Risk Management Ashima Wadhwa Risk Management l l

Risk Management Ashima Wadhwa

Risk Management l l l The future can never be predicted with 100% accuracy. Failure to plan for risks leads crisis management or firefighting The lure of crisis management – – – Attention and visibility Access to resources Rewards

What is a Risk? l l Risk is a measure of the probability and consequence of not achieving a defined project goal. A probability of occurrence of that event. Impact of the event occurring Risks change though out the life of a project

Risk Categorization – Approach #1 l Project risks – – l Technical risks – – l They threaten the project plan If they become real, it is likely that the project schedule will slip and that costs will increase They threaten the quality and timeliness of the software to be produced If they become real, implementation may become difficult or impossible Business risks – – They threaten the viability of the software to be built If they become real, they jeopardize the project or the product (More on next slide) 4

Risk Categorization – Approach #1 (continued) l Sub-categories of Business risks – – – 5 Market risk – building an excellent product or system that no one really wants Strategic risk – building a product that no longer fits into the overall business strategy for the company Sales risk – building a product that the sales force doesn't understand how to sell Management risk – losing the support of senior management due to a change in focus or a change in people Budget risk – losing budgetary or personnel commitment

Risk Categorization – Approach #2 l Known risks – l Predictable risks – l Those risks that are extrapolated from past project experience (e. g. , past turnover) Unpredictable risks – 6 Those risks that can be uncovered after careful evaluation of the project plan, the business and technical environment in which the project is being developed, and other reliable information sources (e. g. , unrealistic delivery date) Those risks that can and do occur, but are extremely difficult to identify in advance

Risk Management l l l Risk management is the act or practice of dealing with risk. Risk management is proactive rather than reactive. Risk management is not a separate activity but rather on aspect of sound project management.

Common Mistakes in Risk Management l l l Not understanding the benefits of Risk Management Not providing adequate time or resources for Risk Management Not identifying and assessing risk using a standardized approach

Requirements for successful risk management l l l Commitment by stakeholders Stakeholder responsibility Planning for risk management Creation of a risk management plan Committing resources to risk management Top 10 risk list – Determine a manageable number of risks

Resources for Risk Management l l When looking at the resources to commit to risk management, one needs to consider the overall project size and the impacts of the risks. The Survival Guide recommends about 5% of the total project resources on specific risk management activities.

Risk Management Planning l l l Risk management planning is a on going process. Develop a plan for risk identification. Determine the resources available for risks. – – What is available beyond the ordinary? This is a good time for out of the box thinking

Simplified Risk Management Process l l l Risk identification Risk analysis/evaluation Risk planning strategies Risk monitoring and control Risk response

Risk Identification l The need to proactively identify risks. – l When an event happens it is too late to plan. Tools for identifying risk – – Brainstorming Nominal Group Technique l l Each member identifies their ideas Each member writes an idea on the board until all ideas are listed

Risk Identification l l l – The group discusses each idea Each individual ranks each of the ideas The group then ranks all the ideas Each individual ranks all the ideas again Rankings are summarized Delphi technique l l l Experts asked individually to provide input Input summarized and distributed Experts rank input

Risk Identification – – – Strength, Weakness, Opportunities, Threats Cause and effect diagrams Past Projects

Possible Risks l l l l Creeping user requirements Excessive schedule pressure Low quality Cost overruns Poor estimates Low customer satisfaction Long schedules

Risk analysis l Questions – – – l l What is causing the risk How much will it affect Are the risks dependent The probability that it will occur Is the exposure acceptable Severity probability

Qualitative Risk Analysis l Probability and Impact – Impacts a Software Project Manager is most likely to face: l l l – Costs Schedule Quality Probability is most often determined by expert opinion and historical data

Qualitative Analysis l l Cause and Effect Diagrams Risk Impact Tables

Quantitative Risk Analysis l Discrete probability distributions – l Continuous probability distributions – l Coin toss Normal distribution or bell shaped curve Running simulations – Using PERT to study the impact. l PERT does identify risks it only helps understand the impact

Risk Response Planning l l l Who is going to detect when the risk occurs? Who has the responsibility to respond and communicate? What is the response?

Risk Strategies l Factors impacting the strategy – – – l Impact of the risk Project constraints Tolerances Strategy – Accept or Ignore l – Provide reserves Contingency plans l Natural disaster/backup plans

Risk Strategies – – Avoidance, eliminate the risk Mitigate, lessen the impact of the risk l – Performance impact, provide extra hardware Transfer the risk l l l Offsite backup planning Server farms Outside management

Risk Monitoring and Control l Risk monitoring – – Determine who is responsible for monitoring How are risks monitored? l – Communicating the status of identified risks l l Project tracking, resources, quality, etc Reviews and Audits Once a risk is identified as occurring – – Communicate Take action

Risk Response and Evaluation l Trigger the defined risk response plan – – – Identify the risk owner Assign resources Understand the impacts l l l PERTs, Dependencies Communicate Evaluate once action is taken – – Is more action needed? What additional risks are triggered?

Common Software Project Risks l Discussion of common risks – Requirements: l l – Quality l l – Feature creep Developer gold plating Low quality Squeeze on testing time Over optimism l l Schedules Tools

Common Software Project Risks – Resources l l l – Not enough Weak personnel Contractor issues Customer l l Customer developer friction Customer acceptance

Thank You !!!!