Risk Management
• Sergii Zabigaylo, Program Manager
What is Risk?
Project Failure
Risk Management, theory and practice
The Cone of Uncertainty
Notes about Risks
Content
2
The optimism bias
3
Risk Management Strategies
4
What is Risk?
5
Uncertain Event or Condition
Always in the Future
Effect on Project Objective
Has Causes, Impact and Probability
Negative or Positive Outcome
6
Practice: What are the benefits of risks
management?
Define common ways to manage risks, analyze, response plans
Increase project success probability
Realistic estimates
Remove obstacles on project launch phases
Increase profitability
Less stress
Professionalism and reputation
Whenever a project
doesn’t meet to the
expectation of the
Stakeholders.
7
Project Failure
A Project is considered as Failure……
• Cost & Time Over-runs
• Quality Degradation
• Frustration & Stress: sometime resulting in
people quitting
• Low Job Satisfaction
• Low Corporate Market Value
• Low Public Opinion
• Negative Media Campaigns
• May even force the company into Closure
Impact of Project Failure
8
Primary Causes of Project Failure
9
Problems:
 The changes that were not initially planned for, are added to
project.
 The Project takes longer and costs more than planned and there
is no record of WHY??
Causes:
 Not having a method to handle or recognize changes.
1. Lack of Change Management
10
Problems:
 Team Members do not have the information they need when they
need it.
 Issues or changes do not get escalated.
 Project reporting is sluggish
Causes:
 The project’s communication plan
was not completed.
 The project’s communication plan
doesn’t have enough details.
2. Poor Communication
11
You do not have enough people, the right skill-sets, or the team is not
committed to the projects.
Problems:
 Tasks take longer than expected
to complete.
 Deadlines and milestones get
missed.
 Project completion date comes
into jeopardy.
 You end up working double shifts to
complete all the works.
Causes:
 There was no pre-commitment of resources to the projects.
 The Project was not supported.
 There was no analysis and documentation of all skill-set required
3. Inadequate Resources
12
“I would like a set of stairs that leads up to a bridge.”
Problems:
 Customer will be unhappy.
 Customer will complain and you will end up doing the what they
want- at your expense.
Causes:
 What the customer wants, was not clearly documented.
 What you believe the customer wants is different that what
the customer believes they have asked for?
4. Poorly Defined Requirement
13
How do you figure out how long the project will take?
Problems:
 An unrealistic timeline or budget will be agreed to.
 You will not be able to do all the work in the time allocated.
Causes:
 No formal estimating method
 Estimate confidence is law.
 Volume of work not understood
5. Inaccurate Estimates
14
Sorry about the project, I left it in my car & there was a bit
of an incidents.
Problems:
 Unexpected events cause delays.
 Domino effect of thing going wrong.
Causes:
 No Formal Risk Management.
 Just try to predict the big things that can go wrong.
 It’s the sum of the all little things that make a project late.
 Nothing is more stressful than trying to keep on schedule when
unexpected things keep happening.
6. Poor Risk Management
15
“Emergency Phone installed, Deliverable completed”
Problems:
 Difficult to get the agreement that the product is finished.
 Customer Keep wanting more, saying you didn’t do it to their
Specification.
Causes:
 The Milestones or deliverables were not measurable.
 The customer never told us How many they wanted So we just
assumed 1,
7. Poorly Defined Deliverables
16
Of course we Can do that for you.
Problems:
 There was little or no planning before deciding you can get the
job done.
 The task you agree to turns out to be more work than expected.
 It takes you longer and jeopardizes other deliverables.
Causes:
 Not enough time spent planning.
 You may have been pressured into giving an answer right then
and there.
 Didn’t have a full understanding of the work involved before
committing.
8. Over Optimism
17
Hurry .... We have a tight deadline. No time to plan. Just start digging.
Problems:
 The plan is flawed from the start.
 The project gets out of control and can’t be recovered.
Causes:
 You have to do the work and weren’t also given time for project
management.
 Perhaps you only have 10% or 20%
allotment for the project management
duties.
9. No time for Project Management
18
You Don't Know What You Don't Know.
Problems:
 Your project don’t finish on time.
 Your project are always squeezed at the end.
 Your project are stressful.
 You have to deal with unrealistic expectation or customers.
 You feel your projects are out of control.
Causes:
 People often don’t know what they don’t know.
 Their project are out of control but they
don’t know WHY??
 They feel they are doing okay but could
benefit from formal PM education.
10. Improved PM Skill-set needed
19
Risk Management Process
20
Plan Risk
Management
Identify Risks
Perform Risk
Analysis
Plan Risk
Responses
Monitoring &
Control
Define how will we work with Risks:
resources, responsibilities, frequency, risk
tolerance…
Plan Risk Management
21
Risk Management Plan:
• Categorize risk sources
• Probability Matrix
• Roles, Responsibilities, Activity Plan
• Monitoring, Reporting, Communication
• Tolerance, Management/Contingency
reserves, reaction (before, after)
Plan Risk Management
22
Risk Breakdown StructureRisk Breakdown Structure
Influence
Source
Time Budget Quality Scope …
Technologies
External Environment
Internal conditions, Project,
Process
+ + +
People, Communication + +
…
Categorization of Sources and Influence
25
Scale: (1-3, 1-10, 1-100)
26
Matrix of Probability and Impact
Matrix of Probability and Impact
Scale: Planning Poker
Matrix of Probability and Impact
Matrix of Influence Definition
Should correlate with Matrix of Probability and
Impact and with Categorization of Sources and
Influence
Matrix of Influence Definition
Should correlate with Matrix of Probability and Impact and
with Categorization of Sources and Influence
Identify RisksIdentify Risks
Risk Register
30
ID Risk Impact Probability Impact Risk Value Notes
1
Application response will
be worse than expected
according to the
acceptance criteria
Architecture redesign –
3 weeks
2
Specifications aren’t
confirmed by client
Corresponding time
delay, budget increase
3 … …
ID Risk Impact Probability Impact Risk Value Notes
1
Application response will
be worse than expected
according to the
acceptance criteria
Architecture redesign –
3 weeks
3 5 15
2
Specifications aren’t
confirmed by client
Corresponding time
delay, budget increase
2 1 2
3 … …
Perform Qualitative Risk Analysis
Current Risks
Watchlist
Perform Qualitative Risk Analysis
Negative Risks: Avoid, Transfer, Mitigate
Positive Risks: Exploit, Share, Enhance
Acceptance of Positive and Negative
Risks
Plan Risk Responses
32
Risk Management Strategies
33
If your project requires
that you stand on the
edge of a cliff, then
there’s a risk that you
could fall.
If it’s very windy out or
the ground is slippery
and uneven, then
falling is more likely.
Risk Management Strategies - Avoid
34
The easiest way to
avoid this risk is to
walk away from the
cliff… but that may not
be an option on this
project
Risk Management Strategies - Mitigate
35
If you can’t avoid the risk,
you can mitigate it. This
means taking some sort of
action that will cause it do
as little damage to your
project as possible.
Risk Management Strategies - Transfer
36
One effective way of deal
with risk is to pay someone
else to accept it for you.
The most common way to
do this is to buy insurance.
Risk Management Strategies - Accept
37
If you can’t avoid the
risk and there’s nothing
you can do to reduce its
impact then accepting it
is you only choice
Looks like falling is
the best option
Monitor and Control Risks
38
Information Management Systems
▪ Expert Judgment
▪ Meetings
Monitor and Control Risks
Iteratively!
Monitor and Control Risks
Project Start
Project EndProject Plan Changes, Change
Requests, Change in Risk
Register and Project
Documents
Emergency Budget (direct, indirect)
strategy “Before”:
 Most critical Risks in the project plan from very beginning
strategy “After”:
 Contingency Reserve should be in the project plan
management Reserve:
 5%-7% for unpredictable cases (in addition to known risks)
Risks and Client
40
Project Scope
Proactive
Reaction
Contingency
Reserve
Management
Reserve
The Cone of Uncertainty
41
Don't make promises if you can't keep them
42
Estimates as a range.
43
10 Golden Rules of Risk Management
1. Make Risk Management Part of Your Project
2. Identify Risks Early in Your Project
3. Communicate About Risks
4. Consider Both Threats and Opportunities
5. Clarify Ownership Issues
6. Prioritize Risks
7. Analyze Risks
8. Plan and Implement Risk Responses
9. Register Project Risks
10.Track Risks and Associated Tasks
10 Golden Rules of Risk Management
• Make Risk Management Part of Your Project
• Identify Risks Early in Your Project
• Communicate About Risks
• Consider Both Threats and Opportunities
• Clarify Ownership Issues
• Prioritize Risks
• Analyze Risks
• Plan and Implement Risk Responses
• Register Project Risks
• Track Risks and Associated Tasks
The optimism bias
45
Thank you
USA TELEPHONE
Toll-Free: 866.687.3588
Office: 239.690.3111
EMAIL
info@softserveinc.com
WEBSITE:
www.softserveinc.com
EUROPE OFFICES
United Kingdom
Germany
Netherlands
Ukraine
Bulgaria
US OFFICES
Austin, TX
Fort Myers, FL
Boston, MA
Newport Beach, CA
Salt Lake City, UT
There is a web application – business analytics. Known technologies,
DB, 23 main modules, DB architecture is very complex, DB performance
is very critical with the strict acceptance criteria. Requirement are 50%
defined, very low chances for requirements to be changed, but they
should be very clear before the realization.
Now is August, release is on April 1. Client wants to have full
transparency on progress. There couldn’t be delay with the delivery of
the whole scope, it is more important than budget.
Test environment is on client’s side, very big load on the network
connection (more than the channel is now).
Client is very qualified in business area, will be doing UAT. Main expert
on the client’s side is Jar Jar Binks. Project team should be 15 people, 5
are missing, they will be not used after project completion. DB architect
works on another project 60-70%. Client’s expert Jar Jar Binks hardly
uses email and has strong non-English accent.
Practice
47

Risk Management

  • 1.
    Risk Management • SergiiZabigaylo, Program Manager
  • 2.
    What is Risk? ProjectFailure Risk Management, theory and practice The Cone of Uncertainty Notes about Risks Content 2
  • 3.
  • 4.
  • 5.
    What is Risk? 5 UncertainEvent or Condition Always in the Future Effect on Project Objective Has Causes, Impact and Probability Negative or Positive Outcome
  • 6.
    6 Practice: What arethe benefits of risks management? Define common ways to manage risks, analyze, response plans Increase project success probability Realistic estimates Remove obstacles on project launch phases Increase profitability Less stress Professionalism and reputation
  • 7.
    Whenever a project doesn’tmeet to the expectation of the Stakeholders. 7 Project Failure A Project is considered as Failure……
  • 8.
    • Cost &Time Over-runs • Quality Degradation • Frustration & Stress: sometime resulting in people quitting • Low Job Satisfaction • Low Corporate Market Value • Low Public Opinion • Negative Media Campaigns • May even force the company into Closure Impact of Project Failure 8
  • 9.
    Primary Causes ofProject Failure 9
  • 10.
    Problems:  The changesthat were not initially planned for, are added to project.  The Project takes longer and costs more than planned and there is no record of WHY?? Causes:  Not having a method to handle or recognize changes. 1. Lack of Change Management 10
  • 11.
    Problems:  Team Membersdo not have the information they need when they need it.  Issues or changes do not get escalated.  Project reporting is sluggish Causes:  The project’s communication plan was not completed.  The project’s communication plan doesn’t have enough details. 2. Poor Communication 11
  • 12.
    You do nothave enough people, the right skill-sets, or the team is not committed to the projects. Problems:  Tasks take longer than expected to complete.  Deadlines and milestones get missed.  Project completion date comes into jeopardy.  You end up working double shifts to complete all the works. Causes:  There was no pre-commitment of resources to the projects.  The Project was not supported.  There was no analysis and documentation of all skill-set required 3. Inadequate Resources 12
  • 13.
    “I would likea set of stairs that leads up to a bridge.” Problems:  Customer will be unhappy.  Customer will complain and you will end up doing the what they want- at your expense. Causes:  What the customer wants, was not clearly documented.  What you believe the customer wants is different that what the customer believes they have asked for? 4. Poorly Defined Requirement 13
  • 14.
    How do youfigure out how long the project will take? Problems:  An unrealistic timeline or budget will be agreed to.  You will not be able to do all the work in the time allocated. Causes:  No formal estimating method  Estimate confidence is law.  Volume of work not understood 5. Inaccurate Estimates 14
  • 15.
    Sorry about theproject, I left it in my car & there was a bit of an incidents. Problems:  Unexpected events cause delays.  Domino effect of thing going wrong. Causes:  No Formal Risk Management.  Just try to predict the big things that can go wrong.  It’s the sum of the all little things that make a project late.  Nothing is more stressful than trying to keep on schedule when unexpected things keep happening. 6. Poor Risk Management 15
  • 16.
    “Emergency Phone installed,Deliverable completed” Problems:  Difficult to get the agreement that the product is finished.  Customer Keep wanting more, saying you didn’t do it to their Specification. Causes:  The Milestones or deliverables were not measurable.  The customer never told us How many they wanted So we just assumed 1, 7. Poorly Defined Deliverables 16
  • 17.
    Of course weCan do that for you. Problems:  There was little or no planning before deciding you can get the job done.  The task you agree to turns out to be more work than expected.  It takes you longer and jeopardizes other deliverables. Causes:  Not enough time spent planning.  You may have been pressured into giving an answer right then and there.  Didn’t have a full understanding of the work involved before committing. 8. Over Optimism 17
  • 18.
    Hurry .... Wehave a tight deadline. No time to plan. Just start digging. Problems:  The plan is flawed from the start.  The project gets out of control and can’t be recovered. Causes:  You have to do the work and weren’t also given time for project management.  Perhaps you only have 10% or 20% allotment for the project management duties. 9. No time for Project Management 18
  • 19.
    You Don't KnowWhat You Don't Know. Problems:  Your project don’t finish on time.  Your project are always squeezed at the end.  Your project are stressful.  You have to deal with unrealistic expectation or customers.  You feel your projects are out of control. Causes:  People often don’t know what they don’t know.  Their project are out of control but they don’t know WHY??  They feel they are doing okay but could benefit from formal PM education. 10. Improved PM Skill-set needed 19
  • 20.
    Risk Management Process 20 PlanRisk Management Identify Risks Perform Risk Analysis Plan Risk Responses Monitoring & Control
  • 21.
    Define how willwe work with Risks: resources, responsibilities, frequency, risk tolerance… Plan Risk Management 21
  • 22.
    Risk Management Plan: •Categorize risk sources • Probability Matrix • Roles, Responsibilities, Activity Plan • Monitoring, Reporting, Communication • Tolerance, Management/Contingency reserves, reaction (before, after) Plan Risk Management 22
  • 23.
    Risk Breakdown StructureRiskBreakdown Structure
  • 24.
    Influence Source Time Budget QualityScope … Technologies External Environment Internal conditions, Project, Process + + + People, Communication + + … Categorization of Sources and Influence 25
  • 25.
    Scale: (1-3, 1-10,1-100) 26 Matrix of Probability and Impact
  • 26.
    Matrix of Probabilityand Impact Scale: Planning Poker Matrix of Probability and Impact
  • 27.
    Matrix of InfluenceDefinition Should correlate with Matrix of Probability and Impact and with Categorization of Sources and Influence Matrix of Influence Definition Should correlate with Matrix of Probability and Impact and with Categorization of Sources and Influence
  • 28.
  • 29.
    Risk Register 30 ID RiskImpact Probability Impact Risk Value Notes 1 Application response will be worse than expected according to the acceptance criteria Architecture redesign – 3 weeks 2 Specifications aren’t confirmed by client Corresponding time delay, budget increase 3 … …
  • 30.
    ID Risk ImpactProbability Impact Risk Value Notes 1 Application response will be worse than expected according to the acceptance criteria Architecture redesign – 3 weeks 3 5 15 2 Specifications aren’t confirmed by client Corresponding time delay, budget increase 2 1 2 3 … … Perform Qualitative Risk Analysis Current Risks Watchlist Perform Qualitative Risk Analysis
  • 31.
    Negative Risks: Avoid,Transfer, Mitigate Positive Risks: Exploit, Share, Enhance Acceptance of Positive and Negative Risks Plan Risk Responses 32
  • 32.
    Risk Management Strategies 33 Ifyour project requires that you stand on the edge of a cliff, then there’s a risk that you could fall. If it’s very windy out or the ground is slippery and uneven, then falling is more likely.
  • 33.
    Risk Management Strategies- Avoid 34 The easiest way to avoid this risk is to walk away from the cliff… but that may not be an option on this project
  • 34.
    Risk Management Strategies- Mitigate 35 If you can’t avoid the risk, you can mitigate it. This means taking some sort of action that will cause it do as little damage to your project as possible.
  • 35.
    Risk Management Strategies- Transfer 36 One effective way of deal with risk is to pay someone else to accept it for you. The most common way to do this is to buy insurance.
  • 36.
    Risk Management Strategies- Accept 37 If you can’t avoid the risk and there’s nothing you can do to reduce its impact then accepting it is you only choice Looks like falling is the best option
  • 37.
    Monitor and ControlRisks 38 Information Management Systems ▪ Expert Judgment ▪ Meetings
  • 38.
    Monitor and ControlRisks Iteratively! Monitor and Control Risks Project Start Project EndProject Plan Changes, Change Requests, Change in Risk Register and Project Documents
  • 39.
    Emergency Budget (direct,indirect) strategy “Before”:  Most critical Risks in the project plan from very beginning strategy “After”:  Contingency Reserve should be in the project plan management Reserve:  5%-7% for unpredictable cases (in addition to known risks) Risks and Client 40 Project Scope Proactive Reaction Contingency Reserve Management Reserve
  • 40.
    The Cone ofUncertainty 41
  • 41.
    Don't make promisesif you can't keep them 42
  • 42.
    Estimates as arange. 43
  • 43.
    10 Golden Rulesof Risk Management 1. Make Risk Management Part of Your Project 2. Identify Risks Early in Your Project 3. Communicate About Risks 4. Consider Both Threats and Opportunities 5. Clarify Ownership Issues 6. Prioritize Risks 7. Analyze Risks 8. Plan and Implement Risk Responses 9. Register Project Risks 10.Track Risks and Associated Tasks 10 Golden Rules of Risk Management • Make Risk Management Part of Your Project • Identify Risks Early in Your Project • Communicate About Risks • Consider Both Threats and Opportunities • Clarify Ownership Issues • Prioritize Risks • Analyze Risks • Plan and Implement Risk Responses • Register Project Risks • Track Risks and Associated Tasks
  • 44.
  • 45.
    Thank you USA TELEPHONE Toll-Free:866.687.3588 Office: 239.690.3111 EMAIL info@softserveinc.com WEBSITE: www.softserveinc.com EUROPE OFFICES United Kingdom Germany Netherlands Ukraine Bulgaria US OFFICES Austin, TX Fort Myers, FL Boston, MA Newport Beach, CA Salt Lake City, UT
  • 46.
    There is aweb application – business analytics. Known technologies, DB, 23 main modules, DB architecture is very complex, DB performance is very critical with the strict acceptance criteria. Requirement are 50% defined, very low chances for requirements to be changed, but they should be very clear before the realization. Now is August, release is on April 1. Client wants to have full transparency on progress. There couldn’t be delay with the delivery of the whole scope, it is more important than budget. Test environment is on client’s side, very big load on the network connection (more than the channel is now). Client is very qualified in business area, will be doing UAT. Main expert on the client’s side is Jar Jar Binks. Project team should be 15 people, 5 are missing, they will be not used after project completion. DB architect works on another project 60-70%. Client’s expert Jar Jar Binks hardly uses email and has strong non-English accent. Practice 47