1 APPLYING RISK RADAR TO HIGH RISK TECHNOLOGY PROJECTS Risk management is how adults manage projectsNiwot Ridge LLC – Tim Lister, Principle, Fellow & Senior Consultant, Cutter Consortium
RiskEveryone involved in development, acquisition, or management of technologyprojects talks about “risk” – trouble is, everyone means something differentby it. Many kinds of risk – can affect your project, program, or business. Withso many questions and variables, how can we make sense of it all? 2
Risk is …3 The likelihood of loss. A measure of the likelihood that a threat will lead to a loss coupled with the magnitude of the loss. Risk requires the following conditions: A potential loss Likelihood Choice Likelihood is a measure of Uncertainty.
What Is Uncertainty?4 Uncertainty is about the “lack of certainty” Uncertainty is about the “variability” in the performance measures like cost, duration, or quality. Uncertainty is about the “ambiguity” associated with a lack of this clarity.
Uncertainty is about Probability5 What is the probability that a risk will occur? The underlying statistical behavior of the source of the risk drives this probability.
Components of Risk6 Risk is comprised of two core components. Threat – a circumstance with the potential to produce loss. Consequence – the loss that will occur when a threat is realized. Cause Effect Probability Impact
Risks are not the same as Issues7 An Issue is a loss or adverse consequence that has occurred or is certain to occur. An Issue has no uncertainty – the loss or adverse consequence has taken place or is certain to take place. An Issue or Problem can also lead to (or contribute to) other risks by: Creatinga circumstance that produces a new threat. Making an existing threat more likely to occur. Aggravating the consequences of existing risks.
A Risk Paradigm†8 † Continuous Risk Management (CRM), Software Engineering Institute
IF–THEN Risk Statement10 IF THEN Then the program will fail toRisk 1 If we miss our next milestone. achieve its product, cost, and schedule objectives. If our subcontractor is late in Then the program’s scheduleRisk 2 getting their modules will slip. completed on time. Probability
CONDITION–CONCERN A Risk Statement11 Condition Concern Data indicates that some tasks The program could fail to are behind schedule andRisk 1 achieve its product, cost, and staffing levels may be schedule objectives. inadequate. Our subcontractor has not provided much information The program’s schedule couldRisk 2 regarding the status of its slip. tasks. Probability
CONDITION–EVENT–CONSEQUENCE A Risk Statement12 Condition Event Consequence Data indicates that The program will some tasks are We could miss our fail to achieve itsRisk 1 behind schedule and next milestone. product, cost, and staffing levels may schedule objectives. be inadequate. The subcontractor The subcontractor has not provided could be late in The program’sRisk 2 much information getting its modules schedule will slip. regarding the status completed on time. of its tasks. Probability
Risk Handling Strategies13 Risk handling is the outcome of the risk management strategy – they are not the same: Assumption – understand what potential impacts may occur and have resources available to deal with them. Avoidance –make a change in the situation that creates the risk. Control – develop a proactive implementation approach to reduce the risk. Transfer – determine who (internally or external) can better handle the risk.
Elements of Risk Analysis14 What are the risks? Name them in a clear and concise manner. FDA requires additional toxicology and / or DME studies beyond those currently planned Likelihood of occurrence. What is the probability that the risk will occur? There is a 30% chance the FDA will require additional toxicology studies Consequence of the risk. Schedule delays in FDA submittal Additional Cohorts needed for study
Example Risk Summary Grid16 1. FDA requires additional toxicology and/or ADME studies 15. Unsuccessful synthesis 16. GLP compliance at BSL–4 2. FDA requires PK in pivotal animal scale–up from 50L to 300L USAMRIID required for The Animal studies 16. New impurities appear as a Rule result of scale up 3. Insufficient subunit purification at vendor 17. Two Segment II tox studies in 4. Failure of purification equipment at non–rodent and/or Segment I and J–M Segment III studies required for 5. New impurities appear as a result of Category B label scale up from 8L to 50L 5 6. Subunits or API temporarily unavailable 18. FDA demands aerosol exposure 4 7. Lot failures of subunits, API or drug (i.e. viral challenge) experiments Likelihood product be performed in nonhuman 8. One or more manufacturers not 3 primate efficacy studies [L/H] cGMP 2 10. Irreversible kidney toxicity is seen 19. One of the pivotal animal efficacy in a subset of healthy volunteers at 1 studies fails to achieve primary therapeutic dose levels clinical efficacy endpoint 11. Clinical trial enrolls more slowly than expected. 1 2 3 4 5 12. Positive signal in QTc study Consequence 13. FDA requests clinical data in 20. No Observed Adverse Effect Special Populations pre–licensure High Level is significantly lower than 14. FDA requests larger clinical safety Moderate expected [L/H] database than initially proposed Low