Risk & Risk Management
Risk management
• Risk management is concerned with identifying risks and drawing up plans to minimise their effect on a project.
• A risk is a probability that some adverse circumstance will occur – Project risks affect schedule or resources;– Product risks affect the quality or performance of
the software being developed;– Business risks affect the organisation developing
or procuring the software.
The risk management process
• Risk identification– Identify project, product and business risks;
• Risk analysis– Assess the likelihood and consequences of these
risks;• Risk planning
– Draw up plans to avoid or minimise the effects of the risk;
• Risk monitoring– Monitor the risks throughout the project;
The risk management process
Risk avoidanceand contingency
plans
Risk planning
Prioritised risklist
Risk analysis
List of potentialrisks
Riskidentification
Riskassessment
Riskmonitoring
Risk identification
• Technology risks.• People risks.• Organisational risks.• Requirements risks.• Estimation risks.
Risk analysis
• Assess probability and seriousness of each risk.
• Probability may be very low, low, moderate, high or very high.
• Risk effects might be catastrophic, serious, tolerable or insignificant.
Risk analysis (i)
Risk Probability Effects
Organisational financial problems force reductions inthe project budget.
Low Catastrophic
It is impossible to recruit staff with the skills requiredfor the project.
High Catastrophic
Key staff are ill at critical times in the project. Moderate Serious
Software components that should be reused containdefects which limit their functionality.
Moderate Serious
Changes to requirements that require major designrework are proposed.
Moderate Serious
The organisation is restructured so that differentmanagement are responsible for the project.
High Serious
Risk planning
• Consider each risk and develop a strategy to manage that risk.
• Avoidance strategies– The probability that the risk will arise is reduced;
• Minimisation strategies– The impact of the risk on the project or product
will be reduced;• Contingency plans
– If the risk arises, contingency plans are plans to deal with that risk;
Risk management strategies (i)
Risk Strategy
Organisationalfinancial problems
Prepare a briefing document for senior managementshowing how the project is making a very importantcontribution to the goals of the business.
Recruitmentproblems
Alert customer of potential difficulties and thepossibility of delays, investigate buying-incomponents.
Staff illness Reorganise team so that there is more overlap of workand people therefore understand each other’s jobs.
Defectivecomponents
Replace potentially defective components with bought-in components of known reliability.
Risk management strategies (ii)
Risk Strategy
Requirementschanges
Derive traceability information to assess requirementschange impact, maximise information hiding in thedesign.
Organisationalrestructuring
Prepare a briefing document for senior managementshowing how the project is making a very importantcontribution to the goals of the business.
Databaseperformance
Investigate the possibility of buying a higher-performance database.
Underestimateddevelopment time
Investigate buying in components, investigate use of aprogram generator
Risk monitoring
• Assess each identified risks regularly to decide whether or not it is becoming less or more probable.
• Also assess whether the effects of the risk have changed.
• Each key risk should be discussed at management progress meetings.
Risk Management
• Risk = Something that may happen.A Possible Danger or Threat.
• Issue = Something that exists or already has happenedA Problem or Concern
Risk Management Process
IdentificationList potential risk name, detail, and Impact
ClassificationRisk CategoryManagement Financial/Commercial Technical & Specs Procurement Legal Quality Assurance Supplier External Inter Prog Dependency Human Resources Strategic Change ManagementPolitical Timescale CostSpecifications Training & User Availability Performance Patient
Probability of Occurrence Criteria
Very low Virtually impossible: 0 – 5%
Low Low but not impossible: 6 – 20%
Medium Fairly likely to occur: 21 – 50%
High More likely to occur than not: 51 – 80%
Very High > 81%
Schedule Impact Score Criteria
Very low 1 No or little effect on schedule: <2 weeks
Low 2 Small schedule slip: 2 - 4 weeks
Medium 3 Significant slip: 5 - 8 weeks
High 6 Large delay: 9 - 12 weeks
Very High 10 Major delay: > 12 weeks
Cost Impact Score Criteria
Very low 1 Negligible effect on costs: 0 - 3%
Low 2 Small increase: 3 – 10%
Medium 3 Significant increase: 10 - 30%
High 6 Large increase: 30 - 50%
Very High 10 Major increase: >50%
Performance Impact Score Criteria
Very low 1 Cosmetic impact only.
Low 2 Minor elements not available and limited area impact.
Medium 3 Significant elements not available and/or wide area impact.
High 6 Major elements of functionality or performance not provided.
Very High 10
Major elements of functionality or performance not provided widespread impact.
Scoring
Risk Ownership & Mitigation
•Avoidance - prevent the risk occurring•Transfer - pass the risk to the party best equipped to deal with it, typically an escalation•Acceptance - accept the risk as defined.•Control - recognise the risk, take actions to deal with it, understand the expected results of these actions and when their effectiveness can be reviewed•Investigation - not a comprehensive response on its own, but often required to more fully define the risk or develop alternative handling actions.
Brainstorm & Decide a course of action to Mitigate or nullify the Risk
Allocate an owner and person responsible for carrying out actions to nullify Risk.
Agree and Record Timescale for mitigation.
Monitor Results and repeat process if necessary.
Risk Management in Export-import Business
• Risk is a fact of business life, more so of international business.
• The Management of International business is the management of risk.
• Important business transactions should not happen without a full evaluation of the risks involved.
• Best business plans have been ruined by a miscalculation or a mistake, or an error in judgment that could have been avoided with proper planning.
Risk Management in Export-import Business
• Many types of risks can be insured against, including the risk of damage to the goods at sea, the risk of losing an investment in a developing country and many others.
Risk Management in Export-import Business
(1) Risk Assessment and the Firm’s Foreign Market Entry Strategy:
• When a firm is considering its entry or expansion in a foreign market, it must consider all options and decide on a course of action commensurate with its objectives, capabilities and its willingness to assume risk.
• Selling to a customer in another country results in less risk to the firm than licensing trademarks, patents and copyrights there.
Risk Management in Export-import Business
(2) Managing Distance and Communications: The risks of doing business in a foreign countryare different from those encountered at home. Potential Risks:-• greater distances; • problems in communications; • language and cultural barriers; • differences in ethical, moral and religious codes;• exposure to strange foreign laws and
government regulations; and different currencies.
Risk Management in Export-import Business
(3) Managing Currency and Exchange Rate Risks:
• Currency risk is risk a firm is exposed to as a result of buying, selling, or holding a foreign currency. Currency risk includes:
(i) Exchange Rate Risk(ii) Currency Control Risk(i) Exchange Rate Risk: Exchange rate risk
results from the fluctuations in the relative values of the foreign currencies against each other when they are bought and sold on international financial markets.
Risk Management in Export-import Business
(ii) Currency Control Risk: • Some countries, particularly developing
countries where access to ready foreign reserve is limited, put restrictions on currency transactions.
• In order to preserve the little foreign exchange that is available for international transactions, such as importing merchandise, these countries restrict the amount of foreign currency that they will sell to private companies.
• This limitation can cause problems for a U.S or any other country exporter waiting for payment from its foreign customer who cannot obtain the dollars needed to pay for the goods.
Risk Management in Export-import Business
(4) Special Transactions Risks in Contracts for the Sale of Goods:
• Special risks are inherent in international transactions for the purchase and sale of goods.
• These transactions present special risks to both the parties because the process of shipping goods and receiving payment between distant countries is riskier than within a country. Such risks are:
(i) Payment or Credit Risk(ii) Property or Marine Risk(iii) Delivery Risk(iv) Pilferage and Theft Risk
Risk Management in Export-import Business
(5) Managing Political Risk: • Political Risk is generally defined as the risk
to a firm’s business interests arising form political instability or political change in a country in which the firm is doing business.
• Political Risk includes risk derived from potentially adverse actions of Governments of the foreign countries in which one is doing business or whose laws and regulations one is subject to.
• It also includes laws and Government policies
Risk Management in Export-import Business
(6) Risks of Foreign Laws and Courts: • Many Acts that are perfectly legal in one
country can be illegal in another. Indeed, most travelers to a foreign country could conceivably break a host of laws and not even be aware of it.
• The same is true for the law of contracts, employment, competition, and other business laws.
Risk Management in Export-import Business
(7) Commercial Risks: The risks arising from suitability of the product for the market or otherwise change in supply and demand conditions and changes in price. Commercial risks arise due to:
• (i) Lack of Knowledge• (ii) Inability to adapt to the environment• (iii) Different kinds of situations to be dealt
with• (iv) Greater transit time involved
Risk Management in Export-import Business
(8) Cargo Risk: • Transit disasters are an ever present hazard
for those engaged in Export-Import business. • Every shipment runs the risk of a long list of
hazards such as storm, collision, theft, leakage, explosion, spoilage etc. It is possible to transfer the financial losses resulting from perils of and in transit to underwriters.
• Every importer/exporter should have an elementary knowledge of marine insurance to get the protection required