F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Improving your Risk Identification
and Management Approach
by
Henry Schneider
Process and Product Quality Consulting, LLC
June 25, 2008F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Agenda
–Why Should I Care About Risks?
–What is a Risk?
–Risk Management Principles
–Risk Identification and Management Techniques
–Summary
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 2F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 3F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 4F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 5F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 6F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 7F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v
 What coulda/shoulda happened?
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 8F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

When Risk Are Not Managed Well
It is easy to ignore risks when they are not
being tracked
Risks that are known to project staff are often
not known or a surprise to management
Every time a new problem manifests, a new
management technique is tried
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 9F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Why Should I Care?
–The project may dodge some
o
o

but not all of them
–No lessons learned captured for future
projects means making the same mistakes
again and again
–Insanity-doing the same thing over and over again
and expecting different results
–Repeated project failures due to unforeseen
(but predictable) risks costs you business, if
not the whole company
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 10F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk and Organization Culture
–Innovative cultures assume that the potential value of
innovation carries some level of risk
– F
(
}
�
Á

�

�
�
]
�
µ


–acknowledge and learn from failures
–risks are investment in success
–Non-
]
v
v
}
À

�
]
À

µ
o
�
µ
�

}
v


l
v
}
Á
o


P
(

]
o
µ
�
an acceptable outcome
– D
�
�
�
}
o
µ
�
]
}
v
�
–acknowledging risks is admitting the possibility of failure
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 11F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Defined
–Dictionary definitions of risk
–hazard, danger, or peril
–exposure to loss, injury, or destruction
–General definition
–A risk is a problem waiting to happen
–A risk is an event that could threaten the successful
completion of the project
–Risk management is the process of identifying the
risks and handling those which are most threatening

�
�
�
�
Z


}
v



}

o

u
�
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 12F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Management Principles - 1
Risks must be assessed continuously and used for
decision-making in all phases of the project
Effective risk management considers all areas of the
project: personnel, process, business, technology, etc.
Risks need to be clearly communicated by all team
members
The environment must allow people to identify risks
without negative consequences to them
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 13F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Management Principles - 2
Risks must be clearly stated before they can be managed
A project should not be judged solely on the number or
nature of risks uncovered
Deal with important risks first
Action items to address risks need to be integrated into
the overall project plan or action item list
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 14F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Source Categories and Consequences
Risk Source
Consequences
Categories
�Mission and goals �Cost overruns
�Decision drivers �Schedule slips
�Organization management �Inadequate functionality
�Customer / end user �Canceled projects
�Budget / cost �Sudden personnel changes
�Schedule �Customer dissatisfaction
�Project characteristics �Loss of company image
�Development process �Demoralized staff
�Development environment �Poor product performance
�Personnel and relationships �Legal proceedings
�Operational environment
�New technology
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 15F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Start by Reviewing Project Parameters
Project Roles and
scope, responsibili-
Project vision
Are objectives milestones, ties Use know-
clear and and Are roles and ledge of
understood? deliverables responsibilities
clear to all specific
Are customer Are features involved? project roles
and provider agreed to?
objectives Are Are all roles to identify
known? commitments staffed? risks
agreed to and Is sponsorship
documented? and
accountability
clear?
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 16F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Identification Technique
–Brainstorming
–Review possible sources of risk and brainstorm specific risks
they could create for your project
–Review potential adverse outcomes for your project and
brainstorm how they might
arise
Sources
Risks
Outcomes
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 17F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Factor Table - Example
Risk Factor Low Risk Cue Medium Risk Cue High Risk Cue
Project fit Directly supports Indirectly impacts Does not support or


µ
�
�
}
u

�one or mor e goals
�

o

�
�
}
u

�
and goals mission or goals
Customer perception Customer expects Team is working on Project is a mismatch
team to provide this project that is not with prior products
product expected by of this team
customer
Work flow Little or not change Will change some Significantly changes
to work flow aspect or have small work flow or method
affect on work flow of organization
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 18F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Reviewing Factors
Examine each risk
factor and rate its Use high rated
relevance
factors to develop
Select appropriate High - potentially high threat risk
table of factors Medium - may suggest a risk specific risk
Low - no apparent risk statements for the
N/A - factor is not applicable project
NI - needs more information
TBD - needs to have project
proceed further; revisit later
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 19F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Factors Help You Focus
Risks to be managed
ten or so
Risks rated High
dozens
Risks indicated by factor
tables - hundreds
All risks - thousands
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 20F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Probability
Probability is the likelihood that the risk will actually occur as
a problem if we take no action
Usually expressed as a percentage:
greater than zero or less than 100%
use increments no smaller than 5%
Example:
something slightly more likely than not - risk probability = 60%
something likely to happen 3/4 of the time - risk probability = 75%
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 21F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Establishing Measures of Loss
–Level of loss (scale of 1 to 10)
–Rate damage to project objectives
–High values indicate serious loss to the project
–Example:
–Risk loss = 4 if project is considerably late, but has all functionality
–Impact of monetary loss useful, if possible
–Long-term costs in operations and support
–Long-term loss of market share or opportunity
–Short-term cost in additional work
–Example:
–Risk loss = $120,000 to add person-year of work
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 22F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Exposure
Risk probability
Components
Risk impact (loss)
Risk exposure is the
Risk exposure = risk probability x risk impact
total threat of the risk
Risk exposure = 75% x 4 = 3.0
Example:
Risk exposure = 60% x $120,000 = $72,000
Focus on reducing
risk exposure
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 23F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Ranking Risks
Rank the risks Rank in order of Look for breaks Focus on actions
risk exposure
at a given (most to least in values in the for those at the
point in time dangerous) list top of the list
Review the
Add items as Adjust exposure
list regularly needed as appropriate
with the team
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 24F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Mitigation Strategies
Apply money or effort for controllable risks
Risk reduction
Use work-arounds for uncontrollable risks
Insure the loss
Involve a third party
Risk transfer
Tie a bonus to completion of the project
Involve domain specialists
Invest no more Some risks cannot be removed completely
Balance cost of handling against exposure
than needed
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 25F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Risk Contingency Plans
Devise contingency plans for
high exposure risks, in case the mitigation strategy fails
any risk for which there is no possible mitigation action
Specify risk measures and trigger values
measures of time, resources to handle risk
measures of risk impact
trigger values that tell it is time to use contingency approach
Agree with customer and management at project start how
contingency plans will be funded and handled
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 26F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Contingency Triggers
For risks leading to For risks requiring
schedule slips additional effort or
Latest date to allow time Limit for extra cost Limit for learning
you to use alternative to the customer time
platforms Latest date to locate
Latest date to select the resources
Greatest amount of
another vendor penalty or fine to incur
Example Contingency Triggers
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 27F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Mitigation and Contingency - Example
If key subject matter experts are not
Risk available by the first of June, we will be
Statement unable to deliver the project per the plan.
Cross train project staff with key subject
Risk matter experts, so work can proceed and
decisions made if key experts are
Mitigation unavailable.
If by the first of April it is known that key
Contingency experts will not be available, assign team
members to learn the needed subject matter
Plan so the project can move forward without
involving key experts.
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 28F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Communication is Essential!
Communicate risk
information to all affected
parties
Encourage free flow of
information about risk
Place risk chart in a common location
Use email or other team collaboration method (e.g. Wiki
Update Top Risks with team page) to identify new risks, change status, and indicate
regularly completion
Encourage raising of new risks in weekly status reports,
during inspections or reviews, and at major milestone
reviews
Review status of risks at key
milestones
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 29F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

What Would Be the Preferable Outcome?
What could have been delivered if risks
had been managed
What was delivered because risks

Á

�

v
P


6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 30F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Summary
–Repeated project failures due to unforeseen (but
predictable) risks can cost you business
–Risk management is the process of identifying the risks
and handling those which are most threatening to the

�
�
Z

�
Z


}
v



}
u
�
�
}

o

u
�
–Risks can be easily managed using techniques such as:
–brainstorming
–risk factors
–risk exposure
–ranking
–mitigation
–communication
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 31F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v
 Questions
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 32F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

PPQC Services
Consulting
CMMI
Software Engineering
Systems Engineering
Process Improvement
Appraising
SCAMPI A, B, C
Gap Analysis
Training
CMMI/Process Improvement
Action Planning Workshops
Measurement and Analysis
Process Area Specific Training
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 33F


]
o
]
�

�
]
v
P
Ç
}


�
i
}
µ
�
v

Contact Information
Address: Henry Schneider
President/Senior Principal Consultant
Process and Product Quality Consulting, LLC
2111 Heather Green
Houston, TX USA 77062
Phone: 281-218-6682
E-mail: henry@ppqc.net
Web Site: www.ppqc.net
6/27/2008 ®2008 ***Proprietary*** All Rights Reserved -Process and Product Quality Consulting, LLC 34