Risk Management EEE493 2001 References: HvV 8'3

1
Risk ManagementEEE493 2001 References HvV
8.3
Royal Military College of Canada Electrical and
Computer Engineering

• Major Greg Phillips
• greg.phillips_at_rmc.ca
• 1-613-541-6000 ext. 6190

Major Ron Smith smith-r_at_rmc.ca 1-613-541-6000
ext. 6030
2
What are Risks ?

• Risks are the potential undesired outcomes of
  alternatives
• Potential means loss is not guaranteed
• Undesired means that there is some loss at stake
• Alternatives implies the manager has choices

3
Risk Management

• Nearly 90 of software intensive projects fail to
  meet schedule, budget and functionality
  expectations

it was a management problem
4
Top Ten Risks (typical)

• personnel shortfall
• unrealistic budget / schedule
• wrong functionality
• wrong user interface
• gold plating
• requirements volatility
• bad external components
• bad external tasks
• real-time shortfalls
• capability shortfalls
• plus, politics

These are both risk drivers and symptoms
5
Risk Management Strategy

• Identify potential problems (risk factors)
• Analyze risk, determine exposure
• estimate the probability p that the problem will
  occur and the resultant effect E
• then exposure p x E
• Mitigate risks
• avoidance - take precautions so that the risks do
  not occur
• transfer - look for other solutions
• acceptance - have a contingency plan (just in
  case)
• Monitor and Handle risks
• risk management starts in planning and continues
  for the duration of a project

6
Resources Needed

• A skilled analyst
• Domain experts
• Budget (ranging from 1 to 5)
• risk management only
• Does not include aversion strategy costs
• Executive level support

7
How to Identify Risk

• Analyze project statement
• Survey (domain experts)
• Historical data and analogy
• Small scale experiments (prototyping)
• Decomposition of product function
• Who ?
• technical personnel
• specialist consultants
• peers, superiors
• customers and users

8
Risk Analysis

• What ?
• estimate probability of event
• estimate potential loss
• How ?
• Delphi method
• adjective calibration
• betting analogy
• probability encoding (survey)
• buying an estimate

9
Adjective Calibration

• Almost certainly (80-90)
• Its probable (60-75)
• Likely (50-75)
• We doubt (0-40)
• Little chance (0-20)
• Highly unlikely (0-10)

10
Betting Analogy

• Put your money where your mouth is !
• Would you be willing to accept these terms
• No slippage, you win 100
• Slippage, you lose 200
• If the estimator is willing to accept this bet,
  it is reasonable to assume that the estimator
  believes the chance of slippage to be less than
  33

11
Risk Exposure
high
active
passive
Ability to Mitigate
helpless
unconcerned
low
low
high
Probable Impact
12
Mitigation Strategy Identification

• Prevent
• Reduce probability
• Nullify or reduce cost
• Transfer risk to areas better able to handle it
• Transfer risk to areas where cost is lower
• Contingency plan
• Accept risk

13
Strategy Identification Example

• What will we do if the system crashes?
• (disk crash,virus,hardware failure,OS bug)?
• Have a hot standby
• Database shadowing
• Electronic vaulting
• Remote operation centre
• Cold standby

14
Strategy Evaluation

• What?
• For each strategy,
• estimate cost and benefit
• estimate new risk introduced
• How?
• Similar techniques as risk analysis
• Delphi
• Betting analogy
• Adjective calibration

15
Risk Planning

• Accept any extremely remote possibilities
• Where possible prevent risk where cost is
  enormous
• For all remaining strategies
• compare cost of strategy with potential loss
  weighted by probability
• if cost lt weighted cost then implement strategy

16
Implementation

• like metrics,
• like process improvement,
• like estimation,
• Get Management to Commit!
• like planning,
• like monitoring,
• Keep it up to date!
• Use it!

17
Benefits of Systematic Risk Management

• options and trade-offs are explicit
• expectations are more realistic
• provides a systematic view of situation
• decisions can account for all available
  information
• assumptions are explicitly identified
• decisions can be consistent with overall project
  goals
• contingency plans are available for faster and
  better reactions
• potential opportunities can be identified and
  exploited

18
Summary

• Nothing new
• Merely good management
• Formalizing it helps improve it
• A good alternative to blaming management!

19
Next ClassWBS, PERT and Gantt Charts