Software Project Management SPM

1
Software Project Management (SPM)

• Lecture 8
• Risk Management
• Dr. Daniel Keret

2
Reading Assignment

• Software Project Management, Bob Hughes and Mike
  Cotterell, McGraw-Hill, 3rd Edition.
• Chapter 7
• A Guide to the Project Management Body of
  Knowledge, PMI Publications, 3rd Edition, 2004
• Chapter 11

3
Risk ManagementRisk Management

• Risk Management Planning
• Risks Identification
• Quality Quantity Risk Analysis
• PERT
• Categories, Probabilities, Impact
• Response Planning
• Avoid, Transfer, Mitigate
• Strategies for Positive Risks Opportunities
• Risk Monitoring and Control

4
Risk Identification Example of a Risk Breakdown
Structure (RBS)
5
Risk Breakdown Structure (RBS)

• Make sure the detailed RBS will include
• Application Factors Size, Safety-Critical,
  Distributed System, Etc.
• Staff Factors Experience, Skills, Level of
  Staff, Staff Turnover, Etc
• Implementation Factors Conversion, Phased
  Implementation VS Cutover.
• Suppliers Factors Reliability, Delays, Level of
  Integration with the Project Plan, Reporting,
  Etc.
• New Technology Factors H/W, Software, Tools

6
Risks Identification Tools and Techniques

• Requirements and Assumptions Documentations
  Reviews The Level of Quality, Consistency and
  Completeness of the Project Documents
• Information Gathering - Brainstorming,
  Interviewing, SWOT analysis (Strength,
  Weaknesses, Opportunities and Treats)
• Root Cause Identifications - different risks can
  emerge from the SAME root cause
• Checklist Analysis - historical information,
  other sources of information
• Assumptions Analysis - Validity of the
  Assumptions
• Interdependencies and Process Flowcharts Analysis

7
Risk Registration

• List of Identified Risks
• List of potential responses
• Root Cause of Risks
• Risk Impact on Project Objectives
• Updated RBS

8
Qualitative Risk Analysis

• Basic Risk Ranking Matrix
• Deal separately with each project objective
  Cost, Time, Scope and Quality
• Rank Very High, High, Medium, Low and Very Low to
  the Importance/Threat and Likelihood/Probability
  of each risk.
• In Decision Stage Deal with risks that are ranked
  high and Very High on both importance and
  likelihood.
• In Planning and Execution Stages Deal With Risks
  with Very High Probability from Medium/Low
  Importance. Low Probability Risk will be dealt if
  it has Very High Threat Grade.

9
Qualitative Risk Analysis - Output

• Relative Ranking and Priority List
• Grouping by Categories Common Root Cause,
  Common Project Area
• Risks requires response in the near-term
• Risks that need additional analysis
• Low priority risks
• Trends in risk analysis results detect
  recurring risk for in-depth analysis and handling

10
PERT Program Evaluation and Review Technique

• Deals with uncertainty of task duration estimates
• Useful for expensive, high risk, state-of-the-art
  projects
• The method is very similar to CPM with different
  approach to time estimates
• Each Activity requires 3 durations estimates
• Most Likely T(M), Optimistic T(O), Pessimistic
  T(P)
• The Expected Duration that is used in the network
  graph is T(E) T(O) 4T(M) T(P) / 6
• The Activity Standard Deviation Defined as
  S T(P) T(O) / 6
• Total Standard Deviation of Activity R Calculate
  the SQR(SIGMA(S2)) for all the Ss that are
  included in the path from the start activity to
  R. If there is more then one path choose the
  maximum value.

11
Quantitative Risk Analysis

• Risk and NPV - add risk factor to the discount
  rate
• RE (Risk Exposure) Risk Probability x Risk
  Impact (expected additional cost to handle the
  risk when it will occur, usually later project
  changes results with greater cost)
• Decision Trees Evaluate 2 Alternatives
• The risk event WILL be handled upfront
• The risk event WILL NOT be handled upfront
• It will be handled only if it will occur
  (calculate RE)
• Compare the costs of the two alternatives.
• Risk Profile Analysis - change the risk factor,
  e.g. by /-5 and recalculate the costs. Evaluate
  the the sensitivity to the change. Focus on
  highly sensitive risks

12
Quantitative Risk Analysis (Cont.)

• Risk Reduction Leverage (RRL) RE(before risk
  mitigation activity) RE (after risk mitigation
  activity) / risk reduction cost
• Focus on risks with large RRL value.
• Stakeholders Risk Tolerance The Project
  Probability Level that the project will meet its
  goals (cost, time,quality, scope), acceptable by
  the corporate.
• Use PERT
• Locate the activities with defined
  target/milestone/goal.
• Z value is the number of Standard Deviations
  between the Stakeholders Targets (T) and the
  Expected Target.
• For Schedule Z (T T(E))/S
• Convert Z to the probability of not meeting the
  target (use standard normal deviates graph found
  in statistical textbook)
• If the probability is ABOVE the stakeholders risk
  tolerance, then the project should reduce the
  Risk Exposure by executing Risk Response Plan.

13
Response Planning

• Risk Response Planning
• Developing Options, Determining Actions to reduce
  Risks to the project objectives
• Addresses the risk by their PRIORITY
• Select the best response
• Insert Resources, Activities, Schedule Changes
  and Budget to the Project Plan
• Types of Risk Handling
• Avoid Changing the Project Plan to Eliminate the
  thread
• Transfer Move the risk to a 3 Party. Examples
• A Party that can better handle the risk (probably
  with additional cost)
• Use contractual agreements like fix price project
  when there is a cost risk.
• Mitigate Reduction of the Risk
  Probability/Threat by upfront activities.

14
Strategies for Positive Risks - Opportunities

• Risk with Potentially Positive Impact on the
  project
• These Risks should be monitored and managed in
  order not to miss potential project gains
• Strategies
• Exploit Eliminate the uncertainty ( assign more
  talented employees, etc)
• Share Joint Venture, Sharing with best fit
  3-party
• Enhance Increase the probability and/or the size
  of the positive impact by upfront action items.

15
Risk Monitoring and Control

• Inputs Risk Management Plan, Risk Registration,
  approved Change Requests, Work Performance
  Information and Reports.
• Tools Techniques
• Risks Reassessment ( Ongoing Process)
• Status Meetings
• Risk Audits ( Audit the effectiveness of the Risk
  Response Plan)
• Technical Performance Measurements and Reserve
  Analysis
• OutputsUpdated Risk Register, Requested Changes,
  Recommended Corrective Actions,Update Project
  Management Plan