CSE Senior Design I

Risk Management
Instructor: Mike ODell
This presentations was derived from the textbook used for this class: McConnell, Steve, Rapid Development, Chapter 5.

6 Systems Design Project Are Risky

The odds of a large project being cancelled due to risks encountered: 50% The odds of a large project finishing on time are close to zero! Pete Marwick (1988): 35% of companies studied had at least one runaway project
Allstate office automation
Westpac Banking Corporation info systems
5 year/$85M 3years/$150M later: cancelled
2

5 year/$8M 6+ years/$100M

6 Why Do Projects Fail?

Generally, from poor risk management
Failure to identify risks Failure to actively/aggressively plan for, attack and eliminate project killing risks

Risk comes in different shapes and sizes

Schedule risks (short to long) Cost risks (small to large) Technology risks (probable to impossible)

Case Study 5-1: What can go wrong?

What type of project is this? How difficult does it appear to be, on the surface? What classic mistakes do you see along the way? Where/when/how could the risks have been better managed?

6 Elements of Risk Management

Managing risk consists of: identifying, addressing and eliminating risks When does this occur?
(WORST) Crisis management/Fire fighting : addressing risk after they present a big problem (BAD) Fix on failure : finding and addressing as the occur. (OKAY) Risk Mitigation : plan ahead and allocate resources to address risk that occur, but dont try to eliminate them before they occur (GOOD) Prevention : part of the plan to identify and prevent risks before they become problems (BEST) Eliminate Root Causes : part of the plan to identify and eliminate the factors that make specific risks possible

6 Elements of Risk Management

Effective Risk Management is made up of:
Risk Assessment: identify, analyze, prioritize Risk Control: planning, resolution, monitoring
IDENTIFICATION

RISK

ANALYSIS PRIORITIZATION PLANNING

ASSESSMENT

RISK MANAGEMENT
RISK CONTROL

RESOLUION MONITORING 6

6 Risk Assessment Tasks

Identification: produces a list of risks that have potential to disrupt your projects schedule Analysis: assesses the likelihood and impact of each identified risk, and the risk levels of possible alternatives Prioritization: prioritizes the list by impact
serves as the basis for risk control tasks

6 Risk Control Tasks

Planning: produces your plan for dealing with each risk
Must ensure consistency of the risk management plan with your overall project plan

Resolution: executing your plan to deal with the risks Monitoring: staying on top of your plan and re-evaluate for new risks
8

6 Risk Identification
Most common schedule risks
1. 2. 3. 4. 5. 6. 7. 8. 9. 10.
CLASSIC MISTAKES

Feature creep Gold-plating (requirements/developer) Shortchanged QA Overly optimistic schedules Inadequate design Silver-bullet syndrome Research-oriented development Weak, poorly-trained personnel Contractor failure Friction between developers & customers
9

6 Risk Identification
Use Table 5-3: Potential Schedule Risks
Schedule Creation Organization and Management Development Environment End-users Customer Contractors Requirements Product External Environment Personnel Design and Implementation Process

10

6 Risk Analysis: Exposure Table

Analyze the (schedule) impact of each risk Create a risk exposure/impact table for each risk.
Risk Exposure = Probability of Loss X Size of Loss
Risk Overly optimistic schedule. Addition of new feature that adds capability to Inadequate design that requires redesign of major Board contractor delays delivery of board. Unstable code base from earlier release of product. Product requirements take longer than expected to finalize than planned. Etc. Probability of Loss 50% 10% 15% 10% 20% 30% Size of Loss 5 wks 20 wks 15 wks 4 wks 10 wks 3 wks Risk Exposure 2.5 wks 2.0 wks 2.25 wks 0.4 wks 2.0 wks 0.9 wks

TOTAL PROJECT OVERRUN

X wks

Y wks
11

6 Risk Analysis
Estimating Size of Loss
Impact to schedule IF risk is encountered in its expected form Can be precise based on known date for re-review(s), etc. May need to break down tasks to lowest known level Subjective assessment of probability that a given risk will cause the stated impact Many different practices can be used:

Estimating Probability of Loss

Experience Delphi or group consensus Betting analogies (How much would you bet that?) Adjective calibration (Good probability = x%, Fair = y%, )
12

6 Risk Prioritization
Establishes a focus on your risks based on the expected impact (risk exposure) of each risk
Greatest potential impact must also be addressed

80/20 Rule
Risk
Overly optimistic schedule. Inadequate design that requires redesign of major Addition of new feature that adds capability to Unstable code base from earlier release of product. Product requirements take longer than expected to finalize than planned. Probability of Loss 50% 15% 10% 20% 30% 10% Size of Loss 5 wks 15 wks 20 wks 10 wks 3 wks 4 wks Risk Exposure 2.5 wks 2.25 wks 2.0 wks 2.0 wks 0.9 wks 0.4 wks

1.3+

5.65 wks

Board contractor delays delivery of board. Etc. TOTAL PROJECT OVERRUN

X wks

Y wks 13

6 Risk-Management Planning
Develop a specific, detailed plan for resolution of each high-priority risk identified
What must be done When it must be done How it will be done Who will do it When/how it will be monitored/reassessed

14

6 Risk Resolution
Risks can be resolved by:
Avoidance: dont do the risky activity Transference: move it to another place (team, organization, contractor, etc.) where its not as likely Buying information: early prototyping, consulting, Root cause elimination: get at what causes the risk, and make it go away Acceptance/assumption: dont worry about it, but plan to accept the consequences Publicizing: let stakeholders know (so they implicitly accept the risk), avoid surprises Controlling: develop contingency plans, allocate additional resources if that will help, Recording/remembering: write down what you know so you can use it in the future (e.g., next project, later in this one)
15

6 Risk Resolution
Use Table 5-6: Means of Controlling the Most Common Schedule Risks
Find ways to apply these common approaches to the specific risks that you have identified. Make them specific and relevant to your project.

16

6 Risk Monitoring
Risks and potential impact will change throughout the course of a project Keep an evolving TOP 10 RISKS list
See Table 5-7 for an example Review the list frequently Refine Refine Refine

Put someone in charge of monitoring risks Make it a part of your process & project plan
17

Case Study 5-2: Risk Management Done Right

Why/how did this project start off on the right foot? Describe the risk management plan:
How were the top risks identified?
What were they?

How were these risks addressed? How were risks monitored?

What was the end result?

18

Risk Management Team Exercise

Identify your teams top 2 risks Clearly state the risk in precise, relevant terms specific to your project and your team. Agree on risk impact and probability Determine plan of to manage these risks

19