The document discusses applying risk management techniques to high-risk technology projects, defining key risk management terms like risk, uncertainty, likelihood, and consequences. It presents different frameworks for analyzing and assessing risks, including using condition-consequence or if-then statements to describe risks, and analyzing the likelihood and impact of risks in a summary grid. The goal is to help project managers make sense of the many types of risks that can affect projects and prioritize them for mitigation.

1. 1
APPLYING RISK RADAR TO
HIGH RISK TECHNOLOGY
PROJECTS
Risk management is how adults manage projects
Niwot Ridge LLC
– Tim Lister, Principle, Fellow & Senior Consultant, Cutter Consortium

2. Risk
Everyone involved in development, acquisition, or management of technology
projects talks about “risk” – trouble is, everyone means something different
by it. Many kinds of risk – can affect your project, program, or business. With
so many questions and variables, how can we make sense of it all? 2

3. Risk is …
3
 The likelihood of loss.
 A measure of the likelihood that a threat will lead
to a loss coupled with the magnitude of the loss.
 Risk requires the following conditions:
A potential loss
 Likelihood
 Choice
 Likelihood is a measure of Uncertainty.

4. What Is Uncertainty?
4
 Uncertainty is about the “lack of certainty”
 Uncertainty is about the “variability” in the
performance measures like cost, duration, or quality.
 Uncertainty is about the “ambiguity” associated with a
lack of this clarity.

5. Uncertainty is about Probability
5
 What is the
probability that a
risk will occur?
 The underlying
statistical behavior
of the source of
the risk drives this
probability.

6. Components of Risk
6
 Risk is comprised of two core components.
 Threat – a circumstance with the potential to produce
loss.
 Consequence – the loss that will occur when a threat is
realized.
Cause Effect
Probability Impact

7. Risks are not the same as Issues
7
 An Issue is a loss or adverse consequence that has
occurred or is certain to occur.
 An Issue has no uncertainty – the loss or adverse
consequence has taken place or is certain to take
place.
 An Issue or Problem can also lead to (or contribute
to) other risks by:
 Creatinga circumstance that produces a new threat.
 Making an existing threat more likely to occur.
 Aggravating the consequences of existing risks.

8. A Risk Paradigm†
8
† Continuous Risk Management (CRM), Software Engineering Institute

9. CMMI Risk Management – RM
9

10. IF–THEN
Risk Statement
10
IF THEN
Then the program will fail to
Risk 1 If we miss our next milestone. achieve its product, cost, and
schedule objectives.
If our subcontractor is late in
Then the program’s schedule
Risk 2 getting their modules
will slip.
completed on time.
Probability

11. CONDITION–CONCERN
A Risk Statement
11
Condition Concern
Data indicates that some tasks
The program could fail to
are behind schedule and
Risk 1 achieve its product, cost, and
staffing levels may be
schedule objectives.
inadequate.
Our subcontractor has not
provided much information The program’s schedule could
Risk 2
regarding the status of its slip.
tasks.
Probability

12. CONDITION–EVENT–CONSEQUENCE
A Risk Statement
12
Condition Event Consequence
Data indicates that
The program will
some tasks are
We could miss our fail to achieve its
Risk 1 behind schedule and
next milestone. product, cost, and
staffing levels may
schedule objectives.
be inadequate.
The subcontractor
The subcontractor
has not provided
could be late in The program’s
Risk 2 much information
getting its modules schedule will slip.
regarding the status
completed on time.
of its tasks.
Probability

13. Risk Handling Strategies
13
 Risk handling is the outcome of the risk management
strategy – they are not the same:
 Assumption – understand what potential impacts may
occur and have resources available to deal with them.
 Avoidance –make a change in the situation that creates
the risk.
 Control – develop a proactive implementation
approach to reduce the risk.
 Transfer – determine who (internally or external) can
better handle the risk.

14. Elements of Risk Analysis
14
 What are the risks?
 Name them in a clear and concise manner.
 FDA requires additional toxicology and / or DME studies
beyond those currently planned
 Likelihood of occurrence.
 What is the probability that the risk will occur?
 There is a 30% chance the FDA will require additional
toxicology studies
 Consequence of the risk.
 Schedule delays in FDA submittal
 Additional Cohorts needed for study

15. Risk Analysis
15

16. Example Risk Summary Grid
16
1. FDA requires additional toxicology
and/or ADME studies 15. Unsuccessful synthesis 16. GLP compliance at BSL–4
2. FDA requires PK in pivotal animal scale–up from 50L to 300L USAMRIID required for The Animal
studies 16. New impurities appear as a Rule
result of scale up
3. Insufficient subunit purification at
vendor 17. Two Segment II tox studies in
4. Failure of purification equipment at non–rodent and/or Segment I and
J–M Segment III studies required for
5. New impurities appear as a result of Category B label
scale up from 8L to 50L 5
6. Subunits or API temporarily
unavailable 18. FDA demands aerosol exposure
4
7. Lot failures of subunits, API or drug (i.e. viral challenge) experiments
Likelihood
product be performed in nonhuman
8. One or more manufacturers not 3 primate efficacy studies [L/H]
cGMP
2
10. Irreversible kidney toxicity is seen 19. One of the pivotal animal efficacy
in a subset of healthy volunteers at 1
studies fails to achieve primary
therapeutic dose levels clinical efficacy endpoint
11. Clinical trial enrolls more slowly
than expected. 1 2 3 4 5
12. Positive signal in QTc study
Consequence
13. FDA requests clinical data in 20. No Observed Adverse Effect
Special Populations pre–licensure High Level is significantly lower than
14. FDA requests larger clinical safety Moderate expected [L/H]
database than initially proposed
Low

17. Example Risk Briefing
17