SOFTWARE PROJECT MANAGEMENT

UNIT-4
RISK MANAGEMENT

Prof. Rejo Mathew

Assistant Professor,
Department of IT, MPSTME
NMIMS (Deemed-to-be) University,
Mumbai
TOPICS TO COVER
 Definition of ‘risk’ and ‘risk management’
 Some ways of categorizing risk

 Risk management
 Risk identification –what are the risks to a project?
 Risk analysis –which ones are really serious?
 Risk planning –what shall we do?
 Risk monitoring –has the planning worked?

 Quantify the likely effect of risk on project timescales

 Using PERT technique

2
SOME DEFINITIONS OF RISK
 ‘the chance of exposure to the adverse consequences of
future events’ -PRINCE2
 ‘an uncertain event or condition that, if it occurs, has a
positive or negative effect on a project’s objectives’ PM-BOK
 Risks relate to possible future problems, not current ones

 They involve a possible cause and its effect(s) e.g. developer

leaves --> task delayed

3
IN-CLASS EXERCISE
 Match the following:
 Causes
a. Staff inexperience
b. Lack of top management commitment
c. New technology
d. Users uncertain of their requirements
 Effects
1. Testing takes longer than planned
2. Planned effort and time for activities exceeded
3. Project scope increases
4. Time delays in getting changes to plans agreed

4
RECALL ‘STEP WISE’

5
CATEGORIES OF RISK

Kalle Lyytinens “sociotechnical model of risk”

6
RISK MANAGEMENT APPROACHES
 Proactive:
 The proactive approaches try to anticipate the possible risks that the
project is susceptible to.
 After identifying the possible risks, actions are taken to eliminate
the risks.
 Reactive:
 Reactive approaches take no action until an unfavourable event
occurs.
 Once an unfavourable event occurs, these approaches try to contain
the adverse effects associated with the risk and take steps to prevent
future occurrence of the same risk events.
7
A FRAMEWORK FOR DEALING WITH
RISK
 The planning for risk includes these steps:
1. Risk identification –what risks might there be?
2. Risk analysis and prioritization –which are the most serious
and recurrent risks?
3. Risk planning –what are we going to do about them?
4. Risk monitoring –what is the current state of the risk?

8
1. RISK IDENTIFICATION
Approaches to identifying risks include:

 Use of checklists –usually based on the experience of past

projects
 Brainstorming –getting knowledgeable stakeholders together
to pool concerns
 Causal mapping –identifying possible chains of cause and
effect

9
 BARRY BOEHM’S TOP 10 RISKS
Risk Risk reduction techniques

Personnel shortfalls Staffing with top talent; job matching; teambuilding;

training and career development; early scheduling of key
personnel

Multiple estimation techniques; design to cost;

Unrealistic time and incremental development; recording and analysis of past
cost estimates projects; standardization of methods

Developing the wrong Improved software evaluation; formal specification

software functions methods; user surveys; prototyping; early user manuals

Developing the wrong Prototyping; task analysis; user involvement

user interface 10
BARRY BOEHM’S TOP 10 RISKS
Gold plating Requirements scrubbing, prototyping,
design to cost

Late changes to
requirements Change control, incremental development

Shortfalls in externally Benchmarking, inspections, formal specifications, contractual

supplied components agreements, quality controls

Shortfalls in externally Quality assurance procedures, competitive design etc

performed tasks

Real time performance Simulation, prototyping, tuning

problems

Development technically Technical analysis, cost-benefit analysis, prototyping , training

too difficult
11
2. RISK ANALYSIS AND RISK
PRIORITIZATION
Risk exposure (RE) = (potential damage) x (probability of occurrence)

 Ideally
Potential damage: a money value e.g. a flood would cause £0.5
millions of damage
Probability0.00 (absolutely no chance) to 1.00 (absolutely certain) e.g.
0.01 (one in hundred chance)
RE = £0.5m x 0.01 = £5,000

Crudely analogous to the minimum sum needed for an insurance

premium
12
IN-CLASS EXERCISE
 Aditi is a systems analyst who is gathering requirements for an application which
will record details of the training undertaken by fire-fighters in the client fire
brigade. Details of the training units successfully completed by fire-fighters are
to be input to the application by trainers who are themselves senior and active
fire-fighters.
 Aditi needs to interview a trainer to obtain his/her requirements. Because of the
senior fire-fighters’ other duties the interview has to be arranged two weeks in
advance. There is then a 20% chance of the fire-fighter being unable to attend
the interview because of an emergency call-out.
 Each week that the project is delayed costs the fire brigade approximately Rs.
10,000.
 Provide an estimate of the risk exposure (as a financial value) for the risk that the
senior fire-fighter might not be able to attend at the times needed.

13
IN-CLASS EXERCISE
 The cost of an adverse outcome would be Rs. 20,000 (i.e.
two weeks at Rs. 10,000 a week).

 There is a 20% (0.20) probability of the adverse outcome.

 The risk exposure is therefore 20% of Rs. 20,000, that is

Rs.4,000

14
RISK EXPOSURE ASSESSMENT
-EXAMPLE

15
RISK PROBABILITY: QUALITATIVE
DESCRIPTORS

Probability level Range

High Greater than 50% chance of happening

Significant 30-50% chance of happening

Moderate 10-29% chance of happening

Low Less than 10% chance of happening

16
Qualitative descriptors of risk probability and associated range values
RISK PROBABILITY: QUALITATIVE
DESCRIPTORS

Impact level Range

High Greater than 30% above budgeted expenditure

Significant 20 to 29% above budgeted expenditure

Moderate 10 to 19% above budgeted expenditure

Low Within 10% of budgeted expenditure

17

Qualitative descriptors of impact on cost and associated range values

PROBABILITY IMPACT MATRIX/
SUMMARY RISK PROFILES

18
RISK PLANNING
Risks can be dealt with by:

 Risk acceptance
 Risk avoidance

 Risk reduction and mitigation / contingency measures

 Risk transfer / sharing

19
RISK REDUCTION LEVERAGE
Risk reduction leverage =
(REbefore- REafter)/ (cost of risk reduction)
REbefore is risk exposure before risk reduction e.g. 1% chance of
a fire causing £200k damage
REafter is risk exposure after risk reduction e.g. fire alarm
costing £500 reduces probability of fire damage to 0.5%

RRL = (1% of £200k)-(0.5% of £200k)/£500 = 2

RRL > 1.00 therefore worth doing

20
RISK REGISTER

 When the project planners have picked out and examined

what appear to be the most threatening risks to the project,
they need to record their findings

 This is called risk register

21
EVALUATING RISKS TO THE
SCHEDULE
 Risk of delaying the schedule

 PERT –takes account of the uncertainties in the duration

of activities within a project

 Monte Carlo simulation –flexible tool that tackles the

same problem

22
USING PERT TO EVALUATE THE EFFECTS
OF UNCERTAINTY

PERT –provides a method for estimating the probability of

meeting or missing target dates
Three estimates are produced for each activity
 Most likely time (m)

 Optimistic time (a)

 Pessimistic (b)

 ‘expected time’ te= (a + 4m +b) / 6

 ‘activity standard deviation’ S = (b-a)/6
23
A CHAIN OF ACTIVITIES

24
A CHAIN OF ACTIVITIES
 What would be the expected duration of the chain A + B + C?
Answer: 12.66 + 10.33 + 25.66 i.e. 48.65

 What would be the standard deviation for A + B+ C?

Answer: square root of (12+ 12+ 32) i.e. 3.32

 To add two standard deviations, we must add their squares and then
find the square root of the sum.

25
ASSESSING THE LIKELIHOOD OF
MEETING A TARGET

 Say the target for completing A+B+C was 52 days (T)

 Calculate the z value, thus z = (T –te)/s

 In this example z = (52-48.33)/3.32 i.e. 1.01

 Look up in table of z values –see next overhead

26
GRAPH OF Z VALUES

27
PERT
 PERT Technique uses the following three-step method
for calculating the probability of meeting or missing a
target date
 Calculate the standard deviation for each activity
 Calculate the z value for each activity that has a target date
 Convert z values into probabilities

 Advantages of PERT
 Which activity has great uncertainty

28
MONTE CARLO SIMULATION
 An alternative to PERT.
 Quantitative Risk analysis.

 A class of general analysis techniques:

 Valuable to solve any problem that is complex, nonlinear, or
involves more than just a couple of uncertain parameters.
 Monte Carlo simulations involve repeated random sampling
to compute the results.
 Gives more realistic results as compared to manual
approaches.

29
THANK YOU

30