Project Management in ICT. Prof. Dr. Harald Wehnes

Transcription

1 Project Management in ICT Prof. Dr. Harald Wehnes 6.2 Risk management Project Management 1 1 1

2 Risk management in projects "risk management is project management for adults" Tom De Marco all projects include risks and opportunities Tasks of the project manager To organising the responsibilities and the process for the treatment and monitoring of risks To secure proactive treatment of the main project risks To establish consciousness for project risks in the team Project Management 2 2 2

3 Why risk management? Again, disasters due to missing or unsatisfactory risk management Oil spill in the Gulf of Mexico : Fukushima Project Management 3 3 3

4 Why risk management? Risk management costs money. No risk management is more expensive! Half a billion for "Euro Hawk" pulverizes n-tv, Project Management 4 4 4

5 Murphys laws (Edward Murphy, 1949) Everything that can go wrong goes wrong. Everything that can't go wrong goes wrong, too. Everything can't go wrong, go wrong, when you don't expect it. Murphy was an optimist! Project Management 5 5 5

6 Risks are uncertain events risk := uncertain event that endangers the project objectives, with the two dimensions What can go wrong? probability of an event occurring (P) := the probability of occurrence is expressed in percent % impact if it does occur (I) := Consequences on the occurrence of the event (on project results, time, budget) risk value (RV) := P * I risk management := systematic process for the management of risks with the sub processes planning of the risk management risk identification risk analysis dealing with risks monitoring risks Lessons learned concerning risk management Project Management 6 6 6

7 Systematic risk management process secures an efficient dealing with the project risks 0. Planning of the management of risks responsibilities, process, templates, dates 1. Identification list of project risks 4. Monitoring 2. Analysis effectiveness test risk portfolio 3. Risk response measures measures 5. Lessons Learned Project Management 7 7 7

8 0. Planning of the management of risks Determination of the approach for risk management rolls and responsibilities moments for risk analysis during the project (risk updating) process, templates etc. communication of project risks and risk response measures Clearness of the process of lesson learned Results Risk management plan Awareness of team members for risks in the project Culture of risks! All project members are allowed to speak open about risks Project manager / core team must deal with risks actively and have to communicate about it Project Management 8 8 8

9 1. Identification goal: complete list of the project risks You can t manage, what you don t know about Alternatives Workshop risk identification using creativity techniques, i.e. brainstorming, mind mapping Using risk identification checklists; using the experience from former projects Interviews with experts SWOT analysis Scenario method Simulation methods Cooperation with qualified executives from all affected business units The "skeptics" in the project provide great services a documentation of the risks in a risk table Project Management 9 9 9

10 Technical risks Types of risks: check list (1) Use of new technologies; Technology changes during runtime Lack of availability of important hardware and/or software components Lack of experience with development environment Lack of compatibility of interfaces Personnel risks Inadequate training/experience of the project manager Human resources: staff are not sufficiently available or have not the required qualifications Lack of motivation of the project staff Team conflicts Misconduct by employees Staff turnover during the project period Commercial risks Customer become insolvent Suppliers are unreliable, failing or deliver products of inferior quality Dependencies of exchange rates Budget cut Project Management

11 Political risks Types of risks: check list (2) Legal changes during the project period Resistors in the society against the project Competitive risks Competitive product comes on the market No or low customer acceptance of the new product or service Contract risks Incomplete project contract Unreliability of sub companies Liability Project environmental risks Acts of God (fire, flood, lightning strike) Management is not behind the project Low importance of the project in the company Risks in project management Resource related risks Time related risks Budget related risks Quality risks Project Management

12 Cause of risk risk event consequences A project risk consists of 1. Cause of risk 2. Risk event with a certain probability of occurrence 3. Consequences to the project, after the risk event (Impact) Effect chain: Cause of risk Risk event Consequences The unidentified risks are very critical, because they are outside of the "project radar" Project Management

13 1. Identification: risk table The identified risks are recorded in the risk table (syn. risk list, spreadsheet, catalogue, register or directory) and described Example: # Risk Type Cause of risk Consequences Time consuming procurement The development of the Delayed supply of R1 Time related processes (EU tender takes at system can not be started the hardware least 2 months) on time R2 Problems with user acceptance political R3 Long batch runtimes technical risk Insufficient involvement of future users Lack of time for necessary QA activities R4 Exchange rate loss commercial Exchange rate is changing R5 Missing DB expert personnel All internal experts have already been allocated The type of risk arises from the cause System is unusable for the customer Scheduled time window in the computer center is not sufficient; Application not operable Financial losses (chance: also gains possible) The development of the system can not be started on time. Project Management

14 Example: Risk identification # Risk Type Cause of risk Consequences R1 Other food website Competitive risk Large market potential Reduce of number of users R2 Team conflict Personnel risk Misunderstanding between team members Reduce the effectiveness of project R3 Staffs lack the required qualifications Personnel risk Lack of qualification in recruiting staffs Reduce the quality and more time delay Project Management

15 Workshop Risk table Produce a risk table with your team 1. Each team member writes his key risk in his opinion on a piece of paper 2. The most commonly cited risk is transferred into the risk table (template) Template: risk-table.xls 3. This risk has to be classified (risk type) 4. It has to be described detailed and intelligible 5. For this risk the causes and consequences to the project after the risk event are entered in the table Time: 10 minutes Project Management

16 Workshop Risk table Results Project Management

17 2. Risk analysis 2.1 Qualitative risk analysis Probability of occurrences and impact on the project are classified: high medium low Advantage: Fast classification of the risks Results can be displayed in a risk matrix 2.2 Quantitative risk analysis An additional qualitative risk analysis is done for the risks with high priority The monetary risk value is calculated from the numerical probability of occurrence and the monetary value of the damage Project Management

18 2.1 Qualitative risk analysis The risks are assessed in terms of their probability of occurrence (P) and their impact (I) using a multi-tiered scale Example: 3-tiered scale: high - medium - low About this categorization, prioritization can be derived Example: # Risk Type Cause of risk Consequences R1 Delayed supply of the hardware time-related Time consuming procurement processes (EU tender takes at least 2 months) The development of the system can not be started on time Probability (P) Impact (I) Priority Result Time Budget l m 2 R2 Problems with user acceptance political Insufficient involvement of future users System is unusable for the customer m h l 4 R3 Long batch runtimes technical risk Lack of time for necessary QA activities Scheduled time window in the RZ is not sufficient; Application not operable m m 3 R4 Exchange rate loss commercial Exchange rate is changing Financial losses (chance: also gains possible) l l 1 R5 Missing DB expert resourcerelated All internal experts have already been allocated The development of the system can not be started on time h h h 5 Project Management

19 Probability of occurrence low medium high 2.1 Qualitative risk analysis: risk matrix Graphical representation of individual risks in a risk matrix: low medium Impact on the project objectives (quality, time, budget) Focus on the "high" and "very high" risks, as risk treatment causes expenses and costs high Project Management

20 Probability of occurrence high 2.1 Qualitative risk analysis: risk matrix Beispiel: R R1: Delayed supply of the hardware R2: Problems with user acceptance R3: Long batch runtimes low medium 2 R33 R2 4 1R4 R1 2 3 R4: Exchange rate loss R5: Missing DB expert low medium high Impact on the project objectives (quality, time, budget) Project Management

21 Example: Risk analysis # Risk Type Cause of risk Consequences Probability (P) Impact (I) Result Time Budget Priority R1 Other food website Competitive risk Large market potential Reduce of number of users h m 4 R2 Team conflict Personnel risk Misunderstanding between team members Reduce the effectiveness of project m h h 4 R3 Staffs lack the required qualifications Personnel risk Lack of qualification in recruiting staffs Reduce the quality and more time delay l m m 2 Project Management

22 Workshop Qualitative risk analysis Perform a qualitative risk assessment for your main risk Template: risk-table.xls 1. Assess the probability of occurrence (P) with the 3-level rating scale: low, medium, high 2. Assess the impact (I) on result, date and budget with the 3-level rating scale: low, medium, high 3. Determine the priority level of the risk from 1 and 2 Time: 10 minutes Project Management

23 Workshop Qualitative risk analysis Results Project Management

24 low P high 3. Risk response planning strategies Risk avoidance To avoid risk exposure entirely, i.e. not to submit a bid to a potential customer Risk reduction Preventive measure to reduce the probability of occurrence (P) Corrective measures to reduce the impact (I) (damage height) of the risk, i.e. Disaster Recovery Plan Risk transfer To transfer risks to other organisations, i.e. an insurance Risk acceptance risks with low probability of occurrence and small impact Costs for the measures are higher than the cost Reduction P Acceptance low I high Avoidance Reduction I Transfer Project Management

25 low medium high 3. Effect of preventative and corrective measures P preventive corrective preventive and corrective low medium high I Project Management

26 3. Risk measure planning # Consequences R1 R2 The development of the system can not be started on time System is unusable for the customer Measures preventive corrective call for bids immediately include user representative in the team costs (T ) for measures Decision 0 Y 5 Y R3 Scheduled time window in the RZ is not sufficient; Application not operable Perform load tests and optimization measures if necessary 10 Y R4 R5 Financial losses (chance: also gains possible) The development of the system can not be started on time engage external DB expert for 2 months insurance 3 N Proportionality between probability/ impact and efforts/costs for the measures must be respected 20 Y Project Management

27 Example: Risk measures # Risk Priority preventive Measures (M) corrective Cost for measures Decision R1 Other food website 4 Improve quality and USP of product 300$ Y R2 Team conflict 4 Make a clear communication plan 20$ Y R3 Staffs lack the required qualifications 2 Training plan for staffs 500$ Y Project Management

28 Workshop Risk measures 1. Consider a preventive or corrective measure to your main risk 2. Discuss: Is it economical to perform this measure? Time: 10 minutes Project Management

29 4. Risk monitoring Risk monitoring is used to control the effectiveness of the measures for the risks Responsibility: project manager; risk manager (big sized projects) Implementation of an early warning system: Determine which signs, symptoms and events help to detect risks at an early stage Pay attention for also the "weak" signals: Rumours, threats, increased disease rate, distrust in the team etc. Risk situation is changing in the course of the project a Regular risk checks (tracking of the measures): Were the measures effective? Changed the importance of previous risks? Are there new risks? Project Management

30 4. Risk monitoring: update risk situation Regularly TOP with Jour Fixe and at meetings of the Steering Committee Result dates Milestone, the beginning of a new phase new risks, some old risks become obsolete Special events Supplier becomes insolvent, new customer requirements, new insights, etc. Possible results of the new analysis Update of risk table Update of the measures Update of risk portfolio Revised staffing plans Proposals for the optimization of risk management Project Management

31 5. Lessons Learned At project close-out: Evaluation of experience Identified risks that happened Unidentified risks that happened Misjudgements Effectiveness of the measures Effectiveness of the practised risk management (processes, dates, communication, templates) Identification of optimization opportunities for future projects Documentation of experiences in an experience database e.g. Measures and their effectiveness Update of the used risk checklist Optimization of the risk management templates Project Management

32 Practical tips to risk management Adequacy! Feasibility study with high uncertainty: clarification of feasibility, time, cost,... Plan a budget for risk measures Already start during the initialization phase with risk management Participation of the entire project team in the risk management process a awareness for risks Consider risks as potential chances Development of prototypes Prevention by risk transparency Focusing the measures & efforts on the TOP risks Create an atmosphere where project risks are discussed open Project Management