Risk and opportunity Part 1

1. Risk and opportunityPart 1 Tor Stålhane Torbjørn Skramstad

2. EuroSPI 2006 - Part 1

3. Contents of part 1 • What is risk and what is opportunity • Why should we care • Assessing risk and opportunity • Risk and opportunity in SPI – the SWIR and the SWIRO models • More on assessment • Brainstorming techniques EuroSPI 2006 - Part 1

4. Risk and opportunity Risk and opportunity have three things in common: • They are concerned with events that may – or may not – happen in the future. • The events are identifiable but their effect are uncertain, although less uncertain than the probabilities. • The outcome of the events can be influenced by our actions EuroSPI 2006 - Part 1

5. What is risk A risk is something that can be a problem in the future. It is defined by two parameters • The consequences - C. What will happen if the risk becomes a problem? • The probability - p. What is the probability that the risk will become a problem? The risk – R – is defined as R = C*p EuroSPI 2006 - Part 1

6. What is opportunity An opportunity is something that can be beneficial in the future. It is defined by two parameters • The value - V. What will happen if the opportunity becomes a reality? • The probability - p. What is the probability that the opportunity will be realized? The opportunity – O – is defined as O = V*p EuroSPI 2006 - Part 1

7. Why should we care -1 Risks may turn into problems. We can reduce or avoid future problems by reducing their consequences or their probabilities. This can be done by • Changing the way we work to • Replace a high risk activity with a low risk activity. • Remove the risk possibility • Adding risk avoidance activities to the way we work EuroSPI 2006 - Part 1

8. Why should we care - 2 Opportunities may turn into benefits. We can increase future benefits by increasing their probabilities. This can be done by • Changing the way we work – replace a low opportunity activity with a high opportunity activity. • Adding opportunity enabling activities to the way we work EuroSPI 2006 - Part 1

9. Assessing risk and opportunity Both risk and opportunity is defined by value and probability. Experience and data are important for two reasons. They can: • Be used to estimate values and probabilities. • Serve as an anchor for assessment – e.g. “How bad can it get?” EuroSPI 2006 - Part 1

10. Risk and improvement All SPI activities implies change and all changes carries their own risks and opportunities. We will present two relevant models called SWIR and SWIRO respectively. The purpose of these models is to identify risks and opportunities in SPI work. EuroSPI 2006 - Part 1

11. The SWIR model -1 The SWIR model is the SPI version of the SWOT model. • SWOT – Strengths, Weaknesses, Opportunities and Threats. • SWIR – Strengths, Weaknesses, Improvements and Risks. EuroSPI 2006 - Part 1

12. The SWIR model - 2 EuroSPI 2006 - Part 1

13. The SWIR components - 1 • Strengths – we need to know and understand our strong sides so that we • do not destroy them in the SPI process • can build on them and improve them • Weaknesses – must be known so that we understand what we are up against. • Improvements – what we want to achieve. They must be discussed and understood together with our strengths and weaknesses. EuroSPI 2006 - Part 1

14. The SWIR components - 2 • Risks – potential problems that we have to cope with. They can stem from: • Our weak sides • Changes that are a necessary part of the SPI process. • Threats to our strong side – things that must be kept the way they are. EuroSPI 2006 - Part 1

15. The SWIRO model - 1 The SWOT model includes opportunities but ignore improvements The SWIR model includes improvements but ignores opportunities. It might be a good idea to merge these two models so that we have a unified presentation of strengths, weaknesses, risk, opportunities and improvements. EuroSPI 2006 - Part 1

16. The SWIRO model - 2 EuroSPI 2006 - Part 1

17. A caveat None of the presented models – SWOT, SWIR or SWIRO – will help us to assess the risks and opportunities. The models are just used to get a complete picture of the situation. Assessment is the logical next step. EuroSPI 2006 - Part 1

18. Exercise You are considering the introduction of an ISO conform process into your company. Fill in the SWIR or SWIRO diagram. EuroSPI 2006 - Part 1

19. Assessment - 1 Even though assessment is a subjective activity it is not about throwing out any number that you like. To be useful, an assessment must be • Based on relevant experience. • Anchored in real world data. • The result of a documented and agreed-upon process. EuroSPI 2006 - Part 1

20. Assessment - 2 Risk and opportunity assessment is critically dependent on the persons who participate, their experience and their knowledge. Experiments have shown that people have some biases which implies that we need to be careful when we look at the identified risk events and their assessed consequences and probabilities. EuroSPI 2006 - Part 1

21. The human bias Two human biases are important: • Omission bias - most persons prefer doing nothing instead of an action if the consequences have equal values. • Status quo bias - people assign a larger risk to change than to maintaining status quo. This bias increases if the change action has the potential to create victims. EuroSPI 2006 - Part 1

22. Qualitative assessment We can assess consequences, probabilities and benefits qualitatively in two ways. We can use: • Categories – e.g. High, Medium and Low • Numbers – e.g. values from 1 to 10. EuroSPI 2006 - Part 1

23. Categories – 1 When using categories, it is important to give a short description as to what each category implies. E.g. it is not enough to say “High consequences”. We must relate it to something already known, e.g. • Project size • Company turn-over • Company profit EuroSPI 2006 - Part 1

24. Categories – 2 Two simple examples: • Consequences: we will use the category “High” if the consequence will gravely endanger the profitability of the project. • Probability: we will use the category “Low” if the event can occur but only in extreme cases. EuroSPI 2006 - Part 1

25. Impact and probability - 1 EuroSPI 2006 - Part 1

26. Impact and probability - 2 The multiplication table is used to rank risks and opportunities. It can not tell us how large they are. We should only use resources on risks and opportunities that are above a certain, predefined level. EuroSPI 2006 - Part 1

27. Numbers as categories -1 We can use numbers instead of names. This does not make the assessment more precise but will free us from the need to define a multiplication table in order to identify risks. In principle we can use any numbers. The best solution is, however, to just assign number to the three aforementioned categories EuroSPI 2006 - Part 1

28. Numbers as categories – 2 The following values are often used in practice, both for consequences, benefits and probabilities: • 10 – high • 4 – medium • 1 – low Thus, a medium consequence and a low probability will give a risk of 4*1 = 4. EuroSPI 2006 - Part 1

29. Numbers as categories – 3 EuroSPI 2006 - Part 1

30. Simple brainstorming techniques Brainstorming is an efficient way to use the creative abilities that each person have. In its simplest form, people just generate ideas and a person registers the ideas on a whiteboard or a flip-over. We can, however, use techniques to do better. EuroSPI 2006 - Part 1

31. Brainstorming and risks - 1 We can use previous experiences to answer questions such as • Can this really happen; e.g. has it happened before? • Can we describe a possible cause - consequence chain for the event? • How bad can it get? • How often has this happened in the past? EuroSPI 2006 - Part 1

32. Brainstorming and risks - 2 We can use techniques such as: • Affinity diagrams – “post it notes” • Cause – consequence diagrams, such as • Ishikawa diagrams – also called fishbone diagrams • Event trees • Cause – consequence networks EuroSPI 2006 - Part 1

33. Planning Resources Wrong personnel Estimation Follow-up Loose keypersonnel Too latedelivery Tool X is notworking Changes Misunderstandings Reuse problems Requirements Development Ishikawa diagram EuroSPI 2006 - Part 1

34. Found in unit test Found in integration test Coding error Found in systems test Not found in unit test Not found in integration test Delivered to customer Not found in systems test Event trees EuroSPI 2006 - Part 1

35. Acc C7 C1 C2 C3 C4 C5 C6 E8 E2 E1 E3 E4 E5 E6 E6 E7 Cause – consequence diagram EuroSPI 2006 - Part 1

36. Change and risk Changes can introduce risks. The main reasons are that: • Any effect of a change is related to the future and can thus not be certain • It is difficult to completely understand the effect of changes in a complex, sociological system EuroSPI 2006 - Part 1

37. Change and opportunities Changes can create new opportunities. The opportunities are mostly • Indirect effects of what we do to achieve our goals – e.g. a new tool that can be used in several ways • Additional effects of having achieved the goals – e.g. less need for rework frees resources for developing a new product. EuroSPI 2006 - Part 1

38. Risk and opportunity in SPI Risk and opportunity are important in SPI. We need to consider: • Cost related to the change. • Benefit, which is its planned purpose • Risk related to the change, since we are going to work in a new way. • New opportunities that are opened up by the changes EuroSPI 2006 - Part 1

39. Exercise You want to study the effect of document inspection on the number of defects delivered to the customer. Build an event tree for the starting event “A defect has been introduced in high level design” EuroSPI 2006 - Part 1

40. Next session The next session will focus on • How to do simple risk and opportunity assessment. • The introduction of barriers and enablers into risk and opportunity assessment • How to use leverage to prioritize our actions EuroSPI 2006 - Part 1

41. Risk and opportunityPart 2 Tor Stålhane Torbjørn Skramstad

42. Contents of part 2 • Simple risk assessment • Simple opportunity assessment • The total picture – risk and opportunity • The risk and opportunity pattern • Barriers, enablers and leverage • Extended risk analysis • Extended opportunity analysis • Risk and regret EuroSPI 2006 - Part 1

43. Simple risk assessment In order to a simple risk assessment we need to identify: • Dangerous events • Each event’s • consequence – C • probability – p • Possible barriers – changes or controls • Person responsible for each risk - Resp. EuroSPI 2006 - Part 1

44. Simple risk table EuroSPI 2006 - Part 1

45. Events We start by identifying dangerous events. The simple way to do this is to use brainstorming. The process is simple – just sit down and envisage your worst nightmares related to the activities under consideration. Be realistic – only consider things that you believe can happen. EuroSPI 2006 - Part 1

46. Barriers Barriers can be realized through: • Prevention – we change our process so that the event cannot occur. • Mitigation – we can • change the process in order to reduce the event’s probability or consequences. • define activities that will reduce the problems if the event occurs. EuroSPI 2006 - Part 1

47. Prevention barriers Prevent risk from becoming a problem Handling barriers Prevent event from having bad consequences Barrier 6 Barrier 1 Barrier 2 Barrier 3 Barrier 5 Barrier 4 Risk Prob. Event Reduction barriers Reduce effect of event EuroSPI 2006 - Part 1

48. Simple opportunity assessment In order to assess opportunities, we need to identify: • The event that opens up opportunities - enablers • Each opportunity’s • realizable value – V • probability - p • The activity needed to realize the value • Person responsible for each opportunity EuroSPI 2006 - Part 1

49. Simple opportunity table EuroSPI 2006 - Part 1

50. Enablers Any action – e.g. a change – can create an opportunity enabler. Each enabler opens up a set of opportunities. Further actions are needed in order to realize value. Both enablers, opportunities and enabling actions can be identified through brainstorming. EuroSPI 2006 - Part 1