Risk Management is routinely asked for on big projects and it inevitably ends up as a big process of hierarchies of spreadsheets or a database that identifies the risk, the potential impact and ways to mitigate it. I have seen many systems, and also seen many project and programme managers pay lip-service to them, by filling in either the bare minimum, or populating it with racing certainties! E.g. ‘Lack of resources’; This is not a risk, it is a management decision.

Yet, as far as software programme management is concerned, for any new development featuring any form of novelty (product, technology, architecture, people, organisation), risk management should be one of the key tools for planning the programme.

Significant risks are, actually, usually pretty obvious… and a browse through the system requirements by someone with even little appreciation of the project, and little experience, will quickly identify the major issues that are likely to have big impacts. Once the big issues are addressed, there will be a much greater number of lesser issues which may take more expertise to assess with regards investment of ‘mitigation’. Iterating this process quickly drops you into the usual ‘noise’ of typical project variation.

Where the risk responsibility lies is often a key factor, in getting authority to address it. It is rare that big impact risks exist within a single discipline (and if it does the technical discipline manager is usually loathe to admit he doesn’t know the solution). These factors make declaring risk unattractive to some practitioners and may put the project and business at risk.

Investing in ‘experiments’ is really what risk management is about. When you don’t understand the science well enough to have some suitable engineering solution that has provenance, you create a task, switch from engineer to scientist (but with a focus on a particular problem), and look for possible solutions, or to gain some understanding, that allows you to mitigate, avoid, control or at least ‘size’ the problem and the effort required in solving the same.

But there is absolutely no point in defining and executing experimental tasks, if the learning is then not applied, in a timely fashion, to your real project. Classical failures in risk management are:

i)                    Doing the experiment too late, or on the project when eventually encountered

ii)                  Not using the information gleaned from the experiment to modify the programme, or product

iii)                Failing to understand the underlying science that creates the risk, such that mitigation actions can be assessed

iv)                Adding extra complexity, further technology risk or unproven processes in the solution

Often risk reduction programmes require trades between different parts of the system and need multi-discipline skills. Often these will be executed with third parties who have a better understanding of the underlying science, or an ability to think more openly (e.g. academic researchers and institutions).

Technology development programmes are inherently risk management/risk reduction exercises and show a maturity of the business in tackling the problem ahead of bidding a programme that deploys the technology in question.

Embedded software in control and information systems say, is practiced by a wide community of businesses but is largely protected as intellectual property within those businesses (and often inside individual business units). It is fair to say, that most problems in software will probably have already been encountered, and in most cases a solution exists, but others will be unaware.

Even if solutions don’t exist there is potential for finding partners who face that common problem to share the burden of finding a solution. These issues will be the subject of a further instalment, but the general principles of Industrial Collaboration can be found here.

___________________________________________________________________________

Let us help you maximise the business potential of your product and its software

Email me on stuart.jobbins@sofintsys.com

Visit our website, or follow us on your preferred Social Media for our latest views.     ___________________________________________________________________________