Book Summary: Waltzing with Bears Part II

Risk Diagram

• x-axis: dates
• y-axis: relative probability

Nano-Percent Date (N)

• the first date that has a nonzero probability (nano-percent likely)
• on software industry average, window size is somewhere between 150-200% of N

Mechanics of Risk Management

• yesterdays' problem is today's risk - initially add the project retrospective results of previous projects
• Risk management is not the same as worrying about your project
• Some risks expire during the course of a project. By the end of the project, all the remaining risks expire.

What to do about a Risk

• avoid: don't do the project
• contain: set aside sufficient time and money to pay for it, should it materialise (risk reserve)
• mitigate: take steps before-hand in order to reduce containment costs
• evade: do nothing and the risk doesn't materialise

Risk Exposure

• expectation of containment cost
• risk exposure = cost x probability
• risk exposure can be expressed in terms of time of expected delay

Showstoppers

• can only be managed by project assumptions
• should any one of the project assumptions prove false, have to escalate the issue upwards
• showstoppers are beyond the responsibility and authority of the project

Risk Management Prescription

1. compile a census of risks using a risk-discovery process
2. make sure all core risks are present
3. do homework on each risk
• name and id
• transition indicator
• estimate impact (cost & schedule) & probability
• calculate risk exposure (budget & schedule)
• determine contingency actions & mitigation actions
• add mitigation actions to project plan
4. designate showstoppers as project assumptions
5. determine nano-percent date (first-pass schedule estimate)
6. construct a risk diagram using N date
7. express all commitments using risk diagrams showing the uncertainty
8. monitor all risks for materialisation & expiration and execute contingency plan if required
9. keep the risk-discovery process going

Commitments and Goals

• schedule = goal = N => stupid
• schedule > goal > N => sensible

Public Risk Management

• keeps all eyes on the core risks
• enables all to engage in the ongoing risk-discovery process