# data[].attributes.attachment_link.readable_text
It's no wonder only 29 percent of IT projects are completed successfully, according to The Standish Group. Project management consultants and software providers say they see IT departments making the same project management mistakes over and over: IT groups don't follow standard project management processes. They don't have the right staff working on projects. They don't assess the risks that could imperil their projects or determine ways to mitigate those risks. The list of mistakes unrolls like a ball of yarn.

MORE ON PROJECT MANAGEMENT

How To Spot a Failing Project

ABC: An Introduction to IT Project Management

When Project Failure Is Not an Option

How to Create a PMO and Select PM Software

Most of the project management mistakes IT departments make boil down to either a lack of adequate planning or breakdowns in communication (either among the project team or between the project team and the project sponsors). These mistakes can be fatal. They can also be avoided. And who better to point out the most common project management mistakes than project management vendors and consultants. (They also suggest ways to avoid them.)

The following list of the 14 most common project management mistakes ought to help you pinpoint where your projects are going wrong and measures you can take to improve them. The upside of avoiding these most common project management pitfalls is tremendous. Not only will your project success rate increase, you'll also improve satisfaction among internal customers, IT's stock inside the organization will increase in value, and the business will benefit from systems that make them more competitive that get delivered on time and on budget.

Staffing Mistakes

Mistake No. 1: Projects lack the right resources with the right skills.

Impact: Proper project staffing is critical, yet improperly allocating resources tops the list of most common project management mistakes. Not having the right people on a project can kill it. "The key to getting a project successfully accomplished is getting the right people with the right skills," says Joel Koppelman, CEO of project management software vendor Primavera. "All the planning in the world won't overcome an insufficiency of talent."

Solution: IT and project managers need full visibility into the skills and workloads of all of their resources, including consultants, contractors and outsourcers, who often get left out of skills assessments even though they're doing a "huge" proportion of work, says Koppelman. Project management software can provide such visibility into everyone's skills and workloads.

Once IT and project managers know who's doing what, they have to figure out how to allocate resources across myriad projects and day-to-day work.

"There are all kinds of organizational models," says Richard Scannell, co-founder of IT infrastructure consultancy GlassHouse Technologies. "I've never seen anything that works well. There's no easy answer [to the resource allocation question]."

You just have to try synchronizing people and projects as best you can, says Koppelman, adding that one potential solution is to appoint a resource manager who's responsible for figuring out who will be assigned to each project and for ensuring there's a fair allocation of talent across projects.

Scannell suggests setting up "tiger teams" where people get taken out of their traditional job responsibility for a year or more to work on a specific project. Ken Cheney, director of HP Software's PPM Center, recommends assigning resources at a project level as opposed to a specific task level, which he says is much more arduous.

If you're still hard-pressed to adequately staff projects, you may be able to free up resources by cancelling a "discretionary" project (e.g. one that isn't tightly tied to the business strategy), says Cheney. He suggests looking at your entire portfolio of projects your IT staff is working on to identify ones that aren't mission-critical. "By stopping those projects and reallocating resources to projects that will have the biggest impact, the organization as a whole can be much more successful," he says.

Mistake No. 2: Projects lack experienced project managers.

Impact: Projects can quickly grow out of control without a savvy project manager at the helm.

Solution: Hire project managers with certifications and the finesse required to manage stakeholders. Matthew Strazza, vice president of services (North America) for CA, says good project managers have to have strong soft skills. They need to know how to facilitate meetings, manage risk and handle a variety of different stakeholders-the business people who are looking for functionality, the IT people who care about security, and the financial people who are worried about the budget.

"If you're not addressing the financials, managing the budget on a week-to-week basis and notifying the client of any change, you can get into trouble pretty quickly," says Strazza.

Good project managers also need to possess technical expertise in whatever technology is being deployed, he adds.

Process Mistakes

Mistake No. 3: IT doesn't follow a standard, repeatable project management process.

Impact: This is the second of the most common project management mistakes. Lack of methodology increases the risk that tasks related to the project will fall through the cracks, that projects will have to be re-worked, and ultimately that a project won't be completed on time or on budget.

Solution: A project management methodology helps you tackle projects efficiently and makes you aware of all the activities involved in the execution of a project.

"Having in place a baseline of standards and methodologies will remove a lot of the risk associated with IT projects," says HP's Cheney.

Douglas Clark, CEO of Métier, a provider of project portfolio management solutions, recommends establishing repeatable processes for scoping, scheduling, allocating resources and communicating with stakeholders. "Those are the things you want to get a handle on first because they would probably give you the biggest payoff," he says.

Mistake No. 4: IT gets hamstrung by too much process.

Impact: Too much process makes the project team inflexible, and their inflexibility frustrates stakeholders.

Fumi Kondo, managing director of NYC-based consultancy Intellilink Solutions, once observed an exchange between a software developer and a project manager where the developer told the project manager that he could add extra features to an application with no additional effort. The project manager told the developer not to add the extra features because users hadn't asked for them. "My response would have been, 'Go to the users and see if those features are useful,'" says Kondo. "I see nothing wrong with over-delivering if it doesn't impact the budget or the schedule."

Solution: Be flexible and communicate with project sponsors and stakeholders.

Mistake No. 5: They don't track changes to the scope of the project.

Implication: The budget for the project explodes. So does the timeline.

Solution: CA's Strazza recommends following a formal change request process: The individual requesting the change in scope (e.g. additional features or functionality) needs to explain the specific changes on a change-in-scope document, and the project manager needs to determine how that request will impact the budget and timeline. The project sponsor has to sign off on the change-in-scope request.

Mistake No. 6: They lack up-to-date data about the status of projects.

Impact: You can't manage what you can't measure, as Peter Drucker would say. Nor can you coordinate resources or react to changes in scope, says HP's Cheney.

Solution: Software.

Mistake No. 7: They ignore problems.

Impact: Problems don't solve themselves. They fester the longer you ignore them and ultimately compound the cost of the project.

Solution: "If you do something wrong, it's about how well you fix it," says GlassHouse Technologies' Scannell. "Most people batten down the hatches and look up in the month. Understanding when you're starting to fail and quickly being able to engage as many stakeholders as possible to fix it is critical."

Planning Mistakes

Mistake No. 8: They don't take the time to define the scope of a project.

Impact: If a project's scope isn't well-defined by the business and IT up front, the project can end up ballooning like Friends actor Matthew Perry in the sitcom's later seasons. What's more, IT lacks the clarity and direction it needs to complete the project on time and on budget and meet the business's expectations.

Solution: Ill-defined projects are best served by a business case and a scoping exercise, says Intellilink Solutions' Kondo.

Mistake No. 9: They fail to see the dependencies between projects.

Impact: Projects don't happen in isolation. They're often dependant on other projects going on at the same time. When project managers fail to see the dependencies between projects-such as staff assigned to one project are needed on another&mdashh;projects get held up. Such slowdowns can have a ripple effect on all projects.

Solution: Take dependencies into account during project planning, says Métier's Clark. Talking with stakeholders and diagramming the project can help uncover dependencies.

Mistake No. 10: They don't consider Murphy's Law.

Impact: Stuff happens, and IT gets surprised by it. Consequently, the project goes off-track while IT tries to clean up a mess it didn't anticipate.

GlassHouse Technologies' Scannell recalls a company in the U.K. that his firm acquired, that was moving its mainframe to a new data center. The IT group devoted an entire Saturday to taking down the mainframe so that they could move it to the new data center the next day, he says. While the IT staff were en route to the new data center with the mainframe on Sunday, they ran into a gay pride parade, and they couldn't reach their destination due to roads blocked off for the parade. They had to drive back to the original data center and put Humpty Dumpty back together again. The lack of planning caused the IT staffers to do more work than was necessary.

Solution: Perform a risk assessment as part of the project planning. With your team, brainstorm what could happen to slow or derail the project, to make it go over budget, or to prevent you from delivering the expected requirements. Then figure out ways you can mitigate those risks, says Primavera CEO Koppelman. "If they sit down and think about those risks, they'll come up with a pretty good list," he says. "This exercise doesn't take a long time, and it's enormously helpful in understanding the soft spots in a project before it even gets underway."

Mistake No. 11: They give short shrift to change management.

Impact: All the time, money and hard work that went into delivering a new IT-enabled capability can be for naught if users don't adopt the new technology.

Solution: Spend time up front during the project planning phase to consider where resistance to a project will manifest itself and ways to address it, says Métier's Clark. Identify the stakeholders whose jobs will be impacted by the new capability, adds Intellilink Solutions' Kondo, and plan how you'll communicate changes to their processes and workflows with them. Not all of the changes will be negative.

Mistake No. 12: Project schedules are incomplete.

Impact: Project team members don't know what is due when, which makes completing the project on time a challenge.

Solution: Clark says a quick way to come up with a schedule for a project is to determine all the activities involved in getting the project done (e.g. scoping, getting requirements, testing and implementing) and then attaching due dates to those activities based on the deadline for the project. Project management software can also help create schedules.

Communication Problems

Mistake No. 13: IT doesn't push back on unreasonable deadlines.

Impact: IT sets itself up to fail and gets a reputation for not being able to deliver projects on time.

Clark says IT departments will scramble to accommodate project deadlines set by the CEO. But tampering with dependencies and with the plan only creates more problems that make delivering the project on time even more difficult, he says.

Solution: IT management has to explain to the CEO what it's going to take to meet that deadline in terms of cost and resources and has to get the CEO to choose between cost, scope and schedule, says Clark.

Mistake No. 14: They don't communicate well with project sponsors and stakeholders.

Impact: IT fails to deliver the expected requirements.

Solution: Project communications need to be catered to the audience, says Kondo. She sees misunderstandings about the scope of a project or a systems' requirements arise when IT departments hand over a spreadsheet to the business with thousands of lines describing the systems' functionality and specs. Because the business owners don't have time to look over such detailed technical documents, they ignore them.

# data[].attributes.attachment_link.title
Project Management: The 14 Most Common Mistakes IT Departments Make

# data[].attributes.attachment_link.description
It's no wonder only 29 percent of IT projects are completed successfully, according to The Standish Group. Project management consultants and software providers say they see IT departments making the same project management mistakes over and over: IT groups don't follow standard project management processes. They don't have the right staff working on projects.

# data[].attributes.body
Health and safety training
use of RISK profiling to determine required and most needed training.
Risk profiling

The risk profile of an organisation informs all aspects of the approach to leading and managing its health and safety risks.

Every organisation will have its own risk profile. This is the starting point for determining the greatest health and safety issues for the organisation. In some businesses the risks will be tangible and immediate safety hazards, whereas in other organisations the risks may be health-related and it may be a long time before the illness becomes apparent.

A risk profile examines:

the nature and level of the threats faced by an organisation

the likelihood of adverse effects occurring

the level of disruption and costs associated with each type of risk

the effectiveness of controls in place to manage those risks

The outcome of risk profiling will be that the right risks have been identified and prioritised for action, and minor risks will not have been given too much priority. It also informs decisions about what risk controls measures are needed

# data[].attributes.attachment_link.title
What Is Risk Mitigation and How Does It Relate to Project Management?

# data[].attributes.attachment_link.description
Learn what risk mitigation is and how project managers incorporate elements of risk mitigation into projects. Every project has some type of risk involved, and often these risks can't be completely eradicated. Instead, steps can be taken so that the risks are minimized. Processes for minimizing scheduling, cost, or monetary risks comprise various risk mitigation methods.

# data[].attributes.attachment_link.readable_text
Definition: Risk mitigation planning is the process of developing options and actions to enhance opportunities and reduce threats to project objectives [1]. Risk mitigation implementation is the process of executing risk mitigation actions. Risk mitigation progress monitoring includes tracking identified risks, identifying new risks, and evaluating risk process effectiveness throughout the project [1].

Keywords: risk, risk management, risk mitigation, risk mitigation implementation, risk mitigation planning, risk mitigation progress monitoring

MITRE SE Roles & Expectations: MITRE systems engineers (SEs) working on government programs develop actionable risk mitigation strategies and monitoring metrics, monitor implementation of risk mitigation plans to ensure successful project and program completion, collaborate with the government team in conducting risk reviews across projects and programs, and analyze metrics to determine ongoing risk status and identify serious risks to elevate to the sponsor or customer [2].

Background

Risk mitigation planning, implementation, and progress monitoring are depicted in Figure 1. As part of an iterative process, the risk tracking tool is used to record the results of risk prioritization analysis (step 3) that provides input to both risk mitigation (step 4) and risk impact assessment (step 2).

Figure 1. Risk Management: Fundamental Steps [3]

The risk mitigation step involves development of mitigation plans designed to manage, eliminate, or reduce risk to an acceptable level. Once a plan is implemented, it is continually monitored to assess its efficacy with the intent of revising the course-of-action if needed.

Risk Mitigation Strategies

General guidelines for applying risk mitigation handling options are shown in Figure 2. These options are based on the assessed combination of the probability of occurrence and severity of the consequence for an identified risk. These guidelines are appropriate for many, but not all, projects and programs.

Figure 2. Risk Mitigation Handling Options [3]

Risk mitigation handling options include:

Assume/Accept: Acknowledge the existence of a particular risk, and make a deliberate decision to accept it without engaging in special efforts to control it. Approval of project or program leaders is required.

Avoid: Adjust program requirements or constraints to eliminate or reduce the risk. This adjustment could be accommodated by a change in funding, schedule, or technical requirements.

Control: Implement actions to minimize the impact or likelihood of the risk.

Transfer: Reassign organizational accountability, responsibility, and authority to another stakeholder willing to accept the risk.

Watch/Monitor: Monitor the environment for changes that affect the nature and/or the impact of the risk.

Each of these options requires developing a plan that is implemented and monitored for effectiveness. More information on handling options is discussed under best practices and lessons learned below.

From a systems engineering perspective, common methods of risk reduction or mitigation with identified program risks include the following, listed in order of increasing seriousness of the risk [4]:

1. Intensified technical and management reviews of the engineering process

2. Special oversight of designated component engineering

3. Special analysis and testing of critical design items

4. Rapid prototyping and test feedback

5. Consideration of relieving critical design requirements

6. Initiation of fallback parallel developments

When determining the method for risk mitigation, the MITRE SE can help the customer assess the performance, schedule, and cost impacts of one mitigation strategy over another. For something like "parallel" development mitigation, MITRE SEs could help the government determine whether the cost could more than double, while time might not be extended by much (e.g., double the cost for parallel effort, but also added cost for additional program office and user engagement). For conducting rapid prototyping or changing operational requirements, MITRE SEs can use knowledge in creating prototypes and using prototyping and experimenting (see SE Guide article on Special Considerations for Conditions of Uncertainty: Prototyping and Experimentation and the Requirements Engineering topic) for projecting the cost and time to conduct a prototype to help mitigate particular risks (e.g., requirements). Implementing more engineering reviews and special oversight and testing may require changes to contractual agreements. MITRE systems engineers can help the government assess these (schedule and cost) by helping determine the basis of estimates for additional contractor efforts and providing a reality check for these estimates. MITRE's CASA [Center for Acquisition and Systems Analysis] and the CCG [Center for Connected Government] Investment Management practice department have experience and a knowledge base in many development activities across a wide spectrum of methods and can help with realistic assessments of mitigation alternatives.

For related information, refer to the other articles in this Risk Management topic area of the SE Guide.

Best Practices and Lessons Learned

What actions are needed?

When must actions be completed?

Handling Options

Assume/Accept. Collaborate with the operational users to create a collective understanding of risks and their implications. Risks can be characterized as impacting traditional cost, schedule, and performance parameters. Risks should also be characterized as impact to mission performance resulting from reduced technical performance or capability. Develop an understanding of all these impacts. Bringing users into the mission impact characterization is particularly important to selecting which "assume/accept" option is ultimately chosen. Users will decide whether accepting the consequences of a risk is acceptable. Provide the users with the vulnerabilities affecting a risk, countermeasures that can be performed, and residual risk that may occur. Help the users understand the costs in terms of time and money.

Avoid. Again, work with users to achieve a collective understanding of the implications of risks. Provide users with projections of schedule adjustments needed to reduce risk associated with technology maturity or additional development to improve performance. Identify capabilities that will be delayed and any impacts resulting from dependencies on other efforts. This information better enables users to interpret the operational implications of an "avoid" option.

Control. Help control risks by performing analyses of various mitigation options. For example, one option is to use a commercially available capability instead of a contractor developed one. In developing options for controlling risk in your program, seek out potential solutions from similar risk situations of other MITRE customers, industry, and academia. When considering a solution from another organization, take special care in assessing any architectural changes needed and their implications.

Transfer. Reassigning accountability, responsibility, or authority for a risk area to another organization can be a double-edged sword. It may make sense when the risk involves a narrow specialized area of expertise not normally found in program offices. But, transferring a risk to another organization can result in dependencies and loss of control that may have their own complications. Position yourself and your customer to consider a transfer option by acquiring and maintaining awareness of organizations within your customer space that focus on specialized needs and their solutions. Acquire this awareness as early in the program acquisition cycle as possible, when transfer options are more easily implemented.

Watch/Monitor. Once a risk has been identified and a plan put in place to manage it, there can be a tendency to adopt a "heads down" attitude, particularly if the execution of the mitigation appears to be operating on "cruise control." Resist that inclination. Periodically revisit the basic assumptions and premises of the risk. Scan the environment to see whether the situation has changed in a way that affects the nature or impact of the risk. The risk may have changed sufficiently so that the current mitigation is ineffective and needs to be scrapped in favor of a different one. On the other hand, the risk may have diminished in a way that allows resources devoted to it to be redirected.

Determining Mitigation Plans

Understand the users and their needs. The users/operational decision makers will be the decision authority for accepting and avoiding risks. Maintain a close relationship with the user community throughout the system engineering life cycle. Realize that mission accomplishment is paramount to the user community and acceptance of residual risk should be firmly rooted in a mission decision.

Seek out the experts and use them. Seek out the experts within and outside MITRE. MITRE's technical centers exist to provide support in their specialty areas. They understand what's feasible, what's worked and been implemented, what's easy, and what's hard. They have the knowledge and experience essential to risk assessment in their area of expertise. Know our internal centers of excellence, cultivate relationships with them, and know when and how to use them.

Recognize risks that recur. Identify and maintain awareness of the risks that are "always there" — interfaces, dependencies, changes in needs, environment and requirements, information security, and gaps or holes in contractor and program office skill sets. Help create an acceptance by the government that these risks will occur and recur and that plans for mitigation are needed up front. Recommend various mitigation approaches — including adoption of an evolution strategy, prototyping, experimentation, engagement with broader stakeholder community, and the like.

Encourage risk taking. Given all that has been said in this article and its companions, this may appear to be an odd piece of advice. The point is that there are consequences of not taking risks, some of which may be negative. Help the customer and users understand that reality and the potential consequences of being overly timid and not taking certain risks in your program. An example of a negative consequence for not taking a risk when delivering a full capability is that an adversary might realize a gain against our operational users. Risks are not defeats, but simply bumps in the road that need to be anticipated and dealt with.

Recognize opportunities. Help the government understand and see opportunities that may arise from a risk. When considering alternatives for managing a particular risk, be sure to assess whether they provide an opportunistic advantage by improving performance, capacity, flexibility, or desirable attributes in other areas not directly associated with the risk.

Encourage deliberate consideration of mitigation options. This piece of advice is good anytime, but particularly when supporting a fast-paced, quick reaction government program that is juggling many competing priorities. Carefully analyze mitigation options and encourage thorough discussion by the program team. This is the form of the wisdom "go slow to go fast."

Not all risks require mitigation plans. Risk events assessed as medium or high criticality should go into risk mitigation planning and implementation. On the other hand, consider whether some low criticality risks might just be tracked and monitored on a watch list. Husband your risk-related resources.

Mitigation Plan Content

Determine the appropriate risk manager.The risk manager is responsible for identifying and implementing the risk mitigation plan. He or she must have the knowledge, authority, and resources to implement the plan. Risk mitigation activities will not be effective without an engaged risk manager. It may be necessary to engage higher levels in the customer organization to ensure the need for the risk manager is addressed. This can be difficult and usually involves engaging more senior levels of the MITRE team as well.

Develop a high-level mitigation strategy. This is an overall approach to reduce the risk impact severity and/or probability of occurrence. It could affect a number of risks and include, for example, increasing staffing or reducing scope.

Identify actions and steps needed to implement the mitigation strategy. Ask these key questions:

What actions are needed?

Make sure you have the right exit criteria for each. For example, appropriate decisions, agreements, and actions resulting from a meeting would be required for exit, not merely the fact that the meeting was held.

Look for evaluation, proof, and validation of met criteria. Consider, for example, metrics or test events.

Include only and all stakeholders relevant to the step, action, or decisions.

When must actions be completed?

Backward Planning: Evaluate the risk impact and schedule of need for the successful completion of the program and evaluate test events, design considerations, and more.

Forward Planning: Determine the time needed to complete each action step and when the expected completion date should be.

Evaluate key decision points and determine when a move to a contingency plan should be taken.

Who is the responsible action owner?

What resources are required? Consider, for example, additional funding or collaboration.

How will this action reduce the probability or severity of impact?

Develop a contingency plan ("fall back, plan B") for any high risk.

Are cues and triggers identified to activate contingency plans and risk reviews?

Include decision point dates to move to fallback plans. The date to move must allow time to
execute the contingency plan.

Evaluate the status of each action. Determine when each action is expected to be completed successfully.

Integrate plans into IMS and program management baselines. Risk plans are integral to the program, not something apart from it.

Monitoring Risk

Include risk monitoring as part of the program review and manage continuously. Monitoring risks should be a standard part of program reviews. At the same time, risks should be managed continuously rather than just before a program review. Routinely review plans in management meetings.

Review and track risk mitigation actions for progress. Determine when each action is expected to be completed successfully.

Refine and redefine strategies and action steps as needed.

Revisit risk analysis as plans and actions are successfully completed. Are the risks burning down? Evaluate impact to program critical path.

Routinely reassess the program's risk exposure. Evaluate the current environment for new risks or modification to existing risks.

References & Resources

1. Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK Guide), Fourth Edition, ANSI/PMI 99-001-2008, pp. 273-312.

2. The MITRE Institute, September 1, 2007, MITRE Systems Engineering (SE) Competency Model, Version 1, pp. 10, 40-41.

3. Garvey, P.R., 2008, Analytical Methods for Risk Management: A Systems Engineering Perspective, Chapman-Hall/CRC-Press, Taylor & Francis Group (UK), Boca Raton, London, New York, ISBN: 1584886374.

4. Kossiakoff, A. and W.N. Sweet, 2003, Systems Engineering Principles and Practice, John Wiley and Sons, Inc., pp. 98-106.

Additional References & Resources

International Council on Systems Engineering (INCOSE), January 2010, INCOSE Systems Engineering Handbook, Version 3.2, INCOSE-TP-2003-002-03.2, pp. 213-225.

# data[].attributes.attachment_link.title
Risk Mitigation Planning, Implementation, and Progress Monitoring

# data[].attributes.attachment_link.description
Definition: Risk mitigation planning is the process of developing options and actions to enhance opportunities and reduce threats to project objectives [1]. Risk mitigation implementation is the process of executing risk mitigation actions. Risk mitigation progress monitoring includes tracking identified risks, identifying new risks, and evaluating risk process effectiveness throughout the project [1].

# data[].attributes.attachment_link.title
5 Benefits of Health and Safety Training

# data[].attributes.attachment_link.description
Meeting government requirements for Health and Safety, of course, has the ultimate goal of protecting your employees from harm.

# data[].attributes.attachment_link.readable_text
Definition: Risk mitigation planning is the process of developing options and actions to enhance opportunities and reduce threats to project objectives [1]. Risk mitigation implementation is the process of executing risk mitigation actions. Risk mitigation progress monitoring includes tracking identified risks, identifying new risks, and evaluating risk process effectiveness throughout the project [1].

Keywords: risk, risk management, risk mitigation, risk mitigation implementation, risk mitigation planning, risk mitigation progress monitoring

MITRE SE Roles & Expectations: MITRE systems engineers (SEs) working on government programs develop actionable risk mitigation strategies and monitoring metrics, monitor implementation of risk mitigation plans to ensure successful project and program completion, collaborate with the government team in conducting risk reviews across projects and programs, and analyze metrics to determine ongoing risk status and identify serious risks to elevate to the sponsor or customer [2].

Background

Risk mitigation planning, implementation, and progress monitoring are depicted in Figure 1. As part of an iterative process, the risk tracking tool is used to record the results of risk prioritization analysis (step 3) that provides input to both risk mitigation (step 4) and risk impact assessment (step 2).

Figure 1. Risk Management: Fundamental Steps [3]

The risk mitigation step involves development of mitigation plans designed to manage, eliminate, or reduce risk to an acceptable level. Once a plan is implemented, it is continually monitored to assess its efficacy with the intent of revising the course-of-action if needed.

Risk Mitigation Strategies

General guidelines for applying risk mitigation handling options are shown in Figure 2. These options are based on the assessed combination of the probability of occurrence and severity of the consequence for an identified risk. These guidelines are appropriate for many, but not all, projects and programs.

Figure 2. Risk Mitigation Handling Options [3]

Risk mitigation handling options include:

Assume/Accept: Acknowledge the existence of a particular risk, and make a deliberate decision to accept it without engaging in special efforts to control it. Approval of project or program leaders is required.

Avoid: Adjust program requirements or constraints to eliminate or reduce the risk. This adjustment could be accommodated by a change in funding, schedule, or technical requirements.

Control: Implement actions to minimize the impact or likelihood of the risk.

Transfer: Reassign organizational accountability, responsibility, and authority to another stakeholder willing to accept the risk.

Watch/Monitor: Monitor the environment for changes that affect the nature and/or the impact of the risk.

Each of these options requires developing a plan that is implemented and monitored for effectiveness. More information on handling options is discussed under best practices and lessons learned below.

From a systems engineering perspective, common methods of risk reduction or mitigation with identified program risks include the following, listed in order of increasing seriousness of the risk [4]:

1. Intensified technical and management reviews of the engineering process

2. Special oversight of designated component engineering

3. Special analysis and testing of critical design items

4. Rapid prototyping and test feedback

5. Consideration of relieving critical design requirements

6. Initiation of fallback parallel developments

When determining the method for risk mitigation, the MITRE SE can help the customer assess the performance, schedule, and cost impacts of one mitigation strategy over another. For something like "parallel" development mitigation, MITRE SEs could help the government determine whether the cost could more than double, while time might not be extended by much (e.g., double the cost for parallel effort, but also added cost for additional program office and user engagement). For conducting rapid prototyping or changing operational requirements, MITRE SEs can use knowledge in creating prototypes and using prototyping and experimenting (see SE Guide article on Special Considerations for Conditions of Uncertainty: Prototyping and Experimentation and the Requirements Engineering topic) for projecting the cost and time to conduct a prototype to help mitigate particular risks (e.g., requirements). Implementing more engineering reviews and special oversight and testing may require changes to contractual agreements. MITRE systems engineers can help the government assess these (schedule and cost) by helping determine the basis of estimates for additional contractor efforts and providing a reality check for these estimates. MITRE's CASA [Center for Acquisition and Systems Analysis] and the CCG [Center for Connected Government] Investment Management practice department have experience and a knowledge base in many development activities across a wide spectrum of methods and can help with realistic assessments of mitigation alternatives.

For related information, refer to the other articles in this Risk Management topic area of the SE Guide.

Best Practices and Lessons Learned

What actions are needed?

When must actions be completed?

Handling Options

Assume/Accept. Collaborate with the operational users to create a collective understanding of risks and their implications. Risks can be characterized as impacting traditional cost, schedule, and performance parameters. Risks should also be characterized as impact to mission performance resulting from reduced technical performance or capability. Develop an understanding of all these impacts. Bringing users into the mission impact characterization is particularly important to selecting which "assume/accept" option is ultimately chosen. Users will decide whether accepting the consequences of a risk is acceptable. Provide the users with the vulnerabilities affecting a risk, countermeasures that can be performed, and residual risk that may occur. Help the users understand the costs in terms of time and money.

Avoid. Again, work with users to achieve a collective understanding of the implications of risks. Provide users with projections of schedule adjustments needed to reduce risk associated with technology maturity or additional development to improve performance. Identify capabilities that will be delayed and any impacts resulting from dependencies on other efforts. This information better enables users to interpret the operational implications of an "avoid" option.

Control. Help control risks by performing analyses of various mitigation options. For example, one option is to use a commercially available capability instead of a contractor developed one. In developing options for controlling risk in your program, seek out potential solutions from similar risk situations of other MITRE customers, industry, and academia. When considering a solution from another organization, take special care in assessing any architectural changes needed and their implications.

Transfer. Reassigning accountability, responsibility, or authority for a risk area to another organization can be a double-edged sword. It may make sense when the risk involves a narrow specialized area of expertise not normally found in program offices. But, transferring a risk to another organization can result in dependencies and loss of control that may have their own complications. Position yourself and your customer to consider a transfer option by acquiring and maintaining awareness of organizations within your customer space that focus on specialized needs and their solutions. Acquire this awareness as early in the program acquisition cycle as possible, when transfer options are more easily implemented.

Watch/Monitor. Once a risk has been identified and a plan put in place to manage it, there can be a tendency to adopt a "heads down" attitude, particularly if the execution of the mitigation appears to be operating on "cruise control." Resist that inclination. Periodically revisit the basic assumptions and premises of the risk. Scan the environment to see whether the situation has changed in a way that affects the nature or impact of the risk. The risk may have changed sufficiently so that the current mitigation is ineffective and needs to be scrapped in favor of a different one. On the other hand, the risk may have diminished in a way that allows resources devoted to it to be redirected.

Determining Mitigation Plans

Understand the users and their needs. The users/operational decision makers will be the decision authority for accepting and avoiding risks. Maintain a close relationship with the user community throughout the system engineering life cycle. Realize that mission accomplishment is paramount to the user community and acceptance of residual risk should be firmly rooted in a mission decision.

Seek out the experts and use them. Seek out the experts within and outside MITRE. MITRE's technical centers exist to provide support in their specialty areas. They understand what's feasible, what's worked and been implemented, what's easy, and what's hard. They have the knowledge and experience essential to risk assessment in their area of expertise. Know our internal centers of excellence, cultivate relationships with them, and know when and how to use them.

Recognize risks that recur. Identify and maintain awareness of the risks that are "always there" — interfaces, dependencies, changes in needs, environment and requirements, information security, and gaps or holes in contractor and program office skill sets. Help create an acceptance by the government that these risks will occur and recur and that plans for mitigation are needed up front. Recommend various mitigation approaches — including adoption of an evolution strategy, prototyping, experimentation, engagement with broader stakeholder community, and the like.

Encourage risk taking. Given all that has been said in this article and its companions, this may appear to be an odd piece of advice. The point is that there are consequences of not taking risks, some of which may be negative. Help the customer and users understand that reality and the potential consequences of being overly timid and not taking certain risks in your program. An example of a negative consequence for not taking a risk when delivering a full capability is that an adversary might realize a gain against our operational users. Risks are not defeats, but simply bumps in the road that need to be anticipated and dealt with.

Recognize opportunities. Help the government understand and see opportunities that may arise from a risk. When considering alternatives for managing a particular risk, be sure to assess whether they provide an opportunistic advantage by improving performance, capacity, flexibility, or desirable attributes in other areas not directly associated with the risk.

Encourage deliberate consideration of mitigation options. This piece of advice is good anytime, but particularly when supporting a fast-paced, quick reaction government program that is juggling many competing priorities. Carefully analyze mitigation options and encourage thorough discussion by the program team. This is the form of the wisdom "go slow to go fast."

Not all risks require mitigation plans. Risk events assessed as medium or high criticality should go into risk mitigation planning and implementation. On the other hand, consider whether some low criticality risks might just be tracked and monitored on a watch list. Husband your risk-related resources.

Mitigation Plan Content

Determine the appropriate risk manager.The risk manager is responsible for identifying and implementing the risk mitigation plan. He or she must have the knowledge, authority, and resources to implement the plan. Risk mitigation activities will not be effective without an engaged risk manager. It may be necessary to engage higher levels in the customer organization to ensure the need for the risk manager is addressed. This can be difficult and usually involves engaging more senior levels of the MITRE team as well.

Develop a high-level mitigation strategy. This is an overall approach to reduce the risk impact severity and/or probability of occurrence. It could affect a number of risks and include, for example, increasing staffing or reducing scope.

Identify actions and steps needed to implement the mitigation strategy. Ask these key questions:

What actions are needed?

Make sure you have the right exit criteria for each. For example, appropriate decisions, agreements, and actions resulting from a meeting would be required for exit, not merely the fact that the meeting was held.

Look for evaluation, proof, and validation of met criteria. Consider, for example, metrics or test events.

Include only and all stakeholders relevant to the step, action, or decisions.

When must actions be completed?

Backward Planning: Evaluate the risk impact and schedule of need for the successful completion of the program and evaluate test events, design considerations, and more.

Forward Planning: Determine the time needed to complete each action step and when the expected completion date should be.

Evaluate key decision points and determine when a move to a contingency plan should be taken.

Who is the responsible action owner?

What resources are required? Consider, for example, additional funding or collaboration.

How will this action reduce the probability or severity of impact?

Develop a contingency plan ("fall back, plan B") for any high risk.

Are cues and triggers identified to activate contingency plans and risk reviews?

Include decision point dates to move to fallback plans. The date to move must allow time to
execute the contingency plan.

Evaluate the status of each action. Determine when each action is expected to be completed successfully.

Integrate plans into IMS and program management baselines. Risk plans are integral to the program, not something apart from it.

Monitoring Risk

Include risk monitoring as part of the program review and manage continuously. Monitoring risks should be a standard part of program reviews. At the same time, risks should be managed continuously rather than just before a program review. Routinely review plans in management meetings.

Review and track risk mitigation actions for progress. Determine when each action is expected to be completed successfully.

Refine and redefine strategies and action steps as needed.

Revisit risk analysis as plans and actions are successfully completed. Are the risks burning down? Evaluate impact to program critical path.

Routinely reassess the program's risk exposure. Evaluate the current environment for new risks or modification to existing risks.

References & Resources

1. Project Management Institute, A Guide to the Project Management Body of Knowledge, (PMBOK Guide), Fourth Edition, ANSI/PMI 99-001-2008, pp. 273-312.

2. The MITRE Institute, September 1, 2007, MITRE Systems Engineering (SE) Competency Model, Version 1, pp. 10, 40-41.

3. Garvey, P.R., 2008, Analytical Methods for Risk Management: A Systems Engineering Perspective, Chapman-Hall/CRC-Press, Taylor & Francis Group (UK), Boca Raton, London, New York, ISBN: 1584886374.

4. Kossiakoff, A. and W.N. Sweet, 2003, Systems Engineering Principles and Practice, John Wiley and Sons, Inc., pp. 98-106.

Additional References & Resources

International Council on Systems Engineering (INCOSE), January 2010, INCOSE Systems Engineering Handbook, Version 3.2, INCOSE-TP-2003-002-03.2, pp. 213-225.

# data[].attributes.attachment_link.title
Risk Mitigation Planning, Implementation, and Progress Monitoring

# data[].attributes.attachment_link.description
Definition: Risk mitigation planning is the process of developing options and actions to enhance opportunities and reduce threats to project objectives [1]. Risk mitigation implementation is the process of executing risk mitigation actions. Risk mitigation progress monitoring includes tracking identified risks, identifying new risks, and evaluating risk process effectiveness throughout the project [1].

# data[].attributes.body
http://www.nap.edu/read/11183/chapter/7

The ultimate purpose of risk identification and analysis is to prepare for risk mitigation.

https://www.mitre.org/publications/systems-engineering-guide/acquisition-systems-engineering/risk-management/risk-mitigation-planning-implementation-and-progress-monitoring

Risk mitigation planning is the process of developing options and actions to enhance opportunities and reduce threats to project objectives.

http://www.brighthubpm.com/risk-management/49633-why-risk-mitigation-is-important-to-project-managers/

Risk mitigation is the act of decreasing the riskiness of a project.

# data[].attributes.body
Mitigation
Communication/monitoring:

Solution: "The project manager should start by calling the team together (being certain to include off-site staff via the best technology available) and delivering a presentation about the project and its significance in a way that gets everybody fired up."
Solution: "Having a clear process that must be followed is the best way to ensure the pertinent details -- how much it will cost, why it is necessary, the impact on the overall project -- are known before the change is approved. It's also extremely effective for auditing performance during and after project completion."
Solution: Pick a day and time to meet each week (either virtually or in person) that works for the team (not just the project manager) -- and stick with it. "Having specific days and times scheduled, in advance, helps to keep everyone on the same page and keeps the project flowing."
http://www.cio.com/article/2391872/project-management/12-common-project-management-mistakes--and-how-to-avoid-them.html

# data[].attributes.attachment_link.title
Effective Meetings | Workplaces That Work | HR Toolkit | hrcouncil.ca

# data[].attributes.attachment_link.description
Once the objective(s) has been clearly stated and the participants selected, make sure to communicate this prior to the meeting so that they can prepare in advance. This simple step will assure that the meeting can benefit all parties involved and accomplish its goal.

# data[].attributes.attachment_link.readable_text
Like it or not, communication is the most important component within any project. The success of most projects, whether handled by a dedicated project team or a cross-departmental team, depends upon a set of crucial communication skills and techniques. Interestingly enough, all IT project and development managers that I interviewed agreed: Communication and human interaction make or break a project.

We sometimes forget that project communications refer to the specific behavior and techniques used to motivate, lead, delegate, and report back to all stakeholders working on the project. There are three clear communication channels that managers need to establish once the project has started (See Figure A). Managing and improving these channels can dramatically increase your chances of success.

Figure A

Communication affects performance. Therefore, if you want high-performance teams working on a project, you need effective communications entrenched to make sure you get these kinds of results. Without well-established channels, it is likely that the project will fail. Successful project managers typically have good communications skills that include being able to effectively present the issues, listen and act on feedback, and foster harmony among team members.

Reinforcing project communications
An effective communications plan will:

Facilitate team development: Proper communication actually provides the basis for the project team to work together and understand objectives and tasks to be completed. Better communication means better performance.

Be used throughout the software development process: From defining the user requirements to implementing the product, a proper communication plan aids in informing all project stakeholders what communication channels will be used on the project, who will report to whom, and the frequency, type, and format of project meetings.

Make it easier to update stakeholders: Frequent communications keep stakeholders in the loop.

Save on creating additional project documentation: By taking effective communication steps from the day the project starts, you may see a reduction in project documentation.

Use the plan to resolve critical issues
I was recently asked by my CIO to assess how one of our most critical e-commerce projects had literally fallen apart at the seams. A quick assessment showed that the project failed because of poor communications. The client was very unsatisfied with the way in which the project was being managed. He expressed his displeasure by saying, "All the project manager had to do was to either ask or come and see me, and we could've resolved this issue." There were also complaints about insufficient project status reports and how the project failed to deliver the application as the client wanted it. An initial kickoff document and a few e-mails were distributed, but that was it. No follow-up meetings were conducted and the client was left without any means of tracking progress. The client complained that he hardly ever saw anyone from the project and had wondered what was going on.
The project manager indicated that it was the developers who had failed to develop the application correctly, a problem that meant he had to "fight fires" most of the time. Nevertheless, our company lost a valuable client, had unhappy project members, and a failed project. The CIO later said, "This is not what I want to hear on my watch; why didn't someone tell me what was going on?" An effective communications plan could have helped avoid most of these problems.

Effectively improving your communications
Project communication isn't always as easy as it may seem, but it is a foundation you can use to build your team, demonstrate your leadership, and provide timely project direction. See Table A for some of the communication tools that project/development managers have available.
Table A

You need to go back to basics to determine which tools to use to remedy poor project communications. Communications are essentially closed when information comes in but doesn't go out. This occurs when some team members have access to accurate information and others don't. It's a key responsibility of project or development managers to provide regular and consistent feedback, such as status reports, issue logs, risk logs, meeting notes, or a project Web site, where project information can be published. You should develop a common repository for project information to avoid miscommunication and confusion on the team.

On the other hand, you should also ensure that you get the correct information across to the project stakeholders without overloading them with reams of documents that are irrelevant or contain repetitive information. Skillful project managers know how to plan their communications, understand what type of information each team member needs, and utilize a wide range of communication methods.

Achieving balance in the communication process
I often think about the great expectations managers leave with stakeholders at their initial project kickoff meetings. Managers say, "My door is always open to you" or "I'll provide you with all the communication you need," but then, a week later, it's a different story. The key factor is that managers should facilitate project communications and encourage openness and allow the teams to be "empowered" with the right information to do their tasks. How do you know if you are effectively managing communications? Here are a few red flags to look for that could signal impending project failure:

Micromanaging everything on the project: Managers design these 1,000-line project plans and start pushing themselves and the team to get every task done in the most incredible detail. This style of project manager actually stifles the entire communication process as a result of getting too involved with the details. The team soon realizes that a dictator has taken over the project, and they typically refrain from saying too much, or, worse yet, can't wait to leave the project. This style of management leads to mistrust and eventual frustration. The project manager usually only releases information on an "as-needed" basis and, as a result, the team becomes less creative or unwilling to come up with great ideas. Remember that project managers need to foster more open and transparent communication.

Allowing too much communication: Sending too much communication can actually hamper the amount of work that gets done. Sharing every piece of data and information with everyone is the norm for this type of manager. Team members are actively encouraged to speak their minds, share their pains, and, eventually, a 40-hour workweek is made even longer, all due to overcommunication. The downside here is that when breakdowns do occur because of technical challenges, the project manager will have a tough time trying to bring the project back on track, due to communication paralysis.

The correct balance is needed on a project team when it comes to communications. The important factors involve communicating how the project will be managed, including how information will flow into and out of the project. You should also have a clear and concise communication plan to address project responsibilities and the types of communication that will take place.

The communication plan
The television series Star Trek embraces the communication plan quite well, I think. Starfleet crewmembers all refer to "The Prime Directive," a master plan that lays out what communication channels are to be used, reporting standards, responsibilities, etc. Well, the project communication plan is no different. The following communication information should be contained within the project communication plan:

Project communication strategy

The kick-off meeting

Roles and responsibilities of the team

Project status meetings and frequency

Change control communications

Project review meetings

Transition from deployment to operations

Closure meeting

In this primer on project communications, I've introduced you to the basics of effectively communicating on a project or program. Not only is it essential to create a communications map of your project (i.e., communications plan), but you should also be able to effectively analyze information and distribute such information in the correct medium.

# data[].attributes.attachment_link.title
Project communications: A plan for getting your message across

# data[].attributes.attachment_link.description
Like it or not, communication is the most important component within any project. The success of most projects, whether handled by a dedicated project team or a cross-departmental team, depends upon a set of crucial communication skills and techniques. Interestingly enough, all IT project and development managers that I interviewed agreed: Communication and human interaction make or break a project.

# data[].attributes.body
Risk mitigation is the process of reducing the risk of failure from a project
https://books.google.co.uk/books?id=gxu9rlixmvwC&pg=PP43&dq=mitigation+of+risks&hl=en&sa=X&ved=0ahUKEwiVw7eznsjOAhXDL8AKHX5oAcAQ6AEILTAD#v=onepage&q=mitigation%20of%20risks&f=false

Shows how to mitigate risks using  a process known as RAMP

# data[].attributes.attachment_link.title
What is a monthly project review meeting and what should it cover? - ProjectConnections.com

# data[].attributes.attachment_link.description
I've been tasked to set up a monthly project meeting. What is the purpose of such a meeting, who attends, and why is it held?

# data[].attributes.body
http://s3.amazonaws.com/academia.edu.documents/34634303/ac.els-cdn.com_S0263786399000368_1-s2.0-S0263786399000368-main.pdf?AWSAccessKeyId=AKIAJ56TQJRTWSMTNPEA&Expires=1471432412&Signature=q2Fk%2FVnWqy%2BBueELoPLao508JjQ%3D&response-content-disposition=inline%3B%20filename%3DAc_els-cdn_com_S0263786399000368_1-s2_0-.pdf

Journal
T Raz and E Michael conclude on page 9 that software development projects are characterised by very short opportunity, high certainty and rapid decision making.

# data[].attributes.body
Health and Safety Training:
http://www.brighthubpm.com/risk-management/47934-risk-mitigation-strategies-and-risk-mitigation-plan/ "A risk mitigation is a checklist of the anticipated risks, listed in accordance with the degree of their probability, as High, Medium or Low. They can more commonly be categorized as: Most Likely, Likely or Unlikely.
Regular Review Meetings"

https://opentextbc.ca/projectmanagement/chapter/chapter-16-risk-management-planning-project-management/ - Explains the Risk management process.

https://www.mitre.org/publications/systems-engineering-guide/acquisition-systems-engineering/risk-management/risk-mitigation-planning-implementation-and-progress-monitoring - Risk Mitigation Strategies

Regular Review Meetings:
http://blog.commlabindia.com/elearning-design/project-review-meeting - Effective project review meetings

# data[].attributes.body
https://www.mitre.org/publications/systems-engineering-guide/acquisition-systems-engineering/risk-management/risk-mitigation-planning-implementation-and-progress-monitoring

Risk Mitigation planning, implementation and progress monitoring.

Health and Safety:

If project involves using machinery then correct health and safety training can prevent injury and the project being delayed.

Regular Review Meetings.
http://www2.le.ac.uk/offices/lli/staff-development/appraisal/individual-learning/sec1-intro/benefits
Benefits of regular review meetings.

# data[].attributes.body
Health and Safety Training
For projects involving machinery to remove the possible health and safety issues within a project training should be done .
https://www.siliconbeachtraining.co.uk/blog/5-benefits-of-health-and-safety-training
Regular review meetings

Project review meeting is a powerful method of delivering project status to executive management and other stakeholders, refreshing with them the major bullets of the project vision, reaffirming their commitment to the vision (or identifying any emerging issues with the vision), and cross-pollinating with other projects and with supporting functional groups.
http://www.projectconnections.com/knowhow/burning-questions/new/monthly-project-review.html

Appropriate communications
Effectively improving your communications
Project communication isn’t always as easy as it may seem, but it is a foundation you can use to build your team, demonstrate your leadership, and provide timely project direction.

https://www.researchgate.net/profile/Jeffrey_Pinto/publication/223207172_Project_Team_Communication_and_Cross-Functional_Cooperation_in_New_Program_Development/links/54d262530cf28e0697240417.pdf
Training and monitoring
Training of staff can help lower the risk of any mistakes being made which could impact the project.
http://s3.amazonaws.com/academia.edu.documents/30240879/42a8009c3d9c5.pdf?AWSAccessKeyId=AKIAJ56TQJRTWSMTNPEA&Expires=1471434785&Signature=yRAYO5hkYRmhgz%2F9TAb%2B7jJ%2FElY%3D&response-content-disposition=inline%3B%20filename%3DProject_management_a_managerial_approach.pdf

# data[].attributes.body
http://teeic.indianaffairs.gov/er/transmission/mitigation/health/index.htm
Explain different types of mitigation measures that can be put into place with regards to the health and safety of others
http://hrcouncil.ca/hr-toolkit/workplaces-meetings.cfm
Explanation on why meetings in general can help around the workplace with and without projects ongoing
http://www.cio.com/article/2434788/project-management/project-management--the-14-most-common-mistakes-it-departments-make.html

# data[].attributes.body
• Mitigation – Take steps to reduce the probability and/or impact of a risk. Taking early action, close monitoring, more testing, etc.
http://www.phe.gov/about/amcg/contracts/Documents/risk-management.pdf
Risk mitigation involves two steps: • Identifying the various activities, or steps, to reduce the probability and/or impact of an adverse risk. • Creation of a Contingency Plan to deal with the risk should it occur.
section 2.5 of the above site describes mitigation techniques

Case study/journal talks about mitigation methodolgies, highlights communication in section 3. http://www.fs.fed.us/rm/pubs_other/rmrs_2009_martin_w001.pdf

risk mitigation website, has strategies and definition https://www.mitre.org/publications/systems-engineering-guide/acquisition-systems-engineering/risk-management/risk-mitigation-planning-implementation-and-progress-monitoring

# data[].attributes.body
1. Risk Management Plan - http://www.phe.gov/about/amcg/contracts/Documents/risk-management.pdf - Identifies possible causes of risks before they occur allowing for preemptively addressing them.
2.Identifying and Managing Project Risk - https://books.google.co.uk/books?id=BnuZBgAAQBAJ&lpg=PP1&dq=risk%20mitigation%20project%20management&pg=PA24#v=onepage&q&f=false - Discusses risks and how to limit them.
3. The Handbook of Project Management - https://books.google.co.uk/books?id=iAMfM4xS5EsC&lpg=PA120&dq=Mitigation%20for%20possible%20risks%20project%20management&pg=PA120#v=onepage&q=Mitigation%20risks&f=false - Discusses potential risks and some prevention methods.