software project management risk control.pptx

Lecture note for Software project risk management course

1. SOFTWARE PROJECT MANAGEMENT RISK MANAGEMENT 1

2. INTRODUCTION What is a risk? -factor or aspect which are likely to have an impact on the projects performance Uncertainties which affect the project performance: budget, schedule, quality 2

3. Risk tolerance or Risk utility Different organizations or individuals have different tolerances to risks. Three types of tolerance: Risk averse-lower tolerance for risk; less satisfaction for risk Risk neutral-achieves a balance between risk and payoff. Risk seeking-high tolerance for risk; high satisfaction for risk. 3

4. Types of Risk Schedule Risks Schedule compression (customer, marketing, etc.) Cost Risks Unreasonable budgets Requirements Risks Incorrect Incomplete Unclear or inconsistent Volatile Operational Risks Assumptions Risks Decisions risks 4

5. Risk Management Any project involves certain risks Purpose of risk management Ensure that the impact of risk on project’s performance is minimized Deals with identifying the undesirable events that can occur, the probability of their occurring, and the loss if an undesirable event does occur Risk mgt can have positive impact on selecting projects, developing realistic schedule and cost estimates. - So, risk management revolves around risk assessment and risk control 5

6. Risk Management 6

7. Risk Identification Produces a list of risks with potential to disrupt your project Sub-activities of risk identification: Brainstorming Generate ideas by a group Aggregate and categorize the ides to make them more manageable Disadvantage includes: Fear of social disapproval Effect of authority hierarchy Domination by vocal individuals Delphi technique or non-consultative group consensus interview Checklist Decision driven analysis Assumption analysis Decomposition analysis 7

8. Risk Identification-Check List Common risks encountered by previous projects Personnel shortfalls 2. Unrealistic schedules and budget 3. Developing the wrong software functions 4. Developing the wrong user interface 8

9. Risk Identification-Check List 5. Gold plating – refers to adding features that are only marginally useful. It consumes resources and time 6. Stream of requirements changes 7. Dependency on externally furnished components 8. Dependency on technology 9

10. Risk Identification-Decision Analysis Analyze all decisions taken Look for decisions derived by non-technical or non- management reasons Such decisions might be driven by politics, marketing or the desire for short term gain 10

11. Risk Identification-Assumption Analysis Look for optimistic assumptions such as: Nothing goes wrong No team member will quit People will put in extra hours if required External components will be delivered on time 11

12. Risk Identification-Decomposition Analysis 20% of the modules cause 80% of the problem Analyze the modules of the project 12

13. Risk Analysis Two types: Qualitative risk analysis Quantitative risk analysis 13

14. Qualitative Risk Analysis Involves assessing the likelihood and impact of identified risks to determine their magnitude and priority Uses rating scale such as low, medium, high Uses probability/impact matrix Estimating size of loss Loss is easier to see than probability Estimating probability of loss Is subjective Use team members estimate and have a risk-estimate review Use Delphi or group-consensus techniques 14

15. Quantitative Risk Analysis Often follows qualitative risk analysis, yet both processes can be done together or separately. Provides high level information in terms of the probabilities of achieving certain project objectives Uses numbers for likelihood and impact Expected monetary value(EMV) is its common tool EMV = probability x impact The higher EMV, the higher the priority 15

16. Risk Prioritization Once analysis is conducted, risks need to be prioritized from highly critical to low Spend more effort according to the prioritization 16

17. Risk Control Unlike risk assessment, risk control involves active measures taken by PM to minimize impact Has three sub-activities: Risk management planning Risk resolution Risk monitoring 17

18. Risk Management Planning Plans are developed for each risk The plan for a particular risk needn’t be extensive or elaborate The plan has five components: Why it is important and why should it be managed? What should be delivered? Who is responsible for risk management activities How the risk be abated/minimized? How many resources are needed? 18

19. Risk Management Planning Involves defining strategies for risks Risk management planning strategies: Risk avoidance Don’t do it Ex: shifting the site of a building to earthquake free zone if location is a risk Risk reduction Risk transference Causing another party to accept, typically by contract or hedging Ex: Insurance, outsourcing Risk retention/acceptance Accept its occurrence Don’t do anything about it 19

20. Risk resolution and Monitoring Risk resolution is essentially risk management planning implementation, i.e , activities to implement each strategy. For each risk, specify its risk monitoring- how the measures described in resolution are executed. 20

21. Risk Control Example Suppose wrong product development is identified as a risk. Identify its strategy, resolution and monitoring Solution: Risk Management planning strategy: reduction Risk resolution - elicit as much requirement as possible clarify vague requirements prepare prototype Risk Monitoring development team leader monitors changes according to the new understanding PM checks whether the new requirements are addressed 21

22. Risk Management Plan Template Introduction Roles and responsibilities Risk assessment 3.1 Risk identification 3.2 Risk analysis and prioritization 4. Risk Control 4.1 Planning strategies 4.2 Resolution 4.3 Monitoring 22