IT Project Management

(MSIT504)

Tessfu G. (PhD)
School of Computing
Department of Computer Science
Dire Dawa Institute of Technology
Chapter 11 – Project Risk Management
 Learning Objectives

• Understand what risk is and the importance of good project

risk management

• Discuss the elements involved in risk management planning

and the contents of a risk management plan

• List common sources of risks in information technology

projects

3
 Learning Objectives (continued)

• Describe the risk identification process, tools and techniques to

help identify project risks, and the main output of risk
identification: a risk register

• Discuss the qualitative risk analysis process and explain how to

calculate risk factors, create probability/impact matrixes, and
apply the Top Ten Risk Item Tracking technique to rank risks

4
 Learning Objectives (continued)

• Explain the quantitative risk analysis process and how to apply

decision trees, simulation, and sensitivity analysis to quantify
risks
• Provide examples of using different risk response planning
strategies to address both negative and positive risks
• Discuss what is involved in risk monitoring and control
• Describe how software can assist in project risk management

5
 The Importance of Project Risk Management

• Project risk management is the art and science of identifying,

analyzing, and responding to risk throughout the life of a project
and in the best interests of meeting project objectives.

• Risk management is often overlooked in projects, but it can help

improve project success by helping select good projects,
determining project scope, and developing realistic estimates.

• Unfortunately, crisis management has higher visibility due to the

obvious danger to the success of the project but it’s risk
management that helps a project have fewer problems to begin
with.

6
 Research Shows Need to Improve Project Risk
Management
• Study by Ibbs and Kwak shows risk has the lowest maturity
rating of all knowledge areas
• A similar survey was completed with software development
companies in Mauritius, South Africa in 2003, and risk
management also had the lowest maturity (1.84 vs average of
2.29)
• A KLCI Research Group study (2001) shows the benefits of
following good software risk management practices
– 97% had procedures to identify and asess risk
– 80% identified anticipating and avoiding problems as the primary
benefit of risk management
– 70% had defined s/w development processes
– 64% has a Project Management Office
7
 Project Management Maturity by Industry Group
and Knowledge Area*
KEY: 1 = LOWEST MATURITY RATING 5 = HIGHEST MATURITY RATING
Engineering/ Telecommunications Information Hi-Tech
Knowledge Area Construction Systems Manufacturing

Scope 3.52 3.45 3.25 3.37

Time 3.55 3.41 3.03 3.50
Cost 3.74 3.22 3.20 3.97
Quality 2.91 3.22 2.88 3.26
Human Resources 3.18 3.20 2.93 3.18

Communications 3.53 3.53 3.21 3.48

Risk 2.93 2.87 2.75 2.76
Procurement 3.33 3.01 2.91 3.33

*Ibbs, C. William and Young Hoon Kwak. “Assessing Project Management Maturity,”
Project Management Journal (March 2000).
8
Benefits from Software Risk Management Practices*

*Kulik, Peter and Catherine Weber, “Software Risk Management Practices – 2001,”
KLCI Research Group (August 2001).
9
 Negative Risk

• A dictionary definition of risk is “the possibility of loss or

injury”

• Negative risk involves understanding potential problems that

might occur in the project and how they might impede project
success.

• Negative risk management is like a form of insurance; it is an

investment.

• If IT projects are so risky, why do companies pursue them?

10
 Risk Can Be Positive

• Positive risks are risks that result in good things happening;

sometimes called opportunities.

• A general definition of project risk is an uncertainty that can

have a negative or positive effect on meeting project objectives.

• The goal of project risk management is to minimize potential

negative risks while maximizing potential positive risks.

11
 Best Practice
• Some organizations make the mistake of only
addressing tactical and negative risks when performing
project risk management
• David Hillson (www.risk-doctor.com) suggests
overcoming this problem by widening the scope of risk
management to encompass both strategic risks and
upside opportunities, which he refers to as integrated
risk management
– Ensure that project delivery is tied to organizational needs
and vision
– Allowing an appropriate level of risk to be taken intelligently
with full awareness of the degree of uncertainty and its
potential effects on objectives
12
 Risk Utility
• Different organizations and people have different
tolerances for risk.
• Risk utility or risk tolerance is the amount of
satisfaction or pleasure received from a potential
payoff.
– Utility rises at a decreasing rate for people who are risk-
averse
– Those who are risk-seeking have a higher tolerance for risk
and their satisfaction increases when more payoff is at stake
– The risk-neutral approach achieves a balance between risk
and payoff

13
Risk Utility Function and
Risk Preference

14
 Project Risk Management Processes

• Risk management planning: deciding how to approach and plan

the risk management activities for the project.

• Risk identification: determining which risks are likely to affect a

project and documenting the characteristics of each.

• Qualitative risk analysis: prioritizing risks based on their

probability and impact of occurrence.

15
 Project Risk Management Processes
• Quantitative risk analysis: numerically estimating the effects of
risks on project objectives.

• Risk response planning: taking steps to enhance opportunities

and reduce threats to meeting project objectives.

• Risk monitoring and control: monitoring identified and residual

risks, identifying new risks, carrying out risk response plans, and
evaluating the effectiveness of risk strategies throughout the life
of the project.

16
Project Risk Management Summary

17
 Risk Management Planning

• The main output of risk management planning is a risk

management plan - a plan that documents the procedures for
managing risk throughout a project.

• The project team should review project documents, corporate risk

management policies, lessons-learned reports from past projects
and understand the organization’s and the sponsor’s approaches to
risk.
– Important to clarify roles and responsibilities, prepare budget
and schedule estimates for risk-related work and identify risk
categories for consideration.

• The level of detail will vary with the needs of the project.

18
 Topics Addressed in a Risk Management Plan
• Methodology: How will risk management be performed on this project?
What tools and data sources are available and applicable?
• Roles and Responsibilities: Who are the individuals responsible for
implementing specific tasks and providing deliverables related to risk
management?
• Budget and Schedule: What are the estimated costs and schedules for
performing risk-related activities?
• Risk Categories: What are the main categories of risks that should be
addressed on this project? Is there a risk breakdown structure for the
project?
• Risk Probability and Impact: How will the probabilities and impacts of
risk items be assessed? What scoring and interpretation methods will be
used for the qualitative and quantitative analysis of risks?
• Risk Documentation: What reporting formats and processes will be
used for risk management activities?
19
 Contingency and Fallback Plans, Contingency
Reserves
• In addition to a risk management plan, many projects also include:
– Contingency plans – predefined actions that the project team will take if
an identified risk event occurs.
• Expecting new release of a software package, must plan to use older
version if delayed
– Fallback plans - developed for risks that have a high impact on meeting
project objectives, and are put into effect if attempts to reduce the risk are
not effective.
• College grad has main plan and contingency plans of where to live
after graduation but needs fallback plan to possibly live at home.

– Contingency reserves or allowances - provisions held by the project

sponsor or organization to reduce the risk of cost or schedule overruns to
an acceptable level.
• Project falling behind schedule due to inexperience with new
technology, use these funds to hire outside trainer
20
 Common Sources of Risk in Information Technology
Projects
• Several studies show that IT projects share some common sources
of risk.
• The Standish Group developed an IT success potential scoring
sheet (next slide) based on potential risks
– If a potential project does not receive a minimum score, the
organization might decide not to work on it or to take actions to
reduce the risks before it invests too much time or money.
– The Standish Group developed specific questions for each success
criterion to help decide the number of points to assign to a project
• User Involvement: Do I have the right users? Did I involve
the users early on? Do I make involvement easy? …

21
Information Technology Success Potential Scoring
Sheet
 The number of questions
Success Criterion Relative Importance
User Involvement 19
corresponding to each
success criterion
Executive Management support 16
determines the number of
Clear Statement of Requirements 15
points each positive
Proper Planning 11
response is assigned
Realistic Expectations 10
 Ex: User involvement:
Smaller Project Milestones 9
19/5 (or 3.8) points per
Competent Staff 8
question answered
Ownership 6
positively
Clear Visions and Objectives 3
Hard-Working, Focused Staff 3
Total 100

22
 Broad Categories of Risk
• Many organizations develop their own risk questionnaires. Some of
the categories of risk might include:
– Market risk – Will the new service or product be useful to the
organization or marketable to others? Will the users accept it? Will
someone else create a better product?
– Financial risk – can the organization afford to undertake the project?
Will the project meet NPV, ROI and payback estimates?
– Technology risk – is the project technically feasible? Is it leading
edge or bleeding edge technology?
– People risk – Are people with appropriate skills available to help
complete the project? Does senior management support the project?
– Structure/process risk – What is the degree of change the new
project will introduce into user areas and business procedures? With
how many other systems does a new project/system need to interact?

23
 What Went Wrong?
• KPMG, a large consulting firm, published a study in 1995 that
found that 55 percent of runaway projects—projects that have
significant cost or schedule overruns—did no risk management at
all; 38 percent did some (but half did not use their risk findings
after the project was underway); and 7 percent did not know
whether they did risk management or not.

• The timing of risk management is also an important consideration

– Comair delayed replacing a legacy system that managed flight
crews and, when it eventually crashed over the holidays, 3,900
flights were cancelled, 200,000 passengers were stranded and
ran up a tab of $20 million.

24
 Risk Breakdown Structure

• A risk breakdown structure is a hierarchy of potential risk

categories for a project.

• Similar to a work breakdown structure but used to identify and

categorize risks.

• In addition to identifying risk based on the nature of the project

or products produced, it is also important to identify potential
risks according to project management knowledge areas.

25
 Sample Risk Breakdown Structure

26
Potential Negative Risk Conditions Associated With
Each Knowledge Area

27
 Risk Identification
• Risk identification is the process of understanding what potential
events might hurt or enhance a particular project.
– This is an ongoing process throughout the project lifecycle as
things change.
– You can not manage risks that you don’t identify.

• Risk identification tools and techniques include:

– Brainstorming
– The Delphi Technique
– Interviewing
– SWOT analysis

28
 Brainstorming

• Brainstorming is a technique by which a group attempts to

generate ideas or find a solution for a specific problem by
amassing ideas spontaneously and without judgment.

• An experienced facilitator should run the brainstorming session.

• Be careful not to overuse or misuse brainstorming:

– Psychology literature shows that individuals produce a greater
number of ideas working alone than they do through
brainstorming in small, face-to-face groups.
– Group effects often inhibit idea generation.

29
 Delphi Technique
• The Delphi Technique is used to derive a consensus among a panel
of experts who make predictions about future developments.
– Developed by the RAND Corporation for the US Air Force in
the late 1960s

• Provides independent and anonymous input regarding future

events.

• Uses repeated rounds of questioning and written responses and

avoids the biasing effects possible in oral methods, such as
brainstorming.
– Requires a panel of experts for the particular area in question.

30
 Interviewing

• Interviewing is a fact-finding technique for collecting

information in face-to-face, phone, e-mail, or instant-messaging
discussions.

– Useful to have a prepared set of questions as a guide to the

interview.

• Interviewing people with similar project experience is an

important tool for identifying potential risks.

31
 SWOT Analysis

• SWOT analysis (strengths, weaknesses, opportunities, and threats)

can also be used during risk identification.

• Project teams focus on the broad perspectives of potential risks for

particular projects
– What are the company’s strengths and weaknesses related to
this project?
– What opportunities and threats exist?

• Helps identify the broad negative and positive risks that apply to
a project.

32
 Other Risk Identification Methods

• Checklists based on risks encountered in previous projects.

• Analyze the validity of project assumptions as incomplete,

inaccurate and/or inconsistent assumptions can lead to identifying
more risks.

• Diagramming techniques: cause-and-effect, fishbone, flowcharts

and influence diagrams.
– Influence diagrams represent decision problems by displaying
essential elements, including decisions, uncertainties, causality
and objectives and how they influence each other
(www.lumina.com/software/influencediagrams.html)

33
 Other Risk Identification Methods
• An influence diagram is a simple visual representation of a decision problem. Influence
diagrams offer an intuitive way to identify and display the essential elements, including
decisions, uncertainties, and objectives, and how they influence each other.

• This simple influence diagram shows how decisions about the marketing budget and
product price influence expectations about its uncertain market size and market share.
These, in turn, influence costs and revenues, which affect the overall profit.
• The product manager, VP of marketing, and market analyst may work together to draw
such a diagram to develop a shared understanding of the key issues. The diagram
provides a high-level qualitative view under which the analyst builds a detailed
quantitative model.
34
Other Risk Identification Methods

A decision is a variable that you, as the decision maker,

have the power to control.

A chance variable is uncertain and you cannot control it

directly.

An objective variable is a quantitative criterion that you

are trying to maximize (or minimize).

A general variable is a deterministic function of the

quantities it depends on.

An arrow denotes an influence. A influences B means

that knowing A would directly affect our belief or
expectation about the value of B. An influence expresses
knowledge about relevance. It does not necessarily
imply a causal relation, or a flow of material, data, or
money.
35
 Risk Register
• The main output of the risk identification process is a list of
identified risks and other information needed to begin creating a
risk register.

• A risk register is:

– A document that contains the results of various risk management
processes and that is often displayed in a table or spreadsheet
format
– A tool for documenting potential risk events and related
information

• Risk events refer to specific, uncertain events that may occur to

the detriment or enhancement of the project.
– Negative risks: delays in completing work as scheduled, increases in
estimated costs, supply shortages, litigation, strikes, etc.
– Positive risks: completing work sooner and/or cheaper than planned,
36
collaborating with suppliers to produce better products, good publicity,
 Risk Register Contents

• An identification number for each risk event

• A rank for each risk event
• The name of each risk event
• A description of each risk event
• The category under which each risk event falls
• The root cause of each risk

37
 Risk Register Contents (continued)

• Triggers for each risk; triggers are indicators or

symptoms of actual risk events
– Cost overruns on early activities, defective products
• Potential responses to each risk
• The risk owner or person who will own or take
responsibility for each risk
• The probability and impact of each risk occurring
• The status of each risk

38
 Sample Risk Register

39
 Qualitative Risk Analysis
• After identifying risks, the next step is to understand which risks
are most important.

• Assess the likelihood and impact of identified risks to determine

their magnitude and priority.

• Risk quantification tools and techniques include:

– Probability/impact matrixes
– The Top Ten Risk Item Tracking
– Expert judgment

40
 Probability/Impact Matrix

• A probability/impact matrix or chart lists the relative

probability of a risk occurring on one side of a matrix or axis
on a chart and the relative impact of the risk occurring on the
other.

• List the risks and then label each one as high, medium, or
low in terms of its probability of occurrence and its impact if
it did occur.

• Deal first with those risks in the high probability/high

impact cell.

41
Sample Probability/Impact Matrix

42
 Risk factors
• Can also calculate risk factors.
– Numbers that represent the overall risk of specific events
based on their probability of occurring and the consequences
to the project if they do occur.

– Probabilities of a risk occurring can be estimated based on

several factors based on the unique nature of each project.
• For example: technology not being mature, technology too complex,
inadequate support base for developing the technology.

– The impact of a risk could include factors such as the

availability of fallback solutions or the consequences of not
meeting performance, cost and schedule estimates.

43
 High-, Medium-, and Low-Risk Technologies
 Example of how risk factors were used to graph the probability of
failure and consequence of failure for proposed technologies in a
research study to help design more reliable aircraft
 Based on this chart, the recommendation was made to invest in
low- to medium-risk technologies and not pursue high-risk
technology

• 44
 Top Ten Risk Item Tracking
• Top Ten Risk Item Tracking is a qualitative risk analysis tool
that helps to identify risks and maintain an awareness of risks
throughout the life of a project.

• Establish a periodic review of the top ten project risk items.

• List the current ranking, previous ranking, number of times the

risk appears on the list over a period of time, and a summary of
progress made in resolving the risk item.

• 45
 Top Ten Risk Item Tracking
• Keeps management and the customer aware of the major
influences that could prevent or enhance the project’s success.

• By involving the customer, the project team may be able to

consider alternative strategies for addressing the risks.

• It’s a means of promoting confidence in the project team by

demonstrating to management and the customer that the team is
aware of the significant risks, has a strategy in place and is
effectively carrying out that strategy

• 46
Example of Top Ten Risk Item Tracking

• 47
 Watch List
• A watch list is a list of risks that are low priority, but are still
identified as potential risks.

• Qualitative analysis can also identify risks that should be

evaluated on a quantitative basis.

• 48
 Quantitative Risk Analysis

• Often follows qualitative risk analysis, but both can be done

together.

• Large, complex projects involving leading edge technologies

often require extensive quantitative risk analysis.

• Main techniques include:

– Decision tree analysis
– Simulation
– Sensitivity analysis

• 49
 Decision Trees and
Expected Monetary Value (EMV)
• A decision tree is a diagramming analysis technique used to help
select the best course of action in situations in which future
outcomes are uncertain.

• Estimated monetary value (EMV) is the product of a risk event

probability and the risk event’s monetary value.

• You can draw a decision tree to help find the EMV.

50
Expected Monetary Value (EMV)

• 51
 Simulation
• Simulation uses a representation or model of a system to analyze
the expected behavior or performance of the system.
– To use a Monte Carlo simulation, you must have three
estimates (most likely, pessimistic, and optimistic) plus an
estimate of the likelihood of the estimate being between the
most likely and optimistic values.

• Monte Carlo analysis simulates a model’s outcome many times

to provide a statistical distribution of the calculated results.
– Predicts the probability of finishing by a certain date or that
the cost will be equal to or less than a certain value

• 52
 Steps of a Monte Carlo Analysis

1. Assess the range for the variables being considered – gather

most likely, optimistic and pessimistic time estimates for each
task
2. Determine the probability distribution of each variable
1. Optimistic 8 weeks, most likely 10 and pessimistic 15
3. For each variable, select a random value based on the
probability distribution
1. 20% chance between 8 and 10 weeks, 80% between 10 and 15
4. Run a deterministic analysis or one pass through the model
5. Repeat steps 3 and 4 many times to obtain the probability
distribution of the model’s results – usually between 100 to
1,000 iterations

• 53
Sample Monte Carlo Simulation Results for Project
Schedule

54
 What Went Right?
• A large aerospace company used Monte Carlo simulation to help
quantify risks on several advanced-design engineering projects,
such as the National Aerospace Plan (NASP)
– Design a vehicle that could fly into space using a single-stage-
to-orbit approach
– The results of the simulation were used to determine how the
company would invest its internal research and development
funds
– Although the NASP project was terminated, the resulting
research has helped develop more advanced materials and
propulsion systems used on many modern aircraft
– Eli Lily uses simulation to determine the optimal plant
capacity that should be built for each drug
• 55
 Sensitivity Analysis

• Sensitivity analysis is a technique used to show the effects of

changing one or more variables on an outcome.

• For example, many people use it to determine what the monthly

payments for a loan will be given different interest rates or
periods of the loan, or for determining break-even points based on
different assumptions.

• Spreadsheet software, such as Excel, is a common tool for

performing sensitivity analysis.

• 56
Sample Sensitivity Analysis for Determining Break-
Even Point

• 57
 Risk Response Planning
• After identifying and quantifying risks, you must decide how to
respond to them.

• Four main response strategies for negative risks:

– Risk avoidance – don’t use h/w or s/w if unfamiliar with them
– Risk acceptance – prepare for risk with backup plan or
contingency reserves
– Risk transference – to deal with financial risk exposure, a
company may purchase special insurance for specific h/w
needed for a project. If h/w fails, insurer has to replace it.
– Risk mitigation – reduce probability of occurrence e.g., use
proven technology, buy maintenance or service contract.
• 58
General Risk Mitigation Strategies for Technical,
Cost, and Schedule Risks

• 59
 Response Strategies for Positive Risks
• Risk exploitation – do whatever you can to make sure the risk
occurs, call press conference to advertise new product, take out
ads, etc.

• Risk sharing – allocating ownership of the risk to another party.

Hire an outside firm to do your advertising and PR.

• Risk enhancement – identify and maximize key drivers of the

risk. Encourage your employees or users of your product to
spread the word of your product.

• Risk acceptance – don’t take any action with regard to positive

risk. Assume the product will speak for itself.

• 60
 Residual and Secondary Risks

• It is also important to identify residual and secondary risks.

• Residual risks are risks that remain after all of the response
strategies have been implemented.
– Even though used stable h/w platform, it still may fail.

• Secondary risks are a direct result of implementing a risk

response
– Using stable h/w may have caused a risk of peripheral devices
failing to function properly

• 61
 Media Snapshot

• A highly publicized example of a risk response to corporate

financial scandals, such as those affecting Enron, Arthur
Andersen, and WorldCom, was legal action
– The Sarbanes-Oxley Act is considered the most significant change to
federal securities laws in the United States since the New Deal
• Fines, prison sentences up to 20 years for anyone who
knowingly alters or destroys a record or document with the
intent to obstruct an investigation
– This Act has caused many organizations to initiate projects and other
actions to avoid litigation

• 62
 Risk Monitoring and Control
• Involves executing the risk management process to respond to
risk events.
– This is an ongoing activity – new risks identified, old risks
disappear, weaken or get stronger.

• Workarounds are unplanned responses to risk events that must

be done when there are no contingency plans.

• Main outputs of risk monitoring and control are:

– Requested changes
– Recommended corrective and preventive actions
– Updates to the risk register, project management plan, and
organizational process assets
• 63
Using Software to Assist in Project Risk Management

• Risk registers can be created in a simple Word or Excel file or

as part of a database.

• More sophisticated risk management software, such as Monte

Carlo simulation tools, help in analyzing project risks.

• The PMI Risk Specific Interest Group’s Web site at

www.risksig.com has a detailed list of software products to
assist in risk management.

• 64
 Results of Good Project Risk Management

• Unlike crisis management, good project risk management often

goes unnoticed.

• Well-run projects appear to be almost effortless, but a lot of

work goes into running a project well.

• Project managers should strive to make their jobs look easy to

reflect the results of well-run projects.

• 65