1. Project Management Risk Management

2. Introduction Project planning Gantt chart and WBS Project planning Network analysis I Project planning Network analysis II Plan Project planning –Resource analysis Budgets and cost control Risk management Project teams

3. Project Disasters Hi-tech Toilet – Failsafe error Mars Orbiter – units error Arianne 5 – data conversion error

4. What is Risk? Risk is the possibility of suffering loss Possible – but not certain, so it is expressed as probability Loss - is any unwanted consequence that might occur

5. Risk in IS Projects In a development project, the loss describes the impact to the project which could be in the form of diminished quality of the end product, increased costs, delayed completion, or failure. SEI

6. Four Main Steps Risk Management Plan Risk Management Process Before these activities?

7. Risk Identification The possible risk is determined by a number of interrelated factors such as: –Nature of the Project –Aggressive or Conservative Schedule/Budget –Skills and motivation of the Project Team

8. Risk Identification Risks can be identified by analysing: –Historical Information Project Files, Commercial Databases, Project team knowledge etc. –Work Breakdown Structure –Internal and External Factors

9. Risk Identification Techniques: –Checklists – e.g. Boehm –Brainstorming –Causal/Cognitive Mapping

10. IS Projects and Risk Identify the possible sources of risk in a typical IS project? See Pressman, 1998 Chapter 6.

11. IS Project Risks One of our Team members is missing The person with the plans is ill Haven’t used VB much before Database design problems Systems broke when I fixed a bug System doesn’t meet requirements It worked when I tried it at home

12. Likelihood What is the likelihood of risk? –Expressed as a Probability (Percentage) –Example – There is a 5% chance of a programmer breaking their big toe whilst coding in any 6 month period

13. Impact What impact will it have on the project? –Example – A broken toe on average results in the loss of 20 working days for a programmer –Expected Value of Loss/Profit Expected Value = Loss/Profit x Likelihood -20 x 0.05 = -1 So we will lose 1 day of coding per programmer on a 6 month project

14. Urgency How urgently do we need to deal with it? –Immediate remedy or Can it wait? –Additional means of prioritising action

15. Example Risk Assessment

16. Quantifying Risk Programmer has 5% chance of breaking toe in any 6 month period –Broken toe results in the loss of 20 programmer days –Cost of a programmer-day = £500 Expected Loss per year due to broken toes –2 x (0.05 x -20) = -2 days –Expected loss = -£1000

17. Techniques Risk Map/Probability Impact Matrix Hazard Control Matrix Payoff Matrix Decision Tree

18. Risk Map

22. List the risks in order of priority What else can we use to help prioritise?

23. Hazard Control Matrix From Curtis, G (1998) "Business Information Systems" Addison Wesley

24. Hazard Control Matrix From Curtis, G (1998) "Business Information Systems" Addison Wesley

25. Hazard Control Matrix From Curtis, G (1998) "Business Information Systems" Addison Wesley

26. Hazard Control Matrix From Curtis, G (1998) "Business Information Systems" Addison Wesley

27. Identification and Assessment Problems –Not a particularly interesting task –Needs experience to do well Are these good reasons to not do it?

28. Risk Response Development How are we going to deal with risks when they occur? –What about those we weren’t expecting?

29. Control Systems Preventive Control –Stops undesirable events (disturbances) from occurring (see Curtis, 1998 Chapter 8) Feedback Control –Doesn’t attempt to prevent unpredictable disturbances –Is able to recover from effects Systems will usually combine both

30. Risk Control Goals of Control –Prevention –Detection –Minimise Loss –Recovery –Investigation H. A. Simon Risk Response –Avoidance Prevention –Mitigation Transfer –Acceptance Cadle and Yeates

31. Quantifying Risk Programmer has 5% chance of breaking toe in any 6 month period –Broken toe results in the loss of 20 programmer days –Cost of a programmer-day = £500 Expected Loss per year due to broken toes –2 x (0.05 x -20) = -2 days –Expected loss = -£1000 Therefore this much is available to be spent on preventative measures (e.g. titanium shoes)

32. Risk Control Mitigation by Procurement of goods/services Contingency Planning Use Alternative Strategies Insurance See also Lockyer and Gordon, 1996 Ch.7

33. IS Projects and Risk What can be done to prevent or mitigate the previously identified IS risks?

34. IS Project Risks Team members don’t exist –Careful distribution of tasks early on The person with the plans is ill –Make sure information is shared and distributed Haven’t used VB much before –Get to the implementation stage early or prototype Database design problems –Early test of info requirements Systems broke when I fixed a bug –Change control process System doesn’t meet requirements –More careful design or better use of use cases

35. Risk Response Control Implement Risk Responses Identify new Risks –Implement new responses

36. Risk Register Can be used to keep information about identified risks (Yeates and Cadle Ch. 13) –Title and description –Risk Status - e.g. candidate, live, closed –Potential impact –Risk owner –Actions –Action Log

37. Risk Ownership Risk owner is someone who: –Has sufficient information concerning the risk –Has the necessary resources to do something about the risk –Possesses the authority to do something about the risk

38. COTS Software Risks Integration –Difficulties with integrating data formats/protocols Upgrading –Using supplier upgrades vs old versions No Source code –How easy/necessary is it to enhance the system? Supplier Failures or Buyouts –Problems of suppliers/products going out of business or being bought out Hughes and Cotterell, 2006

39. Mitigation of COTS Risks Carefully manage the introduction of updates Continually monitor COTS vendors and their markets COTS Development will never be cheaper than bespoke development – do not use it as a cost cutting exercise Watch the major influences on COTS development cost and keep them to a minimum Form partnerships with vendors rather than maintaining continuous conflict with them Use wrappers to protect the system and its components

40. Introduction Project planning Gantt chart and WBS Project planning Network analysis I Project planning Network analysis II Plan Project planning –Resource analysis Budgets and cost control Risk management Project teams