1. CSE Senior Design I Risk Management Instructor: Mike O’Dell This presentations was derived from the textbook used for this class: McConnell, Steve, Rapid Development, Chapter 5.

2. 6 2 Systems Design Project Are Risky cancelled  The odds of a large project being cancelled due to risks encountered: 50% finishing on time  The odds of a large project finishing on time are close to zero! runaway project  Pete Marwick (1988): 35% of companies studied had at least one “runaway project”  Allstate office automation 5 year/$8M … 6+ years/$100M  Westpac Banking Corporation info systems 5 year/$85M… 3years/$150M later: cancelled

3. 6 3 Why Do Projects Fail? poor risk management  Generally, from poor risk management  Failure to identify risks  Failure to actively/aggressively plan for, attack and eliminate “project killing” risks  Risk comes in different shapes and sizes  Schedule risks (short to long)  Cost risks (small to large)  Technology risks (probable to impossible)

4. 6 4 Case Study 5-1: What can go wrong?  What type of project is this?  How difficult does it appear to be, on the surface? classic mistakes  What classic mistakes do you see along the way?  Where/when/how could the risks have been better managed?

5. 6 5 Elements of Risk Management  Managing risk consists of: identifying, addressing and eliminating risks  When does this occur? Crisis management/Fire fighting (WORST) Crisis management/Fire fighting : addressing risk after they present a big problem Fix on failure (BAD) Fix on failure : finding and addressing as the occur. Risk Mitigation (OKAY) Risk Mitigation : plan ahead and allocate resources to address risk that occur, but don’t try to eliminate them before they occur Prevention (GOOD) Prevention : part of the plan to identify and prevent risks before they become problems Eliminate Root Causes (BEST) Eliminate Root Causes : part of the plan to identify and eliminate the factors that make specific risks possible

6. 6 6 Elements of Risk Management  Effective Risk Management is made up of:  Risk Assessment: identify, analyze, prioritize  Risk Control: planning, resolution, monitoring RISKMANAGEMENT RISKCONTROL RISKASSESSMENTIDENTIFICATIONANALYSIS PLANNING PRIORITIZATION RESOLUION MONITORING

7. 6 7 Risk Assessment Tasks  Identification  Identification: produces a list of risks that have potential to disrupt your project’s schedule  Analysis  Analysis: assesses the likelihood and impact of each identified risk, and the risk levels of possible alternatives  Prioritization  Prioritization: prioritizes the list by impact  serves as the basis for risk control tasks

8. 6 8 Risk Control Tasks  Planning  Planning: produces your plan for dealing with each risk  Must ensure consistency of the risk management plan with your overall project plan  Resolution  Resolution: executing your plan to deal with the risks  Monitoring  Monitoring: staying on top of your plan and re-evaluate for new risks

9. 6  Most common schedule risks 1.Feature creep 2.Gold-plating (requirements/developer) 3.Shortchanged QA 4.Overly optimistic schedules 5.Inadequate design 6.Silver-bullet syndrome 7.Research-oriented development 8.Weak, poorly-trained personnel 9.Contractor failure 10.Friction between developers & customers 9 Risk Identification CLASSIC MISTAKES

10. 6 10 Risk Identification  Use Table 5-3: Potential Schedule Risks  Schedule Creation  Organization and Management  Development Environment  End-users  Customer  Contractors  Requirements  Product  External Environment  Personnel  Design and Implementation  Process

11. 6 11 Risk Analysis: Exposure Table  Analyze the (schedule) impact of each risk  Create a risk exposure/impact table for each risk. Risk Exposure = Probability of Loss X Size of Loss Risk Probability of Loss Size of Loss Risk Exposure Overly optimistic schedule.50%5 wks2.5 wks Addition of new feature that adds capability to …10%20 wks2.0 wks Inadequate design that requires redesign of major …15%15 wks2.25 wks Board contractor delays delivery of board.10%4 wks0.4 wks Unstable code base from earlier release of product.20%10 wks2.0 wks Product requirements take longer than expected to finalize than planned. 30%3 wks0.9 wks Etc. TOTAL PROJECT OVERRUNX wksY wks

12. 6 12 Risk Analysis  Estimating Size of Loss expected form  Impact to schedule IF risk is encountered in its expected form known date  Can be precise based on known date for re-review(s), etc. break down tasks  May need to break down tasks to lowest known level  Estimating Probability of Loss  Subjective  Subjective assessment of probability that a given risk will cause the stated impact different practices  Many different practices can be used: Experience Delphi or group consensus Betting analogies (How much would you bet that…?) Adjective calibration (“Good probability” = x%, “Fair” = y%, …)

13. 6 13 Risk Prioritization focusbased on the expected impact (risk exposure) of each risk  Establishes a focus on your risks based on the expected impact (risk exposure) of each risk  Greatest potential impact must also be addressed  80/20 Rule Risk Probability of Loss Size of Loss Risk Exposure Overly optimistic schedule.50%5 wks2.5 wks Inadequate design that requires redesign of major …15%15 wks2.25 wks Addition of new feature that adds capability to …10%20 wks2.0 wks Unstable code base from earlier release of product.20%10 wks2.0 wks Product requirements take longer than expected to finalize than planned.30%3 wks0.9 wks Board contractor delays delivery of board. 10%4 wks0.4 wks Etc. TOTAL PROJECT OVERRUNX wksY wks 1.3+ 5.65 wks

14. 6 14 Risk-Management Planning specific, detailed planfor resolution  Develop a specific, detailed plan for resolution of each high-priority risk identified  What must be done  When it must be done  How it will be done  Who will do it  When/how it will be monitored/reassessed

15. 6 15 Risk Resolution  Risks can be resolved by:  Avoidance  Avoidance: don’t do the risky activity  Transference  Transference: move it to another place (team, organization, contractor, etc.) where it’s not as likely  Buying information  Buying information: early prototyping, consulting, …  Root cause elimination  Root cause elimination: get at what causes the risk, and make it go away  Acceptance/assumption  Acceptance/assumption: don’t worry about it, but plan to accept the consequences  Publicizing  Publicizing: let stakeholders know (so they implicitly accept the risk), avoid surprises  Controlling  Controlling: develop contingency plans, allocate additional resources if that will help, …  Recording/remembering: write down what you know so you can use it in the future (e.g., next project, later in this one)

16. 6 16 Risk Resolution  Use Table 5-6: Means of Controlling the Most Common Schedule Risks  Find ways to apply these common approaches to the specific risks that you have identified. specific and relevant  Make them specific and relevant to your project.

17. 6 17 Risk Monitoring will change  Risks and potential impact will change throughout the course of a project “TOP 10 RISKS” list  Keep an evolving “TOP 10 RISKS” list  See Table 5-7 for an example  Review the list frequently  Refine… Refine… Refine…  Put someone in charge  Put someone in charge of monitoring risks part of your process & project plan  Make it a part of your process & project plan

18. 6 18 Case Study 5-2: Risk Management Done Right  Why/how did this project start off on the right foot?  Describe the risk management plan:  How were the top risks identified? What were they?  How were these risks addressed?  How were risks monitored?  What was the end result?

19. 6 19 Risk Management Team Exercise  Identify your team’s top 2 risks  Clearly state the risk in precise, relevant terms… specific to your project and your team.  Agree on risk impact and probability  Determine plan of to manage these risks