track of each others progress in a supportive manner as well as tracking risks specific to their tasks as well as the risks they have volunteered to own. (In addition effort is sometimes placed on identification of risks which are then not adequately tracked and managed. Another area that is important is that risk often cannot easily be quantified, they often have a profile, hence Monte Carlo software simulations are important for understanding and interpreting risks. )

Environment q Continuous integration q Project Wiki webs q Reverse engineering- Somatik q Caves, walls, digital technology

Risk Concept Map for Euro changeover project Planned branch opening times may be impacted Bank customer dissatisfaction R 1 R 2 Demand will be unusually high Banks could run out of cash in certain areas Replacement may be a problem Changeover is in a holiday period Risk of litigation Risk of misdispense if notes not robust On premise storage R 2 Risk number related to register Risk situation Potential widespread ATM downtime Potential for help desk call surge Impact Risk driver Assumption Based on a NCR project, Euro changeover project for automated teller machines, John Barlett, Managing Risk for Projects and Programmes, Project Manager Today, 2002

Case Study- Data Intelligence ‘Alongside monitoring the vast amounts of email…the RBS Group records and stores other types of unstructured content including digital voice calls made in its dealing rooms, for regulatory purposes. ’ q Apart from the need to guard against fraud, there is a need to ‘store information for compliance, litigation and e-discovery requirements’. q “It is about the quality of information capture – whether customer details or financial transactions – as a function of risk control and risk management, ” David Kemp RBS legal department. q From: ‘Harnessing data intelligence for future growth, (Case Study Royal Bank of Scotland Group) Information Management guide Martin Courtney, Computing 22 January 2009