CST416 Software Enterprise IVSpring 2010

Risk Management February 10, 2010

Objectives:

  • Understand how to use risk management techniques to analyze and controlprojects.
  • In this lab you will enter and track risk information in RTC/Jazz, and prioritize alternatives to delivering project requirements using the general decision tree approach presented in [Boehm91].

Instructions:

  • Please work in groups of 3 and put all names on the submission. Leave Jazz areas intact.
  • To do this lab you will need to reference the data in Tables 1 and 2 below:

Risk / Req1 / Req2
1 / Inadequate understanding of user needs / 0.3 / 15
2 / Poor understanding of needed technology / 0.4 / 10

Table 1. P(UO) / L(UO) per risk and requirement. As an example, read the entry in row 1, Req1 as “there is a 30% chance that Risk 1 will cause a loss of 15 business value points”

Risk Mitigation – Risk Reduction/Cost[k1] / Risk1 / Risk2
1 / Prototype / 0.2/15
2 / Training courses / 0.1/30

Table 2. Risk Mitigation actions with risk reduction and cost values.

The 1stvalue in each cell is the probability by which the risk is reduced, and the 2ndvalue is the cost of implementing the risk mitigation strategy. For example, prototyping (Mitigation Plan 1) may reduce Risk1 for Req1 from 0.3 to 0.1 (0.3 – 0.2 = 0.1), but will increase the cost of implementing Req1 from 15 to 30.

Activity 1: Risk Management in Jazz

We have created a risk management plugin in Jazz. For the second activity, you will install this plugin in TeamConcert, and use it to enter Risk WorkItems, Mitigation plans, and Contingency Plans. Further, you will revise the Risk WorkItem’s RE value and work through its different process states. You will work outside the tool (in powerpoint) to produce decision trees to determine whether to enact Mitigation/Contingency plans.

  1. Download and install the risk management client plugin available on the course website.
  2. Working with a single partner, connect to a Jazz area on swent0. We will reuse the Delphi estimation projects from last week for this exercise. Connect to your project area in Jazz.
  3. Create 2 new User Story WorkItems in your project, creatively named “Req1” and “Req2”.
  4. Now create new 2 WorkItems of type Risk, and name them according to the risk data in Table 1. Associate the first risk with Req1 and the second with Req2 using the WorkItem Link tab. Save your new Risk WorkItems. You should see the states go to “Identified”.
  5. For your Risk WorkItem for Req1. Do the following:
  6. In Powerpoint, construct a decision tree for this Risk and its corresponding Mitigation Plan in Table 2. Be sure to label the modified P(UO), L(UO), and RE values for each branch.
  7. If, based on (a), you believe it is a good idea to employ the mitigation plan for the risk, then
  8. Create a new Task WorkItem named “Training”. Estimate the cost of the Task to be the cost shown in row 1 of Table 2.
  9. On the Links tab of the Risk WorkItem, in the Links Textarea, select the Add button, and choose “Add Mitigation Plan”.
  10. Use the Search to find your Mitigation Plan WorkItem, “Training”, and add it to the Risk.
  11. Returning to the Overview tab, assign new values in the “Risk Probability in %” and “Risk Impact” fields based on your decision tree outcome. Also set the state of the item to “assess”.
  12. Click Save and then Refresh (the dual arrows).
  13. Now select state “monitor” and click Save.
  14. Now select state “resolve” and click Save.
  15. Return to step 5 and repeat the process for Req2/Risk2. However, this time at step 7 select state “invalidate” and click Save.

Activity 2: Multiple Risks per Requirement

Now consider a modified scenario below. In this scenario, Req 2 now has 2 risks and 2 mitigation plans. Return to your decision tree for Req 2 in Powerpoint and revise it according to this new information. Question: would you employ either mitigation plan? Both? Neither? Justify your answer.

Risk / Req1 / Req2
1 / Inadequate understanding of user needs / 0.3 / 15
2 / Poor understanding of needed technology / 0.4 / 10
3 / Inadequate resources to complete / 0.25 / 20

Table 1b. Modified Risk/Requirement table including a 2nd risk for Req2.

Risk Mitigation – Risk Reduction/Cost / Risk1 / Risk2 / Risk3
1 / Prototype / 0.2/15
2 / Training courses / 0.1/30
3 / Outsource / 0.15/10

Table 2b. Modified Mitigation table

Activity 3: Thought Questions (put these on the last slide of your Powerpoint)

  1. Suppose a contingency plan was created for Risk 2 that basically said “for a cost of 5 business points, you could reduce your loss if Risk2 happens from 10 points to 5 points”. Would you do the contingency plan? Why or why not? Explain your answer analytically (e.g. using numbers!).
  2. Assuming a team can work on 1 Requirement at a time, which requirement should it work on 1st? Why?

Activity 4: Journal entry

We will be creating a journal to capture your thoughts on each technique we practice. This will happen online in Moodle, but the site is not quite setup to do it yet. In the interim, I want you to write down answers to these questions:

  1. Do you think Risk Management is a useful technique to do on real software projects?
  2. Do you think Risk Management will benefit your capstone project? How will it, how will it not?

[k1]NOTE: Messed up and used the wrong cost values for the M plans. The break even values are 3 and 1 resp.