Risk Management for Risk Management for Software ProjectsSoftware Projects

Risk Management for Risk Management for Software ProjectsSoftware Projects

The curve that is the life of your project…

Life of the Project

0

50

100

150

200

1 2 3 4 5 6 7 8 9 10

Time

Co

st

of

a c

han

ge

Cost

Session Objectives• Make sure risk identification leads

to real action• Ensure that teams are constantly

and proactively identifying and mitigating risks

• Shift team culture so risk identification occurs as “Good News”

Most risk discussions do not cause any

action• Two typical ways to talk about risk:

– … they don’t– Mention of risk is heard as a fear or

complaint

• Most risk lists are “storage”– They do not result in action– Presented in project review slides that are

referred back to after the project has failed.

A shift in paradigm and language is required to ensure that risk identification leads to action.

What you know has nothing to do with what

you do..• Teams must have foundation

conversations for integrity and commitment:– Integrity: do what you say.– Commitment: standing for the

integrity of a decision and giving up the right to complaint.

Higher standard for commitment leads to the

revelation of risks.• Concern about dependencies gets

voiced early.• Saying “no” becomes

constructive.• Less wondering if they “really

meant the date”

Projects fail because teams do not have a constructive way to

discuss risk

Culture is a network of conversations: what comes out of your mouth and how you listen.

What is a complaint?• A few things to ask yourself..

– Am I talking to someone who can’t do anything about the issue?

– Am I speaking to be “right” about the issue (human beings love to being right)?

• Use language that “forwards the action”.

Cause, Effect, Impact (CEI)

• Cause: Specific, existing condition; a “fact”• Effect: Possible, specific bad outcome• Impact: Measurable effect on the business.

• Complaint: The database will never work• CEI: Lack of a frozen schema, may lead to

late rework, which will slip the schedule.

A Context for discussion risk

• Pretend you’re looking back and asking, “Why did the project fail?”

• The only reason to “discuss” risk is to cause mitigation.

• Probability of failure is the meaningful differentiator and useful heuristic.

Risk Action Plan• Name (Unique Identifier)• Cause (Specific Concern)• Effect (What will fail?)• Impact (Why does this impact the business?)• Owner (Who will own the status of the risk?)• Prioritization (Sort field)• Mitigation plan (At least 5 alternatives)• Critical mitigation milestone (by when must this risk be

mitigated).• Description of Next Attack (with accountable individual)

communicate status.• Date of next attack.

How to prioritize risk• The only goal of prioritization is to determine which

risks will be acted on first.• Past results are the best predicator of future results.

– Super High: Never accomplished in a similar project anywhere.

– High: Successfully mitigated occasionally.– Medium: Successfully mitigated often elsewhere or

occasionally here.– Low: Core competency here.

• When in doubt or impact is huge, then promote priority.

Microsoft Excel Worksheet

How to mitigate?• Get into cross-functional action immediately.• Mitigations take time and resources: they

must appear on your schedule.• The teams should constantly ask “What are

we doing today to mitigate our highest risk?”• Prototype and test from day one.• Contingency Vs Backup plans

– Contingency plans are developed up front, and are executed when Plan A fails.

– Back up plans are executed in parallel with Plan A.

Weekly accountability meeting

• Part 1: Acknowledge accomplishments for the week. What is your percent complete

• Part 2: Any changes to weekly deliverables for next 3 weeks?

• Part 3: Review mitigation of top 3 risks.• Part 4: What are the two most likely

reasons, the project might fail from your perspective, now.

Critical Points• Make conversations on why the project

could fail MANDATORY and frequent.• Use Cause, Effect, Impact language and

require specificity.• Have clear, accountable, empowered,

singular ownership of risks.• Keep your sense of humor.