1. About …
Risk Management

2. What is Risk Management?
Who uses Risk Management?
How is Risk Management used?

3. Risk
Any anticipated unfavorable event or circumstance that can occur while a project is underway
If a risk becomes true it can hamper the successful & timely completion of a project.

4. Risk management Two definitions of risk:
Risk is the possibility of suffering loss
Risk management collects techniques, know-how and process to help identify, assess, manage, and monitor risks

5. Risk Management … is used in several fields: Finance Insurance
Engineering (safety critical, security, …) …
… and various techniques (FMEA, FTA, simulation, …) have been defined and adopted to assess it.

6. What is Risk Management?
Good management practice
Aims at reducing the impact of all kinds of risks that might affect a project
Process steps that enable improvement in decision making
A logical and systematic approach
Identifying opportunities
Avoiding or minimising losses

7. What is Risk Management?
Risk Management is the name given to a logical and systematic method of identifying, analysing, treating and monitoring the risks involved in any activity or process.

8. What is Risk Management?
Risk Management is a methodology that helps managers make best use of their available resources

9. Who uses Risk Management?
Effective Risk Management is a recognised and valued skill.
Educational institutions have formal study courses and award degrees in Risk Management.
The Risk Management process is well established. (International RM process standards.)

10. Essential activities in Risk Management
Risk Identification (RI)
Risk Assessment (RA)
Risk Containment (RC)

11. Identify the risks Monitor and review Communicate & consult
The Risk Management process: RI
Identify the risks
Defining types of risk, for instance, ‘Strategic’ risks to the goals and objectives of the organisation.
Identifying the stakeholders, (i.e.,who is involved or affected).
Past events, future developments.
Monitor and review
Communicate & consult

12. RI:Three types of risks
Project Risk is an event or condition that, if it occurs has positive or negative influence on an objective. It concerns budgetary, schedule, personnel, resource & customer related problems. An important project Risk is schedule slippage. The intangibility and invisibility of the s/w product is an important reason why s/w projects usually suffer from the risk of schedule slippage
Negative outcome: menace
Positive outcome: opportunity
Technical Risks concern potential design,implementation, interfacing, testing & maintenance problems. Also includes ambiguous/incomplete/changing specifications, obsolency etc.
Business risks include risks of building a product that no one wants, losing budgetary or personnel commitments, etc.

13. Analyse the risks Monitor and review Communicate & consult
The Risk Management process: RI
Analyse the risks
How likely is the risk event to happen? (Probability and frequency?)
What would be the impact, cost or consequences of that event occurring? (Economic, political, social?)
Monitor and review
Communicate & consult

14. Evaluate the risks Monitor and review Communicate & consult
The Risk Management process: RA
Evaluate the risks
Rank the risks according to management priorities, by risk category and rated by likelihood and possible cost or consequence.
Determine inherent levels of risk.
Monitor and review
Communicate & consult

15. RA Rank risks in terms of their damage causing potential.
Each risk is first rated in 2 ways:
The likelihood of a risk coming true (r )
The consequence of the problems associated with that risk (s)
Priority of each risk is computed as
p = r * s
where p is priority with which risk must be handled, r is the probability of the risk coming true and s is the severity of damage caused due to the risk becoming true.
More likely and damaging risks are handled first.

16. Evaluate the risks
You need to describe or to quantify exactly what the ‘Likelihood’ and ‘Consequence’ terms means to you.
This helps in ensuring a consistent approach in future risk assessment and review and monitoring.
It promotes a common understanding within the Administration.

17. Evaluate the risks
After establishing ‘Likelihood’ and ‘Consequence’ you can use a table like this to set a level of risk.
Extreme
Very high
Moderate
Low
Negligible
Almost certain
Severe
High
Major
Likely
Significant
Unlikely
Very low
Rare
Very Low
You must define what these risk levels mean to you.

18. The Risk Management process: RC
Treat the risks
Develop and implement a plan with specific counter-measures to address the identified risks.
Consider:
Priorities (Strategic and operational)
Resources (human, financial and technical)
Risk acceptance, (i.e., low risks)

19. Risk containment
After risks identified are assessed plans must be made to contain the most damaging and the most likely risks
Strategies
Avoidance: discuss with customer, reduce scope of work, give incentives to reduce manpower turnover etc.
Transfer the risk: get the risky component developed by a third party, or buy insurance etc.
Risk reduction: plan ways to contain the damage due to risk. Eg. If there is risk that a key personnel might leave, new recruitment may be planned.

20. Treating the risks
Low and very low level risks can normally be accepted, subject to on-going monitoring.
All other risks are included in the management plan.
The plan catalogues the risks, the level of risk, and describes a treatment.
The treatment is the action proposed, (and perhaps the resources allocated).

21. Development of Risk Profiles Compliance improvement
Treating the risks
Development of Risk Profiles
Targeted selections
Industry audits
Physical examination
Random examinations
Compliance improvement

22. Treating the risks
A common method of treating risks is to develop risk profiling and targeting systems.
This means – in the case of goods – selecting transactions for specific checks, according to trader, agent, origin of goods, commodity code, duty rate, routing, value, etc.

23. The Risk Management process:
Treat the risks
Document your risk management plan and describe the reasons behind selecting the risk and for the treatment chosen.
Record allocated responsibilities, monitoring or evaluation processes, and assumptions on residual risk.
Monitor and review
Communicate & consult

24. Risk Management policies and decisions must be regularly reviewed.
The Risk Management process:
Monitor and review
In identifying, prioritising and treating risks, organisations make assumptions and decisions based on situations that are subject to change, (e.g., the business environment, trading patterns, or government policies).
Risk Management policies and decisions
must be regularly reviewed.
Communicate & consult

25. The Risk Management process:
Monitor and review
Risk Managers must monitor activities and processes to determine the accuracy of planning assumptions and the effectiveness of the measures taken to treat the risk.
Methods can include data evaluation, audit, compliance measurement.
Communicate & consult

26. Structured Programming and Decision Logic
© Copyright 2000 by the Trustees of Indiana University

27. Major Topics Structured Programming Flowcharts (Logic Trees)
Decision Tables
Decision Trees
Decision Criteria

28. What is Structured Programming?
Discipline for organizing and coding programs.
Simplifies control paths so that programs can be easily understood and modified.
Uses basic control structures and modules that have only one entry point and one exit point.

29. Control Structures Basic Control Constructs Advanced Control Construct
Sequence Structure
Selection Structure
Iteration Structure
Advanced Control Construct
Case Structure

30. Sequence Construct Single steps or actions in the program logic
Statements executed in the order of appear- ance, with control passing unconditionally from one statement to the next.
The program executes Statement A followed by Statement B.
Initialize
Variables
Increment
Counter A B

31. Selection Construct
A decision point in a procedure in which the outcome of a stated condition determines which of two actions will be taken.
Tests a condition and executes one of the two alternative instruction sets based on the results of the test.

32. Selection Construct continuedY N
Hours > 40
Compute
Overtime
Regular
IF Hours is greater than 40
THEN
Compute Overtime Pay
ELSE
Compute Regular Pay
ENDIF

33. Iteration Construct
The logic pattern in programming in which certain actions are repeated whenever a specified condition occurs.
The cycle repeats until such time as the specified condition no longer occurs

34. Iteration Construct ~ Test Before Looping (WHILE)
Condi-
tion F
Perform
Process T
First, test the control condition
IF condition is true THEN perform the process ELSE continue with the program
Process loops back to the condition

35. Iteration Construct ~ Perform Before Testing (FOR - NEXT)
Process
Condi-
tion T F
A process (which may consist of one or more sequences) is executed.
The condition is tested
IF the condition is true THEN repeat the process ELSE continue the program

36. What are Logic Trees?
Logic Trees have been adapted from program flowcharts
They describe a procedure or program by specifying the sequence in which individual steps must be executed.
An ideal means for documenting complex algorithms so that users can refer to them as procedural guides

37. Flowchart Symbols Terminal (Start/Stop) Input/ Output Process Decision
or Test
Flow Line
Connector

38. Simple Example (Logic Trees)
Start
Print
Headings
Print
Number,
Square
EOF? B B N
Read a
Number
Stop
Procedure reads numbers from a
file and produces a Table of the
numbers and their squares. A

39. Structured English
Structured English is a technique used to describe algorithmic procedures and is sometimes considered an alternative to flowcharts.
Maintains the three basic control structures and punctuates English-like phrases with programming language jargon

40. Structured English ~ Example
DOWHILE cards remain
IF card is red THEN IF card is a  THEN place in the  pile ELSE place in the  pile ENDIF ELSE IF card is a  THEN place in the  pile ELSE place in the  pile ENDIF ENDIF
ENDDO
Pseudocode Example -
Sorting a deck of
playing cards

41. Decision Tables
A Decision table is a table of rows and columns, separated into four quadrants and is designed to illustrate complex decision rules
Condition Stub – upper left quadrant
Rules Stub – upper right quadrant
Action Stub – bottom left quadrant
Entries Stub - bottom right quadrant

42. Decision Table Layout
Standard format used for presenting decision tables.
Condition
Stub
Entry
Action

43. Decision Table Example

44. Developing Decision Tables
Process requires the determination of the number of conditions (inputs) that affect the decision.
The set of possible actions (outputs) must likewise be determined
The number of rules is computed
Each rule must specify one or more actions

45. Number of Rules
Each condition generally has two possible alternatives (outcomes): Yes or No
In more advanced tables, multiple outcomes for each condition are permitted
The total number of rules is equal to no. of conditions
Thus, if there are four conditions, there will be sixteen possible rules

46. Building the Table
For each rule, select the appropriate action and indicate with an ‘X’
Identify rules that produce the same actions and attempt to combine those rules; for example:
Condition 1 Y Y Condition 1 Y Condition 2 Y N Condition Action 1 X X Action 1 X

47. Cleaning Things Up
Check the table for any impossible situations, contradictions, and redundancies and eliminate such rules
Rewrite the decision table with the most reduced set of rules; rearranging the rule order is permissible if it improves user understanding

48. Decision Table example: combine and reduce
     
The four gray columns can
be combined into a single
rule. Note that four each,
there was NO order placed
from the Special Catalog.
In addition, Rules 1&5 and
Rules 3&7 can be combined.
Each pair produces the same
action and each pair shares two
common conditions.

49. Decision Table example ~ Final Version
Eliminates the need to check for every possible case.

50. Decision Table example: checking for completeness and accuracy
   
Although the Y-N Combinations suggest a rule, in this case, it is impossible for conditions 1 & 2 to exist
simultaneously. They are in complete contradiction
with each other. In the final version of the table,
Rule 1 will disappear and Rules -4 will become Rules 1-3.

51. Decision Tables and Membership Tables
The Pattern Repeats
Conditions and Actions
Rules
Sets
Operations A B
AB
AB
Condition 1
Condition 2
Condition 3
Y Y Y Y N N NN
Y Y N N Y Y NN
Y N Y N Y N YN Y Y Y Y Y N Y N
Action 1
Action 2
Action 3
X X X
X X
X X X N Y Y N N N N N

52. Problem Prepare a decision table for the following cases:
A wholesaler has three commodities to sell and has three types of customers. Discount is given as per the following procedure:
For individual orders, 10% discount is given irrespective of the value of the order.
For order more than Rs. 50,000 agent gets a discount of 15% and the retailer get a discount of 10%.
For orders of Rs. 20,000 or more and upto Rs. 50,000, agent gets 12% and retailer gets 8% discount.
For orders of the value less than Rs. 20,000 agent gets 8% and retailer gets 5% discount.
The above rules do not apply to the furniture items wherein a flat rate of 10% discount is admissible to all customers irrespective of the value of the order.

53. Importance of Decision Tables
Aids in the analysis of structured decisions
Ensures completeness
Checks for possible errors (impossible situations, contradictions, and redundancies, etc.)
Reduces the amount of condition testing that must be done

54. Decision Trees
Decision trees are useful when multiple branching occurs in a structured decision process, although they can be quite effective when only two decision paths are called for.
They are helpful when necessary to maintain a certain order for a series of decisions.

55. Drawing Decision Trees
Drawn horizontally
Root of tree is to the left side
Square Nodes indicate actions
Circle Nodes represent possible conditions
Circle is analogous to the condition part of an IF statement
Square is analogous to the consequent of an IF statement (the ‘THEN’ part)
“IF Circle THEN Square”

56. Call supervisor for approval
Decision Tree Example
Ring up sale 4 
Check 2
Card
Look up card in book 5 
Purchase < = Rs. 50
 denotes end
of action 1
Call supervisor for approval 6 
Purchase > Rs.50
Check
Card 3 7
Call bank for approval 