improving your risk identification and management approach

Facilitating your process journey …

Improving your Risk Identification and Management Approach

by

Henry Schneider

Process and Product Quality Consulting, LLC

June 25, 2008

®2008 ***Proprietary*** All Rights Reserved - Process and Product Quality Consulting, LLC


26/27/2008

Why Should I Care About Risks?

What is a Risk?

Risk Management Principles

Risk Identification and Management Techniques

Summary

Agenda



36/27/2008



46/27/2008



56/27/2008



66/27/2008



76/27/2008



86/27/2008

What coulda/shoulda happened?



96/27/2008

When Risk Are Not Managed Well

It is easy to ignore risks when they are not being tracked

Risks that are known to project staff are often not known or a surprise to management

Every time a new problem manifests, a new management technique is tried



106/27/2008

Why Should I Care?

The project may dodge some of the “bullets,” but not all of them

No lessons learned captured for future projects means making the same mistakes again and again

Insanity - doing the same thing over and over again and expecting different results

Repeated project failures due to unforeseen (but predictable) risks costs you business, if not the whole company



116/27/2008

Risk and Organization Culture

Innovative cultures assume that the potential value of innovation carries some level of risk

“Fail forward” attitude

acknowledge and learn from failures

risks are investment in success

Non-innovative cultures don’t acknowledge failure as an acceptable outcome

“Don’t bring me problems, bring me solutions.”

acknowledging risks is admitting the possibility of failure



126/27/2008

Risk Defined

Dictionary definitions of risk hazard, danger, or peril

exposure to loss, injury, or destruction

General definition A risk is a problem waiting to happen

A risk is an event that could threaten the successful completion of the project

Risk management is the process of identifying the risks and handling those which are most threatening to the project, so that they don’t become problems



136/27/2008

Risk Management Principles - 1

Risks must be assessed continuously and used for decision-making in all phases of the project

Effective risk management considers all areas of the project: personnel, process, business, technology, etc.

Risks need to be clearly communicated by all team members

The environment must allow people to identify risks without negative consequences to them



146/27/2008

Risk Management Principles - 2

Risks must be clearly stated before they can be managed

A project should not be judged solely on the number or nature of risks uncovered

Deal with important risks first

Action items to address risks need to be integrated into the overall project plan or action item list



156/27/2008

Risk Source Categories

•Mission and goals

•Decision drivers

•Organization management

•Customer / end user

•Budget / cost

•Schedule

•Project characteristics

•Development process

•Development environment

•Personnel and relationships

•Operational environment

•New technology

Consequences

•Cost overruns

•Schedule slips

•Inadequate functionality

•Canceled projects

•Sudden personnel changes

•Customer dissatisfaction

•Loss of company image

•Demoralized staff

•Poor product performance

•Legal proceedings

Risk Source Categories and Consequences



166/27/2008

Start by Reviewing Project Parameters

Project vision

• Are objectives clear and understood?

• Are customer and provider objectives known?

Project scope,

milestones, and

deliverables

• Are features agreed to?

• Are commitments agreed to and documented?

Roles and responsibili-

ties

• Are roles and responsibilities clear to all involved?

• Are all roles staffed?

• Is sponsorship and accountability clear?

Use know-ledge of specific

project roles to identify

risks



176/27/2008

Brainstorming Review possible sources of risk and brainstorm specific risks

they could create for your project

Review potential adverse outcomes for your project and brainstorm how they might arise

Risk Identification Technique

Sources

Outcomes

Risks



186/27/2008

Risk Factor Table - Example

Risk Factor Low Risk Cue Medium Risk Cue High Risk Cue

Project fit Directly supports customer’s missions and goals

Indirectly impacts one or more goals

Does not support or relate to customer’s mission or goals

Customer perception Customer expects team to provide this product

Team is working on project that is not expected by customer

Project is a mismatch with prior products of this team

Work flow Little or not change to work flow

Will change some aspect or have small affect on work flow

Significantly changes work flow or method of organization



196/27/2008

Reviewing Factors

Select appropriate table of factors

Examine each risk factor and rate its relevance

• High - potentially high threat risk

• Medium - may suggest a risk

• Low - no apparent risk

• N/A - factor is not applicable

• NI - needs more information

• TBD - needs to have project proceed further; revisit later

Use high rated factors to develop

specific risk statements for the

project



206/27/2008

Risk Factors Help You Focus

Risks to be managed –ten or so

Risks rated High –dozens

Risks indicated by factor tables - hundreds

All risks - thousands



216/27/2008

Risk Probability

Probability is the likelihood that the risk will actually occur as a problem if we take no action

Usually expressed as a percentage:

• greater than zero or less than 100%

• use increments no smaller than 5%

Example:

• something slightly more likely than not - risk probability = 60%

• something likely to happen 3/4 of the time - risk probability = 75%



226/27/2008

Establishing Measures of Loss

Level of loss (scale of 1 to 10) Rate damage to project objectives

High values indicate serious loss to the project

Example: Risk loss = 4 if project is considerably late, but has all functionality

Impact of monetary loss useful, if possible Long-term costs in operations and support

Long-term loss of market share or opportunity

Short-term cost in additional work

Example: Risk loss = $120,000 to add person-year of work



236/27/2008

Risk Exposure

• Risk probability

• Risk impact (loss)Components

• Risk exposure = risk probability x risk impactRisk exposure is the

total threat of the risk

• Risk exposure = 75% x 4 = 3.0

• Risk exposure = 60% x $120,000 = $72,000Example:

Focus on reducing risk exposure



246/27/2008

Ranking Risks

Rank the risks at a given

point in time

Rank in order of risk exposure (most to least

dangerous)

Look for breaks in values in the

list

Focus on actions for those at the top of the list

Review the list regularly

with the team

Add items as needed

Adjust exposure as appropriate



256/27/2008

Risk Mitigation Strategies

•Apply money or effort for controllable risks

•Use work-arounds for uncontrollable risksRisk reduction

• Insure the loss

• Involve a third party

•Tie a bonus to completion of the project

• Involve domain specialists

Risk transfer

•Some risks cannot be removed completely

•Balance cost of handling against exposure

Invest no more than needed



266/27/2008

Risk Contingency Plans

Devise contingency plans for

• high exposure risks, in case the mitigation strategy fails

• any risk for which there is no possible mitigation action

Specify risk measures and trigger values

• measures of time, resources to handle risk

• measures of risk impact

• trigger values that tell it is time to use contingency approach

Agree with customer and management at project start how contingency plans will be funded and handled



276/27/2008

Contingency Triggers

For risks leading to schedule slips

• Latest date to allow you to use alternative platforms

• Latest date to select another vendor

For risks requiring additional effort or

time

• Latest date to locate the resources

• Greatest amount of penalty or fine to incur

Limit for extra cost to the customer

Limit for learning time

Example Contingency Triggers



286/27/2008

Mitigation and Contingency - Example

• If key subject matter experts are not available by the first of June, we will be unable to deliver the project per the plan.

Risk Statement

• Cross train project staff with key subject matter experts, so work can proceed and decisions made if key experts are unavailable.

Risk Mitigation

• If by the first of April it is known that key experts will not be available, assign team members to learn the needed subject matter so the project can move forward without involving key experts.

Contingency Plan



296/27/2008

Communication is Essential!

Communicate risk information to all affected

parties

Encourage free flow of information about risk

• Place risk chart in a common location

• Use email or other team collaboration method (e.g. Wiki page) to identify new risks, change status, and indicate completion

• Encourage raising of new risks in weekly status reports, during inspections or reviews, and at major milestone reviews

Update Top Risks with team regularly

Review status of risks at key milestones



306/27/2008

What Would Be the Preferable Outcome?

What was delivered because risks weren’t managed

What could have been delivered if risks had been managed



316/27/2008

Repeated project failures due to unforeseen (but predictable) risks can cost you business

Risk management is the process of identifying the risks and handling those which are most threatening to the project, so that they don’t become problems

Risks can be easily managed using techniques such as: brainstorming risk factors risk exposure ranking mitigation communication

Summary



326/27/2008

Questions



336/27/2008

Consulting

• CMMI

• Software Engineering

• Systems Engineering

• Process Improvement

Appraising

• SCAMPI A, B, C

• Gap Analysis

Training

• CMMI/Process Improvement

• Action Planning Workshops

• Measurement and Analysis

• Process Area Specific Training

PPQC Services



346/27/2008

Address: Henry Schneider

President/Senior Principal Consultant

Process and Product Quality Consulting, LLC

2111 Heather Green

Houston, TX USA 77062

Phone: 281-218-6682

E-mail: [email protected]

Web Site: www.ppqc.net

Contact Information

mailto:[email protected]

http://www.ppqc.net/

improving your risk identification and management approach

Business

process journey agenda

product quality consulting

management techniques