CSE Senior Design ICSE Senior Design I

Risk ManagementRisk Management

Instructor: Mike O’DellInstructor: Mike O’Dell

This presentations was derived from the textbook used for this class: This presentations was derived from the textbook used for this class: McConnell, Steve, McConnell, Steve, Rapid DevelopmentRapid Development, Chapter 5., Chapter 5.

6

2

Systems Design Project Are Systems Design Project Are RiskyRisky

The odds of a large project being cancelled cancelled due to risks encountered: 50%

The odds of a large project finishing on finishing on timetime are close to zero!

Pete Marwick (1988): 35% of companies studied had at least one “runaway runaway projectproject” Allstate office automation

5 year/$8M … 6+ years/$100M Westpac Banking Corporation info systems

5 year/$85M… 3years/$150M later: cancelled

6

3

Why Do Projects Fail?Why Do Projects Fail?Generally, from poor risk managementpoor risk management

Failure to identify risks Failure to actively/aggressively plan for,

attack and eliminate “project killing” risksRisk comes in different shapes and sizes

Schedule risks (short to long) Cost risks (small to large) Technology risks (probable to impossible)

6

4

Elements of Risk ManagementElements of Risk Management Managing risk consists of: identifying,

addressing and eliminating risks When does this occur?

(WORST) Crisis management/Fire fighting Crisis management/Fire fighting : addressing risk after they present a big problem

(BAD) Fix on failure Fix on failure : finding and addressing as they occur.

(OKAY) Risk Mitigation Risk Mitigation : plan ahead and allocate resources to address risk that occur, but don’t try to eliminate them before they occur

(GOOD) Prevention Prevention : part of the plan to identify and prevent risks before they become problems

(BEST) Eliminate Root Causes Eliminate Root Causes : part of the plan to identify and eliminate the factors that make specific risks possible

6

5

Elements of Risk ManagementElements of Risk ManagementEffective Risk Management is made up of:

Risk Assessment: identify, analyze, prioritize Risk Control: planning, resolution, monitoring

RISK RISK MANAGEMENTMANAGEMENT

RISK RISK CONTROLCONTROL

RISK RISK ASSESSMENTASSESSMENT

IDENTIFICATIONIDENTIFICATION

ANALYSISANALYSIS

PLANNINGPLANNING

PRIORITIZATIONPRIORITIZATION

RESOLUIONRESOLUION

MONITORINGMONITORING

6

6

Risk Assessment TasksRisk Assessment Tasks IdentificationIdentification: produces a list of risks that

have potential to disrupt your project’s schedule

AnalysisAnalysis: assesses the likelihood and impact of each identified risk, and the risk levels of possible alternatives

PrioritizationPrioritization: prioritizes the list by impact serves as the basis for risk control tasks

6

7

Risk Control TasksRisk Control TasksPlanningPlanning: produces your plan for

dealing with each risk Must ensure consistency of the risk

management plan with your overall project plan

ResolutionResolution: executing your plan to deal with the risks

MonitoringMonitoring: staying on top of your plan and re-evaluate for new risks

6 Most common schedule risks

1. Feature creep2. Gold-plating (requirements/developer)3. Shortchanged QA4. Overly optimistic schedules5. Inadequate design6. Silver-bullet syndrome7. Research-oriented development8. Weak, poorly-trained personnel9. Contractor failure10. Friction between developers & customers

8

Risk IdentificationRisk IdentificationCL

ASSI

C M

ISTA

KES

6

9

Risk IdentificationRisk Identification Use Table 5-3: Potential Schedule Risks

Schedule Creation Organization and Management Development Environment End-users Customer Contractors Requirements Product External Environment Personnel Design and Implementation Process

6

10

Risk Analysis: Exposure TableRisk Analysis: Exposure Table Analyze the (schedule) impact of each risk Create a risk exposure/impact table for each risk.

Risk Exposure = Probability of Loss X Size of Loss

Risk Probability of Loss

Size of Loss

Risk Exposur

eOverly optimistic schedule. 50% 5 wks 2.5 wks

Addition of new feature that adds capability to … 10% 20 wks 2.0 wks

Inadequate design that requires redesign of major … 15% 15 wks 2.25 wks

Board contractor delays delivery of board. 10% 4 wks 0.4 wks

Unstable code base from earlier release of product. 20% 10 wks 2.0 wks

Product requirements take longer than expected to finalize than planned. 30% 3 wks 0.9 wks

Etc.

TOTAL PROJECT OVERRUN X wks Y wks

6

11

Risk AnalysisRisk AnalysisEstimating Size of Loss

Impact to schedule IF risk is encountered in its expected formexpected form

Can be precise based on known dateknown date for re-review(s), etc.

May need to break down tasksbreak down tasks to lowest known levelEstimating Probability of Loss

SubjectiveSubjective assessment of probability that a given risk will cause the stated impact

Many different practicesdifferent practices can be used:ExperienceDelphi or group consensusBetting analogies (How much would you bet that…?)Adjective calibration (“Good probability” = x%, “Fair” = y%,

…)

6

12

Risk PrioritizationRisk Prioritization Establishes a focusfocus on your risks based on the based on the

expected impact expected impact (risk exposure) of each risk (risk exposure) of each risk Greatest potential impactGreatest potential impact must also be addressed must also be addressed

80/20 Rule80/20 Rule

RiskProbability of Loss

Size of Loss

Risk Exposur

eOverly optimistic schedule. 50% 5 wks 2.5 wks

Inadequate design that requires redesign of major … 15% 15 wks 2.25 wks

Addition of new feature that adds capability to … 10% 20 wks 2.0 wks

Unstable code base from earlier release of product. 20% 10 wks 2.0 wks

Product requirements take longer than expected to finalize than planned. 30% 3 wks 0.9 wks

Board contractor delays delivery of board. 10% 4 wks 0.4 wks

Etc.

TOTAL PROJECT OVERRUN X wks Y wks

1.3+

5

.65

wks

6

13

Risk-Management PlanningRisk-Management PlanningDevelop a specific, detailed planspecific, detailed plan for for

resolutionresolution of each high-priority risk identified What must be done When it must be done How it will be done Who will do it When/how it will be monitored/reassessed

6

14

Risk ResolutionRisk Resolution Risks can be resolved by:

AvoidanceAvoidance: don’t do the risky activity TransferenceTransference: move it to another place (team, organization,

contractor, etc.) where it’s not as likely Buying informationBuying information: early prototyping, consulting, … Root cause eliminationRoot cause elimination: get at what causes the risk, and

make it go away Acceptance/assumptionAcceptance/assumption: don’t worry about it, but plan to

accept the consequences PublicizingPublicizing: let stakeholders know (so they implicitly accept

the risk), avoid surprises ControllingControlling: develop contingency plans, allocate additional

resources if that will help, … Recording/rememberingRecording/remembering: write down what you know so you : write down what you know so you

can use it in the future (e.g., next project, later in this one)can use it in the future (e.g., next project, later in this one)

6

15

Risk MonitoringRisk MonitoringRisks and potential impact will changewill change

throughout the course of a projectKeep an evolving “TOP 10 RISKS” list“TOP 10 RISKS” list

See Table 5-7 for an example Review the list frequently Refine… Refine… Refine…Refine… Refine… Refine…

Put someone in chargePut someone in charge of monitoring risksMake it a part of your process & project part of your process & project

planplan

6

16

Elements of Risk ManagementElements of Risk ManagementEffective Risk Management is made up of:

Risk Assessment: identify, analyze, prioritize Risk Control: planning, resolution, monitoring

RISK RISK MANAGEMENTMANAGEMENT

RISK RISK CONTROLCONTROL

RISK RISK ASSESSMENTASSESSMENT

IDENTIFICATIONIDENTIFICATION

ANALYSISANALYSIS

PLANNINGPLANNING

PRIORITIZATIONPRIORITIZATION

RESOLUIONRESOLUION

MONITORINGMONITORING