Risk Management and Post-Project Reviews: Planning for Uncertainty and Learning from Experience

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 9.10 Free with a free account

Risk Management and Post-Project Reviews: Planning for Uncertainty and Learning from Experience

System Analysis and Design · Chapter 9: Project Management, Scheduling, and QualitySection 9.10 · lesson 69 of 697 min · free with a free account

← Performance Tracking, Monitoring, and Controlling: Keeping Projects on Course

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

Identifying and analyzing risk, the risk register, response strategies, and lessons learned.

  • Describe techniques for identifying project risks
  • Distinguish qualitative from quantitative risk analysis
  • Read a probability-impact matrix, and explain the risk register
  • Compare the 4 response strategies, and explain post-implementation reviews

Transcript

Everything said in the video, section by section (921 words). Read along, or search it.

Project Management, Scheduling, and Quality

Risk Management and Post-Project Reviews

Every project runs on assumptions, and some of them will turn out wrong. This final section covers how teams find and weigh risks, record them, and decide how to respond. And how, once a system is live, a post-implementation review turns experience into lessons for the next project.

Risk Identification

Finding Risks Before They Find You

Risk identification is the systematic process of finding and documenting potential risks before they happen, rather than discovering them once they have caused a problem. Five techniques are common. Brainstorming, where a team generates a broad list together, drawing on varied perspectives. Checklists, where risks common to similar past projects are reviewed for this one. Expert judgment, where experienced practitioners identify risks from what they have seen before. Assumption analysis, which examines the assumptions the plan rests on, and what could go wrong if one proves false. And historical review, which examines records from past projects, for risks that occurred before.

Risk Analysis

Qualitative vs. Quantitative

Once risks are identified, they are analyzed, in one of two ways. Qualitative analysis uses relative, descriptive judgments, typically low, medium, or high. It is fast, needs few resources, and works on most projects as a first pass. Its output is a prioritized list, or a matrix. Quantitative analysis uses numerical data and modeling, such as an actual probability percentage and an estimated cost or schedule impact. It is more precise, but needs more time, data, and expertise. So it is usually reserved for the high-stakes, or highly uncertain, risks that justify that effort.

Figure 9.2

The Probability-Impact Matrix

A probability-impact matrix is a qualitative tool for prioritizing risks. Probability runs across the bottom, from very low to very high. Impact runs up the side, the same way. The cells shift from green toward red, as probability and impact both rise. Four risks are plotted. A minor U I bug sits low on both, in green. Scope creep is high on both, in an orange cell. And along the top row, with very high impact, sit a key vendor delay and a data center outage.

Reading the Matrix

Unlikely Is Not the Same as Unimportant

The point of the matrix is to show which risks need attention first. Look at the data center outage. Its probability is very low. But its impact would be very high. So it still lands in an elevated, orange zone. A risk does not need to be likely to deserve serious attention, if the consequence would be severe enough. The minor U I bug is the opposite. Low probability, very low impact, and safe to watch, rather than act on.

The Risk Register

A Living Record of Every Risk

A risk register is a central, living document that records every identified risk, with the details needed to manage it. Each entry has a risk I D, for tracking, and a description of what the risk actually is. It records the risk's probability, and its impact. A priority, or rating, often derived from the probability-impact matrix. An owner, responsible for monitoring the risk and responding to it. The response strategy. And the risk's status, open, mitigated, closed, or occurred. It is kept living, updated throughout the project, because risks, and what is known about them, keep changing. A list written once would soon go stale.

Response Strategies

Avoid, Mitigate, Transfer, Accept

For each risk, the team chooses one of four classic response strategies. Avoid changes the plan to eliminate the risk, or its cause, entirely. Such as dropping a risky, unproven integration from the scope. Mitigate takes action to reduce the risk's probability or impact. Such as adding extra testing time, to catch defects earlier. Transfer shifts the risk, or its financial consequence, to a third party. Such as buying insurance, or signing a contract that moves liability to a vendor. And accept acknowledges the risk, and takes no proactive action. Sensible for a small, low-cost risk, not worth spending more to address. Notice the difference between transfer and mitigate. Insurance does not make the risk any less likely. It shifts the consequence elsewhere. Mitigation reduces the risk itself.

After Go-Live

The Post-Implementation Review

A post-implementation review, or P I R, is a formal review held after a system goes live, usually after some period of operation. It asks whether the project achieved its objectives, and what worked well or poorly along the way. Did the system meet its original objectives? That confirms the intended value was delivered. Did the project stay within budget and schedule? That assesses how accurate the estimates were. Which risks actually occurred, and how well was each handled? That feeds the risk register, and future risk identification. And what would the team do differently next time? That produces documented lessons learned. Those lessons are often stored where other teams can find them, feeding directly into the historical-review technique, on the next project.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. Qualitative risk analysis uses descriptive ratings. Quantitative analysis uses numerical data and modeling. A probability-impact matrix is a grid that prioritizes risks by likelihood and severity. A risk register is the living record of every identified risk. Avoid, mitigate, transfer, and accept are the four classic risk responses. And a post-implementation review is a formal review after go-live, producing lessons learned.

Key Takeaways

What to Carry Forward

To pull this together. Risks are identified through brainstorming, checklists, expert judgment, assumption analysis, and historical review. Qualitative analysis is fast and descriptive. Quantitative analysis is precise, but resource-intensive, and reserved for higher-stakes risks. A probability-impact matrix prioritizes risks visually, and a low-probability, high-impact risk can still rank high. A risk register is a living record of each risk's description, probability, impact, priority, owner, response, and status. The four responses are avoid, mitigate, transfer, and accept. And a post-implementation review's lessons feed forward into the next project's risk identification.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Risk Management and Post-Project Reviews: Planning for Uncertainty and Learning from Experience

What is the difference between qualitative and quantitative risk analysis?
Qualitative risk analysis uses relative, descriptive ratings such as low, medium, or high, while quantitative analysis uses numerical data and modeling, such as an actual probability percentage and an estimated cost impact. Qualitative analysis is fast, needs few resources, and works as a first pass on most projects. Quantitative analysis is more precise but needs more time, data, and expertise, so it is usually reserved for high-stakes risks.
How do you use a probability-impact matrix?
A probability-impact matrix plots each risk by its likelihood and its severity, so the risks needing attention first stand out. Risks high on both scales, such as scope creep, land in the warmer zones. A risk with very low probability but very high impact, such as a data center outage, can still rank high, while a minor UI bug that is low on both can simply be watched.
What are the four risk response strategies?
The four classic risk responses are avoid, mitigate, transfer, and accept. Avoiding changes the plan to eliminate the risk, such as dropping an unproven integration. Mitigating reduces its probability or impact, such as adding testing time. Transferring shifts the consequence to a third party through insurance or a contract. Accepting takes no proactive action, which suits small, low-cost risks.
What is a post-implementation review?
A post-implementation review is a formal review held after a system goes live, usually after some period of operation, to judge whether the project achieved its objectives. It asks whether the system delivered its intended value, whether budget and schedule estimates held, which risks occurred and how well they were handled, and what the team would do differently. The lessons learned feed future projects' risk identification.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →