Introduction

• An uncertain event or condition that, if it occurs, has a positive

or negative effect on a project’s objectives.
• PRINCE2:
• The Chance of exposure to the adverse consequences of future events .

• PRINCE PRojects IN Controlled Environment

 The key elements of risk
• It relates to future
• Cost underestimation, New Technology difficult to work.
• It involves cause and effect
• Cost Over-run, Use of untrained staff, Poor Specification
 Socio-technical Model of Risk
• Kalle Lyytinen and his Colleagues proposed a diagrammatic representation
 Risk Framework
• Actors : refers to all the people involved in the development of the
application in the question.
• Risk: High staff turn-over
• Technology: encompasses both the technology used to implement
the application and that embedded in the delivered products.
• Risk: Appropriateness of the technologies and possible faults within them
 Risk Framework
• Structure: Describes the management structures and
systems including those affecting planning and control.
• Risk: Some implementation might need user participation in some
tasks(not allotted)
• Tasks: relates to the work planned
• Risk: Complexity of work might lead to delay
 A framework for dealing with Risk
• Planning for risk includes
• Risk identification – what risks might there be?
• Risk analysis and prioritization – which are the most serious risks?
• Risk planning – what are we going to do about them?
• Risk monitoring – what is the current state of the risk?
 Risk identification
Approaches to identifying risks include:

• Use of checklists – usually based on the experience of past

projects
• Brainstorming – getting knowledgeable stakeholders
together to pool concerns
• Causal mapping – identifying possible chains of cause and
effect

7
 Checklists
• Checklists are simply lists of the risks that have been found to
occur regularly in software development projects.
 Boehm’s top 10 development risks
Risk Risk reduction techniques

Personnel shortfalls Staffing with top talent; job matching; teambuilding;

training and career development; early scheduling of
key personnel
Unrealistic time and cost Multiple estimation techniques; design to cost;
estimates incremental development; recording and analysis of
past projects; standardization of methods

Developing the wrong software Improved software evaluation; formal specification

functions methods; user surveys; prototyping; early user
manuals
Developing the wrong user Prototyping; task analysis; user involvement
interface
9
 Boehm’s top ten risk - continued
Gold plating Requirements scrubbing, prototyping,
design to cost
Late changes to requirements Change control, incremental development

Shortfalls in externally supplied Benchmarking, inspections, formal specifications, contractual

components agreements, quality controls

Shortfalls in externally Quality assurance procedures, competitive design etc

performed tasks
Real time performance Simulation, prototyping, tuning
problems
Development technically too Technical analysis, cost-benefit analysis, prototyping , training
difficult
10
 Brainstorming
• Stakeholders are brought together, preliminary and
plans are drafted
• Identifying the solution using the individual knowledge.
 Causal mapping
• Represent the chains of causes and effects that will influence outcomes
• The causes of the problems identified are traced back using the mapping
technique which identifies the project factors ( or ‘concept variables’) that
people see as being important and the causal links between them.
• These links can be positive or negative.
• Where possible, for each factor, positive and negative aspects are
identified e.g. ‘stable…unstable requirements’.

12
 Causal mapping

13
 Causal mapping
• Once a causal map has been drawn up identifying
possible negative outcomes and their causes, the map
can be modified to introduce policies or interventions
which should reduce or mitigate the effects of the
negative outcomes.
• Often a risk reduction activity can actually introduce new
risks.
• The use of consultants to offset the effects of skill
shortages is an example of this.
• Causal mapping can help identify such adverse side-
effects.

14
 Causal mapping - interventions

15
 Risk prioritization
Risk Assessment
• A common problem in risk identification is that a list of risks is
potentially endless.

• Estimating the risk exposure for each risk using the formula:

• Risk Exposure = (Potential Damage)* (Probability of Occurrence)

Risk probability: qualitative descriptors

Probability Range
level
High Greater than 50% chance of
happening
Significant 30-50% chance of happening
Moderate 10-29% chance of happening
Low Less than 10% chance of happening
17
 Qualitative descriptors of impact on cost and
associated range values

Impact level Range

High Greater than 30% above budgeted
expenditure
Significant 20 to 29% above budgeted expenditure

Moderate 10 to 19% above budgeted expenditure

Low Within 10% of budgeted expenditure.

18
 Probability impact matrix

19
 Risk planning
Risks can be dealt with by:
• Risk acceptance
• Risk avoidance
• Risk reduction
• Risk transfer
• Risk mitigation/contingency measures

20
 Risk planning
• Risk acceptance
• The cost of avoiding the risk may be greater than the actual cost of the
damage that might be inflicted
• Risk avoidance
• Avoid the environment in which the risk occurs e.g. buying an OTS
application would avoid a lot of the risks associated with software
development e.g. poor estimates of effort.
• Risk reduction
• The risk is accepted but actions are taken to reduce its likelihood e.g.
prototypes ought to reduce the risk of incorrect requirements

21
 Risk planning
• Risk transfer
• The risk is transferred to another person or organization. The risk of
incorrect development estimates can be transferred by negotiating a
fixed price contract with an outside software supplier.
• Risk mitigation
• Tries to reduce the impact if the risk does occur e.g. taking backups
to allow rapid recovery in the case of data corruption.

22
 Risk Reduction Actions
• The risk reduction action can be assessed by calculating the “Risk
Reduction Leverage”(RRL)
RRL= (RE before-RE after)/(Cost of risk reduction)
• RE -> Risk Exposure
• If RRL = 1.00 indicates the reduction in the exposure is greater than
its cost.
 PERT Technique

• Used to evaluate the effects of uncertainty

• CPM & PERT are similar
• CPM requires Single Estimate
• PERT requires Three Estimates
 PERT Three Estimates are

• Most Likely Time

• The time we would expect the task to take under normal circumstances. “ m”
• Optimistic Time
• Shortest time in which we could expect to complete the activity, barring the miracles.
“a”
• Pessimistic Time
• Worst Possible time. “b”
Expected Duration
• PERT Combines the three estimates to form a single expected
duration, te
• Formula for te is
te = a+4m+b/6
Calculate the expected duration
After Calculating Expected Duration
 Activity Standard Deviation
• S = b-a/6 which gives the degree of uncertainty.
• The activity standard deviation is proportional to the difference between the
optimistic and pessimistic estimates.
• Can be used as a ranking measure of the degree of uncertainty or risk for
each activity.
Standard Deviation
Probability of Meeting or Missing Target Date
• The PERT Technique uses the following three step method
for calculating the probability of meeting or missing a target
date:
• Calculate SD of each project event
• Calculate the Z value for each event that has a target value
• Convert Z values to a probability
Z- Value Formula
 Converting Z values to Probabilities
• A Z-value may be converted to the probability of not meeting the target date
by using the graph.
 Monte Carlo Simulation

• An alternative to PERT Technique

• MC Simulation are a class of general analysis techniques that are valuable to
solve any problem that is complex, nonlinear or for some uncertain
parameters.
• It involves repeated random sampling to compute the results.
• Advantage:
• Repeated computation of random numbers - easier to use this technique when
available as a computer program
 Steps – MC Simulation
• Step 1: Express the project completion time in terms of the duration
of the n-activities xi,i=1,n and their dependencies as a precedence
graph, d=f(x1,x2,….xn).
• Step 2: Generate a set of random inputs, Xi1,Xi2, …Xin using the
specified probability distributions.
• Step 3: Evaluate the project completion time expression and store
the result in di.
• Step 4: Repeat steps 2 and 3 for the specified number of times.
• Step 5: Analyze the results di, i=1,n; summarize and display using a
histogram.
Histogram
 Resource Allocation- Introduction
• Helps in reviewing and modifying the ideal activity plan.
• Helps in revise stage or project completion dates
• The final result of resource allocation involves schedules like
• Activity Schedule
• Resource Schedule
• Cost Schedule
 Nature of Resources
• A resource is any item or person required for the execution of the
project
• In general resource will fall into one of the seven categories
1. Labor
2. Equipment
3. Materials
4. Space
5. Service
6. Time
7. Money
 Identifying Resource Requirements
• The first step in resource allocation plan is to list the resources that
will be required along with the expected level of demand.
• This can be done by considering each activity in turn and identifying
the resources required.
 Scheduling Resources
• After identifying resource requirement list, next is to map this list to activity
plan to assess the distribution of resources required over the duration of the
project.
• Can be done by representing the activity plan as a bar chart and produce a
histogram for each resource.
 Two ways of prioritizing
• Total float priority
• Activities are ordered according to the total float
• Smallest total float has higher priority(Like Ranking)
• Ordered list priority
• Activities that can be proceed at the same time are ordered according to
a set of simple criteria.
• Burman’s Priority list:
• Shortest Critical Activities
• Critical Activities
• Shortest Non-Critical Activities
• Non-Critical Activities with Least Float
• Non- Critical Activities
 Creating Critical Paths
• Scheduling resources can create new critical paths.
• Delaying the start of an activity due to lack of resources will cause that
activity to become critical.
• Delay in completing one activity can delay the availability of a resource
required for later activity.
Allocating Individuals

• Availability
• Criticality
• Risk
• Training
• Team Building
 Cost Schedule

• Categories of cost
• Staff cost
• Staff Salary
• Overheads
• Expenditure of organization
• Usage Charges
• Charge for use of resource