Risk Management
Dealing with the Unknown
Risk is a way to
quantify the unknown
Anything you try that is new, will expose
you to risk
Risk is what you do
not know or cannot be
certain of
–
This Includes
●
Identification of the Risk
●
Quantifying the Risk
●
Developing a plan to address Risk
Risk Management is an exercise in defining the unknown in a fashion
that allows you to develop countermeasures for the risk
Opportunities
Risks
Try to balance risks and opportunities
Without Risk There are
no Opportunities
●
●
●
One way to look at this is:
If you do not have this for
your Project add this
many points to your risk
index
This is an example of
what a (Simple) Risk
scoring sheet might
look like for a Software
Development Project
1. What is the project estimate in calendar (elapsed) time?
( ) 12 months or less Low = 1 point
( ) 13 months to 24 months Medium = 2 points
( ) Over 24 months High = 3 points
2. What is the estimated number of person days for the system?
( ) 12 to 375 Low = 1 point
( ) 375 to 1875 Medium = 2 points
( ) 1875 to 3750 Medium = 3 points
( ) Over 3750 High = 4 points
3. Number of departments involved (excluding IT)
( ) One Low = 1 point
( ) Two Medium = 2 points
( ) Three or more High = 3 points
4. Is additional hardware required for the project?
( ) None Low = 0 points
( ) Central processor type change Low = 1 point
( ) Peripheral/storage device changes Low = 1
( ) Terminals Med = 2
( ) Change of platform, for example High = 3
PCs replacing mainframes
You may develop a
questionnaire to help
quantify the risk for your
project, like the one
partially shown here
You can only go so far in
quantifying risk because
you don’t know what you
don’t know
!
•
•
•
"#""
●
!"#
●
$%"&%'!()(#
●
$
–
(Monte Carlo or Latin Hypercube)
●
●
%*+
●
%*,"'-.,#
$%"
! !&/
–
Time Budgets
–
Resource Budgets
–
Cost (Monetary) budgets
A “Budget” is a pre-established block of the element being used. As
long as you remain within the budget no external approval is needed
You are probably familiar with a Monetary Budget, however the concept
can be used to define limits around any resource for which there is a
limited supply
Extrapolation can be used to see
problems emerge before they are critical
$%"
This concept is also referred to as a “Management Reserve”
Notice how management reserves have been applied to each fixed event below.
5 Days 10 Days 15 Days
Total Float
What are the small blue boxes on the bottom ?
&
●
&%0$12
–
What is the Best Case (BC)
–
What is the Worst Case (WC)
–
What is the Most Likely Scenario (ML)
Duration = (BC + (4*ML) + WC)/6
While it is not
sophisticated and does not
allow for independent
adjustment of risk areas, it
is simple and almost
everyone can follow it
%""'
●
.(&
–
Rather than 0 make it 10 or 30:
Anything that starts to eat up your
budget
●
(3!-45
–
Activities will violate the zone before
slip is critical
●
–
Train team members to have
contingency plans prepared in advance
“ I am behind by 10 days and here are my best 3 ideas for recovering”
The Critical Chain
Method is a Variant of
Critical Path that
proposes a different
way to budget
())
If your
software
allows it you
can set up a
new template
to display
your time
buffer,
allowing other
users to see it
in the default
configuration
)()*
Here we are
setting the
buffer to 15
days, you will
know a task is
in trouble 15
days before it
actually
becomes
critical
()(
Some tools may
have limited
configurability
and only allow
you to set the
main critical path
criteria
Slack is the old
name for float
&+&&
•
Total Float (or Slack) –
•
The amount of time a task
can be delayed without
slipping the Project End Date
•
If someone is talking about
float on a project and does
not specify “total” or “free”
they mean total
•
Free Float (or Slack) –
The amount of time a task
can be delayed without
effecting another task
Your
Time
Budget
%))
Best
Case
Worst
Case
Weight = 5 Weight = 4
Most Likely
5 X Worst Case + 4 X Best Case
9
=
An even easier to understand approach does exist. The “Worst Case – Best
Case” approach is a less accurate approximation of the PERT approach
With this approach you run the risk of being too subjective since you can weight
the values just about anyway you like
%),))
Part of the idea with approaches like this is that even if some tasks finish early others
will finish late and overall they will cancel each other out
Program Evaluation and Review Technique
Best
Case
Worst
Case
Most Likely
Case
Weight = 1 Weight = 4 Weight = 1
Three Estimates are taken for each task
PERT weighted
average
Worst Case + 4 X Most Likely Case + Best Case
6
=
PERT on the other hand has a more standardized approach with a
history of successful projects (Some IT and some elsewhere)
)
Because of it’s history PERT can usually be found as an option on
most Project Management tools
#-.
/)#
Percent Probability between Conditions
10% - 25% - 50% - 75% - 90%
Conditions
Best
Good
OK
Average
Poor
Bad
Really Bad
Degree of Confidence needs
100 – 1000 samples
When you are serious about a Risk Analysis you use a statistical
model with a variety of inputs and/or access to a history database
()(
Monte
Carlo
Analysis
requires
additional
statistical
tools and
may require
a person
trained to
do this type
of work
)(/)
A Monte
Carlo
Analysis
can be
performed
targeting
any number
of project
parameters
Yes, this is
Statistics
$"0.
●
6!$
●
6!$'(2*
7
–
Initial durations are based of the average from the
companies that participated in the development of the
database.
LBMS was a proprietary Management System which was purchased
by Platinum Technology
The idea behind this approach is similar to the idea behind integral
Calculus, as you develop more well defined modules of historic
evidence your odds of a high risk future project are diminished
"(1'
●
$82
9:
&/
&
●
822
82&
"2324
EMV takes a different approach, it asks “where else could I invest
my funds?” and “Is the return on this project better or worse than
my other options?”
For example what
is the probability
I will make more
money if I
proceed with this
project as
opposed to just
placing the
money in a low
risk stock
portfolio
#5
We may also perform an analysis on the technology we wish to use
to determine the risk inherent in that technology and the impact it
would have on our organization
In this example
the circled
projects would be
considered too
risky to pursue
6
Latin Hypercube is another approach like Monte Carlo to develop a
statistical model to predict the outcomes of your project
If your project is using
Latin Hypercube you
will probably have a
mathematician
performing the
analysis
$7-&
Name
Duration
WBS
Total Float
Free Float
Negative Float indicates you will NOT complete your project
on time. The negative number is the number of days you
must shorten your plan by to get back on schedule
/(
Posing questions to your model to develop Contingency Plans
Wouldn't it be nice if you
could ask someone what
would happen if your main
programmer was hit by a bus?
Or
What if the main technology
you planned to use did not
work out?
What would that do to your
plan?
Well you can (If you have
completed all the steps we
have covered until now) and it
is called a What-If Scenario
Once you have a Project Plan
you can change parameters in
the plan and allow the model
to predict the impact of your
change
The idea is then to create a
contingency plan just in case
that happens
You can also run probabilities
on the event happening to
help determine when to
implement your contingency
/#/!
•
Key Resources – Run an
analysis without each key
resource and see the effect
•
May need to plan to have
temp help available
•
May have to cross-train key
people
/#8
Hinge Pin events are focal points in
your plan where many lines of activity
come together (Code Review)
•
Hinge Pin Dates – the probability that
that date will slip becomes higher.
Run an analysis of that date slipping
(6+ months in advance) to see the
effect on the plan.
•
Divide Hinge Pin Events
After all this is a Primary form of Project Communications
8'
If you walk into a meeting with a page of numbers don’t be surprised if
nobody assimilates the information you are presenting
While this is true for all Project Management reporting it is especially
true for statistical information like risk analyses
('70
If you walk into a meeting with a page of numbers don’t be surprised if
nobody assimilates the information you are presenting
While this is true for all Project Management reporting it is especially
true for statistical information like risk analyses
This is
where our
project
should be
This is
where
our
project
is
45 Days
$'
Logically group like data
together
Use Summary
Representation when not
discussing detail
9":
The objective is to allow the team/stakeholders to understand the
impact of the data you are presenting
0";
https://create.kahoot.it/share/risk/2accd530-97ad-
404a-b9a5-b7597583fe12
"
PMBOK – Chapter 11 - Risk
Practical Guide to PM – Chapter 5 – Reporting, 3.6 - Risk
;.
Perform a Mock Pert analysis on your Project