Title: Sources Of Risk
1The IT Outsourcing Risks
Sources Of Risk
2Software Development Problems
- Range of Intervention Theory
- Prevention Treatment and Maintenance
- Planning Development and Use
- Cost of Intervention
3The Importance of Risk Management
- Risk management is the art and science of
identifying analyzing and responding to risk
throughout the life of a project and in the best
interests of meeting project objectives. - Risk management is often overlooked in projects
but it can help improve project success by
helping select good projects determining project
scope and developing realistic estimates.
4Benefits from Software Risk Management Practices
Kulik Peter and Catherine Weber Software Risk
Management Practices 2001 KLCI Research Group
(August 2001).
5Project Risk Management Processes
- Risk management planning Deciding how to
approach and plan the risk management activities
for the project. - Risk identification Determining which risks are
likely to affect a project and documenting the
characteristics of each. - Qualitative risk analysis Prioritizing risks
based on their probability and impact of
occurrence.
6Project Risk Management Processes (contd)
- Quantitative risk analysis Numerically
estimating the effects of risks on project
objectives. - Risk response planning Taking steps to enhance
opportunities and reduce threats to meeting
project objectives. - Risk monitoring and control Monitoring
identified and residual risks identifying new
risks carrying out risk response plans and
evaluating the effectiveness of risk strategies
throughout the life of the project.
7Risk Management Planning
- The main output of risk management planning is a
risk management plana plan that documents the
procedures for managing risk throughout a
project. - The project team should review project documents
and understand the organizations and the
sponsors approaches to risk. - The level of detail will vary with the needs of
the project.
8Table 11-2. Topics Addressed in a Risk Management
Plan
- Methodology
- Roles and responsibilities
- Budget and schedule
- Risk categories
- Risk probability and impact
- Risk documentation
9Contingency and Fallback Plans Contingency
Reserves
- Contingency plans are predefined actions that the
project team will take if an identified risk
event occurs. - Fallback plans are developed for risks that have
a high impact on meeting project objectives and
are put into effect if attempts to reduce the
risk are not effective. - Contingency reserves or allowances are provisions
held by the project sponsor or organization to
reduce the risk of cost or schedule overruns to
an acceptable level.
10Common risk factors for IT Projects
- Risk factors
- Lack of top management commitment to the project
- Failure to gain user commitment
- Misunderstanding the requirement
- Lack of adequate user involvement
- Failure to manage end user expectation
- Changing scope and objectives
- Lack of required knowledge/skill in the project
personnel - New technology
- Insufficient / inappropriate staffing
- Conflict between user departments
11Information Technology Success Potential Scoring
Sheet
12Broad Categories of Risk
- Market risk
- Financial risk
- Technology risk
- People risk
- Structure/process risk
13Risk Breakdown Structure
- A risk breakdown structure is a hierarchy of
potential risk categories for a project. - Similar to a work breakdown structure but used to
identify and categorize risks.
14Figure 11-3. Sample Risk Breakdown Structure
15Risk Identification
- Risk identification is the process of
understanding what potential events might hurt or
enhance a particular project. - Risk identification tools and techniques include
- Brainstorming
- Interviewing
- SWOT analysis
16Brainstorming
- Brainstorming is a technique by which a group
attempts to generate ideas or find a solution for
a specific problem by amassing ideas
spontaneously and without judgment. - An experienced facilitator should run the
brainstorming session. - Be careful not to overuse or misuse
brainstorming.
17Interviewing
- Interviewing is a fact-finding technique for
collecting information in face-to-face phone
e-mail or instant-messaging discussions. - Interviewing people with similar project
experience is an important tool for identifying
potential risks.
18SWOT Analysis
- SWOT analysis (strengths weaknesses
opportunities and threats) can also be used
during risk identification. - Helps identify the broad negative and positive
risks that apply to a project.
19Risk Register
- The main output of the risk identification
process is a list of identified risks and other
information needed to begin creating a risk
register. - A risk register is
- A document that contains the results of various
risk management processes and that is often
displayed in a table or spreadsheet format. - A tool for documenting potential risk events and
related information. - Risk events refer to specific uncertain events
that may occur to the detriment or enhancement of
the project.
20Risk Register Contents
- An identification number for each risk event.
- A rank for each risk event.
- The name of each risk event.
- A description of each risk event.
- The category under which each risk event falls.
- The root cause of each risk.
21Risk Register Contents (contd)
- Triggers for each risk triggers are indicators
or symptoms of actual risk events. - Potential responses to each risk.
- The risk owner or person who will own or take
responsibility for each risk. - The probability and impact of each risk
occurring. - The status of each risk.
22Table 11-5. Sample Risk Register/Risk Analysis
- Project severity expectation (1-10) impact
(1-10) - When should risk analysis be formed
- Is not a time activity
- Periodic update and reviewed
23Calculating severity
Project severity expectation (1-10) impact
(1-10)
24 Major Risks Come From Management Practices..
- Poor analysis of supplier strategy and
capabilities - IT treated as undifferentiated commodity
- Cash injection looked for rather than
business advantage - Incomplete contracting
- Difficulties constructing/adapting deals for
- business/technological change
- Poor sourcing/contracting for new
technologies - Lack of maturity/experience with long-term
total outsourcing - Failure to retain requisite
capabilities/skills for active - contract and relationship management
- Power asymmetries developing in favour of
vendor - Unrealistic expectations with multiple
objectives -
(Source Lacity Willcocks 2001)
25Main Risks in Outsourcing
Other Industrial relations with internal
staff No Learning from vendor about IT Systems
interconnectedness adversely affected Loss of
control over strategic use of IT New IT expertise
from vendor fails to materialise Loss of control
over IT operations Lack of expertise in managing
contracts Irreversibility of contract Credibility
of vendor claims Hidden costs of contract
Points
26Risk Mitigations Plan
- Learn from Experience
- Follow a the maturity model.
- Best Practice / Multi-sourcing approach
- Know what to outsource
- Use the frameworks from previous classes
27Stages
Performing / Strategic Focus (Not just focusing
on cost)
5 4 3 2 1
Norming / Proactive Cost Focus (Beginning to form
norms and actively focusing and proactively using
outsourcing for cost saving including offshore.
Outsourcing 20-40 of IT activities)
Storming / Strategic decision point (Organization
leaders share conflicting ideas about outsourcing
and pursuing different strategy to provide IT
services)
Forming / experimenting stage (outsourcing
between 10-20 of IT activities)
Insourcing / Bystander (outsourcing between 1-5
of IT. Mostly purchasing of IT functions).
Time
28Risk Mitigations Plan
- Outsourcing Type and Scope
- Best-in-class
- In case of multi-sourcing
- Ability of suppliers to work together
- Short term deals better than long term deals
29- Vendor Selection Criteria and Process
- Check Xerox and General Dynamics case studies
- Best fit
- Ability
30And Unrealistic Expectations The IT
Cost/Service Trade-off
Minimal Cost
Premium Cost
Premium Service Minimal Service
Superstar Senior managements and
users expectations of IT
Rolls Royce
Realm of feasible IT performance
Black Hole
Chevrolet
Senior managements and users perceptions of IT
Realm of feasible IT performance