Risk Determination & Decision Tree Analysis
praveen1993
ISEM580_Project-RiskManagent_Overview-Lecture-10.pptxHarrisburg University ISEM 580 Summer 2017
IT Project Risk Management Overview
Objectives
What is Project Risk & Project Risk Management
The goal and value of risk management
Key stages of risk management
Project Risk Management approaches and best practices
2
What is Project Risk ?
Project risk is defined by PMI as 'an uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives'.
3
What is Project Risk Management?
Project risk management is a method of finding risks, classifying risks and mitigating risks.
4
The Goal of Project Risk Management
The goal of project risk management is identifying potential risk, analyzing risk to determine those that have the greatest probability of occurring, identifying the risks that have the greatest impact on the project if they should occur, and defining plans that help mitigate or lessen the risks impact or avoid the risks while making the most of opportunity.
5
Value of Project Risk Management
Project risk management delivers a number of values to the project, including:
Recognizes uncertainty and provides forecasts of possible outcomes.
Produces better business outcomes through more informed decision making
Has a positive influence on creative thinking and innovation
Creates better project control—reduces overhead and time, and enhances benefits.
Contributes to project success
6
Importance of Project Risk Management
Project risk management is an important aspect of project management.
According to the Project Management Institute's PMBOK, Risk management is one of the ten knowledge areas in which a project manager must be competent.
Understanding project risks enables project teams to more effectively fulfill business goals and objectives as well as meet service expectations.
7
Effective Project Risk Management – Behaviors to Avoid
WSDOT Project Risk Management Guide-November 2014
8
Effective Project Risk Management avoids the following behaviors:
Paying too little attention to risk management
Not allocating sufficient resources for risk management
Unable to identify risks before they become issues
Poorly defined or not following project management process and procedures
Missing Opportunities
Project Risk Management – Balanced Approach
9
IT Managers Role in IT Project Risk Management
WSDOT Project Risk Management Guide-November 2014
10
As an IT manager you should coordinate with the PM and project team to:
Ensure proper due diligence in IT project planning and estimations
Coordinate with key stakeholders and subject matter experts to identify, assess/analyze, and respond to major risks
Continually monitor IT project triple constraints, progress, risks, response actions, and results
Maintain a good understanding of the overall health and evolving risk profile of the IT projects in your portfolio
Facilitate compliance with IT governance and polices associated with project management
Manage stakeholders expectations; ensuring timely accurate communications
Listen to stakeholders and project team members; investigate and verify concerns and use appropriate channels to raise awareness or take necessary actions to resolve
Risk Management Stages
Components, Approaches, & Best Practices
11
Project Risk Management - Stages
Risk Management Involves the following stages:
Risk Management Planning
Risk Identification
Risk Analysis & Quantification (Qualitative & Quantitative)
Risk Response
Risk Monitoring & Control
12
Project Risk Management - Planning Stage
WSDOT Project Risk Management Guide-November 2014
13
Project Risk Management - Planning Stage
WSDOT Project Risk Management Guide-November 2014
14
Risk management must commence early in project development and proceed as the project evolves and project information increases in quantity and quality.
Consider the resources needed for project risk management and build them into the project development budget and schedule.
When preparing the Project Management Plan and work activities for IT Projects, we must include both pillars of risk management.
Project Risk Management - Planning Stage
WSDOT Project Risk Management Guide-November 2014
15
How to Plan for Project Risk Management
Determine the level of risk assessment for your project
Incorporate risk management activities into the project schedule
Make risk management an agenda item for regularly scheduled project meetings
Communicate the importance of risk management to the entire project team
Establish the expectation that risk will be managed, documented, and reported
Project Risk Management - Planning Stage
WSDOT Project Risk Management Guide-November 2014
16
Tips for managing Project Risk Management Plan
Allow time in the schedule for prep activities; this includes review and QA/QC of project schedules and cost estimates at appropriate times
Allow a budget for risk assessment, risk management, and risk response activities
Report on the status of project risk in regularly scheduled project meetings
Know the organization’s tolerance for risk
Contact the Enterprise Project Management Office (EPMO) and EA to discuss the possibility of integrating the risk assessments with a business solution architecture (BSA) processes (conduct workshops).
Project Risk Management- Risk Identification Stage
WSDOT Project Risk Management Guide-November 2014
17
Risk identification involves determining which risks might affect the project and documenting their characteristics.
Project Risk Management – Risk Identification
WSDOT Project Risk Management Guide-November 2014
18
| Project Lifecycle | Systems Development Lifecycle |
| Initiation (Scoping) | Feasibility |
| Planning & Estimating | Requirements |
| Scheduling | Design |
| Execution | Build |
| Control & Monitoring | Test & Validate |
| Implementation |
Risk identification occurs throughout most phases of the IT project life cycle and SDLC. The probability of risk is greatest earlier than later in the project lifecycle.
Project Risk Management – Risk Identification
19
Techniques for Risk Identification
Document Reviews
Brainstorming
Lessons Learned
Other Methods
Tips for Risk Identification
Determine, for your project, what constitutes “significant” risk
Thoroughly describe the risk
Include specialty groups and/or other persons who may have meaningful input regarding the challenges the project may face
Determine who “owns” the risk and who will develop a response
Risk Should Be:
Specific
Measurable
Relevant
Time-Bound
Response
Project Risk Management- Risk Profile Sheet
20
Project Risk Management- Risk Analysis & Quantification Stage
21
Qualitative Risk Analysis: is concerned with the discovering the probability of a risk of an occurring and impact the risk will have if it does occur. You should perform qualitative risk analysis throughout the work of the project. This is the most common and probably the easiest method for analyzing risk for projects.
Risk Analysis & Quantification Stage – Qualitative Analysis
22
Risk Analysis & Quantification Stage – Qualitative Analysis
23
Qualitative Analysis - Risk Profile Sheet
WSDOT Project Risk Management Guide-November 2014
24
Project Risk Management- Risk Analysis & Quantification Stage
25
Quantitative Risk Analysis: numerically estimates the probability that a project will meet its cost and time objectives.
Determine Cardinal Scale Values (numbers expressed between zero and 1.0 probability) to both probability and impact so that you can calculate the overall risk score
Risk Analysis & Quantification Stage – Quantitative Analysis
26
Risk Analysis & Quantification Stage – Quantitative Analysis
27
Risk Analysis & Quantification Stage – Quantitative Analysis
28
Several other quantitative techniques exist, including sensitivity analysis, decision tree analysis and simulation techniques.
Since most of these require extensive analysis and significant investments in software and mathematical proficiencies (e.g., variance based methods, dimensional modeling, regression analysis), they aren’t ideally suited to small and medium-sized projects.
Risk Analysis & Quantification Stage – Quantitative Analysis
29
Decision Tree Analysis. This is a diagramming method that shows the sequence of interrelated decisions and expected results of choosing one alternative over another. It is usually used for risk events that impact time or cost.
Risk Analysis & Quantification Stage – Quantitative Analysis
WSDOT Project Risk Management Guide-November 2014
30
Monte Carlo methods (or Monte Carlo experiments) are a broad class of computational algorithms that rely on repeated random sampling to obtain numerical results. Monte Carlo simulation, or probability simulation, is a technique used to understand the impact of risk and uncertainty in financial, project management, cost, and other forecasting models.
Risk Analysis & Quantification Stage – Quantitative Analysis
WSDOT Project Risk Management Guide-November 2014
31
Basic forecasting model for estimating the total time it will take to complete a particular IT project. In this case, it's a EIS implementation project, with three parts (Job 1, Job 2, & Job 3). The parts have to be done one after the other, so the total time for the project will be the sum of the three parts; totaling 14-Months. This is an estimate but this model can't tell us anything about risk. How likely is it that the project will be completed on time?
Risk Analysis & Quantification Stage – Quantitative Analysis
WSDOT Project Risk Management Guide-November 2014
32
Create a model using a Monte Carlo simulation for estimating the total time it will take to complete the EIS project. Build the model by estimating the minimum, most likely, and maximum expected time (based on our experience, or expertise, or historical information). Now there is a range of possible outcomes.
Note: This Monte Carlo simulation will use the beta-PERT distribution to generate random values based on a minimum, most likely, and maximum value.
Risk Analysis & Quantification Stage – Quantitative Analysis
WSDOT Project Risk Management Guide-November 2014
33
The Monte Carlo simulation, randomly generates values for each of the tasks, then calculates the total time to completion. The simulation was run 500 times. Based on the results of the simulation, you will be able to describe some of the characteristics of the risk in the model.
To evaluate the likelihood of a particular result, count how many times the model returned that result in the simulation. In this case, we want to know how many times the result was less than or equal to a particular number of months.
Risk Analysis & Quantification Stage – Quantitative Analysis
WSDOT Project Risk Management Guide-November 2014
34
The Monte Carlo simulation results displayed in a graph. The simulation results reveals that there is only a 34% chance – about 1 out of 3 – that any individual trial will result in a total time of 14 months or less. On the other hand, there is a 79% chance that the project will be completed within 15 months.
Project Risk Management- Risk Analysis & Quantification Stage
35
Risk response is the process of developing options and determining actions to enhance opportunities and reduce threats to achieving the project’s objectives.
From a quantitative risk analysis perspective you should require a risk response plan for risk analysis resulting with an overall risk value equal to critical or significant. Similarly, from a qualitative risk analysis perspective you should require risk response plan for risks scores greater than or equal to a predefined threshold (Risk Score >= 8 in our qualitative model).
Project Risk Management- Risk Response Stage
36
| Risk Outcomes |
| Known risks with predictable outcomes |
| Known risks with uncertain outcomes |
| Unknown risks with unpredictable outcomes |
Project Risk Management- Risk Response Stage
37
Risk response plan should include at least the following elements:
Risk ID no
Risk name and description
Risk Owner
Analysis approach and results (risk score, risk value, expected value, probability, priority)
Risk triggers, effects, and impacts the project (e.g., scope, schedule, budget, performance)
Risk Response (e.g., strategy, timeframe, and responsible party)
Resources (e.g., people, things, costs)
Appendix (additional and supporting information)
Project Risk Management- Risk Monitoring & Control Stage
38
Risk monitoring and control tracks identified risks, monitors residual risks, and identifies new risks; ensuring the execution of risk plans and evaluating their effectiveness in reducing risk.
Risk monitoring and control is an ongoing process for the life of the project.
Involves a risk audit review process as a part of the project close-out phase to identify things that went well and opportunities for improvement and preventing future reoccurrences
Assignments
Chapters 4, 8 (IT Managers Handbook)
Homework 5: Risk Management
Project 2
Part A: Create an IT Governance Matrix
Part B: Create a Governance Charter for Enterprise Security Committee
Part C: Write a Information Security Policy for Data Classifications
39
