Risk management analysis in Scrum software projects

Risk and risk management in software projects: A reassessment

An international association advancing the multidisciplinary study of informing systems. Founded in 1998, the Informing Science Institute (ISI) is a global community of academics shaping the future of informing science.

Software project risk analysis using Bayesian networks with causality constraints

Economic Capital for Market Risk

This paper analyzes whether the Inter-American Development Bank (IDB, or Bank) has fully and effectively implemented the IDB-9 requirements related to risk and financial management. IDB-9 included four requirements in this area: (i) adopt a rule-based Income Management Model (IMM); (ii) implement the recently introduced risk-based Capital Adequacy Policy; (iii) execute a set of agreed actions to enhance the short-term sustainability of the Fund for Special Operations (FSO); and (iv) continue strengthening the Banks Risk Management Framework. The Bank has fully implemented the IDB-9 financial and risk management actions. The highly detailed and prescriptive nature of the requirements aided implementation. In terms of effectiveness, the IMM imposes financial discipline and enhances financial selfsustainability by linking Bank expenses directly to income through loan charges. The CAP supports prudent risk management and the Banks AAA rating. The actions taken for the FSO will not be sufficient to ensure the Funds sustainability until 2020, as mandated in IDB-9, and Management is preparing to propose additional measures for the Board¿s approval. A few issues with the IMM and CAP merit further review going forward. First, the IMM is very strict, with a high administrative expense coverage rule and its inclusion of nonoperational expenses. Second, it is not clear that the reserve ratios for sovereignguaranteed (SG) and non-sovereign-guaranteed (NSG) exposure adequately reflect their relative levels of risk or lead to the most effective leveraging of scarce Bank capital. Third, the Bank¿s unused borrowing capacity rule¿though perhaps reassuring to potential investors¿is outdated and is not relevant to the maintenance of the Bank¿s AAA rating, while a criterion that rating agencies do consider relevant¿country portfolio concentration¿is not factored into the Bank¿s rules. Finally, the IDB-9 architecture is inward-looking and does not promote a focus on the Bank¿s financial competitiveness. In light of these findings, OVE suggests that the Bank (i) consider introducing greater flexibility in the IMM by setting an administrative coverage band and perhaps excluding certain nonoperational expenses; (ii) review the capital accumulation rule and the reserve ratios for SG and NSG exposures; (iii) update the Bank¿s financial rules by phasing out the borrowing authority limit; and (iv) use the financial and risk management architecture as input to strategic decision-making on the projected size of the Bank, the blend of SG and NSG lending, expected countercyclical support, the role of the FSO, and the Bank¿s approach to future capitalization.

In a country like Ethiopia, where information and communication systems are in the early stage of development, software projects may face several challenges. Risk is one of the factors that challenges project performance, and even causes failure. Risk management helps project managers to control the effect of risks. However, risk management appears to be the least practiced component of project management. To help understand the software risk management practice in the developing countries (DC) context, this study explores the risk management practice of Ethiopian software projects. It also investigates the level of adoption of formal risk management models and which steps are included in the ad‐hoc risk management exercise. Finally, it looks into the relationship between risk management practice and project success. We conducted a survey of 45 banks, insurance companies and United Nations agency offices in Addis Ababa, Ethiopia. In this study, a very low rate of application of formal risk management models was observed. We observed a different perception of risk management whereby only watching projects to see if any risks occur during implementation without performing risk identification and mitigation or response plan was considered as a risk management practice by project managers. It was also found that some project managers were not able to confidently tell whether risk management processes have taken place in the projects they manage.

Systems Engineering (SE) and Project / Program Management (pM / PM) struggle with Risk Management confusion in organizations embracing certifications of the two disciplines. Some of that confusion may remain even if an organization has standardized on their own Risk Management process if it adds yet another view and language of Risk Management (RM) process and activities. This Call is to encourage the collaboration of multiple organizations and standards committees, citing instances where alignment has been achieved and providing twelve recommendations for exploration of opportunities for improved program and systems engineering RM function. This paper is an elaboration of the RM section of last year's paper, (Arnold, 2012) based on the two certification bases. The Systems Engineering Handbook (Haskins, 2011), the Project Management Body of Knowledge (PMBoK) (PMI, 2008), and the Systems Engineering Body of Knowledge (SEBoK) (Pyster et al, 2012) are explored, with other RM contributors.

The use of agile methods tends to keep risks under control in software projects, due to their inherent characteristics of small increments, work visibility and expectation management. Thus, explicit risk management in agile projects has often been neglected, as the use of agile methods, with a focus on rapid value delivery, tends to lead to implicit risk management. However, software projects that use agile methods also can fail and implicit risk management may often not be sufficient for certain contexts. This has sparked research interest in the possible need for explicit risk management in software organizations that use agile methods. Motivated by the lack of information about risk management in agile software development contexts, in this work a comprehensive survey is carried out to understand how software development organizations that use agile methods are managing risk. We conducted an online survey with a statistically significant sample of 273 agile professionals in Brazil. Our findings indicate that although most organizations engage in some form of explicit risk management, a significant proportion consider agile methods insufficient for comprehensive risk mitigation. We also observed a set of 15 explicit risk management practices in agile contexts, with some agile ceremonies, notably daily and sprint planning meetings, emerging as conducive to the integration of explicit risk management practices. We also verified a statistically relevant association between these agile ceremonies and risk management processes.

Based on analyzing the characteristics of supply chain risk management under the influences of knowledge, in this paper integrates basic theories and methods of knowledge management into the process of risk management, builds a knowledge-oriented supply chain risk management system model, and proposes relevant strategies, presenting references for practical application of knowledge-oriented supply chain risk management. By means of acquiring, storing, sharing, and transferring supply chain risk knowledge and knowledge innovation, it can ensure the knowledge supply for the whole process of supply chain operation management and risk management, effectively blocking the evolution and transmission of risks in supply chain, realizing the added value of activities in supply chain, and improving the performance of supply chain.

This paper examines the relationship between operational risk management and knowledge learning process, with an emphasis on establishing the importance of statistical and mathematical approach on organizational capability to forecast, mitigate and control uncertain and vulnerable situations. Knowledge accumulation reduces critical situations unpredictability and improves organizational capability to face uncertain and potentially harmful events. We retain mathematical and statistical knowledge is organizational key factor in risk measuring and management process. Statistical creativity contributes to make quicker the innovation process of organization improves exploration capacity to forecast critical events and increases problem solving capacity, adaptation ability and learning process of organization. We show some important features of statistical approach. First, it makes clear strategic importance of risk culture within every level of organization; quantitative analysis support the emergence of latent troubles and make evident vulnerability of organization. Second, innovative tools allow to improve risk management and organizational capability to measure total risk exposition and to define a more adequate forecasting and corrective strategy. Finally, it’s not so easy to distinguish between measurable risk and unmeasurable uncertainty, it depends on quantity and quality of available knowledge. Difficulty predictable extreme events can bring out crisis and vulnerable situations. Every innovative approach which increases knowledge accumulation and improves forecasting process should be considered.

This paper provides insights on the link between operational risk management, disaster recovery (DR), business continuity planning (BCP), outsourcing and operational resilience, for financial services. Core of the analysis of this paper is examining the use of stress and scenario testing for operational risks, focusing on the UK insurance sector as a case study. Specifically, it presents a critical analysis on the application of this risk management tool in risk and crisis management, from a resilience lens. The aim of this practical paper is to highlight the relationship between DR, BCP, third party risk management (TPRM) and operational resilience from a scenario analysis angle and testing requirements. This comparison of existing regulatory prescribed stress tests supports the recommendations for the development of company-specific severe but plausible scenarios. Guidance on the development, design, assessment and quantification of idiosyncratic scenarios is presented, building on the lessons learned from the regulatory prescribed stress tests. Overall, this research highlights the application of scenario analysis and stress testing as a core element of risk management practices for UK insurance companies in meeting operational resilience requirements, while enhancing their DR, BCP, TPRM and their overall approach in managing operational risks. Insights on advances in scenario analysis and stress testing for cyber risks and operational resilience are sought, considering the developments around FinTech and providing practical guidance for their implementation. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business.

This study explores the impact of the Risk-Based Internal Audit approach on improving risk management processes in Yemeni Islamic banks in Aden. The study focuses on four core RBIA functions: early identification, risk assessment, control evaluation, and monitoring and reporting. Data from eight banks were analyzed using SPSS, linear regression, and ANOVA. In light of the study's results, there is a statistically significant impact of the risk-based internal audit approach in improving risk management processes in Islamic banks operating in Aden by 51.3%. According to the results, the control evaluation function ranked first in influencing the improvement of risk management processes with a rate of 45.2%, followed by risk assessment at 39.9%, and early detection at 32.2%. The study suggests that the management of Yemeni Islamic banks should take into account the recommendations and reports submitted by the Internal Audit Department regarding risk management activities and processes and proposals for improvement, in addition to the need for the management of Yemeni Islamic banks to support and develop communication systems between them and the Internal Audit Department to facilitate the exchange of necessary information on time, to support the monitoring and reporting function, which had the lowest impact rate of 24.3%.

Risk control and management are becoming increasingly important in many organisational operations. It goes beyond the business sector to include security organisations like police departments. The fact that police officers engage in a widerange of daily activities that expose them to a variety of potentially hazardous situations Police risk management includes both physical and financial aspects. Risk identification is the first step in the risk management process, followed by risk analysis, risk evaluation, and risk treatment. According to the literature, the Dubai Police Department has no framework in place to fully manage risks and evaluate the effectiveness of police operations. Early warning systems are critical for detecting potential severe RM because police departments must rely on them to manage risks and keep track of any potential new risks. As a result, the UAE police department's risk management strategy was investigated in this paper. It classified the data collection process using exploratory factor analysis, which wasa quantitative approach. A self-administered survey yielded 381 valid questionnaires from Dubai Police Department officers. The study's findings revealed that risk identification, risk analysis, risk evaluation, and risk response are the four fundamental steps of effective risk management. The Crobach Alpha test was used to assess the consistency and reliability of the data, and the result was 0.814, indicating that the data is suitable for use. Only one of the twenty indicators, which were divided into four groups for risk management, was weak according to outliers and communalities tests. The risk management process was accurately described by another 20 factors. Total variance extraction yielded a rate of 57.130 percent, which was higher than the required 50%. As a result, the risk management procedure investigated in this study may be useful for effectively managing risks in the UAE police force.

Construction projects in mineral processing plants in South Africa have high failure rates despite the availability of many risk management processes, tools and practices to project managers. This industry application paper investigates the effectiveness of risk management in mineral processing projects. The mining and mineral processing industry is one of the world's most uncertain and hazardous industries and in recent years South Africa has experienced its fair share of economic, political and industrial challenges. Despite these challenges, a recent survey revealed that many African mining executives remain focused on the importance of securing new projects to ensure future production and growth. These new projects include new and complex technologies aimed at increasing productivity and efficiencies in the extraction and processing of minerals. South African mining industry risks unique to the region include knowledge and skills shortage, quality of education, prevalence of HIV/AIDS, power outages, political involvement and increased talks on nationalization, insufficient expenditure on R&D projects and increased unionisation. The effective management of risks is essential for project performance especially in this particular industry, due to significant investments required as well as the combination of both construction and mining/mineral processing risks involved. The study uses qualitative research methods to collect and analyse data from project management practitioners involved in construction projects in mineral processing plants. Operational, financial, legal and compliance, political and SHE risks are identified as major risks that need to be effectively managed to reduce project failure. The actions and behaviours of leaders and followers in projects are found to precipitate project failure. These include limited risk knowledge and competence, complacency and poor collaboration with team members. Risk management processes are also noted as a problem as they tend to be complex and impractical. Finally, the lack of comprehensive application of formal risk management along all the stages of the project life cycle is found to have a negative effect on risk management. The study recommends the development of a risk management culture, project team training and the reassessment of the effectiveness of currently used risk management tools in order to improve project success rate.

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.