Post on 06-Apr-2018
8/3/2019 130-29
1/25
Paper 130-29
Risk Management for Software ProjectsTom DeMarco, The Atlantic Systems Guild, Camden, ME
ABSTRACT
Risk management is project management for adults. It guides project managers to focus specifically on what can gowrong, instead the more usual "if everything goes as planned" approach. The benefits of risk management include these:
it enables aggressive risk-taking
it protects management from being blind-sided
it provides minimum cost downside protection
In this keynote, Tom DeMarco lays out the basics of a risk-focused strategy and provides clear guidelines for itsimplementation.
SUGI 29 Planning, Development and Support
8/3/2019 130-29
2/25
Copyright 2004 by Tom DeMarco: The Atlantic Systems Guild
Risk Managementfor Software
Projects
SUGI2004: Montreal, May 10, 2004
SUGI29
Plann
ing,DevelopmentandSupport
2
8/3/2019 130-29
3/25
RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .nothing but the beef:
three reasons why you bother
one key tool
use of monte-carlo simulation
one metric to track (late) risk manifestation
a useful pattern from the past
a scary but wonderful observationthe did-we-really-do-it? test
SUGI29
Plann
ing,DevelopmentandSupport
3
8/3/2019 130-29
4/25
Youre blind-sided by a risk thats happened athousand times before.
You have no infrastructure in place to dealwith a risk when it materializes.
You dont have a useful (early) transitionindicator.
RISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIES
SUGI29
Plann
ing,DevelopmentandSupport
4
8/3/2019 130-29
5/25
DENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORT
The automated baggage handling system:
SUGI29
Plann
ing,DevelopmentandSupport
5
8/3/2019 130-29
6/25
D.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATH
Baggage Handling Software..
Integration testing.Acceptance & signoff
Airport opening
1993 1994 1995
SUGI29
Plann
ing,DevelopmentandSupport
6
8/3/2019 130-29
7/25
Youre blind-sided by a risk thats happened a
thousand times before.
You have no infrastructure in place to dealwith a risk when it materializes.
You dont have a useful (early) transitionindicator.
RISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIES
SUGI29
Plann
ing,DevelopmentandSupport
7
8/3/2019 130-29
8/25
SUGI29
Plann
ing,DevelopmentandSupport
8
8/3/2019 130-29
9/25
1. You have zero chance ofdelivering before January ofnext year.
2. My best guess is youll bedone around April 1st . . .
3. but to be at least 50% sure,
youd better advertise a dateof May 1 or later.
4. To be 100% safe, youd have toallow for delivery as late as
end of next year.
SUGI29
Plann
ing,Developmenta
ndSupport
9
8/3/2019 130-29
10/25
RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:
A risk diagram shows explicitly how uncertain we are aboutdelivery date (or anything else).
SUGI29
Plann
ing,Developmenta
ndSupport
10
8/3/2019 130-29
11/25
SUGI29
Plann
ing,Developmenta
ndSupport
11
8/3/2019 130-29
12/25
SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:
Effort
Size in (for example) Function Points
20,000 FP
52 person months
SUGI29
Plann
ing,Developmenta
ndSupport
12
8/3/2019 130-29
13/25
40 52 70
Effort
(Person Months)
SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:
Delivery Date
6/2000 11/2000
9/2000
The project will take this much time.
SUGI29
Plann
ing,Developmenta
ndSupport
13
8/3/2019 130-29
14/25
RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:
RiskModelingProcessSources of
UncertaintyResultant
Uncertainty
Delivery Date
Size Inflation
ProductivityVariation
etc.
Flaw in sizeestimate
SUGI29
Plann
ing,Developmenta
ndSupport
14
8/3/2019 130-29
15/25
Alpha Platform: Project Simulation (500 Runs)
0
1 0
2 0
3 0
4 0
5 0
6 0
7 0
8 0
9 0
1 0 0
21-FEB-04
3-JUN-04
15-SEP-04
27-DEC-04
9-APR-05
21-JUL-05
3-NOV-05
15-FEB-06
27-MAY-06
9-SEP-06
CANCELLED
Completion Date
Numbe
r
ofInstancesin
Range
SUGI29
Planning,Developmenta
ndSupport
15
8/3/2019 130-29
16/25
SUGI29
Planning,Developmenta
ndSupport
16
S
8/3/2019 130-29
17/25
Alp ha Platf or m Pr ojectEar ned Valu e Dem onstr ated b y Ver sion s Run ni ng
-
2.00
4.00
6.00
8.00
10.00
12.00
14.00
16.00
18.00
Jun -01 Dec-01 Jun -02 Dec-02 Jun -03 Dec-03 Jun -04 Dec-04
Calendar Date
EnVuR
nnMio
Expected Version Acceptance
Date
Actual Version Acceptance
Date
September 22, 200 3
SUGI29
Planning,Developmenta
ndSupport
17
S
8/3/2019 130-29
18/25
SUGI29
Planning,Developmenta
ndSupport
18
S
8/3/2019 130-29
19/25
SUGI29
Planning,Developmenta
ndSupport
19
S
8/3/2019 130-29
20/25
SUGI29
Planning,Developmenta
ndSupport
20
S
8/3/2019 130-29
21/25
SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:
The real reason we need to do risk
management is not to avoid risks,but to enable aggressive risk-taking.
UGI29
Planning,Developmenta
ndSupport
21
SU
8/3/2019 130-29
22/25
THE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSThe following five risks are common to all high-
tech projects:
Size inflation
Original estimate flaw
Personnel turnoverFailure to concur (breakdown among theinterested parties)
Productivity variation
UGI29
Planning,Developmenta
ndSupport
22
SU
8/3/2019 130-29
23/25
1. Is there a census of risks with at least 10-20 risks on it?
2. Is each risk quantified as to probability and cost and
schedule impact?
3. Is there at least one early transition indicator associatedwith each risk?
THE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TEST
(in six parts):
UGI29
Planning,Developmenta
ndSupport
23
SU
8/3/2019 130-29
24/25
THE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKMANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)
4. Does the census include the core risks indicated bypast industry experience?
5. Are risk diagrams used widely to specify both thecausal risks as well as the net result (schedule andcost) risks?
6. Is the scheduled delivery date significantly different
from the best-case scenario?
UGI29
Planning,DevelopmentandSupport
24
SU
8/3/2019 130-29
25/25
UGI29
Planni
ng,DevelopmentandSupport
25