Carnegie Mellon University © Robert T. Monroe Management Information Systems Software Development Lifecycles (SDLC’s), Project Planning, and Risk Management Management Information Systems Robert Monroe October 6, 2009

Carnegie Mellon University © Robert T. Monroe Management Information Systems Goals For Today By the end of today's class you should: –Be able to explain the core principles behind the waterfall, spiral, and agile SDLC's –Understand the primary advantages and disadvantages of each of the SDLC's –Be able to select an appropriate SDLC for your organization and project –Be able to effectively evaluate various IS project alternatives –Understand basic project risk management concepts and be able to apply those concepts to identify risks and develop plans for managing those risks

Carnegie Mellon University © Robert T. Monroe Management Information Systems Systems Development Lifecycle Models

Carnegie Mellon University © Robert T. Monroe Management Information Systems Quick Recap: SDLC’s Systems Development Lifecycles (SDLC’s) describe the order, tasks, deliverables, and interactions of the stages of a systems development project Most SDLC’s Share Common Stages –Planning –Analysis –Design –Development –Testing –Implementation –Maintenance

Carnegie Mellon University © Robert T. Monroe Management Information Systems SDLC Model: Waterfall Planning Analysis Design Development Testing Implementation Maintenance Traditional model Very linear Step A precedes Step B precedes Step C … Commonly used when system must (or can) be fully specified before development begins

Carnegie Mellon University © Robert T. Monroe Management Information Systems Waterfall Model Questions The textbook notes that the waterfall method has a notoriously poor record for delivering successful projects (~10% success rate!) –So why is it so frequently used? –… and why is it so difficult to use successfully? –Is it ever a good idea to use the waterfall method? If not, why? If so, when? –What does it mean to have a 10% success rate? How is that number determined? Is it reflective of reality?

Carnegie Mellon University © Robert T. Monroe Management Information Systems SDLC Model: Spiral Planning Analysis Design Development Testing Implementation Maintenance (Part I) Start Deliver Part 1 Begin Part 2 Planning Analysis Design Development Testing Implement Deliver Part 2 Begin Part 3 Maintenance (Part 2) Planning Analysis Design Development Testing Implementation …

Carnegie Mellon University © Robert T. Monroe Management Information Systems “Agile” SDLC Models Many different variations on ‘Agile’ SDLC’s –XP: eXtreme Programming –Rapid Prototyping / Rapid Application Development –‘Agile’ –… Key ideas common across agile methods –Small, frequent iterations with fast feedback loops –Embrace change –Customer-centric –Working system from very early in the project –Learn as you go, improve as you go –If something is not working, change it

Carnegie Mellon University © Robert T. Monroe Management Information Systems Agile Model Questions The textbook notes that the Agile methods seem to have a much better record for delivering successful projects (65% success rate quoted) –Do you believe the 65% number? Why or why not? –How does this compare to the 10% number given for waterfall? Is it a fair comparison? –What are the advantages of Agile methods? –What are the drawbacks of Agile methods? –What makes them difficult to use successfully? –Under what circumstances might you want to use Agile methods? When might they not be appropriate?

Carnegie Mellon University © Robert T. Monroe Management Information Systems There Are Many, Many SDLC’s Available Most work well in some situations and poorly in other situations –Choosing the correct SDLC for the correct situation is a skill developed primarily through experience Most successful SDLC’s include opportunities for measurement, feedback, and organizational learning Factors to consider when choosing an SDLC: –Culture of the organization –Size and complexity of the project –Routine vs. innovative projects –Personalities of the people involved What other factors should they consider?

Carnegie Mellon University © Robert T. Monroe Management Information Systems SDLC Selection Questions What factors should a company consider in selecting an SDLC model? Do these models differ in terms of their effectiveness and the resources involved? Which steps could be linked to risk management? - student question posted to wiki

Carnegie Mellon University © Robert T. Monroe Management Information Systems Testing Questions How do businesses make the tradeoff between time spent testing a system and trying to get it out there as soon as possible, bearing in mind the exponential increase in cost of fixing an error the later it is found? - Student question on wiki Questions: –Do the different SDLC’s that we have looked at answer this question in different ways? –Do they require fundamentally different ways of thinking about the nature of testing the system?

Carnegie Mellon University © Robert T. Monroe Management Information Systems Four Different Approaches To Staging A Rollout Question: Do all of the SDLC’s that we’ve looked at work equally well with each of these system rollout approaches?

Carnegie Mellon University © Robert T. Monroe Management Information Systems SDLC Questions Which of the SDLC stages is the most important to apply fast if a business faces a short term crisis? - student question posted to wiki Of the phases involved in SDLC, which do you think is the most important phase/phases and why do you think some companies choose to sometimes skip certain phases and what are the disadvantages of doing so? - student question posted to wiki Question: How do these SDLC models differ in their approach to skipping or going quickly through individual stages? Do any of them support outright skipping of phases?

Carnegie Mellon University © Robert T. Monroe Management Information Systems Project Planning and Selection Stage

Carnegie Mellon University © Robert T. Monroe Management Information Systems Hard Questions Where and how should my organization invest in IT? What IT initiatives should we pursue? What IT initiatives should we defer (possibly indefinitely)? How should we balance investment between infrastructure and applications?

Carnegie Mellon University © Robert T. Monroe Management Information Systems Rules Of Thumb Business strategy needs to drive technology strategy –Technology opportunities can, however inform business strategy and introduce business opportunities Define your organization’s process and criteria for evaluating IT investment alternatives Define your organizations strategy for investing in IT –Are you an IT pioneer, a fast follower, or a tech laggard? –When should your organization play each role? –Does your organization believe that “IT Doesn’t Matter” in terms of gaining competitive advantage? Act accordingly

Carnegie Mellon University © Robert T. Monroe Management Information Systems eBiz Define An IT Evaluation Process And Criteria Having a perfect process for this is less important than having a process and following it You will always have more opportunities build information systems than you will have resources (people, money, time) available to execute with ERP CRM SCM Faster Servers BI VPN Candidate Projects VPN SCM Project Approval Gates (filtering process) Implemented Projects Business Case Prorotype Detailed Planning Final Approval

Carnegie Mellon University © Robert T. Monroe Management Information Systems Typical IS Proposal Evaluation Criteria Fit with business strategy –Does this proposed project advance our business strategy? –Is it so compelling that we should change our strategy? Costs: –What will the project cost? –Have you considered all of the true costs (TOC)? –How accurate are the estimates likely to be? Benefits: –What benefits do we believe this project will give us? –Which of those benefits can we quanitify? –Are there other important benefits that are difficult to quantify? Do we believe that those will be worth the cost? –How realistic are these estimates?

Carnegie Mellon University © Robert T. Monroe Management Information Systems Typical IS Proposal Evaluation Criteria (cont.) Risks –How likely are we to successfully complete the project? –What major risks does the project face? Can we mitigate those risks? –What are the risks of not moving forward with it? Alternatives –Are there cheaper/easier alternatives to this project? Feasibility: resources and capabilities –Do we have the resources and skills that we need to complete this project? –What have learned from previous experience with similar projects? –How accurate are the cost/time/effort estimates? Do we believe them? Fit with technical architecture and strategy

Carnegie Mellon University © Robert T. Monroe Management Information Systems Suggestion: Pick The Low-Hanging Fruit Do these ones first! Then these ones… …or these onesDefer indefinitely

Carnegie Mellon University © Robert T. Monroe Management Information Systems Risk Management

Carnegie Mellon University © Robert T. Monroe Management Information Systems Some Definitions A project risk is an uncertain event or condition that, if it occurs, has a negative effect on project objectives Risk management is the process of proactive and ongoing identification, analysis, and response to risk factors. Source: [HBP09] Stephen Haag, Paige Baltzan, and Amy Phillips, Business Driven Technology 3rd Edition, McGraw-Hill Irwin, 2009, ISBN

Carnegie Mellon University © Robert T. Monroe Management Information Systems Risk Identification This is generally done early in the SDLC, and revisited at various points throughout the IS project Ask questions such as: –What could go wrong in completing the project? –What could go wrong for the business once the project goes live? –What other things could this project break? Be sure to have representatives for all of the key stakeholders involved in the identification process

Carnegie Mellon University © Robert T. Monroe Management Information Systems Risk Analysis and Response At this stage you need to figure out: –How likely is it that this risk will occur? –What would the cost be if the risk did occur? –What other risks might cascade from this event? –How can we mitigate this risk before it happens –Do contingency planning How would we respond to this risk if it does happen? How will we know when the risk has turned into a reality? Prioritize the risks based on this analysis and develop a plan to deal with them Revisit the analysis and plans regularly, or as important aspects of the project change

Carnegie Mellon University © Robert T. Monroe Management Information Systems Risk Management Matrix High Medium Low MediumHigh Likelihood of risk occuring Cost of risk occuring

Carnegie Mellon University © Robert T. Monroe Management Information Systems Exercise Consider the following proposed IS project: a large bank based in Doha is planning to move it’s system to a third party Software as a Service provider. The system it currently uses is failing frequently and the executives of the bank want to move this project forward as quickly as possible Identify and analyze five significant risks that this project either faces or introduces to the bank. Put them into the risk management matrix and identify the most important risks for the project team (and/or bank) to address.