Fall 2009 David Harris

MGMT631 IS Project ManagementMGMT631 IS Project Management

Slides Five

Fall 2009 2

Session ObjectivesSession Objectives

Projects result in change BPR

And projects themselves are subject to rampant change especially IT projects

Hence Change Control And Projects are inherently risk-prone Hence Risk Management

Fall 2009 3

Change ResistanceChange Resistance

Tradition & culture resist changeTradition & culture resist change only 16 % Prometheanonly 16 % Promethean If it ainIf it ain’’t broke, dont broke, don’’t fix itt fix it

But in revolutionary times, traditionalists But in revolutionary times, traditionalists crushed beneath tidal wave of changecrushed beneath tidal wave of change

Innovation often comes from outsideInnovation often comes from outside

Fall 2009 4

Developing Pro-Change MindsetDeveloping Pro-Change Mindset

ThroughThrough education & training education & training Upside-down thinkingUpside-down thinking

thrive in turbulent timesthrive in turbulent times

Think multiple customers & stakeholdersThink multiple customers & stakeholders not just one or a fewnot just one or a few

Use crises to change traditional attitudesUse crises to change traditional attitudes focus on new ways to do thingsfocus on new ways to do things

And inside projectsAnd inside projects

Fall 2009 6

Embracing & Managing ChangeEmbracing & Managing Change

Change will happenChange will happen Are we prepared to deal with it?Are we prepared to deal with it?

blurred visionsblurred visions rubber baselinesrubber baselines fluctuating prioritiesfluctuating priorities

All contribute to:All contribute to: Scope creepScope creep schedule slippagesschedule slippages cost overrunscost overruns customer dissatisfactioncustomer dissatisfaction

Fall 2009 7

Embracing & Managing Change Embracing & Managing Change (Cont.)(Cont.)

As project managers, team membersAs project managers, team members We must learn how/when to We must learn how/when to ““Go with the flowGo with the flow”” And when to resist changeAnd when to resist change

In other words we must pro-actively In other words we must pro-actively Manage ChangeManage Change

Fall 2009 8

Sources of ChangeSources of Change

CChanging players hanging players Folks change their mindsFolks change their minds Budget instabilityBudget instability Technology keeps changingTechnology keeps changing Changing competitive environmentChanging competitive environment The economyThe economy

The longer the project timeframe the The longer the project timeframe the more likely change will happenmore likely change will happen

Fall 2009 9

Configuration Management (CM)Configuration Management (CM)

Resist change via bureaucracyResist change via bureaucracy Change control via CMChange control via CM

Rigorously screen changesRigorously screen changes formal process for assessing meritformal process for assessing merit major or minor impact?major or minor impact? if major, goes to Change Control Board if major, goes to Change Control Board

(CCB)(CCB) document changesdocument changes update baselineupdate baseline

Change Control ProcessChange Control ProcessWritten change proposal

CCB Review

Rework proposal

proposal designed, documented,

implementation schedule

CCB reviews

Proposal implemented

Rework proposal

stop

Written change proposal

stop

Rework

Rejected

Rework

RejectedAccepted in product

Accepted for impact study

Fall 2009 11

Change Management (Harris)Change Management (Harris) Accept all written change proposals Project team assesses impact

cost, staff, schedule Change team* reviews

value, importance (politically weighted) triage add to scope, phase II, phase III

* Key stakeholders, project manager

Fall 2009 12

Changes: Key QuestionsChanges: Key Questions

For any/every change: There is a price to be paidThere is a price to be paid Do stakeholders understand the Do stakeholders understand the

price?price? Are they willing to pay the price?Are they willing to pay the price?

Fall 2009 13

Scope CreepScope Creep

Scope Creep: frequently used term Scope Creep: frequently used term in PMin PM

Minor refinements eventually build Minor refinements eventually build into major scope changesinto major scope changes

Creep: anything beyond original Creep: anything beyond original project scope project scope

Creep common especially in early Creep common especially in early phases of projectphases of project

Fall 2009 14

Scope Change ControlScope Change Control

ConcernsConcerns Scope gropeScope grope

Inability of project team to define scopeInability of project team to define scope Scope creepScope creep

““Increasing featurism”Increasing featurism” Scope leapScope leap

Major changes in scopeMajor changes in scope

Fall 2009 15

MythsMyths of Scope Management of Scope Management

User involvement will result in an IS User involvement will result in an IS project grounded in the realities of project grounded in the realities of business needsbusiness needs

A scope statement will clearly define A scope statement will clearly define what a project will dowhat a project will do

Once the scope of the project is Once the scope of the project is defined, hold firm because any defined, hold firm because any deviation from the original plan is a deviation from the original plan is a sign that the project is out of controlsign that the project is out of control

Fall 2009 16

MythsMyths (Cont.)(Cont.)

Function of a scope change committee Function of a scope change committee is to arbitrate user requests for is to arbitrate user requests for additional features or functionality additional features or functionality beyond the original project charterbeyond the original project charter

Regular & frequent meetings with senior Regular & frequent meetings with senior management will ensure they are kept management will ensure they are kept up to date & will result in goodwill and up to date & will result in goodwill and supportsupport

You can always make up schedules & You can always make up schedules & budgets later on if they slip a little bitbudgets later on if they slip a little bit

Scope Change Request FormScope Change Request Form

Fall 2009 18

Risk – Risk – RiskRisk – Risk – Risk

Life is full of uncertainty, i.e. Risk Projects are inherently & especially

risk prone Insurance companies are risk

managers Re projects: Murphy was an optimist

if it can go wrong, it willif it can go wrong, it will

Fall 2009 19

RiskRisk

As project managers: We must apply systematic risk We must apply systematic risk

management techniques throughout management techniques throughout projectproject

They are part of our toolkit (PMBOK)They are part of our toolkit (PMBOK)

Fall 2009 20

Risk ManagementRisk Management

Software Engineering Institute (SEI) perspective: URLs 

http://www.sei.cmu.edu/risk/overview.htmlhttp://www.sei.cmu.edu/risk/paradigm.htmlhttp://www.sei.cmu.edu/risk/principles.html

Risk management must be continuous thru life of project

Risk & opportunity go hand in hand

Project Management Maturity by Project Management Maturity by Industry Group and Knowledge AreaIndustry Group and Knowledge Area

Fall 2009 22

SEI on RiskSEI on Risk

""Risk in itself is not bad; risk is Risk in itself is not bad; risk is essential to progress, and failure is essential to progress, and failure is often a key part of learning. But we often a key part of learning. But we must learn to balance the possible must learn to balance the possible

negative consequences of risk negative consequences of risk against the potential benefits of its against the potential benefits of its

associated opportunity."associated opportunity."

Fall 2009 23

SEI: What is Risk Management?SEI: What is Risk Management?

A practice with processes, methods A practice with processes, methods & tools for managing risk in & tools for managing risk in projects, providing a disciplined projects, providing a disciplined environment for pro-active decision environment for pro-active decision making:making: continuously assess what could go continuously assess what could go

wrongwrong determine which risks are most determine which risks are most

importantimportant implement strategies to deal with implement strategies to deal with

these risksthese risks

SEI’s Risk Management ParadigmSEI’s Risk Management Paradigm

Fall 2009 25

Sources of Project RiskSources of Project Risk

environmental (largely uncontrollable) external, e.g. government regulations internal, e.g. new division VP

technical market financial people

Fall 2009 26

Sources of Project Risk (cont.)Sources of Project Risk (cont.)

What goes wrong with projects in your environment?

Standish top five success factors user involvement, management support,

requirements agreed/understood, planning, realistic expectations

Verzuh top five agreed goals, planning, communication,

controlled scope, management support

Fall 2009 27

Verzuh on Risk ManagementVerzuh on Risk Management

Selecting right project is business risk Managing uncertainty is project risk Identifying risks – involve stakeholders Risk Profiles: questionnaire addressing

expected project risk areas Guidelines:Guidelines: industry & organization specificindustry & organization specific address both product & mgt risksaddress both product & mgt risks gauge magnitude of risk – high/medium/lowgauge magnitude of risk – high/medium/low

Verzuh on Risk ManagementVerzuh on Risk Management

Fall 2009 29

Verzuh: Dealing with RiskVerzuh: Dealing with Risk Make a decision:Make a decision: AcceptAccept

understanding risks, consequences, probabilities, understanding risks, consequences, probabilities, react if happensreact if happens

AvoidAvoid change scope to avoid, accept “low risk– low change scope to avoid, accept “low risk– low

return”return” Monitor & have contingency plans readyMonitor & have contingency plans ready

e.g. at DIA have lower tech alternative for baggagee.g. at DIA have lower tech alternative for baggage TransferTransfer

contract, outsource, insure (but remember win—win)contract, outsource, insure (but remember win—win) MitigateMitigate

work hard to reduce riskwork hard to reduce risk

Fall 2009 30

Project RiskProject Risk Project Risk has two components:

The probability (or likelihood) of failing to achieve a particular outcome

The consequence (or impact) of failing to achieve that outcome

Risk = function (probability, consequence)Risk = function (probability, consequence)

Risk Management & ProbabilityRisk Management & Probability

Probability x Impact of Risk (consequence)Probability x Impact of Risk (consequence)

= Expected Value (Cost)= Expected Value (Cost)

Calculate expected cost of riskCalculate expected cost of riskDecision on $ to spend to reduce riskDecision on $ to spend to reduce risk

Verzuh

Qualitative Scoring of RiskQualitative Scoring of Risk

LowConsequence

MediumConsequence

HighConsequence

HighProbability

MediumRisk

HighRisk

HighRisk

MediumProbability

LowRisk

MediumRisk

HighRisk

LowProbability

LowRisk

LowRisk

MediumRisk

The Risk Scoring Matrix

Probability & ConsequenceProbability & Consequence

Which illustration depicts the higher risk?

Consequence = Probability =

Risk =

High Low

Consequence = Probability =

Risk =

Low Medium

Medium Low

Probability or consequence of a risk condition is not, by itself, a good measure of risk

Fall 2009 34

Top 10 Risk Item TrackingTop 10 Risk Item Tracking

Tool for maintaining awareness of Tool for maintaining awareness of risk throughout life of a projectrisk throughout life of a project

Establish periodic review of the 10 Establish periodic review of the 10 project risk itemsproject risk items

List current/previous ranking, List current/previous ranking, number of times the risk appears on number of times the risk appears on list over time, summary of progress list over time, summary of progress made in resolving each risk itemmade in resolving each risk item

35Fall 2009

Top 10 Risk Item Tracking ExampleTop 10 Risk Item Tracking ExampleMonthly Ranking

Risk Item This

Month

Last

Month

Numberof Months

Risk ResolutionProgress

Inadequateplanning

1 2 4 Working on revising theentire project plan

Poor definitionof scope

2 3 3 Holding meetings withproject customer andsponsor to clarify scope

Absence ofleadership

3 1 2 Just assigned a newproject manager to leadthe project after old onequit

Poor costestimates

4 4 3 Revising cost estimates

Poor timeestimates

5 5 3 Revising scheduleestimates

Fall 2009 36

Expert JudgmentExpert Judgment

Many organizations rely on the Many organizations rely on the intuitive feelings & past experience intuitive feelings & past experience of experts to help identify potential of experts to help identify potential project risksproject risks

Experts can categorize risks as high, Experts can categorize risks as high, medium, or low with or without more medium, or low with or without more sophisticated techniquessophisticated techniques

Fall 2009 37

FMEA: a risk assessment tool FMEA: a risk assessment tool Failure modes & effects analysisFailure modes & effects analysis methodology for analyzing potential methodology for analyzing potential

reliability problems during developmentreliability problems during development Performed by cross functional teamPerformed by cross functional team Can greatly reduce impact of failuresCan greatly reduce impact of failures

by systematically identifying, analyzing & by systematically identifying, analyzing & developing corrective action plansdeveloping corrective action plans

Can be used multiple times thru projectCan be used multiple times thru project Systematic approach: 10 stepsSystematic approach: 10 steps

FEMA: 10 StepsFEMA: 10 Steps

Describe anticipated Describe anticipated failure modefailure mode

Describe effect of failureDescribe effect of failure Describe causes of Describe causes of

failurefailure Estimate severity of Estimate severity of

failurefailure Estimate probability of Estimate probability of

occurrenceoccurrence

List current controlsList current controls Estimate detectability of Estimate detectability of

failurefailure Calculate risk priority Calculate risk priority

number (RPN)number (RPN) Recommend corrective Recommend corrective

actionaction Recalculate “predicted” Recalculate “predicted”

RPNRPN

Dilbert on Risk ManagementDilbert on Risk Management

FACT: If project manager doesn’t see risk management as part of job, then risk management process will not be effective in reducing program risk.

Fall 2009 40

Identifying IT Project RisksIdentifying IT Project Risks

BrainstormingBrainstormingSWOT AnalysisSWOT AnalysisCause and Effect DiagramsCause and Effect DiagramsPast ProjectsPast Projects

Fall 2009 41

SWOT AnalysisSWOT Analysis

Fall 2009 42

Cause and Effect DiagramCause and Effect Diagram

Identify the risk in terms of a threat or Identify the risk in terms of a threat or opportunityopportunity

Identify the main factors that can cause Identify the main factors that can cause the risk to occurthe risk to occur

Identify detailed factors for each of the Identify detailed factors for each of the main factorsmain factors

Continue refining the diagram until Continue refining the diagram until satisfied that the diagram is completesatisfied that the diagram is complete

Cause and Effect DiagramCause and Effect Diagram

Fall 2009 44

Normal DistributionNormal Distribution

Fall 2009 45

PERT DistributionPERT Distribution

Fall 2009 46

PERT DistributionPERT Distribution

PERT distribution uses a three-point PERT distribution uses a three-point estimate where: estimate where: a denotes an optimistic estimate a denotes an optimistic estimate b denotes a most likely estimate b denotes a most likely estimate c denotes a pessimistic estimate c denotes a pessimistic estimate

PERT Mean = (a + 4m + b) / 6PERT Mean = (a + 4m + b) / 6 PERT Standard Deviation = (b - a) / 6PERT Standard Deviation = (b - a) / 6

Fall 2009 47

SimulationsSimulationsMonte Carlo

a technique that randomly generates specific values for a variable with a specific probability distribution.

goes through a specific number of iterations or trials and records the outcome.

Risk Management ToolsRisk Management Tools

@RISK, risk analysis and simulation add-in for MS Project http://www.palisade.com/

Risk Radar®, MS Access-based project risk analysis and tracking softwarehttp://www.iceincusa.com/products_tools.htm

Risk Simulation Using @Risk for Risk Simulation Using @Risk for Microsoft ProjectMicrosoft Project

Output from Monte Carlo SimulationOutput from Monte Carlo Simulation

Cumulative Probability DistributionCumulative Probability Distribution

Sample Monte Carlo Simulation Sample Monte Carlo Simulation Results for Project ScheduleResults for Project Schedule

Risk Response Plan should include:Risk Response Plan should include: The project risk The trigger which flags that the risk has occurred The owner of the risk (i.e., the person or group

responsible for monitoring the risk and ensuring that the appropriate risk response is carried out)

The risk response based on one of the four basic risk strategies

Fall 2009 54

Results of Good Project Risk ManagementResults of Good Project Risk Management

Unlike Unlike crisiscrisis management, good management, good project risk management often goes project risk management often goes unnoticedunnoticed

Well-run projects appear almost Well-run projects appear almost effortless, but a lot of work goes into effortless, but a lot of work goes into running a project wellrunning a project well

Project managers should strive to Project managers should strive to make their jobs look easy to reflect make their jobs look easy to reflect the results of well-run projectsthe results of well-run projects

Fall 2009 55

Results (continued)Results (continued)

Inherently high risk businesses use risk analysis, mitigation & avoidance tactics Projects finish earlier, cost less as most

problems discovered & avoided/handled earlier at lower cost

Projects typically spend 1 - 2% of contract cost with a 20:1 cost avoidance/savings on investment

Fall 2009 56

““Waltzing with Bears”Waltzing with Bears”

Practical & readable text on “Managing Risk on Software Projects”

Paperback By Tom Demarco & Timothy Lister Dorset House, 2003, ISBN 0-932633-60-9