Improving Intuitive Risk Management Skills These slides show how risk management is something we all do intuitively, every day. After demonstrating this truth, the talk will cover ways we can be more successful with our risk management efforts – and make it more fun! These concepts can be applied equally to our personal and work lives. Ultimately, improved risk management usually translates to improved outcomes. Know how to approach Risk Management intuitively, both as part of every day life and as part of project management. Have some quick and easy techniques to jump start risk management. Know how you can improve your risk management skills, and have some fun with it.

1. Trashing your Risk –
Improving Your Intuitive Risk
Management Skills
with F. Michael Dedolph
fmdedolph@netscape.net
services@xbosoft.com

2. XBOSoft Info
Founded in 2006
Dedicated to software quality
Software QA Consulting
Software Testing
Offices in San Francisco, Beijing, Oslo, and Amsterdam
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 2

3. Housekeeping
Everyone except the speakers are muted
Questions via the gotowebinar control on the right side of
your screen or through Twitter @XBOSoft
Questions can be asked throughout the webinar - we’ll try
to answer them at the end.
You will receive info on recording after the webinar
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 3

4. Speakers
Sabrina Gasson
XBOSoft Marketing
Jan Princen
Director at XBOsoft
Founder of GripQA
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 4

5. Trashing Your Risk - Improving Your
Intuitive Risk Management Skills
F. Michael Dedolph
Abstract: This interactive webinar will show how risk management is
something we all do intuitively, every day. After demonstrating this truth,
the talk will cover ways we can be more successful with our risk
management efforts - and make it more fun! These concepts can be
applied equally to our personal and work lives. Ultimately, improved risk
management usually translates to improved outcomes
This presentation is based on material developed by F. Michael Dedolph
while working at the Software Engineering Institute (SEI). Please do not
reuse the material without giving credit to the SEI. Credit for Michael
would be nice, too. I have used variations of this presentation in
workshops at the PNSQC, SEI, Bell Labs, CSC, Xerox, various DoD
agencies, and Software Process Improvement Network (SPIN)
presentations.
11/20/2014 F. Michael Dedolph Webinar 11/20/14
Slide 5

6. Once Upon a Time - A Risk Parable
F. Michael 11/20/2014 Dedolph Webinar 11/20/14 Slide 6

7. The Problem:
Getting to work
The Risk:
Must be on time
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 7

8. “Uncle Joe” Offers to Help
F. Michael 11/20/2014 Dedolph Webinar 11/20/14 Slide 8

9. What Could Possibly Go Wrong?
(Insert your list here)
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 9

10. A Few Risks Others Have Noted
• Involved in an auto accident
• Traffic problems
• Mechanical problems
• Car uncomfortable, lacks class
• Sleep in
• Weather
• Illness
• ???
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 10

11. What Do We Notice About the Risks?
Here are some things you may have noted:
• Many of the risks captured go beyond the initial problem
statement (getting to work on time)
• Risks may focus on urgent things while neglecting important
things (lower probability but higher overall impact).
• Different people have different ideas and tolerances for risk
• Risks can be grouped
• Risks are inter-related - one risk makes another more or less
likely, and/or changes the severity of the consequence
• Risk identification can be done intuitively and informally
– Are there other ways we could have done this?
– For this example, would it be worthwhile?
Assumption: risks can be mitigated.
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 11

12. What Can We Do?
(Insert your list here)
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 12

13. Mitigations Others Have Noted
Risks: Mitigation Action
Involved in an auto accident Insurance
Driver training
Maintain vehicle
Cell phone
Traffic problems Radio reports
Plan alternate routes
Set up home office
Leave early
Mechanical problems Maintain vehicle
Roadside assistance
plan
Vehicle inspections
Cell phone
Car lacks class Hmmm
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 13

14. What is Notable About the Mitigations?
Here are some things you may have noted:
• Some strategies address multiple risks
• No single strategy address all the risks
• All of the mitigation strategies take resources – time
F. Michael Dedolph Webinar 11/20/14
and/or money!
• Some mitigation activities introduce new risks
• ???
11/20/2014 Slide 14

15. Question: Do Any of These
Mitigations Introduce New Risks?
The “SO” . . . “BUT” game.
Risk
I might be involved in an auto accident
SO I bought Insurance
BUT the insurance cost more money than I had
SO I got a second job
BUT I was so tired I swerved and got a ticket
SO I stayed home and slept in
BUT . . .
11/20/2014 F. Michael Dedolph Webinar 11/20/14
Slide 15

16. Hmmm.
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 16

17. Hmmm.
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 17

18. What Should We Do?
There are always choices
“Two roads diverged . . .”
•How do we choose?
>> Making better choices
is the reason for risk
analysis
For our example, what should our hero do?
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 18

19. A Risk Example, Continued—Analysis
Using the intuitive approach, we need to ask—
“What should we do?”, OR,
“Should we do ALL of these things?”
>> Quick answer – we should do the most important
things (we need to balance costs and benefits.)
>> Risk analysis is used to help decide which things
are most important.
11/20/2014 F. Michael Dedolph Webinar 11/20/14
Slide 19

20. A Risk Example, Continued—Analysis
Risk Analysis supports risk management by:
• providing tools to help prioritize risks
• identifying critical follow up actions (triggers and
tracking mechanisms)
• helping us assess the effectiveness of planned
F. Michael Dedolph Webinar 11/20/14
mitigations
• providing ways to balance the acceptable level of risk
against the cost of mitigation activities
Analysis starts by looking at the individual risk statements.
Additional work may be needed to analyze the composite
set of risks.
11/20/2014 Slide 20

21. A Risk Example, Continued—Analysis
Supports Management Decisions
Basic risk analysis involves estimating 2 things:
• What is the probability (or likelihood) of the risk
happening?
– Usually expressed as High, Medium, Low
• What is the cost/impact if the risk happens?
– Usually expressed as High, Medium, Low,
sometimes “Catastrophic” is added
Other analysis questions may include what the risk
triggers are, when the risk might occur, etc.
11/20/2014 F. Michael Dedolph Webinar 11/20/14
Slide 21

22. A Risk Example, Continued—Simple
Analysis
EXPOSURE TABLE
High 3 6 9
Med 2 4 6
Low 1 2 3
Low Med High
• P(Risk) X Impact =
F. Michael Dedolph Webinar 11/20/14
Magnitude (aka,
Exposure)
• Exposure gives a
measure of how
important the risk is
• Exposure can/should be
estimated before and
after mitigation
planning
• One mechanism: Score
risks individually,
discuss as a team, use
average
P
R
O
B
A
B
I
L
I
T
Y
IMPACT
11/20/2014 Slide 22

23. What Will We Do?
Plan your work, then work your plan.
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 23

24. The Final Question . . .
What will we do?
• What might prevent us from following through?
• What could we do to ensure we follow through?
>> Quick answer: include risk management in project
F. Michael Dedolph Webinar 11/20/14
management.
>> But, this is dependent on your goals, organization,
customer, product, and risk tolerance.
• Keep it practical – use analysis to set priorities
– What can we afford?
– How much time do we have?
11/20/2014 Slide 24

25. Summary: Intuitive Risk Management
This intuitive approach is based on 4 questions.
ANALYSIS
Identification Mitigation
Risk Management
F. Michael Dedolph Webinar 11/20/14
4 Risk Questions:
What
> could go wrong?
> can we do?
> should we do?
> will we do?
11/20/2014 Slide 25

26. OK, That’s Cool, But,
How About Us?
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 26

27. What Types of Products do You Make?
• “Use and lose” - product is disposable,
mass produced
• “One and done” - custom built product, no
follow up support
• “Build and sustain” - built and operated by
us or a partner
• “Build and enhance” - iterative product with
multiple releases
• “Give away” – indirect profit from add-ons,
ad-ons, premium service packages
>> Different products, different risk
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 27

28. What Could (Possibly) Go Wrong?
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 28

29. Insert Your List Here:
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 29

30. Sample Testing Risk Areas
Here are some things I’ve seen in the past
•Test strategies don’t match the product
•Insufficient resources for the testing needed
•Incomplete testing
•Undocumented testing
•Wrong tools and methods
•No automation/too much automation
•Uncooperative development & management teams
•Unclear criteria – what is “good enough”?
•Testers don’t have any control of test process
•???
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 30

31. What Can We Do?
(Insert your list here)
What stands out for you? Are any of these
risks things that have happened before?
>> (It might be a problem, not a risk)
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 31

32. What Should We Do?
>> Start by identifying and communicating risk
>> Translate risks into $$$ and time (analysis)
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 32

33. What Will We Do?
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 33

34. The Goal:
Trash those risks
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 34

35. Q+A
Post your questions on Twitter and we'll answer them @XBOSoft
Join us to keep updated on all our webinars, reports and whitepapers:
facebook.com/xbosoft
+xbosoft
We post regularly on our blog – check us out!
http://xbosoft.com/software-quality-blog/
Why not download our free Whitepapers, available here: http://xbosoft.com/knowledge-center/software-testing-
white-paper/
You will receive an email with information on slides and recording. Any further queries regarding our services
or ideas for future webinars please email us! Services@xbosoft.com
11/20/2014 F. Michael Dedolph Webinar 11/20/14 Slide 35