Risk Management Process

1. Risk ManagementProcess

2. Augustine’s Law of Counter Productivity« It costs a lot to build bad products »

3. Contents • Challenges to a project • Participants to Risk management • Risk management process steps Source: TBD

4. Challenges to a Project • Risk exists among opportunities • Adequate plans must be maintained • Continually update plan to reduce risk • Must have capability to execute plans • Resources, process, training, experience • Project objectives must be met • Customer needs, product requirements • Decisions must be based on a balance between risks and benefits ----> There is a need to manage risk

5. Risk Management along the Life Cycle HWCI Testing Fabrication Hardware (HWCI) Development Detailed Design Preliminary Design Hardware Rqmts. Analysis FCA PCA PDR CDR System System Testing Production System Reqmts Integration SDR and and SRR FQR Design SSR Analysis and Testing Evaluation Development PDR CDR Software FCA PCA Rqmts. Analysis Preliminary Design Detailed TRR REVIEWS Design Coding SOFTWARE (CSSI) DEVELOPMENT and CSA SRR - System Requirements Review Testing SDR - Systems Design Review CSC SSR - Software Specification Review Integration PDR - Preliminary Design Review and Testing CSCI CDR - Critical Design Review Testing TRR - Test Readiness Review PCA - Physical Configuration Audit DEVELOPMENT FQR - Formal Qualification Review CONFIGURATIONS may be integrated with hardware reviews FUNCTIONAL ALLOCATED PRODUCT From Figure 1 of DoD-Std.-2167A BASELINE BASELINE BASE LINE

6. Participants to Risk Management • Project members • Support groups (finance, MIS, marketing) • Senior management • Customer support • Customer • Partner • Supplier

7. Components of Plan • Requirements • Quantitative and qualitative • Schedule • Description of work to be performed • Budget • Processes • technical, communication, reporting, training, decision making, etc • Resources

8. When are Plans Complete ? If the act of performing to the plans and only to the plans will logically produce the product the customer wants, when he wants it, for a pre-defined cost.

9. Risk Management Questions • What could go wrong with the plan ? • How likely is it ? • What could be the consequences ? • What can I do about it? • Are things getter better or worst ?

10. Risk Management Process Steps 1: Identify Potential Risks 2: Analyze risks 3: Develop risk reduction plans 4: Communicate & track risks

11. Step 1: Identify Potential Risks 1. Assess resource & Process readiness & plan & adequacy 2. Assess capability to achieve clear project objectives Identify undocumented requirements, tasks, assumptions 3. Collect & integrate potential risks

12. Step 1: Identify Potential Risks • Risk Identification Methods • Interviews, questionnaires • Risk templates • Integrated scheduling • Trend and failure analysis • Lessons learned • Risk checklists • Pareto charts • Fishbone (Cause and effect diagram)

13. Graybeards & Previous PMs • Pool of talent and experience • What worked, what didn’t • Why • Variety of Forums • Technical Issues Briefs • Special Groups/Gatherings • “If I knew then what I know now…”

14. Step 1: Identify Potential Risks • Risk Areas for Generating Risk Checklists • Plans • Requirements • Materials • Suppliers • Schedules • Costs • Personnel • Training • Facilities • Processes • Alignment with customer • Technology, politic, regulations, etc

15. Step 1: Identify Potential Risks • Key risk clues • Not sure • Don’t know • May…might..could • Complexity • Dependency • New • ‘ Can-do ’ • Hopefully • Probably

16. Step 1: Identify Potential Risks • Description of the Risk • Should be a complete sentence which includes: • Source of uncertainty (e.g. if …) • Potential consequence (e.g. ...then …) • Example • Source: Management views a member’s project- related responsibilities as a higher priority than process improvement - related responsibilities. • Consequence: When schedules clash, members will be pulled from the improvement effort. The team’s schedule will slip, momentum will be lost, and morale will suffer.

17. Step 1: Identify Potential Risks • Risk Identification Worksheet

18. Step 2: Analyze Risks 1. Select analysis type (Quantitative - Qualitative) 2. Determine likelihood and consequence using criteria 3. Determine risk level 4. Collect and integrate risk assessments

19. Step 2: Analyze Risks • Quantitative Versus Qualitative • Quantitative: expressible as a specific quantity or amount, usually numerically • e.g. the water is flowing at 20 KPH • Qualitative: characterized by a description of the fundamental nature of an item. Potentially different for each observer. • e.g. the pattern is random

20. Step 2: Analyze Risks • Likelihood Criteria - no mitigation plans • Low • Proven approach or design, problem very unlikely to occur • Moderate • Partially demonstrated approach or design • High • Speculative approach or design, or ‘ To be determined ’

21. Step 2: Analyze Risks • Likelihood Criteria - with approved mitigation plans • Low • Proven or completely mitigated by an approved plan • Moderate • Partially demonstrated or somewhat mitigated by approved plan • High • Speculative with no identified mitigation plan

22. Step 2: Analyze Risks • Consequence criteria • Low • Little or no impact • Moderate • Major problems that could be tolerated • High • Major crisis that could result in project termination if not mitigated

23. Step 2: Analyze Risks

24. Step 2: Analyze Risks • Risk levels • Low risk • No specific action required to reduce risk • Medium risk • Special project emphasis and close monitoring will probably be sufficient to overcome potential difficulties • High risk • Special action needs to be taken as soon as possible.Some or much negative impact to the project might still occur.

25. Step 2: Analyze Risks Medium High Probability of Occurrence Low Impact- Consequence

26. What Is the Likelihood the Risk Will Happen? Level Your Approach and Processes... 5 1 2 3 4 5 Not Likely: Low Likelihood: Likely: Highly Likely: Near Certainty: ...Will effectively avoid or mitigate this risk based on standard practices ...Have usually mitigated this type of risk with minimal oversight in similar cases ...May mitigate this risk, but workarounds will be required ...Cannot mitigate this risk, but a different approach might ...Cannot mitigate this type of risk; no known processes or workarounds are available 4 Likelihood 3 2 1 Given the risk is realized, what would be the magnitude of the impact? Level Technical Schedule Cost 1 Minimal or no impact Minimal or no impact Minimal or no impact 2 Minor performance Additional activities Budget increase or shortfall, same required; able to meet unit production cost approach retained key dates increase <1% 3 Moderate performance Minor schedule slip; Budget increase or shortfall, but work- will miss need date unit production cost arounds available increase <5% 4 Unacceptable, Program critical path Budget increase or but workarounds affected unit production cost available increase <10% 5 Unacceptable; no Cannot achieve key Budget increase or alternatives exist program milestone production cost increase >10% Questions about Risk Management? Call a member of the Risk Mgmt Team Consequence Xxxxx Xxxx 800-555-5555 x 5555 Yyy Yyyy 888-555-5555 Zzzz Zzzzzz 800- 555-5555 Aaa Aaaaa 800- 555-5555 Bbbbbb Bbb 800- 555-5555 US F-18 Program Risk Analysis High Medium Likelihood Low 1 2 3 4 5 Consequence

27. Step 3: Develop Risk Reduction Plans 1. Select risk reduction technique 2. Develop specific risk reduction plan 3. Estimate impacts and prepare planning changes 4. Approve risk reduction plans & implement planning changes

28. Step 3: Develop Risk Reduction Plans • Risk reduction strategies • Avoid risk, e.g. choosing an alternative path • Control-mitigate risk: reduce probability-impact • Example: feature creep • Incremental development practices • Design for change • Assume risk: plan a contingency • Transfer risk • e.g. get someone else to assume: Insurance policy • Reduce uncertainty • Examples: Parallel development, Multiple suppliers

29. Step 4: Communicate & Track Risks 1. Communicate Risk & Plan status and compare Plans Vs actuals 2. Iterate Risk management process 3. Update risk database 4. Update risk reduction reports

30. Risk Management Cannot • Identify all risks (e.g. unknown risks) • Minimize or eliminate all known risks • Guarantee best course of action is always chosen • Provide early warning of all problems • Compensate for poor planning • Work in spite of a lack of commitment

31. Risk Management Can • Minimize or eliminate many risks • Highlight areas of uncertainty and false confidence • Help to decide best course of action • Provide early warning of many problems • Provide basis for plan changes • Increase management and customer confidence

32. Review • Challenges to a project • Participants to Risk management • Risk management process steps