1. 1 The Concept of Risk A risk is defined as a variable that can take a value that endangers or eliminates success for a project. In plain terms, a risk is whatever may stand in our way to success and is currently unknown or uncertain. We can qualify risks further as direct or indirect: –Direct risk: The project has a large degree of control –Indirect risk: The project has little or no control

2. 2 Risk Attributes We can also add two important attributes: –The probability of occurrence –The impact on the project (severity) These two attributes can be combined in a single risk magnitude indicator, and five discrete values are sufficient: –High, –Significant, –Moderate, –Minor, –Low.

3. 3 How to Cope with Risks Three main routes are possible: –Risk avoidance: Reorganize project so that it cannot be affected by the risk. –Risk transfer: Reorganize project so that someone or something else bears the risk (the customer, vendor, bank, or another element). –Risk acceptance: Decide to live with the risk. Monitor its symptoms and determine what to do if it materializes.

4. 4 Types of Risks Risks that can be avoided or worked around Risks that cannot be avoided –“What if the project leader in this 15-person team leaves the company?” –Retire this by preparing a backup person. From: Software Engineering An Object-Oriented Perspective By: Eric J. Braude

5. 5 A Way to Compute Risk Priorities Likelihood 1 to 10 Impact 1 to 10 Retirement Cost 1 to 10 Priority Computation Resulting priority (1=least likely)(1=least impact) (1=lowest cost)(Lowest number handled first) Highest Risk10 1(11-10) x (11-10) x 1 1 Lowest Risk1110(11-1) x (11-1) x 10 1000 From: Software Engineering An Object-Oriented Perspective By: Eric J. Braude

6. Risk Management From Software Engineering R7 By Sommerville

7. 7 Risk Management Process Risk identification –Possible project, product and business risks are identified. Risk analysis –The likelihood and consequences of these risks are assessed. Risk planning –Plans to address the risk either by avoiding it or minimizing its effects. Risk monitoring –The risk is constantly assessed an plans for risk mitigation are revised as more information about the risk becomes available.

8. 8 Risks and Risk Types (Risk Identification) Risk TypePossible Risks Technology Database used cannot process as many transactions per second as expected. Reused SW components contain defects which limit their functionality. People It is impossible to recruit staff with skills required. Key staff are ill and unavailable at critical times. Required training for staff is not available. Organizational Organization is restructured so that different managements are possible for the project. Organizational financial problems force reductions in project budget. Tools The code generated by CASE tolls is inefficient. CASE tools cannot be integrated. Requirements Changes to requirements which require major design rework are proposed. Customers fail to understand the impact of requirements changes. Estimation The time required to developed SW is underestimated. The rate of defect repair is underestimated. The size of the software is underestimated.

9. 9 Risks Analysis RiskProbabilityEffects Financial problems force reductions in project budget.LowCatastrophic It is impossible to recruit staff with skills required for the project.HighCatastrophic Key staff are ill at critical times in the projectModerateSerious Customers fail to understand the impact of requirements changes.ModerateTolerable The code generated by CASE tools is inefficient.ModerateInsignificant

10. 10 Risks Management Strategies RiskStrategy Organizational financial problem Prepare a briefing document for senior management showing how the project is making a very important contribution to the goals of business. Recruitment problemsAlert customer of potential difficulties an possibility of delays, investigate buying-in components Staff illnessReorganize team so that there is more overlap of work and people therefore understand each other’s jobs Requirements changesDerive traceability information to assess requirements change impact, maximize information hiding in the design. Database performanceInvestigate the possibility of buying a higher-performance database.

11. 11 Risk Factors Risk TypePotential indicators Technology Late delivery of hardware of support SW, many reported technology problems. People Poor staff morale, poor relationships amongst team members, job availability. Organizational Organizational gossip, lack of action by senior management. Tools Reluctance by team members to use tools, complaints about CASE tools, demands for higher-powered workstations. Requirements Many requirements change requests, customer complaints. Estimation Failure to meet agreed schedule, failure to clear reported defects.