For example, suppose a project is being developed on one machine and will be ported to another when the system is fully tested. If the second machine is a new model to be delivered by the vendor, we must estimate the likelihood that it will not be ready on time. When the risk probability is 1, then the risk is called a problem, since it is certain to happen. The degree to which we can change the outcome. For each risk, we must determine what we can do to minimize or avoid the impact of the event.
Risk control involves a set of actions taken to reduce or eliminate a risk.
For example, if the requirements may change after design, we can minimize the impact of the change by creating a flexible design. If the second machine is not ready when the software is tested, we may be able to identify other models or brands that have the same functionality and performance and can run our new software until the new model is delivered. We can quantify the effects of the risks we identify by multiplying the risk impact by the risk probability, to yield the risk exposure. Clearly, the risk probability can change over time, as can the impact, so part of a project manager's job is to track these values over time, and plan for the events accordingly. Generic risks are those common to all software projects, such as misunderstanding the requirements, losing key personnel, or allowing insufficient time for testing.