Risk Management in Software Development Projects Roberto Torres Ph.D. 11/6/01

11/06/012 Consider the following: According to the Standish Group: More than 52% of IT projects overrun schedules and budgets. More than 31% are canceled. Less than 17% are on time and on budget. Other studies show failure rates for large scale SW projects as high as 85%.

11/06/013 Agenda Definition of risk Historical Background Risk Management Basics SEI Recommended Practices Example

11/06/014 Definition of Risk SEI uses the Webster’s definition of risk: Risk is the possibility of suffering loss

11/06/015 Historical Background The origins of risk management Insurance Futures Business adopts risk management Loss Prevention Security Consulting Services Project Management adopts risk management PMI SEI

11/06/016 Risk Management Basics The PMI defines the following Risk Management processes: Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/017 The Risk Management Process Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/018 Risk Management Planning Inputs: Project charter and WBS Risk management processes Stakeholders risk tolerance Risk roles and responsibilities Output: Risk Management Plan Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/019 Risk Identification Inputs: Risk Management Plan Historical information Risk categories Outputs: Risks Triggers Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0110 Risk Analysis Inputs: Identified risks Outputs: Prioritized list of assessed risks including probability and impact. Probabilistic analysis for the project* (*) Not required by SEI yet. Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0111 Risk Analysis (continued) All risks are analyzed: Probability Impact Expected loss Probabilistic analysis: It uses the information above to determine the likelihood of achieving the project’s objectives. Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0112 Risk Response Planning Inputs: List of prioritized risks Probabilistic analysis of the project Outputs: Risk response plan (mitigation and contingency plans) Financial impact of risk response planning Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0113 Risk Response Planning Risk response options Avoidance Transference Mitigation Acceptance (Monitor) Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0114 Risk Monitoring and Control Inputs: Risk Response Plan Outputs: Corrective actions Updates to risk identification Updates to risk management plan Risk Management Planning Risk Identification Risk Analysis Risk Response Planning Risk Response Monitoring and Control

11/06/0115 SEI Recommended Practices The SEI Risk Management Cycle Identify Analyze Plan Track Control Communicate

11/06/0116 SEI Specific Goals SG1 Prepare for Risk Management Preparation for risk management is conducted. SG2 Identify and Analyze Risks Risks are identified and analyzed to determine their relative importance. SG3 Mitigate Risks Risks are handled and mitigated, where appropriate, to reduce adverse impacts on achieving objectives.

11/06/0117 Example - schedules

11/06/0118 Example (continued)

11/06/0119 Example (continued)