1. Risk Analysis & Management
Analisa & Manajemen Resiko

2. What is it?
Risk analysis and management are a series of steps that help a software team to understand and manage uncertainty.
Many problems can plague a software project.
A risk is a potential problem—it might happen, it might not.
But, regardless of the outcome, it’s a really good idea to :
identify it,
assess its probability of occurrence,
estimate its impact, and
establish a contingency plan should the problem actually occur.

3. Who does it?
Everyone involved in the software process participate in risk analysis and management:
managers,
software engineers, and
customers—

4. Why is it important?
“Be prepared.” Software is a difficult undertaking.
Lots of things can go wrong, and frankly, many often do.
It’s for this reason that being prepared— understanding the risks and taking proactive measures to avoid or manage them—is a key element of good software project management.

5. What are the steps?
Recognizing what can go wrong is the first step, called “risk identification.”
Next, each risk is analyzed to determine the likelihood that it will occur and the damage that it will do if it does occur.
Once this information is established, risks are ranked, by probability and impact.
Finally, a plan is developed to manage those risks with high probability and high impact.

6. What is the work product?
A risk mitigation, monitoring, and management (RMMM) plan
Or a set of risk information produced.

7. 6.1 REACTIVE VS. PROACTIVE RISK STRATEGIES
More commonly, the software team does nothing about risks until something goes wrong. Then, the team flies into action in an attempt to correct the problem rapidly. This is often called a fire fighting mode.
A proactive strategy begins long before technical work is initiated. Potential risks are identified, their probability and impact are assessed, and they are ranked by importance. Then, the software team establishes a plan for managing risk.

8. 6.2 SOFTWARE RISKS
When risks are analyzed, it is important to quantify the level of uncertainty and the degree of loss associated with each risk.
Risk categories:
Project risks threaten the project plan.
Technical risks threaten the quality and timeliness of the software to be produced.
Business risks threaten the viability of the software to be built.

9. 6.3 RISK IDENTIFICATION Generic and product-specific risk.
Create risk item checklist:
Product size
Business
Customer
Process
Development
Technology
Staff size and experience
Risk components :
Performance
Cost
Support
Schedule risk

11. RISK PROJECTION
The project planner, along with other managers and technical staff, performs four risk projection activities:
(1) establish a scale that reflects the perceived likelihood of a risk,
(2) delineate the consequences of the risk, (3) estimate the impact of the risk on the project and the product, and
(4) note the overall accuracy of the risk projection so that there will be no misunderstandings.

12. Develop Risk Table

13. Assessing Risk Impact
Risk identification. Only 70 percent of the software components scheduled for reuse will, in fact, be integrated into the application. The remaining functionality will have to be custom developed.
Risk probability. 80% (likely).
Risk impact. 60 reusable software components were planned. If only 70 percent can be used, 18 components would have to be developed from scratch (in addition to other custom software that has been scheduled for development). Since the average component is 100 LOC and local data indicate that the software engineering cost for each LOC is $14.00, the overall cost (impact) would be 18 x 100 x 14 = $25,200.
Risk exposure. RE = 0.80 x 25,200 ~ $20,200.

14. RISK MITIGATION, MONITORING, AND MANAGEMENT
An effective strategy must consider three issues:
risk avoidance
risk monitoring
risk management and contingency planning

15. RMMM Plan

16. Summary
Sun Tzu, a Chinese general who lived 2500 years ago, "If you know the enemy and know yourself, you need not fear the result of a hundred battles."
For the software project manager, the enemy is risk.