Information Technology Information Technology Project ManagementProject Management

Managing IT Project Risk

OutlineOutline

Defining IT FailureDefining Risk and Risk ManagementRisk Management Cycle

– Risk Identification– Risk Analysis– Risk Handling– Risk Monitoring

What do we mean by failure?What do we mean by failure?Lyytinen (1988) distinguishes between “development failure”

and “use failure”A more detailed categorization of IT failure would include:

– system grossly exceeds original budget– system grossly exceeds original schedule– system never functions technically– system functions, but quality is so poor that, for all practical purposes,

system is not usable– system functions but is not used--users reject the system because it is

cumbersome to use or because they have no incentive to use it– system functions, but completely lacks originally promised

functionality or fails to fit the task it was designed to support

“RunawaySystems”

Some Observations about Some Observations about Success/FailureSuccess/Failure

TotalFailure

TotalSuccess

Stakeholder A Stakeholder B

Success/Failure is often viewed as a binary classification

Success/Failure should be viewed along a continuum

Success is in the eyes of the beholder

Why IT Projects Fail:Why IT Projects Fail:The Traditional WisdomThe Traditional Wisdom

Systems are specified and initiated by IS without sufficient input from the user(s)

Inadequate estimates of development cost and time

Lines of responsibility not clearly specifiedUser acceptance test delayed until the project is

completedInadequate system testingImplementation difficulties

Warning SignsWarning Signs(Keider, 1984)(Keider, 1984)

Inadequate status reportingIsolationLack of schedule changesOveremphasis on how a system will be builtPremature programmingStaff reassignments

Defining Risk and Risk Defining Risk and Risk ManagementManagement

A project risk is a potential problem that would be detrimental to a project’s success should it materialize

Risk management is the identification and response to potential problems with sufficient lead time to avoid a crisis

Risk Management CycleRisk Management Cycle

RiskIdentification

RiskAnalysis

RiskHandling

RiskMonitoring

Risk IdentificationRisk IdentificationBusiness risk

– Market risk– Shifts in business strategy or senior management

Technical risk– Design and development problems– Testing and maintenance problems– Technical uncertainty

Project risk– Budget– Schedule– Personnel– Requirements problems

Tools for Identifying RisksTools for Identifying Risks

Checklists (e.g., Boehm’s top ten risk list)Frameworks (e.g., McFarlan’s framework)Questionnaires (e.g., Barki, Rivard, and

Talbot survey)

Risk Factors: What the Risk Factors: What the Literature Says . . .Literature Says . . .

Technological newnessApplication sizeApplication complexityTask complexityProject team expertiseOrganizational environmentMagnitude of potential loss

Barki, Rivard, and Talbot, 1993

What Project Managers SayWhat Project Managers Say0 2 4 6 8 10 12

Lack of top management commitment tothe project

Failure to gain user commitment

Misunderstanding the requirements

Lack of adequate user involvement

Failure to manage end user expectations

Changing scope/objectives

Lack of required know ledge/skills in theproject personnel

Lack of frozen requirements

Introduction of new technology

Insufficient/inappropriate staff ing

Conflict betw een user departments

HKG

USA

FIN

Risk AnalysisRisk Analysis

For each identified risk, evaluate the probability of occurrence

For each identified risk evaluate the impact if the risk should occur

Prioritize your risk handling effort based on both probability and impact

Assigning ProbabilitiesAssigning Probabilities

Here we ask: “What is the likelihood that something will go wrong?”

Establish a scale that reflects the perceived likelihood of a risk– Probability scales are commonly used– Can be qualitative or quantitative

e.g. highly improbable, improbably, moderate, likely, highly likely

e.g. 0-100% probability

Example Scale for Evaluation Example Scale for Evaluation of Probabilityof Probability

Score Probability

0 Highly unlikely (1% or less)

1 Very unlikely (1% - 24%)

2 Unlikely (25% - 49%)

3 Likely (50% - 74%)

4 Very likely (75% -94%)

5 Highly likely (95% or more)

Assessing ImpactAssessing Impact

Here we ask: “What is the damage or impact if something does go wrong?”

Three factors can be used to assess impact– Nature of the risk (i.e. the problems that are

likely if it occurs)– Scope of the risk (i.e. how serious is the risk

and how much of the project will be affected?)– Timing of the risk (i.e. when and for how long

will the impact be felt)

Example Scale for Evaluation Example Scale for Evaluation of Impactof Impact

Score Impact

0 Ignorable

1 Unimportant

2 Less important

3 Important

4 Very important / serious

5 Catastrophic / critical

Risk Matrix ExampleRisk Matrix Example

Risk Factor Probability Impact Probability x Impact

Priority

A 2 5 10 1

B 4 2 8 3

C 3 3 9 2

Risk HandlingRisk Handling Risk prevention

– Develop options to reduce the potential of the problem occurring Risk avoidance

– Accepting a lower risk (another solution) to avoid a high risk Risk remedy

– Monitoring risk status and developing solutions to reduce effect when risk becomes a problem

Risk assumption– Decision to accept the risk should it occur

Risk reduction– Obtaining additional information that will reduce risk (e.g., prototyping,

incremental development)

Risk MonitoringRisk Monitoring

Should be done periodically – (e.g., when certain milestones are reached, at the end

of project phases, at steering committee meetings, etc.)

Useful to regularly assess and update project risk exposure

Senior management should be involved in monitoring and should be aware of exposures

Listen to the project group

Establishing Risk Referent Establishing Risk Referent LevelsLevels

Risk referent levels can be set to define regions of acceptable and unacceptable risks

Three typical risk referent levels– Cost overrun– Schedule slippage– Performance criteria

ExampleProjectedScheduleOverrun

Projected Cost Overrun

Region in whichproject terminationwill occur

Referent level for cost/schedule overruns