1. Software project management (intro)
Risk Management

2. Introduction
Risk of the development project’s not proceeding according to plan
The risk of the project’s running late or over budget and
The identification of the steps to avoid or to minimize those risks

3. The nature of risk Estimation errors Planning assumptions
Eventualities (unforeseen events)

4. Managing risk Objective:
To avoid or minimize the adverse effects of unforeseen events by avoiding the risks or drawing up contingency plans for dealing with them
Risk Identification
Risk Analysis
Risk Estimation
Risk Evaluation
Risk Engineering
Risk Planning
Risk Control
Risk Management
Risk Monitoring
Risk Directing
Risk Staffing

5. Managing risk (2) Task breakdown Risk identification Risk estimation
Listing all of the risks that can adversely affect the successful execution of the project
Risk estimation
Assessing the likelihood and impact of each hazard
Risk evaluation
Ranking the risks and determining risk aversion strategies
Risk planning
Drawing up contingency plan and, where appropriate, adding these to the project’s task structure
Risk control
Minimizing and reacting to problems
Risk monitoring
An ongoing activity, as the importance and likelihood of particular risks can change as the project proceeds
Risk directing & risk staffing
Day-to-day management of risk

6. Risk Identification Identify hazard: To identify hazard:
Hazard -- an event that might occur and will, if it does occur, create a problem for the successful completion of the project.
To identify hazard:
Use a checklist listing all the possible hazards and factor that influence them
Some hazards are:
Generic risks – relevant to all software projects
Specific risks – relevant to an individual project

7. Categories of factors
Application factors -- The nature of the application
Staff factors -- The experience and skills of the staffs
Project factors -- Project and its objectives well defined
Project methods -- Using well specified and structured method
Hardware/software factors -- Installation risk
Changeover factors -- All-in-one vs gradual changeover
Supplier factors – reliance on external organization
Environment factors – eg. Taxation regulation
Health and safety factors – though not generally a major issue

8. Risk exposure = risk likelihood * risk impact
Risk Analysis
Risk Likelihood:
The probability of a hazard’s occurring
Risk Impact:
The effect that the resulting problem will have on the project
Risk Value or Risk Exposure
The importance of the risk
Risk exposure = risk likelihood * risk impact

9. Risk Analysis (2)
Simple scoring to provide a quantitative measure for assessing the risk
Eg., 1 to 10 where
1 is the least likely
10 is the most likely
Hazard
Likelihood
Impact
Risk Exposure
R1 – changes in requirements 5 7 35
R2 – specification takes longer 10 3 30
R3 – staff sickness 1
R …

10. Prioritizing the risks
Managing the risk involves the use of two strategies
Reducing the risk exposure by reducing the likelihood or impact
Drawing up contingency plans to deal with the risk should it occur

11. Prioritizing the risks (2)
The risk exposures allow us to obtain an approximate ranking in order of importance
However
We cannot interpret the risk exposure value quantitatively
Eg., is value of 20 is twice as risk as value of 10?
The exposure value are too close for us to distinguish between them
Eg., which one is more risky, value of 20 or 21?

12. Prioritizing the risks (33)
In addition to the risk exposure value, there are generally other factors to consider when prioritizing the risks:
Confidence of the risk assessment
Compound risks – ie, dependency between risks
The number of risks
Cost of action
Method: Risk Reduction Leverage (RRL)

13. Strategies for risk reduction
Hazard prevention
Eg. Early scheduling for unavailability of staff
Likelihood reduction
Eg by prototyping
Risk avoidance
Eg, by increasing the duration estimates or reducing functionality
Risk transfer
Eg., contracting or taking insurance
Contingency planning
Eg. Using agency programmers for the absence of staff

14. Evaluating risks to the schedule
Not all risks can be eliminated
Two methods for assessing the effects of these uncertainties on the project schedule:
Using PERT to evaluate the effects of uncertainty
Most likely time
Optimistic time
Pessimistic time

15. Using expected durations
Activity
Activity durations (weeks)
Optimistic
(a)
Most likely
(m)
Pessimistic
(b) A 5 6 8 B 3 4 C 2 D
3.5 E 1 F 10 15 G H
2.5
Examples: PERT activity time estimates

16. Expected times and Standard Deviation
Activity
Activity durations (weeks)
Optimistic
(a)
Most likely
(m)
Pessimistic
(b)
Expected
(te)
Std Dev
(s) A 5 6 8
6.17
0.50 B 3 4
4.00
0.33 C 2
2.83
0.17 D
3.5
4.08
0.25 E 1 F 10 15
10.50
1.17 G
3.00 H
2.5
2.08
0.08
Std Dev  s = (b – a) / 6

17. PERT Network
Rather than say “the completion date for the project is …”,
we are lead to say “we expect to complete the project by …” 2
6.17 A
t = 6.17 C
t = 2.83 B
t = 4.00 D
t = 4.08 H
t = 2.08 1 3 4 4 9 6
13.5 E
t = 2.83 F
t = 10.5 G
t = 3.00 5
10.5
Event number
Target date
Expected date
Standard deviation

18. The likelihood of meeting targets
The PERT techniques uses the following three step method for calculating the probability of meeting or missing a target date:
Calculate the standard deviation of each project event
Calculate the z value for each event that has a target date
Convert z values to a probabilities

19. The likelihood of meeting targets (2)
Suppose that we must complete the project within 15 weeks
We expect it will take 13.5 weeks but it could take more or, perhaps, less
Suppose that activity C must be completed by week 10
Event 5 represents the delivery of intermediate products to the customer

20. PERT Network 2
6.17
0.50 A
t = 6.17
s = 0.50 C
t = 2.83
s = 0.17 B
t = 4.00
s = 0.33 D
t = 4.08
s = 0.25 H
t = 2.08
s = 0.08 1 3 4
0.33 4 10 9
0.53 6 15
13.5
1.22 E
t = 2.83
s = 0.50 F
t = 10.5
s = 1.17 G
t = 3.00
s = 0.33 5 10
10.5
1.17
PERT Network with three target dates and calculated event standard deviations

21. Calculating the z values
It is equivalent to the number of standard deviations between the node’s expected and target dates
Where:
Te = the expected date
T = the target date

22. Converting z values to probabilities
Example:
Z value for project completion (event 6) is 1.23
The probability is about 11%
There is an 11% risk of not meeting the target date of the end of week 15

23. The advantages of PERT
The technique can be used to calculate the standard deviation for each task and use this to rank them according to their degree of risk
The probability of meeting any target set can be estimated using the expected times and standard deviations
By setting target dates along the critical path, we can focus on those activities posing the greatest risk to the project’s schedule