Risk Management in Software Development Projects

1. Risk Managementin Software DevelopmentProjects Roberto Torres Ph.D. 11/6/01

2. Consider the following: • According to the Standish Group: • More than 52% of IT projects overrun schedules and budgets. • More than 31% are canceled. • Less than 17% are on time and on budget. • Other studies show failure rates for large scale SW projects as high as 85%.

3. Agenda • Definition of risk • Historical Background • Risk Management Basics • SEI Recommended Practices • Example

4. Definition of Risk • SEI uses the Webster’s definition of risk: Risk is the possibility of suffering loss

5. Historical Background • The origins of risk management • Insurance • Futures • Business adopts risk management • Loss Prevention • Security Consulting Services • Project Management adopts risk management • PMI • SEI

6. Risk Management Basics • The PMI defines the following Risk Management processes: • Risk Management Planning • Risk Identification • Risk Analysis • Risk Response Planning • Risk Response Monitoring and Control

7. The Risk Management Process Risk Management Planning Risk Identification Risk Response Monitoring and Control Risk Analysis Risk Response Planning

8. Risk Management Planning Risk Management Planning Risk Identification • Inputs: • Project charter and WBS • Risk management processes • Stakeholders risk tolerance • Risk roles and responsibilities • Output: • Risk Management Plan Risk Response Monitoring and Control Risk Analysis Risk Response Planning

9. Risk Identification Risk Management Planning Risk Identification • Inputs: • Risk Management Plan • Historical information • Risk categories • Outputs: • Risks • Triggers Risk Response Monitoring and Control Risk Analysis Risk Response Planning

10. Risk Analysis Risk Management Planning Risk Identification • Inputs: • Identified risks • Outputs: • Prioritized list of assessed risks including probability and impact. • Probabilistic analysis for the project* (*) Not required by SEI yet. Risk Response Monitoring and Control Risk Analysis Risk Response Planning

11. Risk Analysis (continued) Risk Management Planning Risk Identification • All risks are analyzed: • Probability • Impact • Expected loss • Probabilistic analysis: • It uses the information above to determine the likelihood of achieving the project’s objectives. Risk Response Monitoring and Control Risk Analysis Risk Response Planning

12. Risk Response Planning Risk Management Planning Risk Identification Risk Response Monitoring and Control Risk Analysis • Inputs: • List of prioritized risks • Probabilistic analysis of the project • Outputs: • Risk response plan (mitigation and contingency plans) • Financial impact of risk response planning Risk Response Planning

13. Risk Response Planning Risk Management Planning • Risk response options • Avoidance • Transference • Mitigation • Acceptance • (Monitor) Risk Identification Risk Response Monitoring and Control Risk Analysis Risk Response Planning

14. Risk Monitoring and Control Risk Management Planning Risk Identification • Inputs: • Risk Response Plan • Outputs: • Corrective actions • Updates to risk identification • Updates to risk management plan Risk Response Monitoring and Control Risk Analysis Risk Response Planning

15. SEI Recommended Practices • The SEI Risk Management Cycle • Identify • Analyze • Plan • Track • Control • Communicate

16. SEI Specific Goals • SG1 Prepare for Risk Management • Preparation for risk management is conducted. • SG2 Identify and Analyze Risks • Risks are identified and analyzed to determine their relative importance. • SG3 Mitigate Risks • Risks are handled and mitigated, where appropriate, to reduce adverse impacts on achieving objectives.

17. Example - schedules

18. Example (continued)

19. Example (continued)