Comprehensive Report on Managing and Controlling ICT Project Risks

This report provides a comprehensive overview of managing and controlling risks in ICT projects. It covers the five stages of the risk management process, emphasizing the importance of the initial identification phase. The report discusses how organizational planning documents and risk policies aid in risk identification, providing examples of internal and external risks. It details the outcomes of risk identification and analysis steps, along with response strategies for common IT project risks like unclear scope, technology changes, and lack of planning. Different risk managing methods, the use of risk matrices, and the importance of risk registers and management plans are explained. The report also addresses impact analysis, risk treatment actions, risk escalation, audits, corrective and preventive actions, contingency plans, and the outcomes of risk monitoring. Furthermore, it discusses change requests, external influential factors, risk reviews, and the necessity of stakeholder involvement in risk management planning. This document is available on Desklib, a platform offering a variety of study tools and resources for students.

Manage and control ICT project risks –
Part A
1

Contents
Introduction......................................................................................................................................3
1. What are the five stages of Risk management process? Why the first step is important from an
organisational point of view?...........................................................................................................4
2. Why organisational Planning document and Risk policies are helpful in the risk identifications
process? Explain in brief with examples if possible........................................................................5
3. Give a few examples of internal and external risks for an ICT project. Give at least five
examples for each............................................................................................................................6
4. What are the outcome/output for each of the following Risk management steps?.....................7
Risk Identifications......................................................................................................................7
Risk Analysis...............................................................................................................................7
5. What will be your risk response strategy for an IT project you are working in for each of the
following risks and why?.................................................................................................................8
Confusion and unclear scope definition.......................................................................................8
Sudden change in ICT technology...............................................................................................8
Not having any risk management plan or contingency plan........................................................8
6. What are the different risk managing methods? Explain in brief................................................9
7. What is a risk matrix? How do you calculate Total risk from that matrix?...............................10
8. What is a risk register? What are the typical information stored in a risk register?..................10
9. What is a risk management plan? Who would you involve in preparing a risk management
plan and why?................................................................................................................................10
2

10. What is an impact analysis? When and why it is done for risk management in a project?.....11
11. What are some of the likely actions you may take in an IT project as a part of risk treatment?
Your answer will depend on the risks you have identified for example.......................................11
12. Apart from the standard risk response strategies, often a strategy is used called “Risk
escalation”. What that does mean and why it is important for the project manager?....................11
13. What is a risk audit? Who perform risk audit and why it is necessary?..................................12
14. Explain the following two in relation to risk monitoring process:..........................................12
Corrective actions......................................................................................................................12
Preventive actions......................................................................................................................12
15. What is a contingency plan? Why and when it is prepared in the risk management cycle?...12
16. What are the typical outcomes of the risk monitoring process? Explain any one of those in
brief from an IT project if you can................................................................................................13
17. What is a change request? As project manager of an IT project, under what circumstances
you may need to prepare a change request? Give examples.........................................................13
18. Give examples of a few external influential factors which requires a risk management plan to
be updated. Explain one of those in brief......................................................................................13
19. What is risk review? Why and when reviews are done?.........................................................14
20. Explain why stakeholders’ involvement is necessary in risk management planning process
and why sign off is necessary for the plan prepared?....................................................................14
Conclusion.....................................................................................................................................15
References......................................................................................................................................16
3

4

Introduction
The whole concept is based upon the risk analysis and risk evaluation ways that have been based
upon the overall factors that might be involved in the development of software’s in ICT and as
per that there has been reviews and audits that have been planned simultaneously. There has been
various meetings and conferences that have been prepared so as to see the reflection in the
development of the software and use it in future. The reviews have highlighted various measures
to be taken on each step so as to make sure most of the issues are being resolved on the way of
development of the softwares. There has been effective involvement of the stakeholders and the
respective changes made according to that has also been seen here.
5

1. What are the five stages of Risk management process? Why is the first step important
from an organizational point of view?
Step 1- Identification of risk- In this method, the risk is identified and seen effectively the
various reasons for the occurrence of the risk and seeing the effect of the same on the scenario. It
is the most important step as the whole planning is based upon this analysis.
Step 2- Analyze the risk – Here the risk is analyzed and seen the relevance and consequence of
each risk.
Step 3- Rank the risk- This decides the severity and importance of the risk in the evaluation of
the same further process are done.
Step 4- Treat the risk- Strategies are made to resolve the issues creating risks.
Step 5- Monitor and review the risk- Periodic monitoring and evaluation is done to avoid the
same in future (Dellinger, 2013).
6

2. Why organizational Planning document and Risk policies are helpful in the risk
identifications process? Explain in brief with examples if possible
The risk has been analyzed and rated as per the documented policies and practices that have been
designed by professionals in order to give the company an idea and respective framework in
order to let them work upon that effectively. In the ICT it is required to see the software policies
and documentation before being used in the development and analysis of risk in the process. For
example, ISO is the standard used in the security and other services to check the methods used in
the safety of the documents.
7

3. Give a few examples of internal and external risks for an ICT project. Give at least five
examples for each
Internal Risk in ICT External Risk in ICT
Employees attrition, lack of talent, lack of
knowledge updating
Economic pricing pressure and changing
economic values and structures
Technology backwardness and lack of
innovation and improvement
Natural factors like earthquakes, floods, storms
affecting the quality and productions
Operations fraud and inefficient work by the
employees
Political changes like elections, laws, and
legislation(Dellinger, 2013).
Physical damage to the computer or to the
employee
Competition pressure on the current market
Theft of data and services Emergent technologies and innovations
8

4. What is the outcome/output for each of the following Risk management steps?
Risk Identifications
Risk Analysis
a) Risk Identifications- The risk identification helps in the identification of the causes that
have been causing the risk and the relative effect has been seen on the quality of the
production. The identification helps in identifying the methods that have been used in
order to see the effective strategy and the methods best fit to resolve them.
b) Risk Analysis- This helps in the analysis of the severity and the relative effect on the
livelihood and ICT development. Based upon there has been a strategy that has been
made in order to resolve the risk and take protective measures for future (Dellinger,
2013).
9

5. What will be your risk response strategy for an IT project you are working in for each of
the following risks and why?
Confusion and unclear scope definition
A sudden change in ICT technology
Not having any risk management plan or contingency plan
 Confusion and unclear scope definition- Monitor and prepare the risk assessment
methods and techniques to identify the meaning of the respective ICT tool.
 A sudden change in ICT technology- Mitigation of the work and making appropriate
plans to deal with the technology and making future technologies aware and updated as
per that.
 Not having any risk management plan or contingency plan- Acceptance of the lack of
knowledge in the current issue and then monitor and prepare a plan to manage the risk in
the future and avoid such issues in future respectively. This develops future ICT
strategies as well (Massad, 2013).
10

6. What are the different risk managing methods? Explain in brief
The different risk management methods are-
Avoidance- this method is used to stop any source or any method that has been providing
jeopardy to the business.
Reduction- This step is taken to minimize the effects of the causes and related ways that have
been used in order to reduce the factors and prioritizing the things effectively.
Transfer- This step is used to transfer the risk causing the element to external or other resources
and taking others help in the same.
Acceptance- This method is used to accept the current features and respectively use the same in
the development of new sources and strategies in the same.
11

7. What is a risk matrix? How do you calculate Total risk from that matrix?
The risk management matrix helps in analyzing the respective ways in which the impact on the
likelihood has been conducted and seen. This may range from the low , medium and high
intensity in which they can be used in order to see the respective effect of the same on the
analysis of risk involved in the ICT software and technology. There may be different versions of
the same or different companies who have been using it in the analysis and ranking of their risks
so to make strategies based upon them in future.
8. What is a risk register? What is the typical information stored in a risk register?
Risk registers are sometimes called risk logs that have been used in order to keep a log of the
risks. They are mostly used from the beginning of the activity and is thus keeping records in the
place to see the effective way in which it can be used in the going forward in the overall
development and analysis of the same in the risk evaluation and development .they might use
qualitative or quantitate risk evaluation of the same in order to see the same in the business
improvement. They are very effective in monitoring and controlling the risk (Massad, 2013).
9. What is a risk management plan? Who would you involve in preparing a risk
management plan and why?
Risk management plan is the plan that has been constructed after the risk is identified of on the
procurement of any risk. It involves various features that have been used in order to identify the
risk, analyze the same and using them in the effective utilization of resources so as to minimize
the effects and occurrence of the same in future. The management plan includes all the decoding
function and the senior members, along with there has been other planning and implementation
managers in the organization. After that the plan also involves all the operational and
implementing work force, they work on the achievement of the goals of the company.
12

10. What is an impact analysis? When and why it is done for risk management in a
project?
The impact analysis is done in order to determine the changes in the system and analyze the
same in the effective analysis and determine the impact of the design, technology, architecture,
and changes in the features of the same in the development of the software. It is done mostly at
the end of the risk analysis, there might be the need to see the effects on all the factors and the
respective changes that have been applied in the process. This will also tell the practical
implementation of the same in the ICT process (Massad, 2013).
11. What are some of the likely actions you may take in an IT project as a part of risk
treatment? Your answer will depend on the risks you have identified for example.
As a part of risk treatment, the actions taken will be the testing and dry run calculation to see the
applicability of the same in the development of the process. There can be new technology and
methods used in order to see the reflection of the same on the business and the development of
the software. The risk that has been identified is the risk of bug that might have developed in the
early stage but has not been identified in the system. Thus their early identification and
knowledge have to be seen and removed from a very early method.
12. Apart from the standard risk response strategies, often a strategy is used called “Risk
escalation”. What that does mean and why it is important for the project manager?
The risk escalation is the ultimate strategy that has to be followed in order to deliver the
optimum results. There might be some situations in which the issues are not resolved in the
progress of the work thus in order to do that effectively there have to be some strategies that have
to be followed in order to see the effective way in which the issues are being resolved. The
escalation is done to senior team or the further operational team so as to see the effective way in
which the overall software can be tested and used accordingly and the further process can be
made as per that.
13

13. What is a risk audit? Who performs risk audit and why it is necessary?
The risk audit has been arranged in order to see the effective way in which the overall project has
been going and the appropriate ways to see the working of the same in the process. The project
manager is the people that are mostly doing the risk audit and are thus responsible to finalize the
overall structure and evaluate the same in the development of the software. This is sometimes a
part of software testing to make appropriate and respective changes whenever required (Béné,
2012).
14. Explain the following two in relation to the risk monitoring process:
Corrective actions
Preventive actions
a) Corrective actions- The corrective measures in the risk monitoring process are used in
order to remove the risk that has been seen at the end of the software development and
working. These actions are taken at the end of the software development.
b) Preventive actions- The preventive measures are taken from the beginning of the
software development. Thus there can be steps taken in order to see the step by step
analysis that can be done to reduce the possibilities of the occurrence of the issues in the
software and is therefore preferred more than the other one.
15. What is a contingency plan? Why and when it is prepared for the risk management
cycle?
A contingency plan has been made in advance stages of risk management plan so as to see the
effective way in which all the points regarding the effect to be used in order to procure the
respective risks and use them in the overall process development and growth. These plans are
being used in order to minimize the effect and seriousness of the issues in the sources. These
plans are used in according to the effective way so as to see the further steps that should be used
in order to see the effect of the current plan and respective future needs.
14

16. What are the typical outcomes of the risk monitoring process? Explain any one of those
in brief from an IT project if you can
The various outcomes that can be seen are projecting coding defect, improper utilization of
resources, wastage of time and resources, lack of expert knowledge, the project not feasible
enough. Thus the overall process has to be seen in order to see the effective plan to be made in
order to reduce the risk related to improper utilization of resources. This avoids any future
redundancy and thus helps in the saving of resources and time in the overall process. These
outcomes tell the overall ranking and structure of the same in the project development and
application (Béné, 2012).
17. What is a change request? As project manager of an IT project, under what
circumstances you may need to prepare a change request? Give examples
The change request can be said as change document or any change that has to be done in order to
make any changes in the current process and development of the same in the project
development and management. The change is for example needed in the upgrades of any
hardware or software in the process. These changes are mostly done in order to have an effective
way so as to see the overall project is being run in proper mode. There might be certain flaws in
the old process and is thus not preferred by the management team in the ICT (Béné, 2012).
18. Give examples of a few external influential factors which requires a risk management
plan to be updated. Explain one of those in brief.
Some of the external factors that have been a requirement in the using of the technology changes
are industrial norms to change certain features in the software. There can be government
processes that have been used in order to see the reflection of the new changes to the software.
Apart from that there are certain changes done by the competitors thus the same has to be done in
order to see the effect of the same on the growth and development of the software. There can be
certain legislative factors like software license that has to be bought and cover all the features in
the overall procedures of the testing and development of the software.
15

19. What is the risk review? Why and when reviews are done?
The risk reviews have been used in order to reevaluate the risk environment, the risk events and
the risk features that have been observed in order to see the effective way in which the overall
process has been working upon. Risk reviews are conducted by the manager regularly.
According to the meetings and respective conferences to highlight the effects of the issues in the
working and the same has been effectively used in order to see the reflection of the same in the
development process. The reviews are done in all the stages so as to remove the faults and make
the project effectively (Khanna, 2012).
20. Explain why stakeholders’ involvement is necessary for the risk management planning
process and why sign off is necessary for the plan prepared?
The stakeholder’s involvement has been used in order to see the respective response of the same
in order to see the effective ways in order to see the knowledge that has been attained from the
internal and external factors also. They tell about the needs and demands of the customers in the
overall process and using the same effect. The internal stakeholders help in gathering effective
resources in order to develop the overall performance and issues being watched over properly
(Chu, 2012).
16

Conclusion
The overall questioner is based upon the risk management ways and various methods that have
been used in order to see the effective ways that should be used in order to develop effective
ways to apply the knowledge. This can also reflect the various methods that can be used in order
to see the management ways and various reviews and audits to be done to remove the flaws.
17

References
 Béné, C., Wood, R.G., Newsham, A. and Davies, M., 2012. Resilience: new utopia or
new tyranny? Reflection about the potentials and limits of the concept of resilience in
relation to vulnerability reduction programmes. IDS Working Papers, 2012(405), pp.1-
61.
 Chu, S. and Majumdar, A., 2012. Opportunities and challenges for a sustainable energy
future. nature, 488(7411), p.294.
 Dellinger, R.P., Levy, M.M., Rhodes, A., Annane, D., Gerlach, H., Opal, S.M.,
Sevransky, J.E., Sprung, C.L., Douglas, I.S., Jaeschke, R. and Osborn, T.M., 2013.
Surviving Sepsis Campaign: international guidelines for management of severe sepsis
and septic shock, 2012. Intensive care medicine, 39(2), pp.165-228.
 Khanna, D., Khanna, P.P., Fitzgerald, J.D., Singh, M.K., Bae, S., Neogi, T., Pillinger,
M.H., Merill, J., Lee, S., Prakash, S. and Kaldas, M., 2012. 2012 American College of
Rheumatology guidelines for management of gout. Part 2: therapy and antiinflammatory
prophylaxis of acute gouty arthritis. Arthritis care & research, 64(10), pp.1447-1461.
 Massad, L.S., Einstein, M.H., Huh, W.K., Katki, H.A., Kinney, W.K., Schiffman, M.,
Solomon, D., Wentzensen, N. and Lawson, H.W., 2013. 2012 updated consensus
guidelines for the management of abnormal cervical cancer screening tests and cancer
precursors. Obstetrics & Gynecology, 121(4), pp.829-846.
18