CSE Senior Design I Risk Management Instructor Mike

CSE Senior Design I Risk Management Instructor: Mike O’Dell This presentations was derived from the textbook used for this class: Mc. Connell, Steve, Rapid Development, Chapter 5.

1 Systems Design Project Are Risky Ø The odds of a large project being cancelled due to risks encountered: 50% Ø The odds of a large project finishing on time are close to zero! Ø Pete Marwick (1988): 35% of companies studied had at least one “runaway project” project § Allstate office automation ü 5 year/$8 M … 6+ years/$100 M § Westpac Banking Corporation info systems ü 5 year/$85 M… 3 years/$150 M later: cancelled 2

1 Why Do Projects Fail? Ø Generally, from poor risk management § Failure to identify risks § Failure to actively/aggressively plan for, attack and eliminate “project killing” risks Ø Risk comes in different shapes and sizes § Schedule risks (short to long) § Cost risks (small to large) § Technology risks (probable to impossible) 3

1 Case Study 5 -1: What can go wrong? Ø What type of project is this? Ø How difficult does it appear to be, on the surface? Ø What classic mistakes do you see along the way? Ø Where/when/how could the risks have been better managed? 4

1 Elements of Risk Management Ø Managing risk consists of: identifying, addressing and eliminating risks Ø When does this occur? ü (WORST) Crisis management/Fire fighting : addressing risk after they present a big problem ü (BAD) Fix on failure : finding and addressing as the occur. ü (OKAY) Risk Mitigation : plan ahead and allocate resources to address risk that occur, but don’t try to eliminate them before they occur ü (GOOD) Prevention : part of the plan to identify and prevent risks before they become problems ü (BEST) Eliminate Root Causes : part of the plan to identify and eliminate the factors that make specific risks possible 5

1 Elements of Risk Management Ø Effective Risk Management is made up of: § Risk Assessment: identify, analyze, prioritize § Risk Control: planning, resolution, monitoring IDENTIFICATION RISK ASSESSMENT RISK MANAGEMENT ANALYSIS PRIORITIZATION PLANNING RISK CONTROL RESOLUION MONITORING 6

1 Risk Assessment Tasks Ø Identification: Identification produces a list of risks that have potential to disrupt your project’s schedule Ø Analysis: Analysis assesses the likelihood and impact of each identified risk, and the risk levels of possible alternatives Ø Prioritization: Prioritization prioritizes the list by impact § serves as the basis for risk control tasks 7

1 Risk Control Tasks Ø Planning: Planning produces your plan for dealing with each risk § Must ensure consistency of the risk management plan with your overall project plan Ø Resolution: Resolution executing your plan to deal with the risks Ø Monitoring: Monitoring staying on top of your plan and re-evaluate for new risks 8

1 Risk Identification CLASSIC MISTAKES Ø Most common schedule risks 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Feature creep Gold-plating (requirements/developer) Shortchanged QA Overly optimistic schedules Inadequate design Silver-bullet syndrome Research-oriented development Weak, poorly-trained personnel Contractor failure Friction between developers & customers 9

1 Risk Identification Ø Use Table 5 -3: Potential Schedule Risks § § § Schedule Creation Organization and Management Development Environment End-users Customer Contractors Requirements Product External Environment Personnel Design and Implementation Process 10

1 Risk Analysis: Exposure Table § Analyze the (schedule) impact of each risk § Create a risk exposure/impact table for each risk. ü Risk Exposure = Probability of Loss X Size of Loss Probability of Loss Size of Loss Risk Exposure Overly optimistic schedule. 50% 5 wks 2. 5 wks Addition of new feature that adds capability to … 10% 20 wks 2. 0 wks Inadequate design that requires redesign of major … 15% 15 wks 2. 25 wks Board contractor delays delivery of board. 10% 4 wks 0. 4 wks Unstable code base from earlier release of product. 20% 10 wks 2. 0 wks Product requirements take longer than expected to finalize than planned. 30% 3 wks 0. 9 wks X wks Y wks Risk Etc. TOTAL PROJECT OVERRUN 11

1 Risk Analysis Ø Estimating Size of Loss § Impact to schedule IF risk is encountered in its expected form § Can be precise based on known date for re-review(s), etc. § May need to break down tasks to lowest known level Ø Estimating Probability of Loss § Subjective assessment of probability that a given risk will cause the stated impact § Many different practices can be used: ü Experience ü Delphi or group consensus ü Betting analogies (How much would you bet that…? ) ü Adjective calibration (“Good probability” = x%, “Fair” = y%, …) 12

1 Risk Prioritization Ø Establishes a focus on your risks based on the expected impact (risk exposure) of each risk § Greatest potential impact must also be addressed Ø 80/20 Rule Probability of Loss Size of Loss Risk Exposure Overly optimistic schedule. 50% 5 wks 2. 5 wks Inadequate design that requires redesign of major … 15% 15 wks 2. 25 wks Addition of new feature that adds capability to … 10% 20 wks 2. 0 wks Unstable code base from earlier release of product. 20% 10 wks 2. 0 wks Product requirements take longer than expected to finalize than planned. 30% 3 wks 0. 9 wks Board contractor delays delivery of board. 10% 4 wks 0. 4 wks X wks Y wks 1. 3+ 5. 65 wks Risk Etc. TOTAL PROJECT OVERRUN 13

1 Risk-Management Planning Ø Develop a specific, detailed plan for resolution of each high-priority risk identified § § § What must be done When it must be done How it will be done Who will do it When/how it will be monitored/reassessed 14

1 Risk Resolution Ø Risks can be resolved by: § Avoidance: Avoidance don’t do the risky activity § Transference: Transference move it to another place (team, organization, contractor, etc. ) where it’s not as likely § Buying information: information early prototyping, consulting, … § Root cause elimination: elimination get at what causes the risk, and make it go away § Acceptance/assumption: Acceptance/assumption don’t worry about it, but plan to accept the consequences § Publicizing: Publicizing let stakeholders know (so they implicitly accept the risk), avoid surprises § Controlling: Controlling develop contingency plans, allocate additional resources if that will help, … § Recording/remembering: write down what you know so you can use it in the future (e. g. , next project, later in this one) 15

1 Risk Resolution Ø Use Table 5 -6: Means of Controlling the Most Common Schedule Risks § Find ways to apply these common approaches to the specific risks that you have identified. § Make them specific and relevant to your project. 16

1 Risk Monitoring Ø Risks and potential impact will change throughout the course of a project Ø Keep an evolving “TOP 10 RISKS” list § See Table 5 -7 for an example § Review the list frequently § Refine… Ø Put someone in charge of monitoring risks Ø Make it a part of your process & project plan 17

1 Case Study 5 -2: Risk Management Done Right Ø Why/how did this project start off on the right foot? Ø Describe the risk management plan: § How were the top risks identified? üWhat were they? § How were these risks addressed? § How were risks monitored? Ø What was the end result? 18