Introduction to Project

Management

Chapter 9
Managing Project Risk

Information Systems Project Management: A Process and Team Approach, 1e

Fuller/Valacich/George

© 2008 Prentice Hall 9-1

 Project Risk

• “…an uncertain event or condition that, if it

occurs, has a positive or a negative effect on a
project objective.”

© 2008 Prentice Hall 9-2

 Information Systems
Associated Risks
• Technology and project management related
– Positive
• Availability of new project management tools
– Negative
• Rate of change in technologies
– Upgrades and new releases
• Assumptions computer-generated output is always correct
• Formation of teams

© 2008 Prentice Hall 9-3

 Risk & Project Life Cycle

• Initiation stage
– Identification and selection of specific projects
• Inside or outside of organization’s core competencies

• Planning stage
– Procurement
• Unreliability of new technology delivery timeframe
• Development of accurate project schedule

© 2008 Prentice Hall 9-4

 Risk & Project Life Cycle (cont.)
• Execution stage
– Missed scheduled delivery date
– Technology upgrades

• Control stage
– Implementation of risk plan
– Modification of project schedule

• Closing stage
– Acceptance of project as finished

© 2008 Prentice Hall 9-5

Project Risk Statistics

© 2008 Prentice Hall 9-6

 Project Risk Examples

• New or different project management

methodologies

• Different:
– Cultures
– Organization structures
– Human resources

© 2008 Prentice Hall 9-7

 General Categories of
IS Project Risk

• Ongoing changes to technology

• Finding, assigning, and retaining skilled

personnel

• Gaining user acceptance

• Choosing the correct development methodology

© 2008 Prentice Hall 9-8

 Outsourcing / Offshoring
• Positives:
– Expanded skill set availability
– Cheaper labor
– Reduced requirements for non-core competencies

• Negatives:
– Internal resistance
• Possible solutions to reduce risk:
– Ensure strong upper management support
– Select the right personnel
– Involve managers early in the outsourcing process
– Educate and reassure internal employees

© 2008 Prentice Hall 9-9

 Outsourcing / Offshoring (cont.)

• Negatives (cont.):
– Increased security and privacy concerns
• Possible solutions to reduce risk:
– Increase physical security measures
– Use software event logging and monitoring tools
– Intrusion detection systems and firewalls
– Encryption hardware/software

© 2008 Prentice Hall 9-10

 Top Five Software Project Risks

• Lack of top management commitment to the

project

• Failure to gain user commitment

• Misunderstanding the requirements

• Lack of adequate user involvement

• Failure to manage end user expectations

© 2008 Prentice Hall 9-11

 Risk Management Planning
• A systematic approach to planning the risk
management activities of a given project

© 2008 Prentice Hall 9-12

Risk Management Planning – Inputs
• Enterprise environmental factors
– Attitudes toward risk and risk tolerance

• Organizational process assets

– Processes in place to handle risk

• Project scope statement

– Defining the project

• Project management plan

– Project summary document
© 2008 Prentice Hall 9-13
 PMBOK
Required Inputs, Tools, and Techniques
Used, and Resulting Outputs During Risk
Management

© 2008 Prentice Hall 9-14

 Risk Management Planning –
Tools & Techniques
• Risk planning meetings
– Senior managers, project team leaders, stakeholders,
project members with decision-making responsibilities
– Development of specific risk management plans
– Inclusion of risk-related items in budget and schedule
– Creation of risk management templates

© 2008 Prentice Hall 9-15

Risk Management Planning – Outputs

• Risk Management Plan

– Methodology or approach to risk management
– Roles and responsibilities of project members
– Risk management budget
– Integration of risk management activities into project
life cycle
– Scoring and interpretation of risk analysis
– Risk thresholds
– Reporting formats
– Tracking
© 2008 Prentice Hall 9-16
 Risk Identification

• The process of identifying potential risks to a

project and documenting them

© 2008 Prentice Hall 9-17

 PMBOK
Required Inputs, Tools and Techniques Used,
and Resulting Outputs During Risk Identification

© 2008 Prentice Hall 9-18

 Risk Identification – Inputs

• Enterprise environmental factors

• Organizational process assets

• Project scope statement

• Project management plan

• Risk management plan

© 2008 Prentice Hall 9-19

 Risk Categories

• Defined in a Risk Register

– A formal recording of all project risks, explaining the
nature of the risk and management of the risk

© 2008 Prentice Hall 9-20

 Risks

© 2008 Prentice Hall 9-21

 Risk Identification –
Tools & Techniques
• Documentation reviews
– The review of organizational information to aid during
risk identification
• May include:
– Project profiles (previous project information and related
lessons learned)
– Published information
» Articles/studies/benchmarking information

© 2008 Prentice Hall 9-22

 Risk Identification –
Tools & Techniques (cont.)
• Information gathering techniques
– Brainstorming
– Delphi technique
– Interviewing
– Strengths, weaknesses, opportunities, and threats
(SWOT)
– Checklists

© 2008 Prentice Hall 9-23

 Risk Identification –
Tools & Techniques (cont.)
– Diagramming techniques
• Cause and effect (Fishbone)
• System or process flowcharts
• Influence diagrams

© 2008 Prentice Hall 9-24

Risk Identification – Output

© 2008 Prentice Hall 9-25

 Qualitative Risk Analysis

• Establishment of probabilities regarding both the

impact and likelihood of specific risk occurrences

© 2008 Prentice Hall 9-26

 PMBOK
Required Inputs, Tools and Techniques
Used, and Resulting Outputs During
Qualitative Risk Analysis

© 2008 Prentice Hall 9-27

 Qualitative Risk Analysis – Inputs

• Organizational process assets

• Project scope statement

• Risk management plan

• Risk register

© 2008 Prentice Hall 9-28

 Qualitative Risk Analysis –
Tools & Techniques
• Risk probability and impact assessment

• Probability/impact risk rating matrix

• Risk data quality assessment

• Risk categorization

• Risk urgency assessment

© 2008 Prentice Hall 9-29

 Probability/Impact
Risk Rating Matrix
• A technique used to analyze project risk in terms
of its probability of occurrence and its impact on
project outcomes

© 2008 Prentice Hall 9-30

 Risk Data Quality Assessment

• Assessment of the quality of the data used to

assess risk

• May include:
• Extent to which a risk is understood
• Available risk data
• Data quality
• Data integrity and reliability

© 2008 Prentice Hall 9-31

Qualitative Risk Analysis – Outputs

• Updated risk register

© 2008 Prentice Hall 9-32

 Quantitative Risk Analysis

• Analysis of the probability of occurrence and

impact of risk on project objectives using
numerical techniques

© 2008 Prentice Hall 9-33

Required Inputs, Tools and Techniques
Used, and Resulting Outputs During
Quantitative Risk Analysis

© 2008 Prentice Hall 9-34

Quantitative Risk Analysis – Inputs

• Organization process assets

• Project scope statement

• Risk management plan

• Risk register

• Project management plan

© 2008 Prentice Hall 9-35

 Quantitative Risk Analysis –
Tools & Techniques
• Data gathering through interviewing

• Quantitative procedures
– Sensitivity analysis
• Technique used to examine the potential impact of specific
risks to a project (Tornado analysis)
– Decision tree analysis
• Diagramming technique used to evaluate courses of action in
terms of their potential cost and benefits relative to other
courses of action

© 2008 Prentice Hall 9-36

 Quantitative Risk Analysis –
Tools & Techniques (cont.)
– Expected monetary value analysis (EMV)
• Statistical technique which captures the average value of
potential projects by analyzing the likelihood of possible
project outcomes as well as each outcome’s financial
consequences
– Simulation
• Statistical technique where what-if analyzes are run to
determine the impact of a given situation on a project
objective (Monte Carlo)

© 2008 Prentice Hall 9-37

Tornado Analysis

© 2008 Prentice Hall 9-38

Expected Monetary Value +
Decision Tree Analysis

© 2008 Prentice Hall 9-39

Quantitative Risk Analysis – Outputs

• Updated risk register

© 2008 Prentice Hall 9-40

 Risk Response Planning
• The process of developing methods for
responding to project risks

© 2008 Prentice Hall 9-41

 Required Inputs, Tools and Techniques
Used, and Resulting Outputs During Risk
Response Planning

© 2008 Prentice Hall 9-42

 Risk Response Planning – Inputs

• Risk management plan

• Risk register

© 2008 Prentice Hall 9-43

 Risk Response Planning –
Tools & Techniques
• Avoidance
– Identified risks are avoided through a different course
of action
• Transference
– Transfer of risk to another party through the use of
contracts
• Mitigation
– Steps are taken to reduce the occurrence or impact of
stated risks
• Acceptance
– Risks are accepted and contingency strategies are
planned
© 2008 Prentice Hall 9-44
Risk Response Planning – Outputs

• Updates to:
– Risk register
– Project management plan
– Risk-related contractual agreements

© 2008 Prentice Hall 9-45

 Risk Response Plan Contents
(Project Management Institute)
• Any risks that have been identified along with a description and the
areas and objectives the identified risk may affect
• The roles and responsibilities of any risk owners
• Qualitative and quantitative risk analysis results as well as any
trends identified during either of these processes
• A description of the risk response strategies including avoidance,
transference, mitigation, and acceptance, and the risk that the
strategies will be applied to
• An acknowledgement of any residual risk projected to remain after
any risk response strategies have been applied
• A list of actions to be used to implement the risk response strategies
• Budget and schedule information in terms of risk response
• Any contingency plans used as part of an active response to accept
risks
© 2008 Prentice Hall 9-46
 Additional Risk Terms

• Residual risks
– Any risks remaining after risk response strategies
have been applied

• Secondary risks
– Any risks resulting from the application of a risk
response strategy

• Contractual agreements
– Any contracts for the purpose of risk transference
during the project
© 2008 Prentice Hall 9-47
 Risk Monitoring & Control

• The process of monitoring identified risks for

change and controlling those changes

© 2008 Prentice Hall 9-48

 PMBOK Required Inputs, Tools and
Techniques Used, and Resulting Outputs
During Risk Monitoring and Control

© 2008 Prentice Hall 9-49

Questions?

© 2008 Prentice Hall 9-50