SCERT Risk Management

After the project has been broken down into analysable components, we identify the source of the risk -- why is there uncertainty?  What is causing this uncertainty or variability?

By addressing the causes or sources of the variability we will be better able to respond to the causes in addition to the effects. 

Suppose we have identified a risk in the completion of the functional specification documents of a software development project.  What we mean is that we have identified an uncertainty in the completion of these documents.  They may take more or less time than expected.  What might be the causes of this risk? 

The specifications may take longer because the requirements may change as the project progresses.  The specifications will change in proportion to the change in requirements. 

The specifications may take longer because it may be realised later that the specifications do not cover its areas on the proper depth and scope.

These are two possible causes.  Notice that responses required to mitigate the uncertainty could be very different.  In the first cause, we need to look further at the requirements documents from which the specifications are being developed.   In the second cause, we need to look at how we can identify gaps in the specifications documents.  Of course it is possible that both causes occur.

Once we have identified the possible causes of the risks, we can proceed to identifying responses to address the  causes, the risk, and the risk events.

* * *

References: Simister & Turner

SCERT Approach to Risk

A risk is an area of uncertainty.  This uncertainty can turn into risk events that may prove unfavourable to a project.  Risk events are not always necessarily unfavourable. 

Whether is will rain or not, for example, is a risk for someone planning to go on a picnic.  The risk events could be that it will rain heavily, or it will rain lightly, or it will not rain.  The area of uncertainty, that is, the risk, is the possibility of rain.

Managing project risks is about analysing the risks (uncertainties) that a project is facing, identifying the risk events that may come out of that risk, planning responses to these events, monitoring the chances of these events, and executing responses to the risk events.

The SCERT approach to managing risk begins with breaking down the project into manageable components.  Because nothing is certain, every single task in a project has some risk (uncertainty)  Much of that however, is handled in the scheduling process which (must have) used a probabilistic approach (for example a 3-point estimation in PERT).

We only look at the major uncertainties. 

Break the project into components. SCERT recommends no more than 20 components for large projects, and no less than 5 components for small projects.

If the concern is for risks affecting the schedule, breakdown the components by activities.  If the concern is risks affecting the cost of the project, breakdown the components by cost components, highlighting their expected costs. 

Once the project has been broken down into manageable components, the process of identifying the sources of risk (again, uncertainty) can be identified.

* * *

Communications - Being Understood

The famous line: "what we have here is a failure to communicate" elicits chuckles.  People recognise the experience these words describe. The words resonates with many people because the experience is very common. 

We've all had experiences of miscommunication.  You may recall colleagues who never let you finish a question -- they answer the question even before you have even gotten midway through your question.  Of course the answer you receive has no relation to the question you were intending to ask.

For a project manager, miscommunication is  a professional tragedy.  A project manager's job is constantly about communication.  He doesn't do the actual work.  He organises, orchestrates, informs, and instructs.  He uses communication to do these.  A project where the manager instructs the team to do something, and the team comes back with something else can be heading for trouble.   Miscommunication consumes time, energy, money,  increases tension, and decreases motivation in the workplace.

Dowling & Sayles says that for communication that instructs to be effective, it must meet a few criteria. 

First, the message itself must be understood.  Understanding is hard, it is easier to misunderstand.  To understand something is to get exactly what is meant. To misunderstand is to get something wrong, even a very little something.

One of the problems is words.  Words are never very precise.  Someone said that words are cups that people fill with the meaning they want.  Think of the words you often use in your projects: maximise, prioritise, quality, improve.  Do they mean the same thing to everyone?  These could all be understood in different ways.  When you come across communication that uses words that come loaded with meaning, make sure to explain in more detail what you mean by the word.

Managers should practice getting feedback about what they are communicating.  How do you know that what you said is what was heard? One way to get feedback is to ask the other party to restate what you just said.  This works for some people.  You can ask your staff to repeat what you said.  You can also practice it yourself, repeating what other people say to you, to help them ensure that you understood them correctly.  It is not as easy to ask your superiors or clients or some people to repeat back what you said.

Another way to check if they understood you is to ask questions about what you said, trying to get a hint of what they think you meant. 

Once your communication has been understood you have crossed one barrier.  There are two more to cross.

The next question is, yes they understood what you said, but did they believe you?