What is risk management?
Risk management is the active identification, recording, and management of potential risks in a project. The Software Program Managers Network has identified risk management as one of the most critical software practices. Risk management should be practiced through out the project. Project sponsors should appoint a risk manager for the project and establish risk reporting procedures. All members of the project should participate in identifying risks. The risk manager should assign and track tasks to reduce potential damage from risks.
Managing risk
An organization can choose to handle a risk in one of four ways:
1. Transfer the risk
2. Reject the risk
3. Reduce the risk
4. Accept the risk.
Transferring risk means contracting with another organization to accept the risk. For example, on a project, the project can contract with another organization to perform tasks at a fixed price, thereby transferring the risk of a cost overrun (or at least partially transferring the risk).
Rejecting the risk means denying that it is actually a risk. Without solid grounds for denying the risk, this approach can be dangerous.
Reducing the risk involves implementing countermeasures. For example, a project can institute a formal change request process to insure that increases in requirements do not produce unexpected cost overruns.
Accepting the risk involves understanding the level of risk and deciding to live with it. For example, a project may maintain a contingency budget. The project acknowledges the risk of cost overruns and chooses to accept this risk.
Risk management sheds light on these choices and the helps insure that the mitigation steps are taken.
Why is risk management important?
Software projects are usually very risky. The Standish Group, in its Chaos surveys, suggests that approximately a quarter of all software projects fail to deliver any useful software and that another fifty percent have substantial cost or schedule overruns. Software projects, particularly large ones, are risky investments.
In many cases, project participants are reluctant to discuss project risks. Project participants are often aware of risks, but are sometimes inclined to ignore these risks. Some project participants may feel that openly discussing project risks may cause senior management to reduce funding or cancel projects.
Such behavior is short sighted. With projects, the greatest latitude in taking corrective action is at the beginning of projects. Usually risks manifest themselves later in the project, particularly if proper monitoring is not in place. Moreover, project sponsors and senior managers dislike unpleasant surprises, resulting in a lack of trust in the project team. It is far better to openly discuss and take action to mitigate project risks.
RiskBench™
RiskBench is a Microsoft OneNote notebook used to manage project risks. The template for RiskBench can be downloaded here. This Web page contains instructions for installing the template.
RiskBench is divided into several sections. The first section captures basic information about the project, including naming the risk manager. The second section contains a set of pages describing active risks. Active risks are risks that are currently being managed. The third section contains a set of pages for closed risks. Closed risks are risks that no longer are considered serious enough to be managed. When active risks are closed, they can be moved to the closed risk section. The fourth section contains a user manual that describes how to fill in the risk template.
Risk information is entered in a page template, one page for each risk. The page template provides space for entering the description of the risk, data about the risk, contingency plans, mitigation plans, and events related to the risk.
Single pages can be printed, or all the pages in a section can be printed.