Threats to software development projects are often minimized or overlooked altogether because they are not as tangible as risks to projects in other industries. The risks are there though and just as capable of derailing the software development project as a project in any other industry.

Most project managers in the information field have had the experience of planning a software development project down to the last detail, planning the effort for each of the tasks in the plan down to the last hour and then having some unforeseen issue come along that derails the project and makes it impossible to deliver on time, or with the feature set originally envisioned.

Successful project managers in any industry must also be skillful risk managers. Indeed, the insurance industry has formalized the position of risk manager. To successfully manage the risks to your software development project, you first must identify those risks. This article was written to provide you with some tips and techniques to help you do that. There are a few terms that are not directly applicable to the activity of identifying risks that are helpful to understand before studying risk identification. These are some of those definitions:

* Risk event – This is the event that will affect the project if it should happen.
* Threat – A risk event that will have a negative impact on the scope, quality, schedule, or budget of the project should it happen.
* Opportunity – Not all risks are threats, some are opportunities which will have a positive impact on scope, quality, schedule, or budget should they happen. Threats should be avoided, or their impacts diminished and opportunities encouraged, or their impacts enhanced.
* Probability – The likelihood that a risk event will happen. This is what people in the gambling business call odds.
* Impact – Usually refers to a comparative cardinal or ordinal rank assigned to a risk event. It may also refer to an absolute monetary value, period of time, feature set, or quality level.
* Risk Tolerance – This refers to your organization’s approach to taking risks. Is it conservative? Does your organization welcome calculated risks?
* Risk Threshold – Your organization’s risk tolerance will usually be expressed as a cardinal or ordinal comparator using the risk events probability and impact to produce the comparator. Risks whose Probability/Impact score exceed this threshold will be avoided or mitigated. Risks whose score is below the threshold are acceptable.
* Risk Contingency – This is a sum allotted to the project for the purpose of managing risks. It should be split into two sums: one for managing identified risks and one for managing unidentified risks, or unknown unknowns. The sum can be either a monetary amount or an amount of time. Read the rest of this entry »