Risk Management essentials

by eugene.veselov@magento.com

Goal

To reinforce Magento team with base knowledge about Risk Management

To share positive knowledge

Plan

1. Base knowledge about risks

2. How to identify risks

3. Risk analysis

4. Plan risk response

Introduction

Risk is always future !

Risk is an uncertain event that, if occurs, has an effect on at least one project objective.

(this means to scope, schedule, quality, cost)

Project risk has its origins in the uncertainly present in all projects

Introduction

Risk identification

1. When should you identify project risks ?

Risk identification

1. Who should identify risks ?

Risk identification. Risk categories

Risk identification. Methods

1. Brainstorming

2. Delphi technique

Risk identification. Methods

1. Interviewing

2. Root cause analysis

Risk identification. Methods

1. Check list analysis

Risk identification. Risk registry

List of identified risks ( EVENT can occur and cause IMPACB)

List of potential responses (if possible and is efficient)

Risk identification. Risk registry example

# Rate Scale Probability Description Trigger Response strategy

1 70% Because of season fever up to 40% of our crew can become sick and this can cause project delay

2 45% Framework X can cause system instability (up to 10h per week)

Replace framework X with framework Y

3 0.003% Asteroid can aim at our office and destroy all our equipment , so that the project will be failed

4 100% Our MS SQL server works too slow and this causes project delays

5 50% Our staff won’t learn framework Y on enough level and this will affect quality and terms of the project (up to 30%)

6 40% Late delivery of Feature X can cause contract withdrawal

Risk identification. Qualitative Analysis

1. Qualitative analysis is the process of prioritizing risks for further analysis

2. Outputs of the process can either inputs to quantitative Risk Analysis or Plan Risk response

Risk identification. Qualitative Analysis

Risk identification. Qualitative Analysis

Risk Rating = Relative scale * Probability

Risk identification. Qualitative Analysis. Updated Risk Registry

# Rate Scale Probability Description Trigger Response strategy

1 0.42 0.60 70% Because of season fever up to 40% of our crew can become sick and this can cause project delay

2 0.36 0.80 45% Framework X can cause system instability (up to 10h per week)

Replace framework X with framework Y

3 .0002 0.95 0.0003% Asteroid can aim at our office and destroy all our equipment , so that the project will be failed

4 0.15 0.30 50% Our staff won’t learn framework Y on enough level and this will affect quality and terms of the project (up to 30%)

5 0.57 0.95 60% Late delivery of Feature X can cause contract withdrawal

Risk identification. Quantitative Analysis

Goal : risk numerical analysis to the project objectives

Risk identification. Quantitative Analysis. Methods

1. Expected Monetary Value (EMV) = probability * impact

2. EMV is also used for building decision trees

Quantitative Analysis. Decision treeFrom TV news you were told that many people (40%) could become sick in a few month because of a new type of fever. One sick person means 1 day of delay for your project, and your team consists of 10 people. Unfortunately, you should pay $1000 per delay day to you customer. However, Ministry of Health recommends two vaccines to help you:Vaccine A sets the risk of getting sick on 30% level. Price of the vaccine is $1500. Vaccine B sets the risk of getting sick on 5% level. Price of the vaccine is $2500. What will you do ?

Fever. What should I do ?

Do nothing. Cost $0EMV = $0+ $1000 *(10*0.4)=$4000

Use Vaccine A Cost $1500EMV =$1500+ $1000 *(10*0.3)=$4500

Use Vaccine B Cost $2500EMV = $2500+ $1000 *(10*0.05)=$3000

Risk identification. Quantitative Analysis. Methods

Example (for audience)– A software company needs to develop a feature for very important customer from

automobile industry for 2 month. This feature is very specific and the Company do not have enough experience to develop it. The best team from this company say that probability to deliver this feature is 40%, the team price is 1000 per moth. They also say that if they do not develop it within month they won’t develop it at all. There also is a well known company that is experienced enough in such features so that they deliver this feature within 2 weeks for 5000 with 100% probability. It is also possible do buy existing component (1500) and adopt it. Probability to customize it by the best team for 1.5 month is 70%. What is the best strategy for PM ?

Risk identification. Quantitative Analysis. Methods

Very important feature

A) Develop by our Best teamCost: $1000

Success (30%) Loss : $0

Fail. (70%) , external company involvementLoss: $5000

B) Develop by external Company Cost: $5000

Buy existing componentCost: $1500 + $1500

Fail. (20%) , external company involvementLoss: $5000

Success (80%) Loss : $0

Very important featurea) EMV = $1000+0.7*$5000 = $4500b) EMV= $5000c) EMV = $1500+$1500+0.2*$5000 = $4000

Risk Management . Risk response

1. Avoid2. Transfer3. Mitigate4. Accept

Risk identification. Qualitative Analysis. Updated Risk Registry

# Rate Scale Probability Description Trigger Response strategy

1 0.42 0.60 70% Because of season fever up to 40% of our crew can become sick and this can cause project delay

Bad news from TV

(Mitigate) Vaccinate people. 70% of vaccinated people won’t become sick

2 0.36 0.80 45% Framework X can cause system instability (up to 10h per week)

N/A (Avoid) Replace framework X with framework Y

3 .0002 0.95 0.0003% Asteroid can aim at our office and destroy all our equipment , so that the project will be failed

N/A (Accept)

4 0.15 0.30 50% Our staff won’t learn framework Y on enough level and this will affect quality and terms of the project (up to 30%)

You ideas ? (Accept/Mitigate)

5 0.57 0.95 60% Late delivery of Feature X can cause contract withdrawal

2 weeks left and feature is not ready

Mitigate/Transfer

Risk Management . Risk response. Cases

1. Lets develop responses for following risks

a) Your key people can leave your Company b) Your office can be destroyed by firec) The customer changes requirements too often

Risk Management . Risk response. Deadlines

Your project consists of two 3 day tasks which must be done sequentially. There is a 50% probability that each task can be delayed for 3 extra days because of some reasons. We must accept these risks. What will be optimistic and pessimistic dates for this project if we start it today ?

Risk Management ready ?

1. Can we manage our risks ?2. What risks will we get from risk management ?

The end.

Questions ?

Literature Tom DeMarco, “Waltzing with Bears: Managing

Risk on Software Projects” PMBOK

eugene.veselov@magento.com