Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about...

81
Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris Matts

Transcript of Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about...

Page 1: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Risk and Risk Management (Theory and Practice)

“It’s tough to make predictions, especially about the future.”Yogi Berra, Niels Bohr

Todd Little and Chris Matts

Page 2: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

A Game?

Page 3: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

A Game?

• Create a six sided random number generator dice like thingy. Everyone on the team needs to roll a double six.

Page 4: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

A Game?

• Create a four sided random number generator dice like thingy. Everyone on the team needs to roll a double six.

Page 5: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Exercise

What are the types of risk?

Page 6: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

How do “Risky Businesses” work

Page 7: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Financial Markets

A severe depression like that of 1920-21 is outside the range of probability.Harvard Economic Society, Weekly Letter, November 16, 1929.

Page 8: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

New Product Development

I think there is a world market for about five computers.Thomas J. Watson, chairman of IBM, 1943.

Page 9: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

War

They couldn't hit an elephant at this dist…General John B. Sedgwick, Union Army Civil War officer's last words, uttered during the Battle of Spotsylvania, 1864

Page 10: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

A right, but not an obligation to do something

Real Options

Page 11: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Medical World

Page 12: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Real Options

Value of Information

Value of Flexibility

Page 13: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Oil & Gas Exploration

Page 14: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.
Page 15: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Which Risks Are Important

Page 16: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Hurricane Rita

Page 17: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Getting Better

Page 18: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Movies

Page 19: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Business Risk Profiles

Page 20: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Books

Page 21: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Venture Capital

Page 22: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Categories of risk

Delivery Failure Business Case Failure

Collateral Damage

Page 23: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Delivery Challenges/Failures

Challenged46%

Failed19%Succesful

35%

Standish Group 2006, reported by CEO Jim Johnson, CIO.com, ‘How to Spot a Failing Project’

Page 24: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Business Case Failure

Page 25: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Collateral Damage

Page 26: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Wrong Priorities

Page 27: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Collateral DamageAn effective roll-back strategy

Page 28: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Delivery Failure results in Collateral Damage

Page 29: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.
Page 30: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

I’m beginning to think it wasn’t such a good idea to turn off those unit tests

Page 31: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Business Case Failure

Page 32: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Features and Functions

Never Used 45%

Rarely Used 19%

Sometimes 16%

Often 13%Always 7%

Always or Often Used: 20%

Never or Rarely Used: 64%

Standish Group Study, reported by CEO Jim Johnson, XP2002

Page 33: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Purpose Alignment Model

MarketDifferentiating

High

Low

Mission CriticalLow High

Differentiating

ParityWho Cares?

Partner

Purpose Does Not Equal PriorityPurpose Does Not Equal Priority

Page 34: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.
Page 35: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Considerations

RisksRisks AssumptionsAssumptions ConstraintsConstraints

Page 36: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Delivery Failure

Page 37: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Managing the Coming Storm Inside the Tornado

When will we get the requirements?All in good time, my little pretty, all in good timeBut I guess it doesn't matter anyway

Doesn't anybody believe me?

You're a very bad man!

Just give me your estimates by this afternoon

No, we need something today!

I already promised the customer it will be out in 6 months

No, we need it sooner.

Not so fast! Not so fast! ... I'll have to give the matter a little thought. Go away and come back tomorrow

Ok then, it will take 2 years.

Team Unity

Project Kickoff

Page 38: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

We’re not in Kansas Anymore

My! People come and go so quickly here!

I may not come out alive, but I'm goin' in there!

The Great and Powerful Oz has got matters well in hand.

"Hee hee hee ha ha! Going so soon? I wouldn't hear of it! Why, my little party's just beginning!

Developer HeroReorg

Testing

Page 39: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

IEEE Software, May/June 2006

Page 40: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Data from LGCInitial Estimate vs. Actual Project Duration (from LGC Portfolio Database)

y = 1.6886x

0

200

400

600

800

1000

1200

0 100 200 300 400 500 600 700 800 900 1000

Initial Estimate

Ac

tua

l

LGC Data

Ideal

Linear (LGC Data)

Page 41: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

CDF Distribution Curve (LGC)Landmark Graphics Cumulative Distribution of Portfolio Projects

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0.1 1 10

Ratio of Actual to Estimate

Cu

mm

ula

tive

Pro

bab

ility p(10) 0.96

p(50) 1.76p(90) 3.23

Page 42: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Delivery Risk Profiles

Page 43: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

But is Uncertainty Really Reduced?

“Take away an ordinary person’s illusions and you take away happiness at the same time.”

Henrik Ibsen--Villanden

Page 44: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Cumulative Distribution (CDF) Curve

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0.1 1 10 100

Initial

Post Env

Post Plan

Post Dev

Log Normal

Page 45: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Why is

Software

Late?

Page 46: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

From the home office in Duncan, Oklahoma

Top Ten reasons why we are late in 2008

Dubai, UAEDubai, UAE

Page 47: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

10: Requirements, what Requirements?

What you want, baby I got it

R-E-Q-U-I-R-E Find out what it means to me

Top Ten reasons why we are late in 2008

Page 48: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

9: Dependencies on other groups that were late

Top Ten reasons why we are late in 2008

Page 49: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

8: Over-optimistic Schedule Estimation Always look on the bright side of code. . . . . . .Always look on the bright side of code. . . . . . .The code’s a piece of $#!^, when we look at itWe can always overlook a minor kink . . . .It probably compiles, it might even link . . .Surely that must mean it doesn’t stink

Top Ten reasons why we are late in 2008

Page 50: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

7: Those weren’t MY estimates

How low can you go!

Scheduling Ritual

Top Ten reasons why we are late in 2008

Page 51: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

6: Not enough testers or documentation resources.

Who needs them anyway? We put those bugs--I mean features--in there on purpose. Besides, it was difficult to program, it should be difficult to use.

Top Ten reasons why we are late in 2008

Page 52: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

5: Offshore and Outsourcing issues

My source code lies over the ocean, My source code lies over the ocean, My source code lies over the sea .My source code lies over the sea .

My source code lies over the ocean, My source code lies over the ocean, Oh bring back my source code to meOh bring back my source code to me

. . . . .. . . . .Bring Back, Bring Back, Bring Back, Bring Back,

oh bring back my source code to me, to meoh bring back my source code to me, to meBring Back, Bring Back, Bring Back, Bring Back,

oh bring back my source code to meoh bring back my source code to me

Top Ten reasons why we are late in 2008

Page 53: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

4: One word, Ch-ch-ch-changes

Top Ten reasons why we are late in 2008

Page 54: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

3: I can’t get no, System Admin– I can’t get no, CM action– ‘cause I try,– ..and I try,– ….and I try,– ……and I try….

Top Ten reasons why we are late in 2008

Page 55: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

2: You didn’t give me the headcount that you promised

Top Ten reasons why we are late in 2008

Page 56: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

1: Weren’t you doing the backups!?1: Weren’t you doing the backups!?

Top Ten reasons why we are late in 2008

Page 57: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Why is Software Late?Genuchten 1991 IEEE

General Manager

Project Manager Item

1 10 Insufficient front end planning

2 3 Unrealistic project plan

3 8 Project scope underestimated

4 1 Customer/management changes

5 14 Insufficient contingency planning

6 13 Inability to track progress

7 5 Inability to track problems early

8 9 Insufficient Number of checkpoints

9 4 Staffing problems

10 2 Technical complexity

11 6 Priority Shifts

12 11 No commitment by personnel to plan

13 12 Uncooperative support groups

14 7 Sinking team spirit

15 15 Unqualified project personnel

Page 58: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Why is Software Late?Genuchten 1991 IEEE

General Manager

Project Manager Item

4 1 Customer/management changes

10 2 Technical complexity

2 3 Unrealistic project plan

9 4 Staffing problems

7 5 Inability to track problems early

11 6 Priority Shifts

14 7 Sinking team spirit

3 8 Project scope underestimated

8 9 Insufficient Number of checkpoints

1 10 Insufficient front end planning

12 11 No commitment by personnel to plan

13 12 Uncooperative support groups

6 13 Inability to track progress

5 14 Insufficient contingency planning

15 15 Unqualified project personnel

Page 59: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Defending an Unpopular Schedule

http://www.stevemcconnell.com/ieeesoftware/bp03.htm

• Developers tend to be temperamentally opposed to the use of negotiating tricks. Such tricks offend their sense of technical accuracy and fair play. Developers don't want to offer lopsidedly high initial estimates even when they know that customers, marketers, or bosses will start with lopsidedly low bargaining positions.

– Steve McConnell

Page 60: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

We want this

Page 61: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Negotiation Bias

• "It is difficult to get a man to understand something when his salary depends upon his not understanding it.“

» Upton Sinclair:

Page 62: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Test 1 (Jørgensen)

Group Guidance Result

A 800

B 40

C 4

D None 160

Page 63: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Test 1

Group Guidance Result

A 800 300

B 40 100

C 4 60

D None 160

Page 64: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Understand Bias

• "What gets us into trouble is not what we don't know. It's what we know for sure that just ain't so.“

» Mark Twain

Page 65: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Don’t know thatwe don’t know

Knowable

Unknowable

Uncertainty

Know that we know

Know that we don’t know

Don’t know that we know

Page 66: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Don’t know thatwe don’t know

Knowable

Unknowable

Uncertainty

Know that we know

Know that we don’t know

Don’t know that we know

UncertaintyManagement

Planning Risk Management

p10 p50

p90

Page 67: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

The Goal

On Time

To Spec

Within Budget

Page 68: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Da Plan, Boss – Da Plan

Page 69: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

The Cone of Uncertainty

We expect uncertainty and manage for it through iterations, anticipation, and adaptation.

Page 70: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Delivery Failure. staff liquidity

Page 71: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Context Leadership Model

Project Complexity

Un

cer

tain

ty

Cows

BullsColts

Sheep Dogs

Page 72: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Context Leadership Model

Project Complexity

Un

cer

tain

ty

Simple, young projects. Need agilityTight Teams

Sheep Dogs Complex, mature marketNeed defined interfaces

Cows

BullsAgility to handle uncertaintyProcess definition to cope

with complexity

laissez faire

Colts

Low

Low

High

High

Page 73: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Bull Product Release

Page 74: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Reduce Uncertainty or Complexity

Uncertainty Complexity

Opportunities to Reduce Uncertainty:• Use proven technologies• Reduce project duration

Opportunities to Reduce Complexity:• Collocate the team• Break project into sub-projects

Attribute Score

Market ███

Technical ███

# Customers █████████

Duration █████████

Change ███

Attribute Score

Team Size █████████

Mission Critical █████████

Team Location █████████

Team Maturity ███

Domain Gaps ███

Dependencies █████████

Page 75: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Partitioning

Dog Project

Cow Project

Colt Project

Bull Program

Remember: Loose Coupling and Strong Cohesion

Page 76: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Project Leadership Guide

M

arke

tD

iffe

ren

tiat

ing

High

Low

Mission CriticalLow High

Invent

ManageOffload

Create Change

Embrace Change

Eliminate Change

Control Change

Ad Hoc Agile

Outsource Structured

Deploy

Page 77: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Portfolio Management

0.0

2.0

4.0

6.0

8.0

10.0

12.0

0.0 5.0 10.0 15.0 20.0 25.0 30.0Project Complexity

Un

cer

tain

ty

Page 78: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Not all dogs are the same

Page 79: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Successful Projects?

Page 80: Risk and Risk Management (Theory and Practice) “It’s tough to make predictions, especially about the future.” Yogi Berra, Niels Bohr Todd Little and Chris.

Curses