Risk Assessment: Riskit Analysis Graph COMM80: Risk Assessment of Systems Change Unit 7

Objectives of Session Coverage To gain the ability to build a Riskit Analysis Graph

Riskit Analysis Graph Perspective This technique belongs to the Riskit method Riskit was designed to manage risk during systems development. However, there is nothing in it that restricts its use to such a perspective.

Summary of Techniques

Risk Analysis Graph (example from the Riskit Manual)

Riskit Analysis Graph Components The overall risk being evaluated An event that may occur as a result of the risk happening A possible action that can be taken in response to the event happening The resultant costs to the organisation on taking a specific action Consequences can be either deterministic (known): full arrow. Or stochastic (probabilistic) : dashed arrow An outcome (can be omitted) shows the situation in a project after the risk event has occurred but before any corrective action is taken. Outcome

General Example of Riskit Analysis Graph Components Risk Factor: a high cholesterol diet Risk Event: a doctor's diagnosis of a patient’s heart problem Risk Outcome: a diagnosed heart disease exists Risk Reaction: treatment of heart problem Risk Effect: hospital stay Utility Loss: net effect of pain, loss of time, expenses felt by individuals: in this case emotional upset and disruption to normal life.

General Example of Riskit Analysis Graph Components Risk Factor: living near a fault line of earth's plates Risk Event: an earthquake Risk Outcome: some buildings/roads destroyed Risk Reaction: reconstruction of infrastructure Risk Effect: cost of reconstruction Utility Loss: net effect of pain, loss of time, expenses felt by individuals: for one individual minimal since personal losses low and covered by insurance, for another catastrophic since home destroyed and without insurance.

Software Systems Example Risk Factor: inexperience of personnel Risk Event: a system crashes Risk Outcome: system out of operation for up to 8 hours Risk Reaction: systems operational after delay, back up data restored Risk Effect: added cost Utility Loss: perceived harm experienced by stakeholders: in this case minimal since only small data entry per day and data backed up daily

Software Systems Example Risk Factor: use of new development methods Risk Event: key personnel leave Risk Outcome: personnel and competence shortage Risk Reaction: recruiting initiated, staff reassigned Risk Effect: two month delay Utility Loss: perceived harm experienced by stakeholders: in this case catastrophic since software delay results in client imposing financial penalty.

A Riskit Analysis Graph for a Systems Change Case Study (part 1) Factor Lack of IT specialist Lack of staff training Event Project costs underestimated. Outcome Project behind schedule, exceeding budgets Reaction Do nothing Allocate more resource

A Riskit Analysis Graph for a Systems Change Case Study (part 2) Effect Set Project behind schedule:10 months budget overrun by £10,000 Reaction Do nothing Allocate more resource Utility Loss Delaying other projects (significant problem) Unable to process all potential orders - lost business (catastrophic) Project behind schedule: 2 weeks budget overrun £25,000 Reduced budget available for planned projects resulting in delay to some non-critical projects (minor problem)

A student generated graph