Chapter 8 Managing Project Risk Copyright 2012 John Wiley & Sons, Inc. 8-1

PMBOK ® Risk Management Processes Plan Risk Management  Determining how to approach and plan the project risk management activities. An output of this process is the development of a risk management plan. Identify Risks  Deciding which risks can impact the project. Risk identification generally includes many of the project stakeholders and requires an understanding of the project’s goal, as well as the project’s scope, schedule, budget, and quality objectives. Perform Qualitative Risk Analysis  Focusing on a qualitative analysis concerning the impact and likelihood of the risks that were identified. Perform Quantitative Risk Analysis  Using a quantitative approach for developing a probabilistic model for understanding and responding to the risks identified. Plan Risk Responses  Developing procedures and techniques to reduce the threats of risks, while enhancing the likelihood of opportunities. Monitor and Control Risks  Providing an early warning system to monitor identified risks and any new risks. This system ensures that risk responses have been implemented as planned and had the effect as intended. 8-2

IT Project Risk Management Processes 8-3

Risk Planning Requires firm commitment by all stakeholders to a RM approach Assures adequate resources are in place Focuses on preparation 8-4

Risk Identification Tools & Techniques Nominal Group Technique Checklists SWOT Analysis Cause & Effect (a.k.a. Fishbone/Ishikawa) 8-5

8-6 Risk Analysis & Assessment Can’t respond to all risks! Depends on Stakeholder risk tolerances

Risk Analysis & Assessment Qualitative Approaches 8-7

A B A*B Schedule RiskProbability Payoff (In thousands) Prob * Payoff (In thousands) Project completed 20 days early5% $ 200$10 Project completed 10 days early20% $ 150$30 Project completed on Schedule50% $ 100$50 Project completed 10 days late20% $ -$0 Project completed 20 days late5% $ (50)($3) 100% $88 Payoff Table The Expected Value 8-8

Decision Tree Analysis 8-9

% 0-10 P*I Risk (Threats) ImpactScore Key project team member leaves project Client unable to define scope and requirements Client experiences financial problems Response time not acceptable to users/client Technology does not integrate with existing application Functional manager deflects resources away from project Client unable to obtain licensing agreements Risk Impact Table 8-10 Rank

Risk Analysis & Assessment Quantitative Approaches Quantitative Probability Distributions  Discrete Binomial  Continuous Normal PERT TRIANG 8-11

Binomial Probability Distribution 8-12

Normal Distribution 8-13

Normal Distribution Rules of thumb with respect to observations Approximately… % + 1 standard deviations of mean 95% + 2 standard deviations of the mean 99% + 3 standard deviations of the mean

8-15 PERT Distribution

8-16

Simulations Monte Carlo  Technique that randomly generates specific values for a variable with a specific probability distribution  Goes through a number of trials or iterations and records the outcome ® An MS Project ® add in that provides a useful tool for conducting risk analysis of your project plan

Monte Carlo Simulation 8-18

Risk Strategies 8-19

Contingency and Fallback Plans, Contingency Reserves 20

Risk Strategies Depend On 8-21

Risk Monitoring & Control 8-22

Controlling Risks 23

Risk Response Plan should include: A trigger which flags that the risk has occurred An owner of the risk (i.e., the person or group responsible for monitoring the risk and ensuring that the appropriate risk response is carried out) A response based on one of the four basic risk strategies Adequate resources 8-24

Risk Evaluation Lessons learned and best practices help us to:  Increase our understanding of IT project risk in general.  Understand what information was available to managing risks and for making risk-related decisions.  Understand how and why a particular decision was made.  Understand the implications not only of the risks, but also the decisions that were made.  Learn from our experience so that others may not have to repeat our mistakes. 8-25