Transcription
Risk Management in an Agile Lifecycle1
Agenda The goals and practices of traditional risk management The goals and practices of Agile risk management Pros and cons of both approaches Can the two risk management methods be used together?22
A Review of Traditional Risk Management33
Risk Defined44
Frequent Risks The stakeholder requirements could be in conflict with each other. The estimate is not based on historical throughput. Team members are allocated to multiple projects. The project was approved without team buy-in. A 3rd party may not deliver their part.5
Frequent Risks The stakeholder requirements could be in conflict with each other. The estimate is not based on historical throughput. Team members are allocated to multiple projects. The project was approved without team buy-in. A 3rd party may not deliver their part. Example - Hardware – bad weather in Asia could delay equipment6
Traditional Risk Management Steps1. Identify2. Quantify Impact3. Quantify Probability4. Create contingencies for high impact - high probability risks5. Manage highest scoring risks7
When do we identify risks?In our PMLC - usually once to Initiate the project,then revisit and update the risks after Planning.8
When do we identify risks?In our PMLC - usually once to Initiate the project,then revisit and update the risks after Planning.We can call this BURP – Big Upfront Risk Planning.9
What Do We Identify?Project Name: Online Auction SystemProject Number: 22880Program Name: 0Sponsor: Jim TraylorBusiness Owner: Anne ArchyProject Manager: Greg SmithTarget Start Date:Target End Date:Company Number:Cost Center:Created sk AssessmentRisk IDRiskNumber CategoriesB5ProjectExecutionRisk DescriptionInsufficient resources to successfullycomplete the project.Severity LikelihoodofofImpact Occurring(1-5)(in %)50.75RiskRatingContingencyPlan Required(Yes/No)Risk Approach3.75YesRisk AvoidanceRisk ResponseSummaryOn Technology side, resourcesare involved with Core platform.RiskOwnerNathan orGreg:10
What Do We Identify?Project Name: Online Auction SystemProject Number: 22880Program Name: 0Sponsor: Jim TraylorBusiness Owner: Anne ArchyProject Manager: Greg SmithTTCoRisk AssessmentRisk IDRiskNumber CategoriesB5ProjectExecutionRisk DescriptionInsufficient resources to successfullycomplete the project.Severity LikelihoodofofImpact Occurring(1-5)(in %)5RiskRating0.753.751. The potential risk11
What Do We Identify?Project Name: Online Auction SystemProject Number: 22880Program Name: 0Sponsor: Jim TraylorBusiness Owner: Anne ArchyProject Manager: Greg SmithTarget Start Date:Target End Date:Company Number:Cost Center:Created sk AssessmentRisk IDRiskNumber CategoriesB5ProjectExecutionRisk DescriptionInsufficient resources to successfullycomplete the project.Severity LikelihoodofofImpact Occurring(1-5)(in %)50.75RiskRatingContingencyPlan Required(Yes/No)Risk Approach3.75YesRisk Avoidance2. The impact if the risk happens3. The likelihood the risk will occur4. Ultimately a Risk Rating12
We Usually Have Risk CategoriesRISK CATEGORIESRISK CATEGORYBusiness ContinuityComplianceDEFINITIONIncludes risk associated with the duration, or impact, ofan interruption of critical business processes and theirassociated people, vendors, systems, technology,Includes risks introduced to the company either duringthe project, or as a result of the project, associated withfailure to meet regulatory requirements. E-Commerce RiskRisks associated with Internet interfaces Is web site privacy adequately protected? Is the website and session security appropriately handled? Is the access to data via web site adequately protected? Is there protection in place to prevent hackers, denial ofservice attacks, website defacement, etc.?Is the web site privacy adequately protected? FinancialIncludes operational risks associated with theft or misuse of Company or customer assets or information, Fraud/TheftIncludes risks introduced to the company either duringthe project, or as a result of the project, associated withtheft or misuse of Company or customer assets orinformation,SAMPLE QUESTIONSWill the introduction of a new product or service cause aninterruption to existing business processes?Is there a Business Continuity Plan?Has the Business Continuity Plan been updated to reflectchanges?Is this a new process, product or business model thatthe Company has not had significant experience inimplementing?Has this project, product or process resulted in acustomer impact resolution in the past?·Is this project in response to a new statute, regulation orcomment from a regulator?Is the forecast of the financial performance of the projectadequate?Describe the assumptions used in this forecast and therisks to achieving them.Are financial tracking requirements clearly documented?Are there changes to accounting practices? 1313
and we have Risk Response categoriesRisk AvoidanceMitigation (Controlling)AcceptanceShare or Transfer(Allocation)RISK RESPONSE APPROACHESEliminating the threat of a risk by eliminating the cause.Reducing the consequences of a risk by reducing its severity of impact orlikelihood of occurring.Accepting the risk if it occurs.Assigning the risk to another party by purchasing insurance or subcontracting.14
When Done We Have a Scored List.We create Contingency Plans for Risks with a High Rating15
Traditional Risk Management – Pros and ConsProsConsRisks identified before major investmentUsually done at the start but notthroughout a projectEarly analysis can help with a go/ nodecisionMay be performed on projects where thereis no value addContingency planning that avoids wasteOften done without examination of specificrequirementsRisks exposed to the team at largeOften done by a small group – not theentire teamLessens chance of mid-project surprisesNo correlation to project specific processesto identify and minimize risk16
How is Agile different?As we mentioned,traditional planning doesrisk management upfront.17
How is Agile different?As we mentioned,traditional planning doesrisk management skLookforRiskLookforRiskLookforRiskWhereas Agile looks forrisk throughout thelifecycle.18
How Does Agile Address Risk?19
Agile Principles Address Risk Transparency – Expose everything we are doing so we can see risks early Collaborative planning – Harness the knowledge of the entire team andsee more risks Customer involvement – Mitigate customer risk by involving themthroughout the lifecycle20
Project Envisioning PracticesEnvisioning the product with the customer The team and customer are synchronized on the need Less risk of delivering the wrong productQuantifying the value with the customer Less risk of the team not supporting the projectPROJECT ELEVATOR STATEMENTFor:Internet RetailersWho:Would like to sell their items locally within an auctionframeworkThe:Acme AuctionatorIs a:Local Online auction systemThat:Allows the selling of goods without a commissionAnd Unlike:CraigslistOur:Product allows the seller to put an item up for bid, asopposed to selling at a fixed price21
Project Planning PracticesEstimation based on history Risk of estimate inaccuracy reduced since constants are involved in estimationWork reviewed at the feature level for moredetailed risk evaluation: Less chance of missing a risk since features are examinedseparately for technical risk22
Development/Implementation PracticesDaily Standup Meetings Agile teams meet every 24 hours Which mean risks are exposed every 24 hoursProduct Demos Every 2 to 4 weeks Constant exposure to the customer Minimizes the risk of building to the spec but not to the need23
Project Tracking Risk PracticesDon’t Manage Based on % of Plan Complete Percentages are misleading There is a risk that 1% takes as long as 99%24
Project Tracking Risk PracticesSTORIESIteration 1Ability to register onthe temIntegrationFunctionalTesting CustomerDR CodeApproval Load Test Release ProductionCodeReleaseN/AAbility to place an itemup for bidAbility to bid on anitemAuction Engine LogicInstead manage by binary attributes Complete or not complete Less risk of overrun on construction tasks25
Can I use Traditional Risk Management on My Agile Project?Yes – Please Do!26
But – Make the Call on Each ProjectDo Traditional Risk Managementwhen Project:Probably Skip, or do lightly,when Project:Has technology never used by the teamIs a simple release on existing platformIs expensiveOnly runs a few daysHas many touch pointsSchedule is tight and extended riskplanning could jeopardize deliveryLonger than a few weeksWe have a lot of experience with thistype of projectIs required to be compliantWe can leverage an existing risk plan27
Summary Traditional Risk Management and an Agile lifecycle are complimentary Traditional Risk Management is done up front and tries to envision what couldgo wrong all the way to the end of the project Agile Risk Management is done more by practices then envisioning. ManyAgile practices look to identify and mitigate risk throughout the project. The level of traditional risk management performed should correlate tocomplexity, duration, and experience with the type of project being pursued.28
Contact InfoGreg Smithgreg@gssolutionsgroup.com29
(Allocation) Assigning the risk to another party by purchasing insurance or subcontracting. RISK RESPONSE APPROACHES. When Done We Have a Scored List. 15 We create Contingency Plans for Risks with a High Rating. Traditional Risk Management – Pros and Cons 16 Pros Cons Risks identified before major investment Usually done at the start but not throughout a project Early analysis can help
