University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Overview of Riskit*: The Method and its Techniques * Further information available from COMM80: Risk Assessment of Systems Change Unit 13

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Objectives of Session Coverage To understand the fundamental principles of Riskit, and its systems change perspective. To understand the distinction between a Method and a Technique To discern the link between the method’s framework and the generic risk framework To appreciate the range of techniques used and phases when used.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Fundamental principles of Riskit Aimed at controlling risk during systems development. All stakeholders within a project should have input. Difficult to evaluate risks quantitatively: –therefore need to cater for qualitative risk assessment. Participant communication is essential.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Method versus Technique Riskit is a method for risk analysis and management. It contains many techniques. Methods provide frameworks and procedures (or process models) to follow to help achieve some end. Techniques are small scale approaches that enable you to do some small scale task.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Riskit: Part 1 Method

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 The Riskit Method and its Life Cycle The focus in typical risk methods

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Components of Each Step Description: Entry Criteria Input: Output: Methods and tools: N.B. in the term defined earlier these are techniques Responsibility: Resources: Exit Criteria:

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Management Mandate Entry Criteria: Project planning has been initiated OR Stakeholders have changed OR Project's overall risk level has changed OR Stakeholders' risk tolerance has changed. Input: Project authorisation information: goals, resources, schedule, budget. Organisation's risk management policy and practice. Output: Risk management mandate.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Management Mandate Methods and tools: Risk management mandate template. Responsibility Project owner or Project manager. Resource: Project owner or Project manager. Exit Criteria: Risk management mandate documented and approved.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Goal Review Entry Criteria: Project planning has been initiated OR New goals or stakeholders have been identified OR A change in goals or stakeholders has been identified. Input: Project authorisation information: goals, resources, schedule, budget. Risk management mandate. Output: Goal Definitions.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Goal Review Methods and tools: Goal-Question-Metric (GQM), Stakeholder-goal priority table, goal definition template. Responsibility: Project manager. Resource: Project owner, project stakeholders, project personnel. Exit Criteria: Goals are explicitly documented and participants agree with their definition.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Identification Entry Criteria: Project planning has been initiated OR New goals or stakeholders have been identified OR A change in goals or stakeholders has been identified. OR The time interval specified in the risk management mandate has elapsed. OR A significant change in the project's situation has been detected. Input: Project authorisation information: goals, resources, schedule, budget. Risk management mandate. Risk checklists: general (e.g. from literature) or organisation specific. Lessons learned from other projects.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Identification Output: A "raw" numbered list of risks. Methods and tools: Brainstorming techniques, goal and stakeholder driven identification approaches, meeting aids, interviews. Responsibility: Project manager. Resource: Project personnel, risk management facilitator. Exit Criteria: The marginal yield of risk identification approaches zero even when identification techniques are changed, OR Time or effort allocated for risk identification runs out.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Analysis Entry Criteria: Potential new risks are identified. Input: List of risk items. Output: A prioritised list of risk scenarios. Methods and tools: Riskit analysis graph, multiple criteria decision making tools (such as Analytical Hierarchy Process), Riskit Pareto ranking technique, risk clustering.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Analysis Responsibility: Project manager. Resource: Selected project personnel, risk management facilitator. Exit Criteria: Participants agree on the priority of the most important risks.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Control Planning Entry Criteria: Important risk scenarios have been identified. Input: Partially prioritised risk scenarios. Output: Selected risk controlling actions. Risk monitoring metrics. Methods and tools: Risk element review, Riskit controlling action taxonomy.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Control Planning Responsibility: Project manager. Resource: Project personnel, risk management facilitator. Exit Criteria: All selected risk scenarios have been addressed.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Control Entry Criteria: A risk controlling action has been selected for implementation. Input: Selected risk controlling actions. Output: Implemented risk controlling action. Problems reports if problems arose in implementation Methods and tools: NA Responsibility: Project manager. Resource: Project personnel, external resources as needed. Exit Criteria: Selected actions have been implemented

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Monitoring Entry Criteria: Project has started. The process may be enacted on predefined frequencies. Input: Definitions for risk monitoring metrics. Risk management mandate. Goal definitions. Riskit analysis graphs. Output Status reports. Methods and tools Organisation measurement program or database. Responsibility Project manager. Resource Project personnel. Exit Criteria Project has been concluded or terminated.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Riskit: Part 2 Techniques

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Techniques in Riskit

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Summary of Techniques

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Goal and stakeholder driven identification A simple technique to rank the identified goals within each stakeholder. N.B. Comparison cannot be made across rows (or goals) Different stakeholders may be of different priority/importance in the project.

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk Analysis Graph (example from the Riskit Manual)

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk scenario ranking: Using Pareto-efficient sets

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Risk element review

University of Sunderland COMM80 Risk Assessment of Systems ChangeUnit 13 Riskit controlling action taxonomy.