What is Risk Management

Risk management is about making informed decisions by consciously assessing what can go wrong and the likelihood and severity of the impact when that possibility comes true. The heart of Risk Management is making informed decisions in the presence of the uncertainties that create risk.

Managing in the presence of these uncertainties involves evaluating the trade-offs associated with risk mitigation in terms of their costs, benefits, and risks and evaluating the impact of current decisions on future options. This risk management process embodies identifying, analyzing, planning, tracking, controlling, and communicating risk.

The sources of uncertainty for all domains, project or not, come in two forms:

A straightforward?process for Managing Risk looks like this. There may be others, but whatever the process is suggested, the six areas of risk management in the upper left corner of this diagram and the data model shown here need to be addressed.

The development and deployment of software intensive systems continue to suffer significant cost overruns, schedule delays, and poor technical performance. This should be of no?surprise to anyone working in the software business.

Research shows these failures result from?failing to appropriately deal with the uncertainties in developing complex, software-intensive, and software-dependent systems. Many?development communities need a systematic way of identifying, communicating, and resolving technical uncertainties on all projects. Often, the focus is on the symptoms of cost overruns and schedule delays rather than on the root causes of product development. More than simply simply asking the?5 Ways is required to manage in the presence of risk. The cause and effect processes must be understood, and corrective actions must be produced to fix the cause rather than treat the symptom. Here's the basis of Root Cause Analysis. So when you hear?something (like?estimating) is the Smell of Dysfunction, you'll know that can't possibly be true, and it's not made valid by asking?why without a process to find and fix the Root Cause.

So when we hear?Agile is Risk Management, that's not true. Agile is a participant in the Risk Management process, providing frequent assessments of progress to the Plan that can inform the Risk Management process.?

When we hear #Noestimates is Risk Management, that's not only not true, it can't possibly be true.

By?Progress to Plan, I mean Progress to?Plan. The Plan is the Product Roadmap for delivering the needed Capabilities the customer is paying for. These capabilities must appear at the timerequired forr the business strategy to be fulfilled. In some parts of our work, a Mission replaces the business strategy. However, the capabilities needed at the time are still the same.

If those Capabilities don't appear at the time, the simple Return on Investment calculation is disrupted. Since the?time cost of money is ALWAYS at play in any business.?

Now for the Punch Line

Suppose we are managing in the presence of uncertainty, using the?time cost of money?as one (just one, more are below) of our business or mission success measures. In that case, we need to make uncertain decisions to increase the probability of success.

But first, here is a short interlude on?Project Success. It is popular in the Agile and #NoEstimates community to conjecture that project success is about something other than on-time, on-budget, or performance. First, if you show up late and over budget with your?working software,?you need to ask those paying you if they consider that a success.?

So?now?what does project success mean?

Success means different things to different people. Projects are conceived with a business perspective?in mind. The project's goal usually focuses on producing?a better result?or increasing?organizational performance—more profits, additional?growth, and improved market position. Otherwise, why are we funding this work? [1]?

There are four dimensions of project success. [1] Each of these dimensions operates in the presence of uncertainty.

Project efficiency

• Did we spend the money as planned to?earn back the produced value?
• While spending this money, did we meet the?scheduled goal?
• Meeting budget goal?

Impact on the customer

• Meeting function performance?
• Meeting technical?specifications?
• Could you fulfill customer needs?
• Would you be able to solve the customer's problem?
• Is the customer using the resulting system to solve the identified problem with the provided technical and functional performance?
• Is the customer satisfied with the system and the results it produces?

Business success

• Are the results of the project a business success?
• The project has created a larger market share for the firm.

Preparing for the future

• New markets have been opened?
• New product lines have been created?
• New technology?has been developed?

These four dimensions can?be applied to a spectrum of projects and tailored to fit their needs. Here's one approach to identifying projects across that spectrum.

So In The End

Agile alone is not risk management. It's a contributor to the Risk Management process.

With estimating, you can only make decisions in the presence of uncertainty, which creates risks that must be managed to increase the probability of project success.

• The probability of occurrence of a reducible risk.
• The probability that the mitigations?will reduce the impact.
• The statistical range of the variances?in the irreducible uncertainties that create schedule risk.

You can't manage risk without estimating. And as we know?Risk Management is how Adults Manage Projects - Tim Lister. If you're saying you're managing risk and you're not estimating, then you're not managing risk. And you're not behaving like an adult with other peoples money.