1. Software Project Management (SPM)
Risk Management

2. Risk Management Risk Management Planning Risks Identification
Quality & Quantity Risk Analysis
PERT
Categories, Probabilities, Impact
Response Planning
Avoid, Transfer, Mitigate
Strategies for Positive Risks Opportunities
Risk Monitoring and Control

3. Risk Identification Example of a Risk Breakdown Structure (RBS)
הדוגמא הנ"ל מציגה את הקטגוריות של סיכונים שעלולים להתרחש במהלך פרויקט מסוים.

4. Risk Breakdown Structure (RBS)
Make sure the detailed RBS will include:
Application Factors – Size, Safety-Critical, Distributed System, Etc.
Staff Factors – Experience, Skills, Level of Staff, Staff Turnover, Etc
Implementation Factors – Conversion, Phased Implementation VS Cutover.
Suppliers Factors – Reliability, Delays, Level of Integration with the Project Plan, Reporting, Etc.
New Technology Factors – H/W, Software, Tools

5. Risks Identification Tools and Techniques
Requirements and Assumptions Documentations Reviews – The Level of Quality, Consistency and Completeness of the Project Documents
Information Gathering - Brainstorming, Interviewing, SWOT analysis (Strength, Weaknesses, Opportunities and Treats)
Root Cause Identifications - different risks can emerge from the SAME root cause
Checklist Analysis - historical information, other sources of information
Assumptions Analysis - Validity of the Assumptions
Interdependencies and Process Flowcharts Analysis

6. Risk Registration List of Identified Risks List of potential responses
Root Cause of Risks
Risk Impact on Project Objectives
Updated RBS

7. Qualitative Risk Analysis
Basic Risk Ranking Matrix:
Deal separately with each project objective: Cost, Time, Scope and Quality
Rank Very High, High, Medium, Low and Very Low to the Importance/Threat and Likelihood/Probability of each risk.
In Decision Stage Deal with risks that are ranked high and Very High on both importance and likelihood.
In Planning and Execution Stages Deal With Risks with Very High Probability from Medium/Low Importance. Low Probability Risk will be dealt if it has Very High Threat Grade.

8. Qualitative Risk Analysis - Output
Relative Ranking and Priority List
Grouping by Categories – Common Root Cause, Common Project Area
Risks requires response in the near-term
Risks that need additional analysis
Low priority risks
Trends in risk analysis results – detect recurring risk for in-depth analysis and handling

9. PERT – Program Evaluation and Review Technique
Deals with uncertainty of task duration estimates
Useful for expensive, high risk, state-of-the-art projects
The method is very similar to CPM with different approach to time estimates
Each Activity requires 3 durations estimates:
Most Likely T(M), Optimistic T(O), Pessimistic T(P)
The Expected Duration that is used in the network graph is: T(E) = {T(O) + 4*T(M) + T(P)} / 6
The Activity Standard Deviation Defined as: S = {T(P) – T(O)} / 6
Total Standard Deviation of Activity R: Calculate the SQR(SIGMA(S**2)) for all the Ss that are included in the path from the start activity to R. If there is more then one path choose the maximum value.

10. Quantitative Risk Analysis
Risk and NPV - add risk factor to the discount rate
RE (Risk Exposure) = Risk Probability x Risk Impact (expected additional cost to handle the risk when it will occur, usually later project changes results with greater cost)
Decision Trees – Evaluate 2 Alternatives:
The risk event WILL be handled upfront
The risk event WILL NOT be handled upfront
It will be handled only if it will occur (calculate RE)
Compare the costs of the two alternatives.
Risk Profile Analysis - change the risk factor, e.g. by +/-5% and recalculate the costs. Evaluate the the sensitivity to the change. Focus on highly sensitive risks

11. Quantitative Risk Analysis – (Cont.)
Risk Reduction Leverage (RRL) = {RE(before risk mitigation activity) – RE (after risk mitigation activity)} / risk reduction cost
Focus on risks with large RRL value.
Stakeholders Risk Tolerance – The Project Probability Level that the project will meet its goals (cost, time,quality, scope), acceptable by the corporate.
Use PERT
Locate the activities with defined target/milestone/goal.
Z value is the number of Standard Deviations between the Stakeholders Targets (T) and the Expected Target.
For Schedule: Z = (T – T(E))/S
Convert Z to the probability of not meeting the target (use standard normal deviates graph found in statistical textbook)
If the probability is ABOVE the stakeholders risk tolerance, then the project should reduce the Risk Exposure by executing Risk Response Plan.

12. Response Planning Risk Response Planning Types of Risk Handling
Developing Options, Determining Actions to reduce Risks to the project objectives
Addresses the risk by their PRIORITY
Select the best response
Insert Resources, Activities, Schedule Changes and Budget to the Project Plan
Types of Risk Handling
Avoid: Changing the Project Plan to Eliminate the thread
Transfer: Move the risk to a 3 Party. Examples:
A Party that can better handle the risk (probably with additional cost)
Use contractual agreements like fix price project when there is a cost risk.
Mitigate: Reduction of the Risk Probability/Threat by upfront activities.

13. Strategies for Positive Risks - Opportunities
Risk with Potentially Positive Impact on the project
These Risks should be monitored and managed in order not to miss potential project gains
Strategies:
Exploit: Eliminate the uncertainty ( assign more talented employees, etc)
Share: Joint Venture, Sharing with best fit 3-party
Enhance: Increase the probability and/or the size of the positive impact by upfront action items.

14. Risk Monitoring and Control
Inputs: Risk Management Plan, Risk Registration, approved Change Requests, Work Performance Information and Reports.
Tools & Techniques:
Risks Reassessment ( Ongoing Process)
Status Meetings
Risk Audits ( Audit the effectiveness of the Risk Response Plan)
Technical Performance Measurements and Reserve Analysis
Outputs:Updated Risk Register, Requested Changes, Recommended Corrective Actions,Update Project Management Plan