1. Project Name: Web Content Management System for Macquarie University Macquarie University ITEC841-Project and Risk Management Semester 1, 2012 Presented to: Dr. Ian Krycer Group Project ITEC 841

2. BY: POOPAK ALAEIFAR 42431646 PART D: RISK MANAGEMENT PLAN

3. Introduction Introduction o Risk Likelihood (L) Descriptors o Risk Consequence (C) Descriptors o Risk Rating Assessment o Treatment of risk exposures for assets Risk Identification Risk Identification Risk Assessment and Controls Risk Assessment and Controls Risk Treatment Plan Risk Treatment Plan Outline:

4. Introduction Risk management for this project is concerned with the identifying specific risks (aware of the generic risks that affect virtually all IT projects) and planning to mitigate their effects and impacts on the whole project.

5. -Risk Likelihood (L) Descriptors DescriptionLikelihood of OccurrenceRating Common Highly likely. In most circumstances the event is expected to occur 5 Likely Strong possibility is there that the event will occur 4 Moderate Some time the event might occur 3 Unlikely There is not a strongly but minor possibility expected for the event occurrence 2 Rare It is very unlikely that the event occurs but may be happened in ordinary circumstances. Its occurrence is very unusual 1

6. Risk Consequence (C) Descriptors DescriptionImpact on Project, Financial LossRating Catastrophic Disastrous impact, huge financial loss 5 Major Major impact, major financial loss 4 Moderate Significant impact, high financial loss 3 Minor Minor impact, medium financial loss 2 Insignificant Negligible impact, low financial loss 1

7. Risk Rating Assessment DescriptionRisk Rating (C*L) Very High16 – 25 High12 – 15 Tolerable8 – 11 Low4 – 7 Very Low1 – 3

8. Treatment of risk exposures for assets OptionOutcomeOption rationale Acceptance Accept and retain the exposure to risk. An entity may choose to make an informed decision to accept a risk associated with asset ownership. Risk Mitigation Manage the effect of exposures to risk and losses This involves developing asset solutions and controls that prevent or reduce the likelihood of a risk occurring or limit the consequence it should occur. Avoidance Avoidance Avoid or reject the exposure to risk. An entity may make a decision to not expose the organisation to the potential risk resulting from asset ownership, by, for example, leasing it. Risk Sharing Share the risk exposure with another party. An entity may also share the effects of exposure to risks if it is unable to manage them, through partnering arrangements (joint ventures, etc) and contracts (outsourcing, etc).

9. Risk Identification R1: Lack of stakeholder consensus R1: Lack of stakeholder consensus R2: Problems in data migration R2: Problems in data migration R3: Inadequate time for the adoption of the new system R3: Inadequate time for the adoption of the new system R4: Lack of detailed (and measurable) requirements R4: Lack of detailed (and measurable) requirements R5: Lack of documentation for existing websites R5: Lack of documentation for existing websites R6: Change in requirements for the new system R6: Change in requirements for the new system R7: Inadequate manpower R7: Inadequate manpower R8: Delay in adoption due to unfamiliarity with the new platform R8: Delay in adoption due to unfamiliarity with the new platform

10. Risk Identification R9: Organizational Change R9: Organizational Change R10: Not enough consideration to Internal users’ expectation from new system R10: Not enough consideration to Internal users’ expectation from new system R11: Users are reluctant to change and use new system R11: Users are reluctant to change and use new system R12: Too many bugs in the final system R12: Too many bugs in the final system R13: Usability issues with the final system R13: Usability issues with the final system R14: R1Slow progress due to the limitations of the target platform R14: R1Slow progress due to the limitations of the target platform R15: University is unable to save the amount of money that it expected R15: University is unable to save the amount of money that it expected

11. Risk Assessment and Controls Risk ID Risk DescriptionSource Event (What can happen?) Existing Control(s)ConsequenceLikelihoodRisk Level R1 Lack of stakeholder consensus Stakeholders The stakeholders do not agree on the scope and objectives of the project and they have different requirements of the CMS  Have a complete proposal including requirements for the project  Interview with all the stakeholders to collect their expectation from the project Catastrophic LikelyVery High R2 Problems in data migration Technical Resources The process of data migration from the old to the new system is complex and time-consuming so delay may occur Use best practices Catastrophic LikelyVery High R3 Inadequate time for the adoption of the new system Management/ Requirement Risk Schedule flaws will happened Have a time schedule for the project based on the estimation Catastrophic LikelyVery High R4 Lack of detailed (and measurable) requirements Requirement Risk The requirements of the project are unclear and immeasurable therefore:  the priority of requirements will be undetermined  implementation may not be successful  success of project will not be recognizable because of having no measurable requirements Have a template for the document of requirements MajorLikelyVery High

12. Risk Assessment and Controls Risk ID Risk DescriptionSource Event (What can happen?) Existing Control(s)ConsequenceLikelihoodRisk Level R5 Lack of documentation for existing websites Stakeholders and Users No access to background information that explains how the existing websites for various departments work so the new website may not provide all requirements and functionalities, new requirements may appear during the implementation Have a complete proposal for the project to clarify the demands of documentation MajorLikelyVery High R6 Change in requirements for the new system Stakeholders / Requirements Delay may occur as the new requirements should be provided, complexity and new scope of project may increase Have a complete Requirements Management Plan MajorModerateHigh R7 Inadequate manpower Human Resource Risks Lack of team members to perform the planned tasks may cause the schedule not to be proceeded on time and accurate Get a commitment from the sponsors that project will get the required manpower that it needs Moderate Tolerate

13. Risk ID Risk DescriptionSource Event (What can happen?) Existing Control(s)ConsequenceLikelihoodRisk Level R8 Delay in adoption due to unfamiliarity with the new platform Users The users do not have enough knowledge to use the new system effectively so adoption with that may need more time and the project deadline may not be met Provide help module for using the system Moderate Tolerate R9 Organizational Change Stakeholders The organizations related to the project may change during the project and the changes may affect the priority of the project or the allocated budget after it is underway -Moderate Tolerate R10 Not enough consideration to Internal users’ expectation from new system Users Some specific functionalities involved with Internal users may missed to be focused, so the new system may be useless A complete Requirements Management Plan ModerateLikelyHigh R11 Users are reluctant to change and use new system Users Users may be resistance on using their current system and job and don’t want to take time on learning how to use the new system so the process of training users and adoption to new system may be need more times Establish auditing and meeting sessions to clarify all the requirement MajorLikelyVery High Risk Assessment and Controls

14. Risk ID Risk Description Source Event (What can happen?) Existing Control(s) Consequenc e LikelihoodRisk Level R12 Too many bugs in the final system Technical Risk/ Management Risk Too many bugs (poor product quality) and no time to correct them until the release so new website will have a poor structure and many required features may not work as expected and Websites of various departments hosted on the new system are buggy -MajorModerateHigh R13 Usability issues with the final system Technical Risk The new website may not provide all the visitors’ request and the visitors may not feel satisfaction using it. -Moderate Tolerate R14 Slow progress due to the limitations of the target platform Technical/ Operational Risk The progress of project may not be acceptable for the stakeholders, due to large amount of functionalities that should be coded for the users also some functionalities may not be provided or may be provided late by the project -Moderate Tolerate R15 University is unable to save the amount of money that it expected Resource/Cost Risk The adoption of the new system is slower than expected and different departments continue to maintain their websites and IT staff. As a result, the financial benefits outlined in the business case may not be realized in the expected time frame. Cost estimation and control ModerateLikelyHigh Risk Assessment and Controls

15. Risk Treatment Plan Risk ID Risk DescriptionRisk RatingRisk TreatmentMitigation Strategies Risk rating after treatment/ controls R1 Lack of stakeholder consensus Very HighRisk Mitigation  Have a consensus-based* decision-making process to achieve the highest level of consensus  Make an improved proposal after listening carefully to all the stakeholder’s interests Low R2 Problems in data migration Very HighRisk Mitigation  The data migration team should start their work earlier  Have a test mechanism for the work Low R3 Inadequate time for the adoption of the new system Very HighRisk Mitigation Have a plan for assess and carefully estimate the requirement times for each tasks before delivering the proposal Tolerate

16. Risk Treatment Plan Risk ID Risk Description Risk RatingRisk TreatmentMitigation Strategies Risk rating after treatment/ controls R4 Lack of detailed (and measurable) requirements Very HighRisk Mitigation Develop a clear understanding of the requirements Low R5 Lack of documentation for existing websites Very HighRisk Mitigation  Have a complete proposal for the project to clarify the demands of documentation  Using best practices in requirements management and collaborate with stakeholders and users in this matter Tolerate R6 Change in requirements for the new system HighRisk MitigationHave a requirement traceability matrixLow R7 Inadequate manpower TolerateRisk Mitigation Have a plan to assess each resources for project including the consequences of lack of each of them and their alternative mechanisms Low

17. Risk Treatment Plan Risk ID Risk Description Risk RatingRisk TreatmentMitigation Strategies Risk rating after treatment/ controls R8 Delay in adoption due to unfamiliarity with the new platform TolerateRisk Mitigation Provide training support for the new system Low R9 Organizational Change TolerateRisk Mitigation Define the expected impacts of this risk on project and compensate mechanisms of them in advanced ** Low R10 Not enough consideration to Internal users’ expectation from new system HighRisk Mitigation Communicate with internal users, gathering their points and expectations from new system, and involve their functionalities while using the current system Low R11 Users are reluctant to change and use new system Very HighRisk Mitigation  Provide a clear list of system feature and documents of what system can do for them  Have demos of the new system Tolerate

18. Risk Treatment Plan Risk ID Risk DescriptionRisk RatingRisk TreatmentMitigation Strategies Risk rating after treatment/ controls R12 Too many bugs in the final system HighRisk Mitigation Have a testing mechanisms to reduce and control bugs in different levels of project Low R13 Usability issues with the final system TolerateRisk Mitigation Have a user interface (UI) consultant to look into UI design related tasks Low R14 Slow progress due to the limitations of the target platform TolerateRisk Mitigation Have a plan to train staffs to be comfortable with the technologies Low R15 University is unable to save the amount of money that it expected HighRisk Mitigation Have a strong leadership from top management. The university policy may dictate that all websites should be moved to the new system within a specified period of time and no department should continue to retain its own IT staff after that period Tolerate