Software Project Risk Management 1 Risk Management The

Software Project Risk Management 1

Risk Management • The future can never be predicted with 100% accuracy. • Failure to plan for risks leads to crisis management or firefighting – Cultivates as dangerous “hero” culture – A very poor management practice (why? ) • The lure of crisis management – Attention and visibility – Access to resources – Rewards 2

Objective of Risk Management • The objective is to plan and manage the project in such a way that whatever happens, whatever outcomes are achieved, the stakeholders still “win” – That is, value is still obtained • Example: Failed system development can provide value in learning early on that a system as designed is not worth pursuing which helps avoid costly commitment to a system that eventually will not be adopted/accepted/used 3

What is a Risk? • Risk is the potential of loss – Always has two components • Likelihood of loss • Size of loss – Must account for both! • Risk Exposure = Prob(Loss)* Size(Loss) – A probability of occurrence of that event. – Impact of the event occurring – a quantitative measure of risk 4

What is a Risk? - 2 • Project risk – Risk of not achieving a defined project goal (schedule, quality, cost, …) • The challenge is to manage project risk, not eliminate it (impossible!) • Note: Risks change throughout the life of a project 5

Opportunity • The flip-side of risk is opportunity – The potential for gain • Often where there is risk there is opportunity – Without risk there is usually no value – Need to accept risk as a inherent part of the development process because we seek value • Need to consider opportunity when considering risk 6

Risk Management • Risk management is the act or practice of dealing with risk. • Risk management is proactive rather than reactive. • Risk management is not a separate activity – an aspect of sound project management. – this implies that, when you make any decision, you account for its risk considerations 7

Successful Risk Management • Depends upon: – Commitment by stakeholders – Stakeholder responsibility – Planning for risk management – Creation of a risk management plan – Committing resources to risk management – Top 10 risk list • Determine a manageable number of risks 8

Resources for Risk Management • When looking at the resources to commit to risk management, one needs to consider the project size and the impacts of the risks. • Recommendation: about 5% of total project resources on risk management activities. 9

Risk Management Planning • Risk management planning is a continuous and ongoing process. • Develop a plan for risk identification. • Determine the resources available for risks. – What is available beyond the ordinary? – This is a good time for out of the box thinking • Establish a methodology for accounting for risk in every decision with significant impact 10

A Simplified Risk Management Process • • • Risk identification Risk analysis/evaluation Risk planning strategies Risk monitoring and control Risk response 11

Risk Identification • Proactively identify risks! • Tools for identifying risks – Brainstorming – Nominal Group Technique • • Each member identifies their ideas Each member writes their idea on the board The group discusses each idea Each individual ranks each of the ideas The group then ranks all the ideas Each individual ranks all the ideas again Rankings are summarized 12

Risk Identification – Strength, Weakness, Opportunities, Threats (SWOT analysis) – Cause and effect diagrams – Past Projects experiences (lessons learned) 13

Possible Risks • • • Creeping user requirements Excessive schedule pressure Low quality Cost overruns Poor estimates Low customer satisfaction Long schedules Inadequate planning or managing to plan Project member shortfalls 14

Qualitative Risk Analysis • Probability and Impact – Impacts a software Project Manager is most likely to face: • Costs • Schedule • Quality – Probability is most often determined by expert opinion and historical data • Simple “red-yellow-green” or 1 -5 scale assessment 15

Quantitative Risk Analysis • Discrete probability distributions – Coin toss • Continuous probability distributions – Normal distribution or bell shaped curve • Running simulations – Using PERT/GANTT charts to study the impact. • does not identify risks; helps understand the impact • Betting analogies – “How much would you be willing to bet on a successful outcome? ” 16

Risk Response Planning • Who is going to detect when the risk occurs? • Who has the responsibility to respond and communicate? • What is the response? 17

Risk Strategies • Factors impacting the strategy – Impact of the risk – Project constraints – Tolerances • Strategy – Accept or Ignore • Provide reserves – Contingency plans • Natural disaster/backup plans/plan-B’s 18

Risk Strategies – Avoidance, eliminate the risk – Mitigate, lessen the impact of the risk • Performance impact, provide extra hardware, de-scope – Transfer the risk • Offsite backup planning • Server farms • Outside management 19

Risk Monitoring and Control • Risk monitoring – Determine who is responsible for monitoring – How are risks monitored? • Project tracking, resources, quality, etc – Communicating the status of identified risks • Reviews and Audits • Once a risk is identified as occurring – Communicate – Take action 20

Risk Response and Evaluation • Trigger the defined risk response plan – Identify the risk owner – Assign resources – Understand the impacts • PERTs, Dependencies • Communicate • Evaluate once action is taken – Is more action needed? – What additional risks are triggered? 21

Common Software Project Risks – Requirements: • Feature creep • Developer gold plating – Quality • Low quality • Squeeze on testing time – Over optimism • • • Schedules Tools Capability Re-use or acquisition Quality

Common Software Project Risks – Resources • Not enough • Weak personnel • Contractor issues – Customer • Customer developer friction • Customer acceptance 23

Group Exercise • Create a formal, documented risk management plan for your project. • Do the following: – Risk identification • Discuss at least three serious risks – Risk analysis/evaluation • Assess the risks identified (qualitatively or quantitatively) – Risk planning strategies • What can you do to manage these risks? – Risk monitoring and control • How will you manage these risks during the remainder of the project? – Risk response • What will you do if a risk becomes actual (i. e. exposed)? both for the development and the eventual operation of your system. 24