Risk Management Planning

1
Risk Management Planning

• Similar to security analysis
• Identify threats
• Prevent threats
• Detect threats (not trivial with information
  systems!)
• Mitigate (reduce) the effects of the threats

2
Risk Resolution

• Avoid the risk (have someone else do it)
• Transfer risk to another area (e.g. redesign)
• Investigate the risk to better understand it
  (e.g. use prototype or consultant to clarify)
• Eliminate the cause of the risk (defect
  prevention)
• ...

3
Risk Resolution

• Assume the risk will occur and cope with minor
  impact
• Publicize the risk - well known risks are easier
  to avoid, and less shocking if they do occur
• Control the risk - implement mitigation strategy
• Remember the risk - keep lessons learned!

4
Risk Monitoring

• Develop and maintain top 10 risk list
• Conduct postmortems after each major project
  event (milestone) - collect and record lessons
  learned
• Assign a risk officer - a devils advocate, if
  you will - to keep pestering with what if...
  situations
• Dont be afraid to discuss risks openly

5
Top 10 Risks List

• Develop a list of the ten most serious risks,
  their status, and mitigation plans
• Review and update each week
• Raises awareness of risks, and helps detect
  (identify) them

6
Risk Management Tasks

• Develop Risk Management Plan
• May take from one week to several months,
  depending on project size
• Results in approval of Risk Management Plan
• Update Risk List at a weekly status meeting
• Update existing risks, add new ones as needed
• Reevaluate Risk Management Plan every 3 months to
  year, depending on project size

7
Risk Management Tasks

• Be sure to account for the following ongoing risk
  management activities
• Risk identification (what could happen?)
• Risk management planning
• Risk analysis and prioritization (what would
  result?)
• Risk resolution (mitigation strategy)
• Risk monitoring (has it happened?)

8
Risk Management Tasks

• For each risk, describe
• Risk number, name, and description
• The Loss Hours, Probability, and Impact of each
  risk sorted by descending Impact
• How each risk will be prevented (keep it from
  happening), identified (know when it has
  happened), and mitigated (managed once it has
  happened)

9
Core Development Issues

• Examine system reliability versus the extent of
  distribution - where does it fit?
• Determine type of development needed - what are
  the key project constraints?
• Strong schedule constraints (rapid product
  obsolescence)
• Runaway prevention by a well managed project
• ...