Risk Management

The concept phase of a project centers on measuring and judging the risk-reward tradeoff: what are the rewards that the organization will reap from a successful project, and what is the risk that the project will not be a success. The reward of a project has well-defined metrics such as return on investment analysis, marketing forecasts, and revenue projections, all of which can be presented in powerfully persuasive arguments in favor of doing the project. But the risk of a project is often presented in an ad hoc way, saddled by technical jargon and arm waving -- or indeed, not presented at all. How can we make a more balanced presentation of the risks and rewards? What are the elements of a good risk management plan? What methods can we employ to identify, analyze, and measure risk early in a project and present these risk measurements in a form as readily understandable to senior management as a marketing forecast? How can technical risk be presented to a non-technical audience? And when a project goes forward with this more balanced understanding of the risk versus rewards, how can we control and mitigate these identified risks? What tools are available to help us in capturing project risks, presenting them for decision analysis, and controlling and mitigating these risks during the project's execution? What is a hazard analysis and how do I conduct one? Are hazard analyses just for safety-significant designs and processes? Are there any special techniques for risk analysis of software products?

• TEMPLATE: The SWOT Analysis template contains a review of Strengths, Weaknesses, Opportunities, and Threats affecting the subject of the analysis. SWOT analysis is often used to evaluate strategic choices (project objectives, priorities, etc.) and can also be used to review potential impacts on things like a process, solution, or business entity.
  
  
• TEMPLATE: Even apparently simple IT projects can open a Pandora's Box of user concerns, questions, and frustrations caused by overlooked impacts. The User Impact Assessment template guides the team through an assessment of the user impacts of technology changes, to enable better planning and communication and a smoother deployment experience for everyone.
  
  
• TEMPLATE: Drafting a risk list can be a daunting proposition. The Project Risk Checklist prompts your team to consider common risks across a wide variety of categories, to reduce the odds of missing one of those dreaded "unknown-unknowns."
  
  
• TEMPLATE: It's one thing to make a list of risks, and another to be quite clear about just how badly a particular risk could impact the project in financial terms. The Calculating Expected Monetary Value (EMV) of Risks template helps teams assess the financial impact of a given risk and determine how much time and money to spend avoiding it.
  
  
• TEMPLATE: Download our templates for Product and Project Risk Assessment and Mitigation Tables.
  
  
• TEMPLATE: The Risk Management Plan template provides a high-level plan/outline for ensuring consistent implementation of risk management across an organization, or across a division or group within an organization.
• TEMPLATE: The Risk Management Process template provides guidance on the steps to be followed when implementing a risk management process -- a roadmap to get from risk-unaware to risk-aware and risk-ready.
• TEMPLATE: Our Risk Strategy Selection Matrix helps the project manager, management, and the team get a clear look at the most pervasive risks, and identify which strategies have the best chance of resolving multiple risks at once.
  
  
• TEMPLATE: Our Risk Management Model (courtesy Pritchard Management Associates) provides a quantitative approach to assessing multiple, very specific risk factors such as technical complexity and PR exposure and opportunity factors such as market leadership and employee retention.
  
  
• PAPER: "Transferring a Genetically Engineered Biopharmaceutical from Research to Clinical Development - Impact on Facility Design and Build Projects" (offsite link) This paper from Pharmaceutical Engineering uses the transfer of a product from R&D into Phase 1 clinical trials to discuss how time-to-market concerns often drive design of manufacturing facilities before the manufacturing process has been full designed. Changes during technology transfer of those processes to manufacturing will then impact the facility-related projects, and this case study covers approaches to facility design and build projects that can be used to handle the uncertainty and risks.
  
  
• ARTICLE: An Overview of Project Risk Management (Coblands Consulting)
  
  
• PAPER: Continuous Risk Management at NASA is available online. The paper outlines the implementation of continuous risk management in software development. It was presented at the Applied Software Measurement / Software Management Conference, February 1999, San Jose, California.
  
  
• PAPER: Tom Gilb's Results-Planning web site has resources on risk management and related topics. See their download area for the paper "Risk Management: A Practical Toolkit For Identifying, Analyzing And Coping With Project Risks". This paper discuses the use of Requirements Driven Management (RDM) methods to reduce risk.
  
  
• ARTICLES: Among our archived columns on Risk Management:
• Getting Past the Big "Event" on Risk: Define risks clearly and thoroughly to enhance your ability to manage them.
• Where Did the Numbers Go?: Don't get lost in the numbers game; managing risks is more important than measuring them.
• Setting the Thresholds: Make measurable the degree of risk your project can tolerate.
• Dispelling Fear: Something to Get Exorcised About: Advice from Doug DeCarlo on ridding your project of its demons.
• Did Somebody Say Customer Service? gives advice on mitigating the risks in dealing with customers.
• If it wasn't broken, why is the new PMBOK^® Guide "fixing" risk management? Read the answer in New Risk Practice? Did We Miss Something Before?



• PAPERS: Two online papers that examine the role of configuration management in reducing project risk:
• Experiences in Risk Mitigation with Configuration Management (site registration required)
• Does Configuration Management Mitigate Project Risk?



• OTHER RESOURCES: Want to dive into deep treatments of product risk management in medical device software? Even if your software development is not "safety significant", the risk management methodology discusses in these admittedly heavy treatments can still help improve both product quality and development process efficiency.
• The 33-page paper Medical Device Use - Safety: Incorporating Human Factors Engineering into Risk Management is a guidebook for the use of human factors to identify and remove possible user interface errors. (PDF format)
• Do It By Design: An Introduction to Human Factors in Medical Devices is a primer on using human factors principals and methods to design intuitive human interfaces that reduce user errors.
• More resources on risk management in medical instrument design are available at the U.S. Food and Drug Administration Center for Devices and Radiological Health web site.



• BOOKS: Check out the books on risk management in our book list.