Improving your Risk Identification and Management Approach

Facilitating your process journey …

Improving your Risk Identification and Management Approach by Henry Schneider Process and Product Quality Consulting, LLC June 25, 2008

Facilitating your process journey …

Agenda 

Why Should I Care About Risks?



What is a Risk?



Risk Management Principles



Risk Identification and Management Techniques



Summary

Facilitating your process journey …

Facilitating your process journey …

Facilitating your process journey …

Facilitating your process journey …

Facilitating your process journey …

Facilitating your process journey …

What What coulda/ coulda/sho shoulda ulda happen happened? ed?

Facilitating your process journey …

When Risk Are Not Managed Well

It is easy to ignore risks when they are not being tracked Risks that are known to project staff are often not known or a surprise to management Every time a new problem manifests, a new management technique technique is tried

Facilitating your process journey …

Why Should I Care? 



The project may dodge some of the “bullets,” “bullets,” but not all of them No lessons learned captured for future projects means making the same mistakes again and again 

Insanity - doing the same same thing over over and over over again again

and expecting different different results 

Repeated project failures due to unforeseen (but predictable) risks costs you business, if  not the whole company

Facilitating your process journey …

Risk and Organization Organization Culture 



Innovative cultures assume that the potential value of  innovation carries some level of risk 

“Fail forward” attitude



acknowledge and learn from failures



risks are investment in success

Non-innovative cultures don’t acknowledge failure as an acceptable outcome 

“Don’t bring me problems, bring me solutions.”



acknowledging risks is admitting the possibility of failure

Facilitating your process journey …

Risk Defined 

Dictionary definitions of risk  



General definition  



hazard, danger, or peril exposure to loss, injury, or destruction A risk is a problem waiting to happen A risk is an event that could threaten the successful completion of the project

Risk management is the process of identifying the risks and handling those which are most threatening to the project, so that they don’t become problems

Facilitating your process journey …

Risk Risk Manag Manageme ement nt Princ Principle ipless - 1 Risks must be assessed continuously and used for decision-making in all phases of the project Effective risk management considers all areas of the project: personnel, process, business, technology, technology, etc. Risks need to be clearly communicated by all team members The environment must allow people to identify risks without negative negative consequences to them

Facilitating your process journey …

Risk Risk Manag Manageme ement nt Princ Principle ipless - 2 Risks must be clearly stated stated before they can be managed

A project should not be judged solely on the number or nature of risks uncovered Deal with important risks first Action items to address risks r isks need to be integrated integrated into the overall project plan or action item list

Facilitating your process journey …

Risk Source Categories and Consequences Risk Source Categories Mission and goals Decision drivers Organization management Customer / end user  Budget / cost Schedule Project characteristics Development process Development environment Personnel and relationships Operational environment New technology

Consequences Cost overruns Schedule slips Inadequate functionality Canceled projects Sudden personnel changes Customer dissatisfaction Loss of company image Demoralized staff  Poor product performance Legal proceedings

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

Facilitating your process journey …

Start by Reviewing Project Parameters

Project vision • Are objectives

clear and understood? • Are customer and provider objectives known?

Project scope, milestones, and deliverables • Are features

agreed to? • Are commitments agreed to and documented?

Roles and responsibilities • Are roles and

responsibilities clear to all involved? • Are all roles staffed? • Is sponsorship and accountability clear?

Use knowledge of  specific project roles to identify risks

Facilitating your process journey …

Risk Identification Technique Brainstorming







Review possible sources of risk and brainstorm brainstorm specific risks they could create for your project Review potential adverse outcomes for your project and brainstorm brainstorm how they might arise Sources

Risks Outcomes

Facilitating your process journey …

Risk Factor Factor Table - Example Example Risk Factor Project fit

Low Risk Cue Directly supports customer’s missions

Medium Risk Cue Indirectly impacts one or more goals

and goals

High Risk Cu C ue Does Does not support support or relate to customer’s

mission or goals

Cust Cu stom omer er pe perrce cept ptio ion n Cust Custom omer er expec expects ts team to provide provide this this product

Team is working working on project that is not expected by customer

Project Project iiss a mismatch mismatch with prior products of this team

Work flow

Will change some aspect aspect or have have small small affect on work flow

Significantly changes work flow or method of organization organization

Little or not change to work flow

Facilitating your process journey …

Reviewing Factors

Examine each risk factor and rate its relevance

Select appropriate table of factors

• High - potentially potentially high threat threat risk • Medium - may sugges suggestt a risk • Low - no apparent apparent risk • N/A - factor factor is not applicable applicable • NI - needs more more information information • TBD - needs to have project project

proceed further; revisit later

Use high rated factors to develop specific risk statements for the project

Facilitating your process journey …

Risk Factors Help You Focus Risks to be managed – ten or so Risks rated High – dozens Risks indicated by factor tables tables - hundr hundreds eds All risks risks - thousands thousands

Facilitating your process journey …

Risk Probability Probability is the likelihood that the risk will actually occur as a problem if we take no action Usually expressed as a percentage: zero or less than 100% • greater than zero • use increments no smaller than 5%

Example: • something slightly more likely likely than not - risk probability = 60%

likely to happen 3/4 of the time - risk probability = 75% • something likely

Facilitating your process journey …

Establishing Measures of Loss 

Level of loss (scale of 1 to 10)  



Example: 



Risk loss = 4 if project is considerably late, but has all functionality fun ctionality

Impact of monetary loss useful, if possible   



Rate damage to project objectives High values indicate serious loss to the project

Long-term costs in operations and support Long-term loss of market share or opportunity Short-term cost in additional work

Example: 

Risk loss = $120,000 to add person-year of work

Facilitating your process journey …

Risk Exposure Components

• Risk probability • Risk impact (loss)

Risk exposure is the • Risk exposure = risk probability x risk impact total threat of the risk Example: Focus on reducing risk exposure

• Risk exposure = 75% x 4 = 3.0 • Risk exposure = 60% x $120,000 = $72,000

Facilitating your process journey …

Ranking Risks

Rank the risks at a given point in time

Rank in order of  risk exposure (most to least dangerous)

Look for breaks in values in the list

Review the list regularly with the team

Add items as needed

Adjust exposure as appropriate

Focus on actions for those at the top of the list

Facilitating your process journey …

Risk Mitigation Strategies

Risk reduction

Risk transfer Invest no more than needed

• Apply money or effort for controllable risks uncontrollable risks • Use work-arounds for uncontrollable

• Insure the loss • Involve a third party • Tie a bonus to completion of the project Involve domain specialists • Involve

• Some risks cannot be removed completely • Balance cost of handling against exposure

Facilitating your process journey …

Risk Contingency Plans Devise contingency plans for • high exposure risks, in case the mitigation strategy strategy fails • any risk for which there is no possible mitigation action

Specify risk measures and trigger values • measures of time, resources to handle risk • measures of risk impact • trigger values that tell it is time to use contingency approach

Agree with customer and management at project start how contingency plans will be funded and handled

Facilitating your process journey …

Contingency Triggers

For risks leading to schedule slips • Latest date to allow

you to use alternative platforms • Latest date to select another vendor

For risks requiring additional effort or time • Latest date to locate

Limit for extra cost to the customer

the resources • Greatest amount of  penalty or fine to incur

Example Contingency Triggers

Limit for learning time

Facilitating your process journey …

Mitigation Mitigation and Continge Contingency ncy - Example Example

Risk Statement

• If key subject matter experts are not

Risk Mitigation

• Cross train project staff with key subject

Contingency Plan

available by the first first of June, we will be unable to deliver the project per the plan.

matter experts, experts, so work can proceed and decisions made if key experts experts are unavailable. • If by the first of April it is known that key

experts will not be available, assign team members to learn the needed subject matter so the project can move forward forward without involving key experts.

Facilitating your process journey …

Communication is Essential! Communicate risk information to all affected parties Encourage free free flow of  information about risk • Place risk chart in a common location • Use email or other team collaboration collaboration method (e.g. Wiki

Update Top Risks with team regularly

Review status of risks at key milestones

page) to identify new risks, change status, and indicate completion • Encourage raising of new risks in weekly status reports, during inspections or reviews, and at major milestone reviews

Facilitating your process journey …

What Would Be the Preferable Outcome?

What could have been delivered if risks had been managed

What was delivered because risks weren’t managed

Facilitating your process journey …

Summary 





Repeated project failures due to unforeseen (but predictable) risks can cost you business Risk management is the process of identifying the risks ris ks and handling those which are most threatening to the project, so that they don’t become problems Risks can be easily managed using techniques such as:      

brainstorming risk factors risk exposure ranking mitigation communication

Facilitating your process journey …

Questions

Facilitating your process journey …

PPQC Services Consulting • • • •

CMMI Software Engineering Systems Engineering Process Improvement

Appraising • SCAMPI A, B, C • Gap Analysis

Training • • • •

CMMI/Process Improvement Action Planning Workshops Workshops Measurement and Analysis Process Area Specific Training

Facilitating your process journey …

Contact Information Address:

Henry Schneider President/Senior President/Senior Principal Consultant Process and Product Quality Consulting, LLC 2111 Heather Green Houston, TX USA USA 77062

Phone:

281-218-6682

E-mail:

[email protected]

Web Site:

www.ppqc.net