Managing Risk: Methods for Software Systems Development (SEI Series in Software Engineering)

397 Pages·1998·2.113 MB·English

by  Elaine M. Hall

Managing Risk:
Methods for Software
Systems Development
Elaine M. Hall, Ph.D.
ADDISON-WESLEY
An Imprint of Addison Wesley Longman, Inc.
Reading, Massachusetts ■ Harlow, England ■ Menlo Park, California
Berkeley, California ■ Don Mills, Ontario ■ Sydney
Bonn ■ Amsterdam ■ Tokyo ■ Mexico City
i
Software Engineering Institute
The SEI Series in Software Engineering
Many of the designations used by manufacturers and sellers to distinguish their products are claimed
as trademarks. Where those designations appear in this book, and Addison Wesley Longman, Inc. was
aware of a trademark claim, the designations have been printed in initial capital letters or all capital
letters.
The author and publisher have taken care in preparation of this book, but make no expressed or implied
warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for
incidental or consequential damages in connection with or arising out of the use of the information or
programs contained herein.
The publisher offers discounts on this book when ordered in quantity for special sales. For more infor-
mation please contact:
Corporate & Professional Publishing Group
Addison Wesley Longman, Inc.
One Jacob Way
Reading, Massachusetts 01867
Copyright © 1998 by Addison Wesley Longman, Inc.
Library of Congress Cataloging-in-Publication Data
Hall, Elaine M.
Managing risk: methods for software systems development / Elaine
M. Hall.
p. cm.—(SEI series in software engineering)
Includes bibliographical references and index.
ISBN 0-201-25592-8
1. Computer software. 2. Risk management. I. Title.
II. Series.
QA76.754.H346 1997
005.1'068'1—DC21
97–24703
CIP
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or
transmitted, in any form, or by any means, electronic, mechanical, photocopying, recording, or other-
wise, without the prior consent of the publisher. Printed in the United States of America. Published
simultaneously in Canada.
ISBN 0201255928
Text printed in the United States at International Book Technologies in Troy, New York.
1 2 3 4 5 6 7 8 9—MA—0201009998
8th Printing March 2007
FOR MY HUSBAND
iii
This page intentionally left blank
CONTENTS
FOREWORD: RUNNING TOWARD RISK xiii
PREFACE xv
ABOUT THE AUTHOR xxi
PART I RISK MANAGEMENT DISCOVERY 1
Chapter 1 SOFTWARE RISK MANAGEMENT 3
1.1 Foundations 4
1.2 Risk in the Large 12
1.3 Risk in the Small 17
1.4 Consequences of Knowledge 22
1.5 Consequences of Ignorance 23
1.6 Summary 23
1.7 Questions for Discussion 24
1.8 References 25
v
vi Contents
Chapter 2 P2I2 SUCCESS FORMULA 29
2.1 Major Factors in Risk Management Capability 30
2.2 People: The Human Element 31
2.3 Process: The Steps to Manage Risk 39
2.4 Infrastructure: The Organizational Foundation 41
2.5 Implementation: The Project Execution 45
2.6 Summary 48
2.7 Questions for Discussion 49
2.8 References 49
Chapter 3 RISK MANAGEMENT MAP 51
3.1 The Road to Risk Management Capability 53
3.2 Risk Management Map Directions 54
3.3 Journey from Problem to Opportunity 57
3.4 Journey from Novice to Expert 61
3.5 Summary 62
3.6 Questions for Discussion 64
3.7 References 65
PART II RISK MANAGEMENT PROCESS 67
Chapter 4 IDENTIFY RISK 69
4.1 Define the Risk Identification Process 70
4.2 Develop Risk Checklists 75
4.3 Define the Risk Assessment Method 76
4.4 Develop the Risk Management Form 82
4.5 Establish the Risk Database Schema 82
4.6 Summary 84
4.7 Questions for Discussion 84
4.8 References 85
Chapter 5 ANALYZE RISK 87
5.1 Define the Risk Analysis Process 88
5.2 Define Risk Analysis Techniques 93
Contents vii
5.3 Define Risk Evaluation Criteria 100
5.4 Establish the Risk Prioritization Scheme 102
5.5 Summary 102
5.6 Questions for Discussion 103
5.7 References 104
Chapter 6 PLAN RISK 107
6.1 Define the Risk Planning Process 108
6.2 Define Risk Resolution Strategies 112
6.3 Define Selection Criteria 115
6.4 Develop the Risk Action Plan Template 116
6.5 Summary 117
6.6 Questions for Discussion 118
6.7 References 119
Chapter 7 TRACK RISK 121
7.1 Define the Risk Tracking Process 122
7.2 Define Risk Tracking Techniques 125
7.3 Define Risk Measures and Metrics 129
7.4 Define Triggering Devices 130
7.5 Summary 131
7.6 Questions for Discussion 132
7.7 References 133
Chapter 8 RESOLVE RISK 135
8.1 Define the Risk Resolution Process 136
8.2 Define Risk Resolution Techniques 141
8.3 Define Risk Management Return on Investment 143
8.4 Develop a Corrective Action Procedure 144
8.5 Summary 145
8.6 Questions for Discussion 146
8.7 References 146
viii Contents
PART III RISK MANAGEMENT INFRASTRUCTURE 149
Chapter 9 DEVELOP THE POLICY 151
9.1 Obtain Commitment 152
9.2 Allocate Resources 153
9.3 Survey Existing Practice 155
9.4 Define Draft Policy 158
9.5 Review Draft Policy 159
9.6 Document Policy 160
9.7 Approve Policy 161
9.8 Communicate Policy 161
9.9 Summary 161
9.10 Questions for Discussion 162
9.11 References 163
Chapter 10 DEFINE STANDARD PROCESS 165
10.1 Establish an Action Team 166
10.2 Develop the Draft Standard Process 171
10.3 Review the Draft Standard Process 177
10.4 Document the Standard Process 178
10.5 Approve the Standard Process 179
10.6 Distribute the Standard Process 179
10.7 Summary 180
10.8 Questions for Discussion 181
10.9 References 181
Chapter 11 TRAIN RISK TECHNOLOGY 183
11.1 Prepare for Training 184
11.2 Develop Training Material 184
11.3 Apply Training Metrics 187
11.4 Deliver Training 188
11.5 Obtain Training Feedback 189
11.6 Summary 190
11.7 Questions for Discussion 191
11.8 References 191
Contents ix
Chapter 12 VERIFY COMPLIANCE 193
12.1 Review the Risk Management Plan 194
12.2 Audit Agents and Artifacts 195
12.3 Generate an Audit Report 197
12.4 Track Action Items 198
12.5 Summary 199
12.6 Questions for Discussion 199
12.7 References 200
Chapter 13 IMPROVE PRACTICE 201
13.1 Develop an Appraisal Method 202
13.2 Assess Risk Practices 204
13.3 Develop an Improvement Plan 205
13.4 Implement the Improvement Plan 206
13.5 Summary 207
13.6 Questions for Discussion 207
13.7 References 208
PART IV RISK MANAGEMENT IMPLEMENTATION 209
Chapter 14 ESTABLISH THE INITIATIVE 211
14.1 Review Risk Management Requirements 212
14.2 Plan Risk Management Activities 214
14.3 Budget Risk Management Activities 215
14.4 Schedule Risk Management Activities 215
14.5 Staff Risk Management Activities 217
14.6 Coordinate Risk Management Training 217
14.7 Summary 218
14.8 Questions for Discussion 218
14.9 References 219
Chapter 15 DEVELOP THE PLAN 221
15.1 Outline the Risk Management Plan 222
15.2 Define Risk Management Goals 222