Risk Management Process

04/19/23 1

Risk ManagementProcess

04/19/23 2

Augustine’s Law of Counter Productivity

« It costs a lot to build bad products »

04/19/23 3

Contents

1. Challenges to a project

2. Participants to Risk management

3. Risk management process steps

Source: TBD

04/19/23 4

Challenges to a Project1. Risk exists among opportunities2. Adequate plans must be maintained

– Continually update plan to reduce risk3. Must have capability to execute plans

– Resources, process, training, experience4. Project objectives must be met

– Customer needs, product requirements5. Decisions must be based on a balance between

risks and benefits

----> There is a need to manage risk

04/19/23 5

Risk Management along the Life Cycle

FUNCTIONAL BASELINE

ALLOCATED BASELINE

DEVELOPMENT CONFIGURATIONS

PRODUCT BASE LINE

System Reqmts Analysis

System Design

Hardware Rqmts. Analysis

Preliminary Design

Detailed Design

Fabrication

HWCI Testing

System Integration and Testing

Testing and Evaluation

Production and Development

FCA PCA

FQR

PDR

Hardware (HWCI) D

evelopment

CSCI Testing

CSC Integration

and Testing

Coding and CSA

Testing

Detailed Design

Preliminary Design

Software Rqmts.

Analysis

SOFTWARE (CSSI) DEVELOPM

ENT

TRR

CDR

PDR

SSRSRR SDR

FCA PCA

REVIEWS SRR - System Requirements Review SDR - Systems Design Review SSR - Software Specification Review PDR - Preliminary Design Review CDR - Critical Design Review TRR - Test Readiness Review

PCA - Physical Configuration Audit FQR - Formal Qualification Review

may be integrated with hardware reviews

CDR

From Figure 1 of DoD-Std.-2167A

04/19/23 6

Participants to Risk Management

1. Project members

2. Support groups (finance, MIS, marketing)

3. Senior management

4. Customer support

5. Customer

6. Partner

7. Supplier

04/19/23 7

Components of Plan1. Requirements

– Quantitative and qualitative

2. Schedule3. Description of work to be performed4. Budget5. Processes

– technical, communication, reporting, training, decision making, etc

6. Resources

04/19/23 8

When are Plans Complete ?

If the act of performing to the plans and only to the plans will logically produce the product the customer wants, when he wants it, for a pre-defined cost.

04/19/23 9

Risk Management Questions

1. What could go wrong with the plan ?

2. How likely is it ?

3. What could be the consequences ?

4. What can I do about it?

5. Are things getter better or worst ?

04/19/23 10

Risk Management Process Steps

1: Identify Potential Risks

2: Analyze risks

3: Develop risk reduction plans

4: Communicate & track risks

04/19/23 11

Step 1: Identify Potential Risks

1. Assess resource & Process readiness & plan & adequacy

2. Assess capability to achieve clear project objectives

Identify undocumented requirements, tasks, assumptions

3. Collect & integrate potential risks

04/19/23 12

• Risk Identification Methods– Interviews, questionnaires– Risk templates– Integrated scheduling– Trend and failure analysis– Lessons learned– Risk checklists– Pareto charts– Fishbone (Cause and effect diagram)


04/19/23 13

Graybeards & Previous PMs

• Pool of talent and experience– What worked, what didn’t– Why

• Variety of Forums– Technical Issues Briefs– Special Groups/Gatherings

• “If I knew then what I know now…”

04/19/23 14

• Risk Areas for Generating Risk Checklists1. Plans2. Requirements3. Materials4. Suppliers5. Schedules6. Costs7. Personnel8. Training9. Facilities10. Processes11. Alignment with customer12. Technology, politic, regulations, etc


04/19/23 15

• Key risk clues1. Not sure2. Don’t know3. May…might..could4. Complexity5. Dependency6. New7. ‘ Can-do ’8. Hopefully9. Probably


04/19/23 16

• Description of the Risk– Should be a complete sentence which includes:

• Source of uncertainty (e.g. if …)• Potential consequence (e.g. ...then …)• Example

– Source: Management views a member’s project- related responsibilities as a higher priority than process improvement - related responsibilities.

– Consequence: When schedules clash, members will be pulled from the improvement effort. The team’s schedule will slip, momentum will be lost, and morale will suffer.


04/19/23 17

• Risk Identification Worksheet


Risk ID: Factor type: Report date:Probability: Loss: Risk Exposure:Description of Risk:

Current Management Plan:

Date Started: Date to Complete:Status./measures:

Contingency plan:

Trigger value:

04/19/23 18

1. Select analysis type (Quantitative - Qualitative)

2. Determine likelihood and consequence using criteria

3. Determine risk level

4. Collect and integrate risk assessments

Step 2: Analyze Risks

04/19/23 19

• Quantitative Versus Qualitative– Quantitative: expressible as a specific quantity

or amount, usually numerically• e.g. the water is flowing at 20 KPH

– Qualitative: characterized by a description of the fundamental nature of an item. Potentially different for each observer.

• e.g. the pattern is random


04/19/23 20

• Likelihood Criteria - no mitigation plans– Low

• Proven approach or design, problem very unlikely to occur

– Moderate• Partially demonstrated approach or design

– High• Speculative approach or design, or ‘ To be

determined ’


04/19/23 21

• Likelihood Criteria - with approved mitigation plans– Low

• Proven or completely mitigated by an approved plan

– Moderate• Partially demonstrated or somewhat mitigated by

approved plan

– High• Speculative with no identified mitigation plan


04/19/23 22

• Consequence criteria– Low

• Little or no impact

– Moderate• Major problems that could be tolerated

– High• Major crisis that could result in project termination

if not mitigated


04/19/23 23

Step 2: Analyze RisksTop 10 Risk Analysis Chart Project Name:

Date:

ID - numeric identifier of the risk Risk Exposure - product of probability and lossRisk Item - describe the potential problem Risk Management Approach - action planned to mitigate riskProb - probability it will arise Who - person responsible for the actionLoss - relative loss potential (range of 1 through 10) Date - date by which to complete

RiskID Risk Item [unsatisfactory outcome] ProbLoss Exp Risk Management Approach Who Date

1

2

3

4

5

6

7

8

9

10

04/19/23 24

• Risk levels– Low risk

• No specific action required to reduce risk

– Medium risk• Special project emphasis and close monitoring will

probably be sufficient to overcome potential difficulties

– High risk• Special action needs to be taken as soon as

possible.Some or much negative impact to the project might still occur.


04/19/23 25


Probability of

Occurrence

Impact- Consequence

Low

Medium High

04/19/23 26

US F-18 Program Risk AnalysisL

ike

lih

oo

d

What Is the Likelihood the Risk Will Happen?

Not Likely:

Low Likelihood:

Likely:

Highly Likely:

Near Certainty:

Your Approach and Processes...

...Will effectively avoid or mitigate this risk based on standard practices

...Have usually mitigated this type of risk with minimal oversight in similar cases

...May mitigate this risk, but workarounds will be required

...Cannot mitigate this risk, but a different approach might

...Cannot mitigate this type of risk; no known processes or workarounds are available

1

2

3

4

5

Level

Given the risk is realized, what would be the magnitude of the impact?

Co

nse

qu

ence

Level Technical Schedule Cost

1 Minimal or no impact Minimal or no impact Minimal or no impact

2 Minor performance Additional activities Budget increase orshortfall, same required; able to meet unit production costapproach retained key dates increase <1%

3 Moderate performance Minor schedule slip; Budget increase orshortfall, but work- will miss need date unit production costarounds available increase <5%

4 Unacceptable, Program critical path Budget increase orbut workarounds affected unit production costavailable increase <10%

5 Unacceptable; no Cannot achieve key Budget increase oralternatives exist program milestone production cost

increase >10%

Lik

eli

ho

od

5

4

3

2

1

Consequence54321

High

Medium

Low

Xxxxx Xxxx 800-555-5555 x 5555Yyy Yyyy 888-555-5555Zzzz Zzzzzz 800- 555-5555Aaa Aaaaa 800- 555-5555Bbbbbb Bbb 800- 555-5555

Questions about Risk Management? Call a member of the Risk Mgmt Team

04/19/23 27

Step 3: Develop Risk Reduction Plans

1. Select risk reduction technique2. Develop specific risk reduction

plan3. Estimate impacts and prepare

planning changes4. Approve risk reduction plans

& implement planning changes

04/19/23 28

• Risk reduction strategies1. Avoid risk, e.g. choosing an alternative path

2. Control-mitigate risk: reduce probability-impact• Example: feature creep

– Incremental development practices

– Design for change

3. Assume risk: plan a contingency

4. Transfer risk• e.g. get someone else to assume: Insurance policy

5. Reduce uncertainty• Examples: Parallel development, Multiple suppliers

Step 3: Develop Risk Reduction Plans

04/19/23 29

Step 4: Communicate & Track Risks

1. Communicate Risk & Plan status and compare Plans Vs actuals

2. Iterate Risk management process

3. Update risk database

4. Update risk reduction reports

04/19/23 30

Risk Management Cannot

1. Identify all risks (e.g. unknown risks)

2. Minimize or eliminate all known risks

3. Guarantee best course of action is always chosen

4. Provide early warning of all problems

5. Compensate for poor planning

6. Work in spite of a lack of commitment

04/19/23 31

1. Minimize or eliminate many risks2. Highlight areas of uncertainty and false

confidence3. Help to decide best course of action4. Provide early warning of many

problems5. Provide basis for plan changes6. Increase management and customer

confidence

Risk Management Can

04/19/23 32

Review

1. Challenges to a project

2. Participants to Risk management

3. Risk management process steps

Documents

Risk Management Process