# Presentation: 197227

## Applications of Risk Management

**Barry Schrimsher**
**U.S. Census Bureau SEPG Conference**
**08 November 2005**

## Agenda

**Objectives**
**What is risk?**
**Effective strategy for risk management**
**Managing risks**
**Implementing corrective & preventive actions**
**Summary**

## Objectives

**After this session, you should understand:**
**How to identify projects that implement effective risk management plans in order to avoid them**
**How to sabotage effective risk management by not evaluating risks and opportunities on a regular basis **
**How to stay in fire-fighting mode in order to be recognized and promoted for heroic efforts**

## What Is a Risk?

**Risk =**
**Probability of a change**
**Impact =**
**Affect of a realized change on the ability of the project team to meet defined cost, schedule, and quality goals i.e., meet their commitments**
**Affect may be positive or negative**
**Negative = risk**
**Positive = opportunity**

## Effective Strategy for Risk Management

**Identify sources of risk**
**People**
**Product**
**Process**
**Categorize risks**
**Individual**
**Project/Organization**
**Evaluate risks according to defined parameters**

## People Risks

**Capability**
**Analysis (problem domain)**
**Implementation (solution domain)**
**Continuity**
**Turnover rate**
**Ratio of senior/junior personnel**
**Communication**
**Interpersonal issues**
**Co-located vs. globally-dispersed team**

## Product Risks

**Comfort**
**Familiar problem?**
**Same tool set as last time?**
**Complexity**
**Product-specific**
**Reuse**
**Constraints**
**Customer**
**Schedule**
**‘****Ilities...**

## Process Risks

**Maturity**
**Organizational maturity vis-à-vis CMMI****®**
**Project-specific maturity**
**Mindset**
**“****Thrash & burn”**
**Monitoring**
**Risk chaos**
**Funding**

## Categorize Risks

**At the individual level**
**Probability * Consequences * Weighting Factor**
**Pareto analysis**
**At the project or organizational level**
**Aggregation of individual risks**
**Historical data & checklists**
**Monte Carlo simulation**

## Evaluate According to Defined Parameters

**At the individual risk level**
**Document the boundary conditions & rational for**
**Probability of occurrence**
**Consequences**
**Weighting factor**
**COCOMO II.2000 example**

## Sample COCOMO II.2000Post-Architecture Cost Drivers & Scale Factors

| Driver/ Factor | Very Low | Low | Nominal | High | Very High | Extra High |
| --- | --- | --- | --- | --- | --- | --- |
| Reliability (reverse scored) | Slight Inconven-ience | Low, easily recover-able losses | Moderate, easily recoverable losses | High financial loss | Risk to human life | N/A |
| Programmer Capability (percentile) | 15th | 35th | 55th | 75th | 90th | N/A |
| Schedule (% of nominal) | 75% | 85% | 100% | 130% | 160% | N/A |
| Precedent | Thorough-ly unprece-dented | Largely unprece-dented | Somewhat unprece-dented | Generally familiar | Largely familiar | Thorough-ly familiar |
| Process Maturity | SW-CMM Level 1- | SW-CMM Level 1+ | SW-CMM Level 2 | SW-CMM Level 3 | SW-CMM Level 4 | SW-CMM Level 5 |

## Sample COCOMO II.2000Post-Architecture Cost Drivers & Scale Factors

| Driver/ Factor | Very Low | Low | Nominal | High | Very High | Extra High |
| --- | --- | --- | --- | --- | --- | --- |
| Reliability (reverse scored) | Slight Inconven-ience | Low, easily recover-able losses | Moderate, easily recoverable losses | High financial loss | Risk to human life | N/A |
| Programmer Capability (percentile) | 15th | 35th | 55th | 75th | 90th | N/A |
| Schedule (% of nominal) | 75% | 85% | 100% | 130% | 160% | N/A |
| Precedent | Thorough-ly unprece-dented | Largely unprece-dented | Somewhat unprece-dented | Generally familiar | Largely familiar | Thorough-ly familiar |
| Process Maturity | SW-CMM Level 1- | SW-CMM Level 1+ | SW-CMM Level 2 | SW-CMM Level 3 | SW-CMM Level 4 | SW-CMM Level 5 |

- Consequences

## Sample Risks:  Consequences & Weighting

| Risk | Weight | Low (1) | Nominal (3) | High (5) | Insane (7) |
| --- | --- | --- | --- | --- | --- |
| Computa-tional complexity | 40% | Data table lookups | Standard math & statistical routines | Multivariate analysis; differential equations | Rocket science |
| Funding instability | 30% | Incrementally-funded multi-year contract | Current-year funding obligated | Can pay this month’s bills | Overhead |
| Schedule compression | 20% | Accepted team estimate + 25% margin | Accepted team estimate | Slashed team estimate by 30% | Wanted it yesterday |
| Analyst Capability | 10% | Smartest guys in the room | Average Jane & Joe | Can e-mail questions to Ted | What analyst? |
| Total | 100% |  |  |  |  |

## Sample Risks:  Probability, Consequences, & Weighting

| Risk | Weight | Low (1) | Nominal (3) | High (5) | Insane (7) |
| --- | --- | --- | --- | --- | --- |
| Computa-tional complexity
(0.4*3=1.2) | 40% | Data table lookups | Standard math & statistical routines | Multivariate analysis; differential equations | Rocket science |
| Funding instability
(0.3*5=1.5) | 30% | Incrementally-funded multi-year contract | Current-year funding obligated | Can pay this month’s bills | Overhead |
| Schedule compression
(0.2*7=1.4) | 20% | Accepted team estimate + 25% margin | Accepted team estimate | Slashed team estimate by 30% | Wanted it yesterday |
| Analyst Capability
(0.1*5=0.5) | 10% | Smartest guys in the room | Average Jane & Joe | Can e-mail questions to Ted | What analyst? |
| Total = 4.6 | 100% |  | 3*0.4=1.2 | 5*(0.3+0.1)=2.0 | 7*0.2=1.4 |

## Sample Risks:  Probability, Consequences, & Weighting

| Risk | Weight | Low (1) | Nominal (3) | High (5) | Insane (7) |
| --- | --- | --- | --- | --- | --- |
| Computa-tional complexity
(1.8) | 40% | Data table lookups | Standard math & statistical routines (0.5) | Multivariate analysis; differential eqations(0.25) | Rocket science
(0.25) |
| Funding instability
(1.7) | 30% | Incrementally-funded multi-year contract | Current-year funding obligated | Can pay this month’s bills
(0.7) | Overhead
(0.3) |
| Schedule compression
(1.4) | 20% | Accepted team estimate + 25% margin | Accepted team estimate | Slashed team estimate by 30% | Wanted it yesterday
(1.0) |
| Analyst Capability
(0.6) | 10% | Smartest guys in the room | Average Jane & Joe | Can e-mail questions to Ted (0.5) | What analyst?
(0.5) |
| Total = 5.5 | 100% |  | 0.6 | 0.5+1.05+.25 = 1.8 | 0.7+0.6+1.4+ 0.4 = 3.1 |

## Evaluate According to Defined Parameters

**At the project level**
**Aggregate individual risks to determine project risk**
**Total = 4.6?**
**Total = 5.5?**
**Collect & analyze data to establish organizational norms**
**High, medium, low**
**Low, nominal, high**
**Monte Carlo analysis**
**Drive tailoring of the organization’s standard process**
**Ensure action thresholds clearly specified**

## Managing Risks & Opportunities

**Identify**
**Prioritize**
**Monitor**
**Project ****(the verb)**
**Wash, rinse, repeat**

## Monitor & Project Risks

**Make someone responsible**
**Project risk manager**
**Team member**
**Review & update**
**Weekly team meetings**
**Quarterly management reviews**
**Major project milestones**
**Reprioritize regularly**
**80/20 rule**
**“****Top 10” list**

## Implementing Corrective & Preventive Actions

**Choices for dealing with identified, monitored risks**
**Accept**
**Do nothing**
**Avoid**
**Redefine the problem**
**Control**
**Manage through mitigation and contingency plans**
**Transfer**
**Make it someone else’s problem**

## Implementing Corrective & Preventive Actions

**Controlling risks**
**Assigned to a team member**
**Mitigation plan in place**
**Steps to take to prevent risk from being realized**
**Contingency plan in place**
**Steps to take if risk becomes an issue**
**Common features of both types of plan**
**Specific actions identified**
**Target completion dates**
**Responsible parties**

## Examples of Documented Risks

| Risk | Probability | Consequences | Impact | Mitigation |
| --- | --- | --- | --- | --- |
| Computational complexity | 50% | 2-4 month slip | 30-60 day slip |  |
| Funding instability | 30% | Work stoppage | Day-for-day slip | Ensure funding remains steady |
| Schedule compression | 80% | Deliver reduced functionality | Overtime | Overtime |
| Analyst Capability | 10% | See Computational Complexity |  |  |

## Examples of Documented Risks

| Statement | Underestimated complexity of computational algorithms for data mining and regression analysis |  |  |
| --- | --- | --- | --- |
| Rank/Value/ Owner/ Updates | #7
1.8 | Doe, Jane | Last: 5 Nov 05
Next: 19 Nov 05 |
| Mitigation Plan | Review estimates against historical data from Projects X & Q
Have staff data mining expert John Doe provide independent review of estimate |  |  |
| Contingency Plan | Renegotiate functional content of Build 3 with customer
Use up to 2% of Management Reserve budget to hire a consultant who specializes in the problem area |  |  |

## Summary

**Be specific!**
**Risk statements**
**Impact analyses**
**Mitigation & contingency plans**
**Use organizational resources**
**Checklists, templates**
**Historical data & organizational norms**
**Regularly Review, Revise, & Reprioritize**
**Change is inevitable! **
**To be successful, ensure the changes**
**you *****want***** to happen are the ones that occur.**

## Objectives (Revisited)

**After this session, you should understand:**
**How to identify projects that implement effective risk management plans in order to avoid them**
**How to sabotage effective risk management by not evaluating risks and opportunities on a regular basis **
**How to stay in fire-fighting mode in order to be recognized and promoted for heroic efforts**

## References

**Steve McConnell**
***Rapid Development*****, Microsoft Press, 1996**
***Software Project Survival Guide*****, Microsoft Press, 1998**
**Mary Beth Chrissis, Mike Konrad, & Sandy Shrum, *****CMMI:  Guidelines for Process Integration and Product Improvement*****, Addison – Wesley, 2003**
**Barry Boehm, et al., *****Software Cost Estimation with COCOMO II*****, Prentice Hall PTR, 2000.**

## Contact Information

**Barry Schrimsher**
**GlenTalon Consulting, Inc.**
**256.655.3381**
**barry@glentalon.com**