Customer Reviews

Managing Risk: Methods for Software Systems Development

5 star:		(5)
4 star:		(1)
3 star:		(0)
2 star:		(0)
1 star:		(2)

 

 

Shows how to establish and manage a comprehensive risk management program. The basis of Ms. Hall's approach is called "P2I2", which stands for Process, People, Infrastructure and Implementation. Within these processes are subprocesses and tasks that, as a whole, will result in a risk management posture that is seamlessly integrated into a development project. Although this book is about managing software development project risks, the approach can be applied to any type of project, and can also be tailored to work in an operational or production environment. For example, implementation plans and change control in the operational environment require a risk management strategy, and the methods provided in this book will fill the void with no modification of the basic P2I2 approach.

The process portion of P2I2 consists of 5-steps for managing risks: identify, analyze, plan, track and resolve. For those who manage projects in accordance with the Project Management Institute's Project Management Body of Knowledge (PMBOK) processes, the P2I2 on the surface appears different from the 6 steps set forth in the PMBOK. The key difference between the two is the PMBOK's risk management approach groups 5 processes into project planning and 1 into project control, while the P2I2 approach takes a more holistic view and incorporates risk management across the entire project life cycle. If you are striving for or working within the Capability Maturity Model at level 3 or above, then this book is essential and perfectly aligns. The book devotes a chapter to each of the processes, which clearly identifies the what's and how's of each. Note that the book does not cover advanced risk management techniques, such as probability curves - you will need to obtain this information elsewhere. It does give qualitative techniques, and gives quantitative methods to assess ROI for the risk management initiative itself, as well as other metrics to prove its effectiveness or lack thereof.

Implementing the risk management infrastructure is covered in great detail and is a roadmap for making risk management an integral part of your project. It starts with developing a policy, defining standard processes to be employed, training your team and compliance verification and continuous improvement methods. This material spans five chapters, which sets the foundation for the next five chapters that address implementation of the program itself. These chapters cover establishing the initiative, developing the plan, tailoring the process to your environment, and assessing and controlling risks. The last two are excellent primers on their topics.

The remaining five chapters are devoted to the people part of P2I2, and are broken down into stages, each discussed in its own chapter. The stages are: problem, mitigation, prevention, anticipation and opportunity. Each is thoroughly discussed and taken together these last chapters clearly show roles, issues and factors, and how human resources are integrated into a coherent and holistic risk management initiative.

This book is clearly written and well illustrated. The approach is not only practical, it's essential to ensuring the success of any specific project or extended to encompass a development organization. Moreover, it is also essential for any organization that wants to attain CMM level 4 or 5.

If you're a software development manager, project manager, or technical lead then you'll want to incorporate this risk management discipline into your activities. The author writes with incredible cogency, fitting the pieces together so wonderfully that I'm intellectually stimulated just reading the text. Hall has revealed my heretofore short-sightedness concerning risk. I am indebted to her for a fine work that I believe is certain to enable me to spearhead more successful software development projects.

If you are contemplating purchasing this book, it must be because it's required reading in a class (as it was for me). I cannot imagine anyone purchasing it for any other reason. It seems inconceivable that a book so poorly written could make it past the editors. The author seems to have no concept of appropriate verb tenses, switching between present, past, and conditional repeatedly within paragraphs, adding to the confusion of trying to understand what in the world she's talking about. The vocabulary is extremely technical, and the author seems to operate with the concept of never using simple terms when you can use complicated ones.

This book introduces three methods to promote understanding of software risk management: the 6-D Model, the P2I2 Success Formula, and the Risk Management Map. The 6-D Model extends the Deming Plan-Do-Check-Act cycle by adding the ability to reveal risk and opportunity. The P2I2 is a cause-effect diagram that relates the factors influencing risk management capability, by distributing the task of managing risk according to four major factors: people, process, infrastructure and implementation. Using this divide-and-conquer approach, parallel efforts can speed the adoption of risk management within an organization. The Risk Management Map synchronizes these efforts by proving direction through five evolutionary stages: problem, mitigation, prevention, anticipation, and opportunity.

This book assumes that you already have risk management experience. It shouldn't be your first reading on risk management.

If you buy this book, examine it as soon as you get it. My copy had several sets of blank pages in the back half of the book, which I didn't discover until after the 30-day deadline had passed for returns to Amazon. I contacted Addison-Wesley customer service and was told their policy is no returns, no refunds, no exchanges.
Maybe the author should teach her publisher about quality control.

Dr. Hall has done a superb work by fitting all the pieces that are needed for a successful software risk management. The way this book is explained is fairly comprehensive, going from a high level view, and later "drilling down" into important particular concepts.
You can not go wrong following the "Managing Risk" methodology when developing your next project, especially under the current international regulations and standards for corporate governance...

This book is impressive and contains a lot of useful detail and original thought. Anyone interested in risk will enjoy and learn from the book as I did. It does tackle "quantified objectives" much better than other texts.

An excellent resource. It presents very practical methods for project manager who wants to mange project risk proactively.