1. Project Management for Software Engineers (Summer 2017)
LECTURE 13
Project Risk Management
July 21, 2017
(9:00 am – 10:40 pm PST)
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

2. How to manage Risk? Plan the Risk  Identify the Risks
Qualify the Risk
Quantify the Risk
Respond to the Risk
Control the Risks
Source: PMBOK®, Chapter 11
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

3. Risk Management Plan
An Integrative approach (ALL objectives and their interactions): Scope, Time, Cost, Quality, Corporate, Environment, Client, etc.
Internal (more manageable) & External (less manageable)
It is a baseline for Risk, corresponding to all other baselines for the project objectives
Examples: 1 , 2 , 3 , 4 , 5 (The RMP depicts all RM steps)
Source: PMBOK®, Chapter 11
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

4. Risk Identification Cost overrun Delay Change Order Scope Creep
Internal Conflict
Bad Client!
Bad Environment
Bad luck!
Accidents!
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

5. Qualitative Risk Analysis
Develop Likelihood-Impact Matrix (PMBOK® , Chapter 11, P. 331) and Identify low- medium-high risk boundaries for the project
Calculate Likelihood & Impact of each risk item (Examples: T&T, P )
The risk items can be prioritized by L*I, Continuously monitor ranking of each Risk item and respond to it, if becomes more likely/affective
Finding the root cause (Fishbone – p.252)
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

6. Quantitative Risk Analysis
Decision models
FMEA (P. 254), Decision Trees (P.256)
Tornado Diagram for sensitivity analysis (T&T, P. 392)
Descriptive Statistics
Monte Carlo Simulation 
Other Numerical Models (Linear / non-linear programing, etc.)
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

7. Statistical Techniques Example
How confident are you in total project duration?
Activities’ durations are “estimated” and could be inaccurate
Critical path could be longer or shorter
A non-critical path could be actually a critical path!
How to quantify and manage this uncertainty?
Use known statistical distributions that “fit” the schedule parameters and calculate probability of success or failure
X ~ NormDist(m,s)  P(X<=X0) is easy to calculate
EXAMPLE: Fig (p351) & Analysis (p360)
Too many constraints to keep in mind. Simulation makes our job MUCH easier!
Example Excel File, DUR Tab, referring P. 360
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

8. Estimating reality by experimentation
What is simulation?
Problem: Flipping a coin as many times as we get 3 heads; Cost: $1 per coin-flip, reward: $8 for 3 heads
Can you develop a formula to get the answer?
Yes you can, but it’s a tedious and complicated process.
Can it be done easier? Just walk the talk:
Generate a random integer (0, 1) Excel: Int((Rand()+0.5))
Repeat until you get three 1’s (heads)
If we repeat this experiment many many times, we can develop a statistical distribution for the sample size (i.e. number of flips that returns 3 heads)
Example calculations in Excel (handout)
Estimating reality by experimentation
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

9. Monte-Carlo Simulation
Process: If Y=f(X1,X2,X3,…) and statistical distribution of Xi’s are known as F(Xi), then:
U = F(Xi)  Xi = F-1(U), where U is a probability, a random number between 0 and 1 (100%)
With numerous iterations, statistical distribution of Y and its statistical characteristics can be modeled and the probability of Y<=Y0 can be estimated with a very high accuracy
The more iterations, the more accurate the statistical distribution for Y
For each Xi:
For the entire model (Y):
N=500
N=1000
N=100
N=200
Source: Queueing Methods, Randolph W. Hall (1991), P. 59
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

10. A Basic Example A Typical customer service: Poisson Process Trial #5
𝐹 𝑥 =1− 𝑒 −l𝑥 , SET: R[0−1]=𝐹 𝑥  𝑥= ln⁡ 𝑅 −l
Assume l=4 customers / hour based on historical data
How many customers will arrive in 2 hours?
Trial #5
N=5 #5
N=4 #4
Trial #4
N=2 #3
Trial #3
Trial #1
N=6 #1
N=5 #2
Trial #2
Also see Example: Hall. P. 185
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

11. Simulating PM Metrics NPV : pp 310-318 CPM/PERT Scheduling: pp 367-372
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

12. Response to Risk
Avoid: The best thing you can do with a risk is avoid it. If you can prevent it from happening, it definitely won’t hurt your project. The easiest way to avoid this risk is to walk away from the cliff, but that may not be an option on this project.
Mitigate: If you can’t avoid the risk, you can mitigate it. This means taking some sort of action that will cause it to do as little damage to your project as possible.
Transfer: One effective way to deal with a risk is to pay someone else to accept it for you. The most common way to do this is to buy insurance.
Accept: When you can’t avoid, mitigate, or transfer a risk, then you have to accept it. But even when you accept a risk, at least you’ve looked at the alternatives and you know what will happen if it occurs. If you can’t avoid the risk, and there’s nothing you can do to reduce its impact, then accepting it is your only choice.
Source:
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

13. The Risk Management System
Everything that we assumed, learned, and planned about the project risks should be well documented in the “Risk Register” during planning, See P.259 for a list of items to be included in the Risk Management System
This register is your “Risk Baseline” and will be used to monitor and control project progress with respect to risks
The Risk Register gets updated as the project progresses, some risks are eliminated and (possibly) new risks are discovered, during Risk Control (To be discussed later)
Naturally, and intuitively, for a well-managed project, the primary risks (scope, time, cost) reduce as the project progresses (Back to Project Life-Cycle, Chapter 1, P. 22)
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018

14. Contemporary PM, Minimizing risks & maximizing flexibility
University of Southern California, IMSC/SSU CERTIFICATION PROGRAM
9/19/2018