graham.collins@ucl.ac.uk

1. COMP3001 Technology Management & Professional Issues: Project ManagementRisk ManagementLecture 9Graham Collins, UCL graham.collins@ucl.ac.uk

2. Risks mentioned • Lack of appropriate communication to client • Lack of ‘buy-in’ • Delivering the project, on time on budget to the required performance can still result in the project being considered a failure • Scope creep, the project may be delayed and over budget • Lack of understanding of the requirements, how the work fits into the wider picture (WBS) or how this links into the process (the series of linked development stages) or life-cycle, the main phases of the project • Lack of understanding of progress • Lack of understanding of capability, the individual, team or the organisation • Sometimes it is useful to categorise risks using a framework mentioned PESTEL, otherwise categories of risks may be ignored • As with metrics, it is useful to keep data and discuss in a review session.

3. Discounting future performance measures • Poor communication • Lack of technical understanding • Intrinsic uncertainty • Different interpretations • Different assumptions • Multitude of variables • Problem compounded by linking to options

4. Plotting V as a function of D 2000 0 D, the real discount rate 2 4 6 -2000 V, the value of deferral less proceed now cash flows deferral is the preferred choice proceed now is the preferred choice -8 000 Uncertainty about cash flows can be examined using sensitivity analysis on a few key variables -10 000 Based on Chris Chapman & Stephen Ward, Managing Project Risk and Uncertainty: A Constructively Simple Approach to Decision Making, John Wiley 2002.

5. M_o_R Strategic framework for the Management of Risk Define a framework Identify the risks Embed and review Identify probable risk owners Gain assurances about effectiveness Evaluate the risks Implement responses Set acceptable levels of risk tolerance Identify suitable responses to risk Based on: Management of Risk: Guidance for Practitioners, OGC, HMSO,2002 originally adapted from the HM Treasury Orange Book

6. Definitions from M_o_R • Risk - uncertainty of outcome (whether a positive or negative threat). It is the combination of the chance of an event and its consequences • Risk management – the task of ensuring that the organisation makes cost effective use of a risk process. Risk management requires: processes in place to monitor risks; access to reliable up to date information about risk; the right balance of control in place to deal with those risks; decision making processes supported by a framework of risk analysis and evaluation. • Risk register – a product used to maintain information on all the identified risks pertaining to a particular activity (project or programme) • Risk appetite – the amount of risk the organisation is prepared to tolerate (be exposed to) at any point in time.

7. Risk Management - Stages • Risk awareness • Risk identification • Risk owner identification • Qualitative assessment • Quantification of probability • Quantification of impact (severity) • Exposure rating • Mitigation • Contingency provision • Risk register • Software usage (if any) • Monitoring and reporting Based on Albert Lester, Project Planning and Control, third edition, Butterworth-Heinemann, 2000

8. Risk Profile Models The project profile model www.ogc.gov.uk H Risk tolerance line Unacceptable risks M Probability Acceptable risks Typically this grid incorporates, categories VL and VH on both scales L L M H Impact (effect)

9. Status flags • Status flags may also be used. Identified in terms of red/amber/green (or RAG status) • The use of RAG status can be useful for incorporating the status reporting from risk registers into the risk profiles • Measure of risk RAG status, reflects the level of exposure that the risk represents to the project • Action RAG status, reflects the effectiveness of the action applied to the risk.

10. Risk register Project: ……………………………….. Key: H – High; M – Medium; L - Low Reference: ………..... Date: ………………… Prepared by: …………….. Type of Risk Description of Risk Probability Impact Risk reduction strategy Contingency plans Risk owner H M L Perf. Cost Time Based on A. Lester, ibid. Other categories could be added i.e. trigger, (which would be synonymous to input in a process diagram) or proximity indicating which phase the risk is likely to occur.

11. Solar heating exercise Please work in pairs You are the owner of a semi-detached house (your partner in the exercise owns the adjacent property) You decide to replace part of the roof with solar panels to save on your hot water heating bill. Identify the risks involved in this project, and ways in which you could manage each of these risks. I hope to display some of your ideas for the class to discuss, after 10 minutes.

12. Risk Management Then develop a management plan on wall, ie risk, actions, owner, status

13. Visible models Risk … Actions Owner Status Insufficient number of skilled object-oriented developers; thus slow development and poor design Proactive Hire temporary consultants Design and program in pairs Classroom education and mentoring The key concept is to keep the models such as the risk register (here it is the risk list with associated actions and status) as visible as possible, using whiteboards on the wall of the project room, and then transfer via digital camera to a Wiki web-page (project web-page).

14. Personal view Shared responsibility for risk i.e. the team are responsible for risk reporting (as well as joint planning, estimating, reporting progress and sharing the rewards). Where possible teams of two are not only involved in co-development (pair programming) but also keeping track of each others progress in a supportive manner as well as tracking risks specific to their tasks as well as the risks they have volunteered to own. (In addition effort is sometimes placed on identification of risks which are then not adequately tracked and managed. Another area that is important is that risk often cannot easily be quantified, they often have a profile, hence Monte Carlo software simulations are important for understanding and interpreting risks.)

15. Environment • Continuous integration • Project Wiki webs • Reverse engineering- Somatik • Caves, walls, digital technology

16. Risk Concept Map for Euro changeover project Planned branch opening times may be impacted Bank customer dissatisfaction R1 R2 Demand will be unusually high Banks could run out of cash in certain areas Risk of litigation Replacement may be a problem Risk of mis-dispense if notes not robust Changeover is in a holiday period On premise storage R2 Risk number related to register Risk situation Impact Risk driver Assumption Potential for help desk call surge Potential widespread ATM downtime Based on a NCR project, Euro changeover project for automated teller machines, John Barlett, Managing Risk for Projects and Programmes, Project Manager Today, 2002

17. Case Study- Data Intelligence From: ‘Harnessing data intelligence for future growth, (Case Study Royal Bank of Scotland Group) Information Management guide Martin Courtney, Computing 22 January 2009 • ‘Alongside monitoring the vast amounts of e-mail…the RBS Group records and stores other types of unstructured content including digital voice calls made in its dealing rooms, for regulatory purposes.’ • Apart from the need to guard against fraud, there is a need to ‘store information for compliance, litigation and e-discovery requirements’. • “It is about the quality of information capture – whether customer details or financial transactions – as a function of risk control and risk management,” David Kemp RBS legal department.