130-29

8/3/2019 130-29

1/25

Paper 130-29

Risk Management for Software ProjectsTom DeMarco, The Atlantic Systems Guild, Camden, ME

ABSTRACT

Risk management is project management for adults. It guides project managers to focus specifically on what can gowrong, instead the more usual "if everything goes as planned" approach. The benefits of risk management include these:

it enables aggressive risk-taking

it protects management from being blind-sided

it provides minimum cost downside protection

In this keynote, Tom DeMarco lays out the basics of a risk-focused strategy and provides clear guidelines for itsimplementation.

SUGI 29 Planning, Development and Support

8/3/2019 130-29

2/25

Copyright 2004 by Tom DeMarco: The Atlantic Systems Guild

Risk Managementfor Software

Projects

SUGI2004: Montreal, May 10, 2004

SUGI29

Plann

ing,DevelopmentandSupport

2

8/3/2019 130-29

3/25

RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .RISK MANAGEMENT . . .nothing but the beef:

three reasons why you bother

one key tool

use of monte-carlo simulation

one metric to track (late) risk manifestation

a useful pattern from the past

a scary but wonderful observationthe did-we-really-do-it? test

SUGI29

Plann


3

8/3/2019 130-29

4/25

Youre blind-sided by a risk thats happened athousand times before.

You have no infrastructure in place to dealwith a risk when it materializes.

You dont have a useful (early) transitionindicator.

RISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIES

SUGI29

Plann


4

8/3/2019 130-29

5/25

DENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORTDENVER INTERNATIONAL AIRPORT

The automated baggage handling system:

SUGI29

Plann


5

8/3/2019 130-29

6/25

D.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATHD.I.A. PROJECT: CRITICAL PATH

Baggage Handling Software..

Integration testing.Acceptance & signoff

Airport opening

1993 1994 1995

SUGI29

Plann


6

8/3/2019 130-29

7/25

Youre blind-sided by a risk thats happened a

thousand times before.

You have no infrastructure in place to dealwith a risk when it materializes.

You dont have a useful (early) transitionindicator.

RISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIESRISK MANAGEMENT ATROCITIES

SUGI29

Plann


7

8/3/2019 130-29

8/25

SUGI29

Plann


8

8/3/2019 130-29

9/25

1. You have zero chance ofdelivering before January ofnext year.

2. My best guess is youll bedone around April 1st . . .

3. but to be at least 50% sure,

youd better advertise a dateof May 1 or later.

4. To be 100% safe, youd have toallow for delivery as late as

end of next year.

SUGI29

Plann

ing,Developmenta

ndSupport

9

8/3/2019 130-29

10/25

RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:RISK DIAGRAM:

A risk diagram shows explicitly how uncertain we are aboutdelivery date (or anything else).

SUGI29

Plann

ing,Developmenta

ndSupport

10

8/3/2019 130-29

11/25

SUGI29

Plann

ing,Developmenta

ndSupport

11

8/3/2019 130-29

12/25

SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:

Effort

Size in (for example) Function Points

20,000 FP

52 person months

SUGI29

Plann

ing,Developmenta

ndSupport

12

8/3/2019 130-29

13/25

40 52 70

Effort

(Person Months)

SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:SENSIBLE RISK MANAGEMENT:

Delivery Date

6/2000 11/2000

9/2000

The project will take this much time.

SUGI29

Plann

ing,Developmenta

ndSupport

13

8/3/2019 130-29

14/25

RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:RISK DIAGRAMS IN USE:

RiskModelingProcessSources of

UncertaintyResultant

Uncertainty

Delivery Date

Size Inflation

ProductivityVariation

etc.

Flaw in sizeestimate

SUGI29

Plann

ing,Developmenta

ndSupport

14

8/3/2019 130-29

15/25

Alpha Platform: Project Simulation (500 Runs)

0

1 0

2 0

3 0

4 0

5 0

6 0

7 0

8 0

9 0

1 0 0

21-FEB-04

3-JUN-04

15-SEP-04

27-DEC-04

9-APR-05

21-JUL-05

3-NOV-05

15-FEB-06

27-MAY-06

9-SEP-06

CANCELLED

Completion Date

Numbe

r

ofInstancesin

Range

SUGI29

Planning,Developmenta

ndSupport

15

8/3/2019 130-29

16/25

SUGI29


ndSupport

16

S

8/3/2019 130-29

17/25

Alp ha Platf or m Pr ojectEar ned Valu e Dem onstr ated b y Ver sion s Run ni ng

-

2.00

4.00

6.00

8.00

10.00

12.00

14.00

16.00

18.00

Jun -01 Dec-01 Jun -02 Dec-02 Jun -03 Dec-03 Jun -04 Dec-04

Calendar Date

EnVuR

nnMio

Expected Version Acceptance

Date

Actual Version Acceptance

Date

September 22, 200 3

SUGI29


ndSupport

17

S

8/3/2019 130-29

18/25

SUGI29


ndSupport

18

S

8/3/2019 130-29

19/25

SUGI29


ndSupport

19

S

8/3/2019 130-29

20/25

SUGI29


ndSupport

20

S

8/3/2019 130-29

21/25

SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:SCARY BUT WONDERFUL OBSERVATION:

The real reason we need to do risk

management is not to avoid risks,but to enable aggressive risk-taking.

UGI29


ndSupport

21

SU

8/3/2019 130-29

22/25

THE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSTHE FIVE CORE RISKSThe following five risks are common to all high-

tech projects:

Size inflation

Original estimate flaw

Personnel turnoverFailure to concur (breakdown among theinterested parties)

Productivity variation

UGI29


ndSupport

22

SU

8/3/2019 130-29

23/25

1. Is there a census of risks with at least 10-20 risks on it?

2. Is each risk quantified as to probability and cost and

schedule impact?

3. Is there at least one early transition indicator associatedwith each risk?

THE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TESTMANAGEMENT TEST

(in six parts):

UGI29


ndSupport

23

SU

8/3/2019 130-29

24/25

THE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKTHE ARE WE REALLY DOING RISKMANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)MANAGEMENT TEST (CONTINUED)

4. Does the census include the core risks indicated bypast industry experience?

5. Are risk diagrams used widely to specify both thecausal risks as well as the net result (schedule andcost) risks?

6. Is the scheduled delivery date significantly different

from the best-case scenario?

UGI29

Planning,DevelopmentandSupport

24

SU

8/3/2019 130-29

25/25

UGI29

Planni

ng,DevelopmentandSupport

25

130-29

Documents

Transcript of 130-29