Dr. Joseph A. Morgan, D.E., P.E. jmorgan@tamu.edu 979-575-0128 ESET 419 Engineering Technology Capstone I Dr. Joseph A. Morgan, D.E., P.E. jmorgan@tamu.edu 979-575-0128

Risk RISK NLD TIME COST SCOPE RAM WBS

What Is Risk? Definition: Measure of potential inability to achieve objectives and their probable consequences within constraints RISK EVENTS: Specific, analyzable, quantifiable risk occurrences that might happen to the detriment of a project or other initiative PROBABILITY: The likelihood of risk event occurring IMPACT: Gain or loss if risk event occurs Risk is a function of two components - the probability of an undesirable event occurring (e.g.. system failure in testing), and the impact of the occurrence (e.g.. additional program costs of $20M). Often we see the terms “high”, “moderate”, and “low”. However these subjective ratings should be based on the probability and severity of the consequence of the occurrence. Later in this lesson we will take a look at various methods for assigning the classifications. RISK SOURCES: General categories or areas of possible risk events that can affect the project.

Risk Management Definition: The act or practice of dealing with risk Process used to identify, evaluate, respond and control risks throughout the life of a project or initiative. This process is iterative and proactive for the life of the project. Ask Student -”What do we mean by process?” (a system of steps) BPMP 3.0 see pages 4-28 to 4-32

Risk Management Process Identification Description Category Evaluate Probability of Occurrence Impact Develop responses Eliminate Transfer Mitigate Reduce probability of occurrence Reduce impact Accept Control Corrective action Workaround RISK MANAGEMENT MODEL Communication

Risk Identification * -- USAA RISK FORM Communication RISK MANAGEMENT MODEL Communication * -- USAA RISK FORM

(severity of consequence) Risk Evaluation 1,7,15 14 8,11 12,13 9,10 HIGH 2,3,4 5,6 PROBABILITY OF OCCURRENCE (uncertainty) We use a process much like Carrier Air-conditioning Company LOW LOW MEDIUM HIGH IMPACT (severity of consequence)

Risk Responses Eliminate Transfer Mitigate Accept Reduce impact Reduce probability Accept RISK MANAGEMENT MODEL Communication

Risk Response Strategy -Eliminate- DEFINITION: Avoidance of the risk areas or sources that could possibly lead to the risk event No risk is ever fully eliminated but it can be fully avoided EXAMPLE: Not attending a baseball game to avoid being hit by a baseball

Risk Response Strategy -Transfer- DEFINITION: Reduction of risk exposure by reallocation of risk from one part of the system to another or move risk to another group/organization EXAMPLE: In a project, hire a subcontractor to perform tasks that your company does not have the skill to perform

Risk Response Strategy -Mitigate: Reduce Likelihood- DEFINITION: Lowering frequency of risk event occurrence. Strategy may be to improve design or quality of a system EXAMPLE: Providing a redundant power supply Lower the frequency of failure. Many of the same principles in a systems engineering process apply to management systems. Identification of the failure modes is critical to reducing the likelihood of a risk event occurrence. Knowledge Management prevents people from making mistakes. Training people to a high level to perform self inspections. Developing checklists. Collecting and developing lessons learned databases.

Risk Response Strategy -Mitigate: Reduce Impact- DEFINITION: A method of controlling the risk event by planning a mitigation strategy to lower the effect should a risk event occur EXAMPLE: Having a second person trained to perform critical project tasks Example: Tree surgeons are bonded or insured to reduce the impact of a lawsuit should they botch their job and drop a tree on a house or worse a person! Example: Airlines have a second, less experienced pilot at a second set of controls to reduce the risk of the Captain getting sick. Example: Flood canals and dams in San Antonio. Not a guarantee to prevent floods but will lessen the effect should a bad on occur.

Risk Response Strategy -Accept- DEFINITION: Acknowledging a risk event and accepting the consequences without any efforts to control it EXAMPLE: Only having “one deep” team member and consciously not training a backup ( Not enough resources available) Example: Adjusting the customer expectation that a product will be delivered late or incomplete. Example: Building your house over an earthquake fault line out of traditional building materials. You know there is a risk but do nothing to mitigate. A non response.

Risk Prioritization 1 2 3 4 5 6 7 8 9 10 11 12

Corrective Action Any action that attempts to bring the project or initiative back on plan Consists of Implementing contingency plans (planned) Developing workarounds (unplanned)

Assignment Generate 10-12 project risks Complete risk cards for each risk Evaluate risks in terms of impact and probability using 3x3 matrix Prioritize risks using the risk prioritization analysis process Be prepared to present your risks processes in lab