1

Risk Management

Mark E. Sampson

EMIS 8340

Systems Engineering Tool—applying tools to engineering systems

2

What is Risk?

• A Risk is the probability of an unwanted consequence of an event or decision

• It deals with failing to meet an expectation. Opportunities are an opening to exceed expectations.

• Once a risk happens, it becomes a problem.

Typical risk management follows a cycle…

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk

3

Identify Risks

• Consider how achieving customer expectations could be effected by…• Choices• Assumptions being made • Current capabilities (not intentions)• Organizational/Cultural factors

• Sources of risk…• Political—customers, competition, regulatory,

suppliers, inter-organization,…• Financial—company, customer, end-user,…• Technical—quality, performance, production,…

• Causes of risk…• Control—no authority or process• Resources—• Time—• Information—

Tools…Survey tools for extracting risks from experts, lessons learned from last time around, WBS, TPM, models, news channels…

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk

Search & Rescue Operation Leads to Apartment…

An Oregon man discovered earlier this month that his year-old Toshiba flat-screen TV was emitting an international distress signal (121.5 mhz) picked up by a satellite, leading a search and rescue operation to his apartment in Corvallis, Oregon, 70 miles south of Portland. Oct. 18, 2004 CNN

4

Characterize Risks

• Causes—what is triggering this risk• Impact—what would the effect be? Costs? Schedule? • Probability—how likely is it to happen?• Choices—what are the options to deal with it?• Time Frame—how long is the window of opportunity• Coupling—does it effect other risks?Tools…Impact Models, PERT Charts, Risk Coupling, Interrelationship

Diagrams, Impact Distribution, Decision Trees,…

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk

Root Cause

Louisiana's power grid was upgraded following Hurricane Mitch to "Hurricane Proof" the system. Since the new stiffer power poles were built in the same right-of-way, the new system was knocked out in the next hurricane by the old power poles tipping over on the new poles.

5

Prioritize Risks

• Which risk is most likely to cause harm?• Which risks have the greatest impact?• Which risks need immediate attention?

Tools…Isorisk charts, Risk Coupling, Gantt Charts, Root Cause Analysis…

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk

6

Avert Risks

• Mitigate—act proactively to reduce the risks probability and/or impact

• Avoid—choose a different course of action• Transfer—get someone else to take the risk• Accept—contingency plan ready in case it happens

• Contingency planning—comparing risk reduction approaches…• Risk Exposure (RE) = Probability x Impact• Risk Leverage (value) = RE(current)-RE(after)/cost of averting

Tools…Isorisk charts, Risk Leveraging,

Lessons Learned,…

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk

E-ZPass toll transponders contain a battery which eventually wears out, so every few years they send you a new pass and tell you return the old one. They provide a conductive bag that prevents the pass from responding, but a certain number of people don't bother to put the pass in the bag and it gets read on the way to the service center. http://catless.ncl.ac.uk/Risks

7

Track/Control Risks

• Risk exposure changes over time…• Have customer expectations changed?• Has the situation changed?• Are there new risks? • …things getting better or worse?• Have aversion efforts been effective?

Tools…Risk Watch Lists…RiskTrack, @risk, Excel, ARM,…

“You need to actively attack risks, they WILL actively attack you”

[SE Handbook 6] [Charrette 1994]

1) ID Risk

2) CharacterizeRisk

3) PrioritizeRisk

4) Avert Risk

5) Control/Track Risk