Project Management for Software Engineers (Summer 2017) LECTURE 13 Project Risk Management July 21, 2017 (9:00 am – 10:40 pm PST) University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

How to manage Risk? Plan the Risk  Identify the Risks Qualify the Risk Quantify the Risk Respond to the Risk Control the Risks Source: PMBOK®, Chapter 11 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Risk Management Plan An Integrative approach (ALL objectives and their interactions): Scope, Time, Cost, Quality, Corporate, Environment, Client, etc. Internal (more manageable) & External (less manageable) It is a baseline for Risk, corresponding to all other baselines for the project objectives Examples: 1 , 2 , 3 , 4 , 5 (The RMP depicts all RM steps) Source: PMBOK®, Chapter 11 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Risk Identification Cost overrun Delay Change Order Scope Creep Internal Conflict Bad Client! Bad Environment Bad luck! Accidents! University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Qualitative Risk Analysis Develop Likelihood-Impact Matrix (PMBOK® , Chapter 11, P. 331) and Identify low- medium-high risk boundaries for the project Calculate Likelihood & Impact of each risk item (Examples: T&T, P.389-391) The risk items can be prioritized by L*I, Continuously monitor ranking of each Risk item and respond to it, if becomes more likely/affective Finding the root cause (Fishbone – p.252) University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Quantitative Risk Analysis Decision models FMEA (P. 254), Decision Trees (P.256) Tornado Diagram for sensitivity analysis (T&T, P. 392) Descriptive Statistics Monte Carlo Simulation  Other Numerical Models (Linear / non-linear programing, etc.) University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Statistical Techniques Example How confident are you in total project duration? Activities’ durations are “estimated” and could be inaccurate Critical path could be longer or shorter A non-critical path could be actually a critical path! How to quantify and manage this uncertainty? Use known statistical distributions that “fit” the schedule parameters and calculate probability of success or failure X ~ NormDist(m,s)  P(X<=X0) is easy to calculate EXAMPLE: Fig. 8-16 (p351) & Analysis (p360) Too many constraints to keep in mind. Simulation makes our job MUCH easier! Example Excel File, DUR Tab, referring P. 360 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Estimating reality by experimentation What is simulation? Problem: Flipping a coin as many times as we get 3 heads; Cost: $1 per coin-flip, reward: $8 for 3 heads Can you develop a formula to get the answer? Yes you can, but it’s a tedious and complicated process. Can it be done easier? Just walk the talk: Generate a random integer (0, 1) Excel: Int((Rand()+0.5)) Repeat until you get three 1’s (heads) If we repeat this experiment many many times, we can develop a statistical distribution for the sample size (i.e. number of flips that returns 3 heads) Example calculations in Excel (handout) Estimating reality by experimentation University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Monte-Carlo Simulation Process: If Y=f(X1,X2,X3,…) and statistical distribution of Xi’s are known as F(Xi), then: U = F(Xi)  Xi = F-1(U), where U is a probability, a random number between 0 and 1 (100%) With numerous iterations, statistical distribution of Y and its statistical characteristics can be modeled and the probability of Y<=Y0 can be estimated with a very high accuracy The more iterations, the more accurate the statistical distribution for Y For each Xi: For the entire model (Y): N=500 N=1000 N=100 N=200 Source: Queueing Methods, Randolph W. Hall (1991), P. 59 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

A Basic Example A Typical customer service: Poisson Process Trial #5 𝐹 𝑥 =1− 𝑒 −l𝑥 , SET: R[0−1]=𝐹 𝑥  𝑥= ln⁡ 𝑅 −l Assume l=4 customers / hour based on historical data How many customers will arrive in 2 hours? Trial #5 N=5 #5 N=4 #4 Trial #4 N=2 #3 Trial #3 Trial #1 N=6 #1 N=5 #2 Trial #2 Also see Example: Hall. P. 185 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Simulating PM Metrics NPV : pp 310-318 CPM/PERT Scheduling: pp 367-372 University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Response to Risk Avoid: The best thing you can do with a risk is avoid it. If you can prevent it from happening, it definitely won’t hurt your project. The easiest way to avoid this risk is to walk away from the cliff, but that may not be an option on this project. Mitigate: If you can’t avoid the risk, you can mitigate it. This means taking some sort of action that will cause it to do as little damage to your project as possible. Transfer: One effective way to deal with a risk is to pay someone else to accept it for you. The most common way to do this is to buy insurance. Accept: When you can’t avoid, mitigate, or transfer a risk, then you have to accept it. But even when you accept a risk, at least you’ve looked at the alternatives and you know what will happen if it occurs. If you can’t avoid the risk, and there’s nothing you can do to reduce its impact, then accepting it is your only choice. Source: http://opentextbc.ca/projectmanagement/chapter/chapter-16-risk-management-planning-project-management/ University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

The Risk Management System Everything that we assumed, learned, and planned about the project risks should be well documented in the “Risk Register” during planning, See P.259 for a list of items to be included in the Risk Management System This register is your “Risk Baseline” and will be used to monitor and control project progress with respect to risks The Risk Register gets updated as the project progresses, some risks are eliminated and (possibly) new risks are discovered, during Risk Control (To be discussed later) Naturally, and intuitively, for a well-managed project, the primary risks (scope, time, cost) reduce as the project progresses (Back to Project Life-Cycle, Chapter 1, P. 22) University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018

Contemporary PM, Minimizing risks & maximizing flexibility University of Southern California, IMSC/SSU CERTIFICATION PROGRAM 9/19/2018