The IT Outsourcing Risks:
Sources Of Risk
Software Development Problems

Range of Intervention Theory



Prevention, Treatment and Maintenance
Planning, Development and Use
Cost of Intervention
The Importance of Risk Management

Risk management is the art and science of
identifying, analyzing, and responding to risk
throughout the life of a project and in the best
interests of meeting project objectives.

Risk management is often overlooked in projects,
but it can help improve project success by helping
select good projects, determining project scope,
and developing realistic estimates.
Benefits from Software Risk Management
Practices*
100%
80%
80%
60%
60%
47%
47%
43%
35%
40%
20%
6%
on
e
ov
N
ns
er
ru
ps
sli
e
co
st
R
ed
u
ce
sc
ce
ed
u
R
to
m
er
us
M
ee
tc
ul
he
d
m
m
co
to
ilit
y
ab
e
pr
ov
Im
itm
en
tia
go
ne
ur
p
ts
en
Pr
ev
ts
s
ris
e
m
s
le
pr
ob
oi
d
av
te
/
ip
a
tic
An
te
0%
*Kulik, Peter and Catherine Weber, “Software Risk Management Practices – 2001,”
KLCI Research Group (August 2001).
Project Risk Management Processes
1.
Risk management planning: Deciding how to
approach and plan the risk management activities for
the project.
2.
Risk identification: Determining which risks are
likely to affect a project and documenting the
characteristics of each.
3.
Qualitative risk analysis: Prioritizing risks based on
their probability and impact of occurrence.
Project Risk Management Processes
(cont’d)
4.
Quantitative risk analysis: Numerically estimating
the effects of risks on project objectives.
5.
Risk response planning: Taking steps to enhance
opportunities and reduce threats to meeting project
objectives.
6.
Risk monitoring and control: Monitoring identified
and residual risks, identifying new risks, carrying out
risk response plans, and evaluating the
effectiveness of risk strategies throughout the life of
the project.
Risk Management Planning

The main output of risk management planning is a
risk management plan—a plan that documents the
procedures for managing risk throughout a project.

The project team should review project documents
and understand the organization’s and the sponsor’s
approaches to risk.

The level of detail will vary with the needs of the
project.
Table 11-2. Topics Addressed in a Risk
Management Plan

Methodology

Roles and responsibilities

Budget and schedule

Risk categories

Risk probability and impact

Risk documentation
Contingency and Fallback Plans,
Contingency Reserves

Contingency plans are predefined actions that the
project team will take if an identified risk event occurs.

Fallback plans are developed for risks that have a
high impact on meeting project objectives, and are put
into effect if attempts to reduce the risk are not
effective.

Contingency reserves or allowances are provisions
held by the project sponsor or organization to reduce
the risk of cost or schedule overruns to an acceptable
level.
Common risk factors for IT Projects

Risk factors










Lack of top management commitment to the project
Failure to gain user commitment
Misunderstanding the requirement
Lack of adequate user involvement
Failure to manage end user expectation
Changing scope and objectives
Lack of required knowledge/skill in the project personnel
New technology
Insufficient / inappropriate staffing
Conflict between user departments
Information Technology Success Potential Scoring
Sheet
Success Criterion
Relative Importance
User Involvement
19
Executive Management support
16
Clear Statement of Requirements
15
Proper Planning
11
Realistic Expectations
10
Smaller Project Milestones
9
Competent Staff
8
Ownership
6
Clear Visions and Objectives
3
Hard-Working, Focused Staff
3
Total
100
Broad Categories of Risk

Market risk

Financial risk

Technology risk

People risk

Structure/process risk
Risk Breakdown Structure

A risk breakdown structure is a hierarchy of
potential risk categories for a project.

Similar to a work breakdown structure but
used to identify and categorize risks.
Figure 11-3. Sample Risk Breakdown
Structure
IT Project
Business
Technical
Organizational
Project
Management
Competitors
Hardware
Executive
support
Estimates
Suppliers
Software
User support
Communication
Cash flow
Network
Team support
Resources
Risk Identification

Risk identification is the process of
understanding what potential events might
hurt or enhance a particular project.

Risk identification tools and techniques
include:

Brainstorming

Interviewing

SWOT analysis
Brainstorming

Brainstorming is a technique by which a
group attempts to generate ideas or find a
solution for a specific problem by amassing
ideas spontaneously and without judgment.

An experienced facilitator should run the
brainstorming session.

Be careful not to overuse or misuse
brainstorming.
Interviewing

Interviewing is a fact-finding technique for
collecting information in face-to-face, phone,
e-mail, or instant-messaging discussions.

Interviewing people with similar project
experience is an important tool for identifying
potential risks.
SWOT Analysis

SWOT analysis (strengths, weaknesses,
opportunities, and threats) can also be used
during risk identification.

Helps identify the broad negative and positive
risks that apply to a project.
Risk Register


The main output of the risk identification process is a
list of identified risks and other information needed
to begin creating a risk register.
A risk register is:



A document that contains the results of various risk
management processes and that is often displayed in a
table or spreadsheet format.
A tool for documenting potential risk events and related
information.
Risk events refer to specific, uncertain events that
may occur to the detriment or enhancement of the
project.
Risk Register Contents






An identification number for each risk event.
A rank for each risk event.
The name of each risk event.
A description of each risk event.
The category under which each risk event
falls.
The root cause of each risk.
Risk Register Contents (cont’d)





Triggers for each risk; triggers are indicators
or symptoms of actual risk events.
Potential responses to each risk.
The risk owner or person who will own or
take responsibility for each risk.
The probability and impact of each risk
occurring.
The status of each risk.
Table 11-5. Sample Risk Register/
Risk Analysis
No.
Rank
R4
1
Risk
Description
Category
Root
Cause
Triggers
Potential
Response
s
Risk
Owner
Probability
Impact
Severity
4
R2
2
1
R7
3




Project severity = expectation (1-10) * impact (110)
When should risk analysis be formed?
Is not a time activity
Periodic update and reviewed
Status
Calculating severity
Problem
Staff
Late delivery of
hardware
Communication and
Networks problem
Expectation
6
5
Impact
5
8
Severity
30
40
5
5
25
Project severity = expectation (1-10) * impact (1-10)
Major Risks Come From
Management Practices…..
•
•
•
•
•
•
•
•
•
•
Poor analysis of supplier strategy and capabilities
IT treated as undifferentiated commodity
Cash injection looked for rather than business advantage
Incomplete contracting
Difficulties constructing/adapting deals for
business/technological change
Poor sourcing/contracting for new technologies
Lack of maturity/experience with long-term ‘total’
outsourcing
Failure to retain requisite capabilities/skills for active
contract and relationship management
Power asymmetries developing in favour of vendor
Unrealistic expectations with multiple objectives
(Source: Lacity & Willcocks, 2001)
Main Risks in Outsourcing
Other
Industrial relations with internal staff
No Learning from vendor about IT
Systems interconnectedness adversely affected
Loss of control over strategic use of IT
New IT expertise from vendor fails to materialise
Loss of control over IT operations
Lack of expertise in managing contracts
Irreversibility of contract
Credibility of vendor claims
Hidden costs of contract
0
50
100
Points
150
200
250
Risk Mitigations Plan

Learn from Experience



Follow a the maturity model.
Best Practice / Multi-sourcing approach
Know what to outsource

Use the frameworks from previous classes
Stages
Performing / Strategic
Focus (Not just focusing
on cost)
5
Norming / Proactive Cost Focus
(Beginning to form norms and
actively focusing and proactively
using outsourcing for cost saving
including offshore. Outsourcing
20-40% of IT activities)
4
Storming / Strategic
decision point
(Organization leaders
share conflicting ideas
about outsourcing and
pursuing different strategy
to provide IT services)
3
2
1
Forming /
experimenting stage
(outsourcing between
10-20% of IT
activities)
Insourcing / Bystander
(outsourcing between
1-5% of IT. Mostly
purchasing of IT
functions).
Time
Risk Mitigations Plan

Outsourcing: Type and Scope


Best-in-class
In case of multi-sourcing


Ability of suppliers to work together
Short term deals better than long term deals

Vendor Selection Criteria and Process



Check Xerox and General Dynamics case studies
Best fit
Ability
…And Unrealistic Expectations:
The IT Cost/Service Trade-off
Minimal Cost
‘Superstar’
Premium
Service
Minimal
Service
Senior management’s
and users’ expectations
of IT
‘Chevrolet’
Realm of feasible IT
performance
Premium Cost
‘Rolls
Royce’
Realm of feasible
IT performance
‘Black Hole’
Senior management’s
and users’ perceptions
of IT