CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved CSE7315M26 Slide 1 January 7, 2006 SMU CSE 7315 / NTU SE 584-N Planning and Managing a Software Project Module 26 The Risk Management Process, In Detail

CSE7315M26 Slide # 2 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Objective of This Module To discuss the details of the risk management process

CSE7315M26 Slide # 3 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning & Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement

CSE7315M26 Slide # 4 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Assessment Goal: understand what the risks are, what they mean, and how best to manage them Method: develop a risk management plan -- documents your risks -- documents your plans for managing them -- communicates responsibilities to all affected parties The plan must be updated as new risks are identified For each risk, the likelihood and impact change over time

CSE7315M26 Slide # 5 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement 

CSE7315M26 Slide # 6 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Identification The First Step of Risk Assessment We have seen how all management activities, especially planning activities, serve to identify risks And we discussed the value of a risk identification brainstorming meeting It helps if you know what to look for Several authors have talked about risks associated with software development

CSE7315M26 Slide # 7 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm’s Top Ten Software Risks (and management techniques for mitigating them) This is Boehm’s list, based on experience with many projects in the time period Your project must define its own list But this is a good place to start looking

CSE7315M26 Slide # 8 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Possible Exam Question  Consider a particular situation (provided with the exam). What risks apply? (careful analysis shows that these three risks are of greatest concern...)  List of Boehm’s top ten risks

CSE7315M26 Slide # 9 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 1: Personnel Shortfalls Mitigation Techniques: Use top talent Use people who are well matched to the problem (i.e., they know the application, tools, etc.) Pre-schedule the key people Cross training -- so you don’t depend on heroes Team building

CSE7315M26 Slide # 10 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 2: Unrealistic Schedules and Budgets Mitigation Techniques: Good estimating techniques – Know before you commit Incremental development cycles Detailed milestones within each phase – Spot trouble early – Provide evidence of progress Software reuse – Don’t build what was built before Requirements scrubbing – Don’t build what is not required

CSE7315M26 Slide # 11 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 3: Developing the Wrong Software Functions Mitigation Techniques: Mission analysis – Understand what is supposed to happen User surveys and communication – Know what the user needs and is expecting Prototyping – Try it out - a prototype is worth a million bytes Write end-user documentation early in the project and use as requirements documents

CSE7315M26 Slide # 12 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 4: Developing the Wrong User Interface Mitigation Techniques: Prototyping Task analysis Scenario models etc,

CSE7315M26 Slide # 13 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 5: Gold Plating Mitigation Techniques: Requirements scrubbing – Don’t build what is not required Cost-benefit analysis – Determine what counts the most Design-to-cost – Development costs include debugging, error correction Design to life-cycle-cost – Life cycle costs include maintenance, debugging, etc.

CSE7315M26 Slide # 14 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 6: Continuing Stream of Requirements Changes Mitigation Techniques: Establish a high change threshold – Make it costly to make a change Information hiding – Minimize the impact of change Incremental development – Do the stable requirements first Establish bounds for requirements – Limit the scope of changes Monitor requirements stability and completion – Know the risk of proceeding

CSE7315M26 Slide # 15 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Information Hiding A programming technique whereby information is made available only where it is required This minimizes the impact of change Student Records (details known only to access program) Access Program Student Data Base Update.. Display.. Examine.. Compute..

CSE7315M26 Slide # 16 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Requirements Bounds Device Fog Requirement: “device must find target in fog of density TBD.” Bounded Requirement: “TBD will range from.02 to 1.7 densograms” When you know the range of the “TBD” requirement, you can make many software design decisions. When you know the range of the “TBD” requirement, you can make many software design decisions. Target

CSE7315M26 Slide # 17 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Requirements Stability Monitoring CDRPDR

CSE7315M26 Slide # 18 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 7: Shortfalls in Purchased Software/Hardware Mitigation Techniques: Benchmarking – Learn what is the best Inspections – Make sure it is in good shape before you buy it Reference Checking – Are they able to do the work? – Do they deliver? Compatibility Analysis – Make sure it fits with your standards, tools, documentation requirements, etc.

CSE7315M26 Slide # 19 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 8: Shortfalls in Externally-performed Tasks Mitigation Techniques: Subcontract management (a KPA for Level 2 in the SEI CMM) Reference checking Pre-award audits and capability evaluations Award fee contracts – Reward or bonus if satisfied Competitive design or prototyping Team building – Make them want you to succeed

CSE7315M26 Slide # 20 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 9: Real-time Performance Shortfalls Mitigation Techniques: Simulation Benchmarking Modeling Prototyping Instrumentation Tuning

CSE7315M26 Slide # 21 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Boehm 10: Straining the Limits of Computer Science Mitigation Techniques: Technical analysis Cost-benefit analysis Prototyping Reference Checking

CSE7315M26 Slide # 22 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Possible Exam Question  List four of Boehm’s “top ten” risks.  For each of the above, list three methods of risk mitigation  Explain each of the risks and each of the mitigation techniques

CSE7315M26 Slide # 23 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Possible Exam Question  Consider the risk mitigation technique of prototyping. Describe this technique, and list three risks that this technique helps to mitigate. For each explain how prototyping mitigates the risk.

CSE7315M26 Slide # 24 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning & Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement  

CSE7315M26 Slide # 25 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Analysis & Prioritization Which Risks are Most Important? A popular method is to compute two numbers for each risk: – How likely is it to happen (a probability from 0 to 1 or a ranking from low to high) – How much will it cost if it happens (dollars, impact) Then make a table showing risks, likelihood, cost, and weighted cost (likelihood * cost)

CSE7315M26 Slide # 26 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Analysis Table

CSE7315M26 Slide # 27 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Prioritized Risk Analysis Table

CSE7315M26 Slide # 28 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Alternative Risk Analysis Table Note that this method produced a different ordering, but the extreme cases came out in the same order.

CSE7315M26 Slide # 29 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Another Way to Show Risk Prioritization ImpactImpact HighHigh Med Med LowLow LowMediumHigh Probability of Occurrence X Subcontractor Failure Late Hardware X Memory Size X Test Equipment Delay X Requirements Change X

CSE7315M26 Slide # 30 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved WARNING These methods of risk prioritization have many risks themselves! Not all risks can be quantified in terms of dollar impact Estimates of impact and probability are highly subjective Impacts change over time -- must be revisited Risk mitigation techniques may have risks of their own

CSE7315M26 Slide # 31 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning & Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement 

CSE7315M26 Slide # 32 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Mitigation Minimizing the Impact Taking actions to reduce the likelihood or net impact of a risk We saw many such actions in reviewing Boehm’s list of risks Each potential action must be evaluated in terms of its cost vs. the potential impact

CSE7315M26 Slide # 33 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved This is the Step Where You Impact the Planning Process Manage Risks Define the Approach Generate Detailed Plans Understand the Need Execute and Monitor

CSE7315M26 Slide # 34 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Mitigation Example Risk: Project delay or failure because subcontractor will fail to deliver Weighted Cost: $50,000 Mitigation Options: Do it in-house -- Costs $100,000 extra Send staff to live with subcontractor -- $50,000 Monthly visits -- $12,000

CSE7315M26 Slide # 35 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Table After Mitigation

CSE7315M26 Slide # 36 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Showing the Effects of Risk Mitigation ImpactImpact HighHigh Med Med LowLow LowMediumHigh Probability of Occurrence X Subcontractor Failure Late Hardware X Memory Size X Test Equipment Delay X Requirements Change X X X X X X

CSE7315M26 Slide # 37 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Plan May Include Tables of Mitigation, Contingency, etc. Methods Risks Memory Size Bench mark Extra Hardware Backupetc.Proto type Subcontractor Delayed Late Test Equip. etc. Late HardwareX X X X X X

CSE7315M26 Slide # 38 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning & Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement  

CSE7315M26 Slide # 39 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Control Monitoring – Watch what is happening – Watch for signs of danger Risk Abatement – Applying contingency plans – Minimizing impact

CSE7315M26 Slide # 40 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Monitoring Methods of monitoring: Reviews - periodic status reports – Must be honest reviews, not “dog and pony shows” Measurements - data to compare actuals with plans and past performance What to monitor: All high priority risk items Consider cost of monitoring - only monitor what is worthwhile

CSE7315M26 Slide # 41 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Identify Monitoring Procedures for Each Risk Determine how to tell if it is a problem; how frequently to monitor; etc. Example: monitor projected size vs. memory limits on a monthly basis

CSE7315M26 Slide # 42 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved How Often to Monitor It depends on priority - you must plan. For example: – Critical items daily or weekly – Normal items weekly or monthly – Minor items quarterly Monitoring too often costs money and slows down the process

CSE7315M26 Slide # 43 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Watch Known Danger Points Monitor status at key milestones or progress points – Are we where we should be by now? We always have a flurry of changes prior to CDR

CSE7315M26 Slide # 44 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Don’t Monitor Too Often or in Too Much Detail Too often – De-motivates people – Costs a lot – Robs resources from productive activities Too much detail (overly precise) – Costs a lot – Does not give significant additional information – May generate a lot of misleading numbers Late by weeks is not much different from late by 3 weeks

CSE7315M26 Slide # 45 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - I Hiding the facts to save face – The purpose of monitoring is to manage properly, not to find fault with individuals – Individuals must trust that you will use the metrics properly to fix the process, not to punish the messengers – One solution is self-measurement -- have the individuals measure and monitor themselves without communicating higher except on an aggregate scale or with big problems that they cannot handle

CSE7315M26 Slide # 46 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - II Hiding the facts to save the project – Egos and jobs of technical staff vs. judgment of management vs. pocketbook of sponsor – This can get very political and very complex

CSE7315M26 Slide # 47 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - III Failure to get the data because of fear, overconfidence, or other psychological factors – Be careful of human nature – Focus on teaming, responsibility, and professional behavior

CSE7315M26 Slide # 48 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - IV Failing to get the data because of high overhead – Automate collection – Consider using a separate metrics collection/analysis staff to minimize impact on development staff but not if it destroys teamwork

CSE7315M26 Slide # 49 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - V Misinterpretation of data – Any number can be interpreted in many ways The “three ways to get it wrong” rule – Be prepared to ask lots of questions – Define standard measures and methods of graphing data to minimize unintentional misinterpretation – Educate everyone in statistics

CSE7315M26 Slide # 50 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Things to Watch Out For - VI Failure to trust past performance – Your “track record” is your most reliable indicator

CSE7315M26 Slide # 51 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Learning Process Information is Communicated Information is Received Information is Analyzed Action Each step offers many opportunities for error

CSE7315M26 Slide # 52 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Example of Misinterpretation Productivity is Low Not Enough Work Being Done Not Working Hard Enough More Overtime Perhaps the Real Problem is Too Much Overtime Already

CSE7315M26 Slide # 53 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Rate Chart Actual vs. Plan A Rate Chart shows actual vs. planned progress for some artifact being produced – Coded units – Tested units – Inspected units – Specifications – Requirements defined – Requirements tested – etc. It works for anything that has discrete, measurable units

CSE7315M26 Slide # 54 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Testing Rate Chart

CSE7315M26 Slide # 55 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Testing Rate Chart

CSE7315M26 Slide # 56 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Testing Rate Chart

CSE7315M26 Slide # 57 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Testing Rate Chart

CSE7315M26 Slide # 58 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Another Rate Chart

CSE7315M26 Slide # 59 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Management Process In Detail Risk Assessment – Risk Identification – Risk Analysis – Risk Prioritization – Risk Planning & Mitigation (contingency planning) Risk Control – Risk Monitoring – Risk Abatement  

CSE7315M26 Slide # 60 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Abatement Establish thresholds so you know when to act – Beware of the “frog in the water” problem – Historical experience is a good basis to judge when things are getting out of hand

CSE7315M26 Slide # 61 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Abatement (continued) Act promptly when necessary – Establish action plans before they are needed – Learn the plan (fire drills) -- there may be no time in an emergency Use backup plans if needed – Develop them during the planning phase – Practice them too!

CSE7315M26 Slide # 62 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Risk Abatement (continued) Let the team participate in the planning – Their cooperation is necessary for success – Their ownership of the plan will improve chances of cooperation

CSE7315M26 Slide # 63 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved The Risk Thread Should be Visible in your Plan Risk Evidence Analysis Risk Factors / Causes – There may be many Priority Mitigation Monitoring Abatement/Contingency

CSE7315M26 Slide # 64 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Summary of Module 1) Risk Assessment – Done as part of project planning – Continues throughout the project – Includes planning for risk control 2) Risk Control – Done as part of project execution – You must respond promptly when monitoring indicates a problem A risk management plan is an important part of planning

CSE7315M26 Slide # 65 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved Possible Exam Questions  Explain the difference between risk mitigation and risk abatement (risk contingency)  Explain why a risk management plan should be documented  Explain why a risk management plan should be periodically revisited  Explain why one would go to all the trouble to write a risk management plan when it tells your manager and your customer that you have a risky project

CSE7315M26 Slide # 66 January 7, 2006 CSE SW Project Management / Module 26 - Risk Management Process, In Detail Copyright © , Dennis J. Frailey, All Rights Reserved END OF MODULE 26