• Risk Management

The purpose of this section is to identify potential risks to the project, and convince the decision-maker(s) that the risks will be managed, so that they will have minimal impact on the project. It also alerts the stakeholder(s) to the most significant risks and what needs to be done to manage and mitigate them. Following the cost-benefit analysis, the next most important item to most senior leadership teams is risk. They want to know what risks will be introduced by the proposed solution and how they can be managed. In well-managed projects a separate “Risk Management Plan” is developed and used throughout the project. For the business case, a summary of the most significant risks is provided along with a completed Risk Matrix. This section will consist of the following:

• A completed Risk Matrix as shown below. Since the Risk Matrix will be placed in the Appendix, this section should include a brief explanation of the Risk Matrix and make reference to it.
• A summary that points out the most significant risks and what the stakeholder(s) must do to manage and/or mitigate them.

Risk Matrix

(instructions)

Approach to Developing this Section

Work on this section should begin with filling in the Risk Matrix. The “How To Guide to Risk Management” (located in Content>Course Resources>Risk Management) provides an explanation for each of the Categories of Risk. It was published by a government agency, the Indian Health Service (an agency in the Department of Health and Human Services) for its component organizations to use in assessing risk associated with proposed IT projects. The guide fully and simply explains risk and risk management throughout the life cycle of a project. Appendix A contains a complete Risk Management Plan outline. Appendix B explains the risk analysis methodology and provides definitions for the risk categories listed in the Risk Matrix. Appendix C provides an example of a completed risk assessment, although it is in a different format with slightly different data required. Appendix D provides assistance in completing a particular form required by the U.S. Office of Management and Budget (OMB); it is not important for this class. Additional information about risk categories is provided in the document “OMB Risk Types Definition” (also located in Content>Course Resources>Risk Management).

Using the Case Study, the above resource documents, and the IT solution being proposed, copy the table and complete the risk matrix provided above, describing for each Category of Risk:

One aspect of how that risk category applies to the proposed IT solution for the Case Study (i.e., what risk in each category may be caused or influenced by implementing the proposed IT solution)

The probability (High/Medium/Low) of its occurrence,

The impact (High/Medium/Low) on the organization if it does occur,

A strategy to mitigate the risk (what should be done to prevent the risk from happening or protect the organization if it happens), and

A contingency plan for what should be done in the event that it occurs.

Provide one example risk for each category listed in the Risk Matrix. Explanations of each of the Categories of Risk are available in the document “How to Guide to Risk Management,” pages B3-B7. Definitions for probability of occurrence and impact may be found on page 7, an example of a mitigation strategy is given on page 9, and an explanation of a contingency plan is on page 8 of the same document. Do not limit responses to the space shown in table, but provide complete answers for “Description,” “Strategy for Mitigation,” and “Contingency Plan.” ( I have attached the document where you can get this)

In addition to the matrix, this section should introduce, explain and summarize the risk matrix, and indicate that the full Risk Matrix is located in the Appendix.

Finally, this section should identify and discuss the most important risks and how they will be handled. These are the risks that the sponsor, stakeholders and senior leadership should be aware of throughout the project. Some of them may be able to be mitigated; if mitigation is not feasible, the decision-makers need that information as well. This should be explained for the stakeholders.