Risk Management Activities
Risk management consists of three main activities, as shown in fig:
Risk Assessment
The objective of risk assessment is to division the risks in the condition of their loss, causing potential. For risk assessment, first, every risk should be rated in two methods:
- The possibility of a risk coming true (denoted as r).
- The consequence of the issues relates to that risk (denoted as s).
Based on these two methods, the priority of each risk can be estimated:
          p = r * s
Where p is the priority with which the risk must be controlled, r is the probability of the risk becoming true, and s is the severity of loss caused due to the risk becoming true. If all identified risks are set up, then the most likely and damaging risks can be controlled first, and more comprehensive risk abatement methods can be designed for these risks.
1. Risk Identification: The project organizer needs to anticipate the risk in the project as early as possible so that the impact of risk can be reduced by making effective risk management planning.
A project can be of use by a large variety of risk. To identify the significant risk, this might affect a project. It is necessary to categories into the different risk of classes.
There are different types of risks which can affect a software project:
- Technology risks: Risks that assume from the software or hardware technologies that are used to develop the system.
- People risks: Risks that are connected with the person in the development team.
- Organizational risks: Risks that assume from the organizational environment where the software is being developed.
- Tools risks: Risks that assume from the software tools and other support software used to create the system.
- Requirement risks: Risks that assume from the changes to the customer requirement and the process of managing the requirements change.
- Estimation risks: Risks that assume from the management estimates of the resources required to build the system
2. Risk Analysis: During the risk analysis process, you have to consider every identified risk and make a perception of the probability and seriousness of that risk.
There is no simple way to do this. You have to rely on your perception and experience of previous projects and the problems that arise in them.
It is not possible to make an exact, the numerical estimate of the probability and seriousness of each risk. Instead, you should authorize the risk to one of several bands:
- The probability of the risk might be determined as very low (0-10%), low (10-25%), moderate (25-50%), high (50-75%) or very high (+75%).
- The effect of the risk might be determined as catastrophic (threaten the survival of the plan), serious (would cause significant delays), tolerable (delays are within allowed contingency), or insignificant.
Risk Control
It is the process of managing risks to achieve desired outcomes. After all, the identified risks of a plan are determined; the project must be made to include the most harmful and the most likely risks. Different risks need different containment methods. In fact, most risks need ingenuity on the part of the project manager in tackling the risk.
There are three main methods to plan for risk management:
- Avoid the risk: This may take several ways such as discussing with the client to change the requirements to decrease the scope of the work, giving incentives to the engineers to avoid the risk of human resources turnover, etc.
- Transfer the risk: This method involves getting the risky element developed by a third party, buying insurance cover, etc.
- Risk reduction: This means planning method to include the loss due to risk. For instance, if there is a risk that some key personnel might leave, new recruitment can be planned.
Risk Leverage: To choose between the various methods of handling risk, the project plan must consider the amount of controlling the risk and the corresponding reduction of risk. For this, the risk leverage of the various risks can be estimated.
Risk leverage is the variation in risk exposure divided by the amount of reducing the risk.
Risk leverage = (risk exposure before reduction – risk exposure after reduction) / (cost of reduction)
1. Risk planning: The risk planning method considers each of the key risks that have been identified and develop ways to maintain these risks.
For each of the risks, you have to think of the behavior that you may take to minimize the disruption to the plan if the issue identified in the risk occurs.
You also should think about data that you might need to collect while monitoring the plan so that issues can be anticipated.
Again, there is no easy process that can be followed for contingency planning. It rely on the judgment and experience of the project manager.
2. Risk Monitoring: Risk monitoring is the method king that your assumption about the product, process, and business risks has not changed.