CSE Senior Design ICSE Senior Design I

Risk ManagementRisk Management

Instructor: Mike O’DellInstructor: Mike O’Dell

This presentations was derived from the textbook used for this class: This presentations was derived from the textbook used for this class: McConnell, Steve, McConnell, Steve, Rapid DevelopmentRapid Development, Chapter 5., Chapter 5.

6

2

Systems Design Project Are Systems Design Project Are RiskyRisky

The odds of a large project being cancelled cancelled due to risks encountered: 50%

The odds of a large project finishing on finishing on timetime are close to zero!

Pete Marwick (1988): 35% of companies studied had at least one “runaway runaway projectproject” Allstate office automation

5 year/$8M … 6+ years/$100M Westpac Banking Corporation info systems

5 year/$85M… 3years/$150M later: cancelled

6

3

Why Do Projects Fail?Why Do Projects Fail?

Generally, from poor risk managementpoor risk management Failure to identify risks Failure to actively/aggressively plan for,

attack and eliminate “project killing” risksRisk comes in different shapes and

sizes Schedule risks (short to long) Cost risks (small to large) Technology risks (probable to impossible)

6

4

Case Study 5-1: What can go Case Study 5-1: What can go wrong?wrong?

What type of project is this?How difficult does it appear to be, on

the surface?What classic mistakes classic mistakes do you see along

the way?Where/when/how could the risks have

been better managed?

6

5

Elements of Risk ManagementElements of Risk ManagementManaging risk consists of: identifying,

addressing and eliminating risksWhen does this occur?

(WORST) Crisis management/Fire fighting Crisis management/Fire fighting : addressing risk after they present a big problem

(BAD) Fix on failure Fix on failure : finding and addressing as the occur.(OKAY) Risk Mitigation Risk Mitigation : plan ahead and allocate

resources to address risk that occur, but don’t try to eliminate them before they occur

(GOOD) Prevention Prevention : part of the plan to identify and prevent risks before they become problems

(BEST) Eliminate Root Causes Eliminate Root Causes : part of the plan to identify and eliminate the factors that make specific risks possible

6

6

Elements of Risk ManagementElements of Risk Management

Effective Risk Management is made up of: Risk Assessment: identify, analyze, prioritize Risk Control: planning, resolution, monitoring

RISK RISK MANAGEMENTMANAGEMENT

RISK RISK

CONTROLCONTROL

RISK RISK

ASSESSMENTASSESSMENT

IDENTIFICATIONIDENTIFICATION

ANALYSISANALYSIS

PLANNINGPLANNING

PRIORITIZATIONPRIORITIZATION

RESOLUIONRESOLUION

MONITORINGMONITORING

6

7

Risk Assessment TasksRisk Assessment Tasks

IdentificationIdentification: produces a list of risks that have potential to disrupt your project’s schedule

AnalysisAnalysis: assesses the likelihood and impact of each identified risk, and the risk levels of possible alternatives

PrioritizationPrioritization: prioritizes the list by impact serves as the basis for risk control tasks

6

8

Risk Control TasksRisk Control Tasks

PlanningPlanning: produces your plan for dealing with each risk Must ensure consistency of the risk

management plan with your overall project plan

ResolutionResolution: executing your plan to deal with the risks

MonitoringMonitoring: staying on top of your plan and re-evaluate for new risks

6 Most common schedule risks

1. Feature creep2. Gold-plating (requirements/developer)3. Shortchanged QA4. Overly optimistic schedules5. Inadequate design6. Silver-bullet syndrome7. Research-oriented development8. Weak, poorly-trained personnel9. Contractor failure10. Friction between developers & customers

9

Risk IdentificationRisk IdentificationC

LASSIC

MIS

TA

KE

S

6

10

Risk IdentificationRisk Identification Use Table 5-3: Potential Schedule Risks

Schedule Creation Organization and Management Development Environment End-users Customer Contractors Requirements Product External Environment Personnel Design and Implementation Process

6

11

Risk Analysis: Exposure TableRisk Analysis: Exposure Table Analyze the (schedule) impact of each risk Create a risk exposure/impact table for each risk.

Risk Exposure = Probability of Loss X Size of Loss

RiskProbability of Loss

Size of Loss

Risk Exposur

e

Overly optimistic schedule. 50% 5 wks 2.5 wks

Addition of new feature that adds capability to … 10% 20 wks 2.0 wks

Inadequate design that requires redesign of major … 15% 15 wks 2.25 wks

Board contractor delays delivery of board. 10% 4 wks 0.4 wks

Unstable code base from earlier release of product. 20% 10 wks 2.0 wks

Product requirements take longer than expected to finalize than planned.

30% 3 wks 0.9 wks

Etc.

TOTAL PROJECT OVERRUN X wks Y wks

6

12

Risk AnalysisRisk Analysis Estimating Size of Loss

Impact to schedule IF risk is encountered in its expected formexpected form

Can be precise based on known dateknown date for re-review(s), etc.

May need to break down tasksbreak down tasks to lowest known level Estimating Probability of Loss

SubjectiveSubjective assessment of probability that a given risk will cause the stated impact

Many different practicesdifferent practices can be used:ExperienceDelphi or group consensusBetting analogies (How much would you bet that…?)Adjective calibration (“Good probability” = x%, “Fair” = y%,

…)

6

13

Risk PrioritizationRisk Prioritization Establishes a focusfocus on your risks based on the based on the

expected impact expected impact (risk exposure) of each risk (risk exposure) of each risk Greatest potential impactGreatest potential impact must also be addressed must also be addressed

80/20 Rule80/20 Rule

RiskProbability of Loss

Size of Loss

Risk Exposur

e

Overly optimistic schedule. 50% 5 wks 2.5 wks

Inadequate design that requires redesign of major … 15% 15 wks 2.25 wks

Addition of new feature that adds capability to … 10% 20 wks 2.0 wks

Unstable code base from earlier release of product. 20% 10 wks 2.0 wks

Product requirements take longer than expected to finalize than planned. 30% 3 wks 0.9 wks

Board contractor delays delivery of board. 10% 4 wks 0.4 wks

Etc.

TOTAL PROJECT OVERRUN X wks Y wks

1.3+

5

.65

wks

6

14

Risk-Management PlanningRisk-Management Planning

Develop a specific, detailed planspecific, detailed plan for for resolutionresolution of each high-priority risk identified What must be done When it must be done How it will be done Who will do it When/how it will be monitored/reassessed

6

15

Risk ResolutionRisk Resolution Risks can be resolved by:

AvoidanceAvoidance: don’t do the risky activity TransferenceTransference: move it to another place (team, organization,

contractor, etc.) where it’s not as likely Buying informationBuying information: early prototyping, consulting, … Root cause eliminationRoot cause elimination: get at what causes the risk, and

make it go away Acceptance/assumptionAcceptance/assumption: don’t worry about it, but plan to

accept the consequences PublicizingPublicizing: let stakeholders know (so they implicitly accept

the risk), avoid surprises ControllingControlling: develop contingency plans, allocate additional

resources if that will help, … Recording/rememberingRecording/remembering: write down what you know so you : write down what you know so you

can use it in the future (e.g., next project, later in this one)can use it in the future (e.g., next project, later in this one)

6

16

Risk ResolutionRisk Resolution

Use Table 5-6: Means of Controlling the Most Common Schedule Risks Find ways to apply these common

approaches to the specific risks that you have identified.

Make them specific and relevantspecific and relevant to your project.

6

17

Risk MonitoringRisk Monitoring

Risks and potential impact will changewill change throughout the course of a project

Keep an evolving “TOP 10 RISKS” list“TOP 10 RISKS” list See Table 5-7 for an example Review the list frequently Refine… Refine… Refine…Refine… Refine… Refine…

Put someone in chargePut someone in charge of monitoring risks

Make it a part of your process & project part of your process & project planplan

6

18

Case Study 5-2: Risk Management Case Study 5-2: Risk Management Done RightDone Right

Why/how did this project start off on the right foot?

Describe the risk management plan: How were the top risks identified?

What were they?

How were these risks addressed? How were risks monitored?

What was the end result?

6

19

Risk Management Team ExerciseRisk Management Team Exercise

Identify your team’s top 2 risksClearly state the risk in precise,

relevant terms… specific to your project and your team.

Agree on risk impact and probabilityDetermine plan of to manage these

risks