Exam II Flashcards
What is Risk?
It is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more product / project objectives.
Define Issue
It is an event or situation that has happened and has a negative effect on one or more project objectives. Therefore, specific actions or work-arounds are needed to address the issue and ensure that the project stays on track.
Risk = Threat * Vulnerability … what does this mean? How this might it work?
It is potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability. We conduct a Risk Assessment which then goes to determine the Actions to Reduce Risk. Then we revise to determine which risks have the most impact before making the changes to reduce risk.
What is Negative Risk?
Are risks that negatively impact the project which we try to reduce or eliminate.
What is Positive Risk?
Is any condition, event, occurrence, or situation that provides a possible positive impact for a project or enterprise that we exploit to maximize project outcomes.
What is the difference between Positive and Negative Risk
Positive risks is where we try to exploit to maximize project outcomes while Negative risks are risks that are potentially threat to the project which we try to reduce or eliminate.
Common Types of Software Risk: Give a (brief) description of each type and other sources of risk
‒ Lack of top-management commitment to the project
‒ Failure to gain user commitment
‒ Misunderstanding the requirements
‒ Lack of adequate user involvement
‒ Failure to manage end-user expectations
‒ Changing scope/objectives (… related to misunderstanding the requirements)
‒ Lack of required knowledge/skills in the project personnel
‒ Lack of frozen requirements (i.e., scope creep or feature creep)
‒ Introduction of new technology (that may not yet be well understood)
‒ Insufficient / inappropriate technology
‒ Conflict between departments (e.g., users & developers)
New Technology and its impact on risk and effects on project risk and corporate risk?
New technology can increase risk
New Technologies + (Inadequate) Resource Base -> Increased Project Risk
-> Increased Corporate Risk
For example …
− Developing new business ideas
− Starbucks crowd-sourced: MyStarbucksIdea
− May need to build and manage various new technologies for which they do not currently have the skills or technology infrastructure
The 7 Components of Project Risk Management
‒ Plan Risk Management ‒ Identify Risks ‒ Perform Qualitative Risk Analysis ‒ Perform Quantitative Risk Analysis ‒ Plan Risk Responses ‒ Implement Risk Responses ‒ Monitor Risks
Space Shuttle Challenger: What happened and what went wrong?
The Challenger exploded 73 seconds after launch killing all of its occupants. The cause of the disaster that two redundant O-ring seals in a joint in the Space Shuttle’s right solid rocket booster (SRB) failed in record-low temperatures of the launch reduced the elasticity of the rubber O-rings, reducing their ability to seal the joints. Investigation reveal organizational culture at NASA contributed to the accident as they knew for nine years before the disaster.
Space Shuttle Columbia, What happened and what went wrong?
The shuttle disintegrated during reentry less than 10 minutes from landing in Florida killing all of its occupants. NASA decision makers “failed to recognize the relevance of engineering concerns for safety as a piece of the insulative foam broke off from the Space Shuttle external tank and struck the thermal protection system tiles on the orbiter’s left wing causing the shuttle to disintegrate returning to Earth.
International Space Station, what happened and what went wrong?
Ever since being launched to deal with several maintenance issues, unexpected problems and failures. These incidents have affected the assembly timeline, led to periods of reduced capabilities of the station and in some cases could have forced the crew to abandon the space station for safety reasons, had these problems not been resolved. The biggest problem are Micrometer strikes and debris up to 1 cm could cause critical damage while anything larger than 10 cm could “shatter a satellite or spacecraft into pieces.
What is the Cone of Uncertainty? What does it represent and How does it work?
It is a progressively more detailed and accurate projection of the project schedule and duration as the project manager or project team specifies project deliverables and activities in more detail. At the beginning of a project, comparatively little is known about the product or work results, and so estimates are subject to large uncertainty. As more research and development is done, more information is learned about the project, and the uncertainty then tends to decrease, reaching 0% when all residual risk has been terminated or transferred. This usually happens by the end of the project i.e. by transferring the responsibilities to a separate maintenance group. It goes from feasibility, concept operation, requirements specifications, product design, detail specifications, and accepted software
What is Risk Assessment? Why is risk so difficult to determine/assess?
It is document that identifies potential risks, an evaluation of the likelihood of the risk event occurring, and its impact on the project. Risk is an important activity that is often not done particularly well! It is difficult, often complex, and subtle.
Managing Risk – features/phases/tasks? What’s done in each phase?
Same ideas in Plan Risk Management ‒ Identify Risks ‒ Perform Qualitative Risk Analysis ‒ Perform Quantitative Risk Analysis ‒ Plan Risk Responses ‒ Implement Risk Responses ‒ Monitor Risks
Risk Management Process – steps/phases? What’s done in each phase?
- Plan Risk Management ‒ Identify Risks ‒ Perform Qualitative Risk Analysis ‒ Perform Quantitative Risk Analysis ‒ Plan Risk Responses ‒ Implement Risk Responses ‒ Monitor Risks
Monitor Risks – Why? How? By doing what …?
Consistent w/ the process of project management control, identified risks must be monitored for change and must be controlled. ‒ Implement Risk Responses ‒ Perform … • Periodic Project Risk Reviews • Project Risk Response Audits • Technical Performance Analysis • Metrics … plan and collect data • And look for risks that exist that were not specifically identified
Reducing Risk
Reducing the risk could be publicized (i.e., make sure everyone is aware of potential risks), avoided, or even eliminated by dealing w/ root cause(s).
Revised Risk
Is where the best managers often prioritize risks according to magnitude and importance
Risk Response Strategies
Six different strategies: Risk escalation, avoidance, exploitation, transference, mitigation, and acceptance
What is risk escalation?
Is moving the response to a higher level in the organization
What is avoidance?
Actively seek to avoid identified threats to the project, eliminate the risk, or not become involved.
What is exploitation?
It is take advantage of opportunities for positive outcomes.
What is transference?
Also known as Risk Sharing, it is the transfer the risk to another party, often through contracts or insurance.
What is mitigation?
It is actively work to reduce, eliminate, or transfer the chances of risk occurring or reduce the impact on project objectives.
What is acceptance?
It is determining an effective response is to just accept the risk(s), budget for risk, and develop contingency strategies on how to respond.
Therac 25 Radition Therapy Machine – What happened? Why?
It was a Radiation Therapy Treatment Machine designed by the Atomic Energy Canada Limited – AECL that was plagued with generally poor software design and development practices … further, the design made it impossible to test it in a clean, automated way. There were several Institutional contributing factors most notably reusing older software which caused several engineering issues causing several failures in the process. In response to incidents like those associated with Therac-25, the IEC 62304 standard was created, which introduces development life-cycle standards for medical device software and specific guidance on using software of unknown pedigree.
Inherent Risk
It is the Impact * Likelihood of the Event
Residual Risk
It is the amount of risk remaining after controls have been applied
Secondary Risk
Are risks resulting from the application of the risk response strategy.
What is Risk Register and how can it be used?
It is a formal record listing all project risks, explaining the nature of the risk, and the management of the risk. It lists all of the risks associated with a project and explains the likelihood and impact from these risks, and what actions are needed to reduce or eliminate these risks.
Risk Appetite
It is amount of risk you are (or the organization is) willing to take in order to achieve the intended operational performance and meet strategic growth opportunities.
NIST Risk Framework – What is it? Why was it developed and used? Steps (list and brief description)
Is a function of the likelihood of a given threat-source’s exercising of a particular potential vulnerability, and the resulting impact of that adverse event on the organization. NIST was selected for the task of developing the Framework because they are a non-regulatory federal agency that acts as an unbiased source of scientific data and practices, including cybersecurity practices. NIST’s mission is to promote U.S. innovation and industrial competitiveness. NIST has a long history of successfully addressing critical national issues through partnerships with industry, academia, and other government agencies. This kind of collaboration would be critical for the Framework to be successful.
- Step 1 – System Characterization
- Step 2 – Threat Identification
- Step 3 – Vulnerability Identification
- Step 4 – Control Analysis
- Step 5 – Likelihood Determination
- Step 6 – Impact Analysis
- Step 7 – Risk Determination
- Step 8 – Control Recommendations
- Step 9 – Results Documentation
Quotes from Eisenhower, von Moltke, & Mike Tyson on planning (i.e., essentially planning for risk)
- In preparing for battle I have always found that plans are useless, but planning is indispensable. —Dwight D. Eisenhower
- No battle plan survives first contact with the enemy. —Helmuth Karl Bernhard Graf von Moltke
- Everybody has a plan ‘til they get punched in the mouth.— Mike Tyson
Risk Grid Template – What is it? What are the primary components? How can it be used?
It is a chart that plots the severity of an event occurring on one axis, and the probability of it occurring on the other. You can also format the matrix as a table, where the risk likelihood and impact are columns, and the risks are listed in rows. The impact and likelihood increase as you continue.
Bias – types & how different types of bias can affect risk assessment(s) – 6 types identified
‒ Anchoring Bias is the tendency to use even unrelated information as input into a judgment or decision.
‒ Availability Heuristic is the tendency to rely on examples of information that come to mind most easily.
‒ Confirmation Bias is the tendency to seek confirming evidence while discounting disconfirming evidence.
‒ False Consequences Effect is the tendency to overestimate others’ agreement
‒ Functional Fixedness – inability to see or realize other creative uses of an object (or skills of a person)
‒ Optimism Bias – tendency to believe that we are more successful than our peers
Carter Racing Scenario and what we learned from the exercise
Where we figure out whatever the engine can race in cold or warm temperature due to the unique turbocharger system. However, two people died and the team was sued for wrongful death
Common Risk Parameters
‒ Detectability is an error (or deviation from normal performance) able to be detected?
‒ Manageability can we manage ‘issues’ if we detect deviation from the norm?
‒ Controllability can we ‘control’ the situation?
‒ Urgency how quickly must this be resolved?
‒ Proximity how close (or far) is this from other ‘systems’ that can be affected?
‒ Dormancy how active (or inactive)?
‒ Connectivity how connected is this to other ‘systems’ where it may have an effect?
‒ Strategic Impact positive/negative impact on strategic goals
‒ Propinquity how close a kinship or proximity is there?
Features of Effective Risk Management
‒ Look for Root Causes (i.e., you often need to look beyond the immediate and/or obvious cause)
‒ Remove subjectivity (from risk assessment and risk responses)
‒ Link risks to controls
‒ Link risks to strategic goals
‒ Make risk a part of everyone’s job responsibility every day software development))
Qualitative Risk Assessment or Risk Analysis
‒ Expert Judgment
‒ Interviews
‒ Observation
‒ Assumption Testing
‒ Scoping – examining Inputs &/or Outputs
‒ Threat Profiling – identify and profile any relevant threats &/or actors
‒ Controls Assessment
• Control(s) implemented / Control Owner / Control Framework
‒ Risk Evaluation
• Residual Risk / Risk Appetite / Risk Registry
‒ Risk Treatment(s)
Tornado Analysis
It is an example of one type of sensitivity analysis … graphical representation showing which risks can cause the greatest variability in some outcome(s). Risks at the top have the largest variability; risks at the bottom cause the least variability in outcomes.
Project Execution
Is the process of carrying out the project plan to accomplish the required work.
Total Cost for Risk (Estimates) – Potential Risk + Mitigation Cost
- Total Cost is the sum of the Mitigation Cost + value of Potential Loses
- Potential Losses + Mitigation Cost = Total Cost [Not to scale]
Look at slides graph
Boeing Starliner (Crew Space Transportation) System – some general design details … what went wrong?
During the first attempt, in December 2019, Starliner suffered a number of software glitches and got stranded in the wrong orbit for a meetup with the orbiting lab. The Starliner has a years-long history of software problems, hardware issues, and other delay-causing problems including Boeing totally skipping a crucial safety test in February 2021 including issues where the astronauts could have got serious injuries or killed.
Error discovery rates for software for different testing stages… where do the error discovery rates tend to be highest? Lowest? Most expensive to fix or address? Least expensive?
Discover the problem earlier helps to get the project ready for integration time and is the least expensive to address. The discovery rate for errors are discovered later, it can delay the integration time and can be very expensive as the project can be delayed and the team behind the project have to fix a lot of problems and might have outsource adding more to the cost.
Effects of Familiarity w/ the technology, project size, and the structure or definition of requirements on project risk?
High Familiarity w/Technology or Application Area:
- Low Structure
- Small Project: Very Low Risk (of project failure), (Very susceptible to mismanagement)
- Large Project: Low Risk (of project failure), (Very susceptible to mismanagement)
- High Structure
- Small Project: Very Low Risk (of project failure)
- Large Project: Low Risk (of project failure)
Low Familiarity w/Technology or Application Area
- Low Structure
- Small Project: High Risk (of project failure)
- Large Project: Very High Risk (of project failure)
- High Structure
- Small Project: Medium-to-Low Risk (of project failure)
- Large Project: Medium Risk (of project failure)
