Sources Of Risk

1
The IT Outsourcing Risks
Sources Of Risk
2
Software Development Problems

• Range of Intervention Theory
• Prevention Treatment and Maintenance
• Planning Development and Use
• Cost of Intervention

3
The Importance of Risk Management

• Risk management is the art and science of
  identifying analyzing and responding to risk
  throughout the life of a project and in the best
  interests of meeting project objectives.
• Risk management is often overlooked in projects
  but it can help improve project success by
  helping select good projects determining project
  scope and developing realistic estimates.

4
Benefits from Software Risk Management Practices
Kulik Peter and Catherine Weber Software Risk
Management Practices 2001 KLCI Research Group
(August 2001).
5
Project Risk Management Processes

• Risk management planning Deciding how to
  approach and plan the risk management activities
  for the project.
• Risk identification Determining which risks are
  likely to affect a project and documenting the
  characteristics of each.
• Qualitative risk analysis Prioritizing risks
  based on their probability and impact of
  occurrence.

6
Project Risk Management Processes (contd)

• Quantitative risk analysis Numerically
  estimating the effects of risks on project
  objectives.
• Risk response planning Taking steps to enhance
  opportunities and reduce threats to meeting
  project objectives.
• Risk monitoring and control Monitoring
  identified and residual risks identifying new
  risks carrying out risk response plans and
  evaluating the effectiveness of risk strategies
  throughout the life of the project.

7
Risk Management Planning

• The main output of risk management planning is a
  risk management plana plan that documents the
  procedures for managing risk throughout a
  project.
• The project team should review project documents
  and understand the organizations and the
  sponsors approaches to risk.
• The level of detail will vary with the needs of
  the project.

8
Table 11-2. Topics Addressed in a Risk Management
Plan

• Methodology
• Roles and responsibilities
• Budget and schedule
• Risk categories
• Risk probability and impact
• Risk documentation

9
Contingency and Fallback Plans Contingency
Reserves

• Contingency plans are predefined actions that the
  project team will take if an identified risk
  event occurs.
• Fallback plans are developed for risks that have
  a high impact on meeting project objectives and
  are put into effect if attempts to reduce the
  risk are not effective.
• Contingency reserves or allowances are provisions
  held by the project sponsor or organization to
  reduce the risk of cost or schedule overruns to
  an acceptable level.

10
Common risk factors for IT Projects

• Risk factors
• Lack of top management commitment to the project
• Failure to gain user commitment
• Misunderstanding the requirement
• Lack of adequate user involvement
• Failure to manage end user expectation
• Changing scope and objectives
• Lack of required knowledge/skill in the project
  personnel
• New technology
• Insufficient / inappropriate staffing
• Conflict between user departments

11
Information Technology Success Potential Scoring
Sheet
12
Broad Categories of Risk

• Market risk
• Financial risk
• Technology risk
• People risk
• Structure/process risk

13
Risk Breakdown Structure

• A risk breakdown structure is a hierarchy of
  potential risk categories for a project.
• Similar to a work breakdown structure but used to
  identify and categorize risks.

14
Figure 11-3. Sample Risk Breakdown Structure
15
Risk Identification

• Risk identification is the process of
  understanding what potential events might hurt or
  enhance a particular project.
• Risk identification tools and techniques include
• Brainstorming
• Interviewing
• SWOT analysis

16
Brainstorming

• Brainstorming is a technique by which a group
  attempts to generate ideas or find a solution for
  a specific problem by amassing ideas
  spontaneously and without judgment.
• An experienced facilitator should run the
  brainstorming session.
• Be careful not to overuse or misuse
  brainstorming.

17
Interviewing

• Interviewing is a fact-finding technique for
  collecting information in face-to-face phone
  e-mail or instant-messaging discussions.
• Interviewing people with similar project
  experience is an important tool for identifying
  potential risks.

18
SWOT Analysis

• SWOT analysis (strengths weaknesses
  opportunities and threats) can also be used
  during risk identification.
• Helps identify the broad negative and positive
  risks that apply to a project.

19
Risk Register

• The main output of the risk identification
  process is a list of identified risks and other
  information needed to begin creating a risk
  register.
• A risk register is
• A document that contains the results of various
  risk management processes and that is often
  displayed in a table or spreadsheet format.
• A tool for documenting potential risk events and
  related information.
• Risk events refer to specific uncertain events
  that may occur to the detriment or enhancement of
  the project.

20
Risk Register Contents

• An identification number for each risk event.
• A rank for each risk event.
• The name of each risk event.
• A description of each risk event.
• The category under which each risk event falls.
• The root cause of each risk.

21
Risk Register Contents (contd)

• Triggers for each risk triggers are indicators
  or symptoms of actual risk events.
• Potential responses to each risk.
• The risk owner or person who will own or take
  responsibility for each risk.
• The probability and impact of each risk
  occurring.
• The status of each risk.

22
Table 11-5. Sample Risk Register/Risk Analysis

• Project severity expectation (1-10) impact
  (1-10)
• When should risk analysis be formed
• Is not a time activity
• Periodic update and reviewed

23
Calculating severity
Project severity expectation (1-10) impact
(1-10)
24
Major Risks Come From Management Practices..

• Poor analysis of supplier strategy and
  capabilities
• IT treated as undifferentiated commodity
• Cash injection looked for rather than
  business advantage
• Incomplete contracting
• Difficulties constructing/adapting deals for
  
• business/technological change
• Poor sourcing/contracting for new
  technologies
• Lack of maturity/experience with long-term
  total outsourcing
• Failure to retain requisite
  capabilities/skills for active
• contract and relationship management
• Power asymmetries developing in favour of
  vendor
• Unrealistic expectations with multiple
  objectives
• 
  (Source Lacity Willcocks 2001)

25
Main Risks in Outsourcing
Other Industrial relations with internal
staff No Learning from vendor about IT Systems
interconnectedness adversely affected Loss of
control over strategic use of IT New IT expertise
from vendor fails to materialise Loss of control
over IT operations Lack of expertise in managing
contracts Irreversibility of contract Credibility
of vendor claims Hidden costs of contract
Points
26
Risk Mitigations Plan

• Learn from Experience
• Follow a the maturity model.
• Best Practice / Multi-sourcing approach
• Know what to outsource
• Use the frameworks from previous classes

27
Stages
Performing / Strategic Focus (Not just focusing
on cost)
5 4 3 2 1
Norming / Proactive Cost Focus (Beginning to form
norms and actively focusing and proactively using
outsourcing for cost saving including offshore.
Outsourcing 20-40 of IT activities)
Storming / Strategic decision point (Organization
leaders share conflicting ideas about outsourcing
and pursuing different strategy to provide IT
services)
Forming / experimenting stage (outsourcing
between 10-20 of IT activities)
Insourcing / Bystander (outsourcing between 1-5
of IT. Mostly purchasing of IT functions).
Time
28
Risk Mitigations Plan

• Outsourcing Type and Scope
• Best-in-class
• In case of multi-sourcing
• Ability of suppliers to work together
• Short term deals better than long term deals

29

• Vendor Selection Criteria and Process
• Check Xerox and General Dynamics case studies
• Best fit
• Ability

30
And Unrealistic Expectations The IT
Cost/Service Trade-off
Minimal Cost
Premium Cost
Premium Service Minimal Service
Superstar Senior managements and
users expectations of IT
Rolls Royce
Realm of feasible IT performance

Black Hole
Chevrolet
Senior managements and users perceptions of IT
Realm of feasible IT performance