Chapter 8 Managing Risk

Concepts

Identifying risks and their potential impact

Assessing the likelihood of occurrence and degree of impact of risks

Risk response planning

Risk monitoring

【•As mentioned in Chapter 1, one attribute of a project is that it involves a degree of uncertainty. Such uncertainty can impact the outcome of a project.

•Risk involves an uncertain event that, if it occurs, can jeopardize accomplishing the project objective.

•Risk management involves identifying, assessing, and responding to project risks in order to minimize the likelihood of occurrence and/or potential impact of adverse events on the accomplishment of the project objective. Addressing risks proactively will increase the chances of accomplishing the project objective. Waiting for unfavorable events to occur and then reacting to them can result in panic and costly responses. Managing risk includes taking action to prevent or minimize the likelihood of occurrence or the impact of unfavorable events.

•A project manager cannot be risk averse. He or she must accept that risk is a part of project management and has to address it head-on. Furthermore, the project manager needs to set the tone for encouraging open and timely discussion of risks among the project team.

Based on what they learn in this chapter, students will become familiar with:

•Identifying risks and their potential impact

•Assessing the likelihood of occurrence and degree of impact of risks

•Risk response planning

•Risk monitoring】

Identify Risks

Can jeopardize accomplishing the project objective

Brainstorm sources of risks

Establish categories for risks and evaluate

Use historical information (The problem you constantly have again and again )

Progressively elaborate and identify new risks as more information becomes available

【A risk is an uncertain event that, if it occurs, can jeopardize accomplishing the project objective.

•Risk identification includes determining which risks may adversely affect the project objective and what the impact of each risk might be if it occurs.

•Sometimes a sponsor identifies major risks in the project charter when the project is authorized.

•A common approach to identifying the sources of risks is brainstorming.

•Risks that are accounted for should be somewhat likely to occur and/or can have a significant negative impact on accomplishing the project objective.

•Establishing risk categories may help to identify and evaluate risks.

•Some possible categories are technical, schedule, cost, human resources, external, or sponsor/customer.

•Historical information from past projects is another source that can be helpful in identifying possible risks.

The project team can progressively elaborate and identify new risks, as well as the estimated impacts of previously identified risks as more information becomes available.】

Assess Risks

Determine the likelihood the risk event will occur

Evaluate degree of impact on the project objective

Prioritize

Likelihood of occurrence and degree of impact

Position relative to the critical path

【•Assessing each risk involves determining the likelihood that the risk event will occur and the degree of impact the event will have on the project objective.

•Risks can then be prioritized based on the likelihood of occurrence and degree of impact

•Risks on the critical path should be given higher priority because, if the risk occurs, it would have a greater impact on the schedule than if it was associated with activities on a path that has a large positive value of total slack.】

Risk Assessment Matrix

Risk, impact, likelihood of occurrence, degree of impact, action trigger, responsibility, response plan

【•This figure depicts a risk assessment matrix, a tool for assessing and managing risks.

•It helps to:

•List the impact of the risk

•Evaluate the likelihood of occurrence

•Determine the degree of impact

•Identify the action trigger

•Name a person responsible

•Create a response plan to avoid, mitigate, or accept the risk】

Plan Risk Responses

Set of actions

Prevent or reduce the likelihood of occurrence or the impact of a risk

Implement if the risk event occurs

Establishes a trigger point for implementing an action

Assigns responsibility for implementation

Avoid, mitigate, or accept the risk

Include a contingency fund to cover implementation cost

【•A risk response plan is a defined set of actions that seek to prevent or reduce the likelihood of occurrence or the impact of a risk.

•The risk response plan is implemented if the risk event occurs.

•Risk response planning involves establishing a trigger point for when to implement the actions to address each risk

•It assigns responsibility to specific individuals for implementing the response plan.

•A risk response plan can be helpful in avoiding, mitigating, or accepting the risk.

•Project prices and budgets should include a contingency or management reserve to pay for additional costs associated with implementing response plans.】

Managing Risks for Information Systems Development

Risks can be categorized into seven types

Technological risk

Human risk (personal)

Usability risk (devise)

Project team risk (all the time, internal to the company, happen every single project, we should use historical information)

Project risk (termination)

Organizational risk

Strategic and political risk

【•These categories help to explain the risks associated with developing systems that accept data inputs, process those inputs, and produce information for users.
•Chapters 4, 5, 6, and 7 provided foundation information about the definition, scheduling, resources, and costs associated with IS development projects.】

IS Example: Risk Assessment Matrix

【•This is a continuation of the web-based reporting system project that we have used as an example in previous chapters.

•Beth wants to prepare for potential project risks so that the team can address them early enough that they do not impact the delivery date for the system.

•Beth planned for the team to determine the impact of the risk, the likelihood of occurrence, the degree of impact if it does occur, the action trigger that will serve as a warning flag for the risk, who is responsible for the risk, and the response plan to avoid, mitigate, or accept the risk.

•Beth reviewed the lessons learned from other projects to make sure that the project team discussed the risks from the other projects.

•This figure depicts the Risk Assessment Matrix for Web-based Reporting System Project.】