Metrics for Managing Project Risk

I was in a bookstore over the weekend and saw of copy of Identifying and Managing Project Risk by Tom Kendrick from HP. The book was published last year but I know of his work on project risk metrics from an earlier whitepaper that really showed how to get a handle on measuring and managing project risks.

Here are some examples of predictive risk metrics which serve as a distant early warning system for project difficulties.

Project size/scale risk

• Project duration (elapsed calendar time)
• Total effort (sum of all activity effort estimates)
• Total cost (budget at completion)
• Size-based deliverable analysis (component counts, number of major deliverables, lines of non-commented code, blocks on system diagrams)
• Staff size (full-time equivalent and/or total individuals)
• Number of planned activities
• Total length (sum of all activity durations if executed sequentially)
• Logical length (maximum number of activities on a single network path)
• Logical width (maximum number of parallel paths)

Schedule risk

• Activity duration estimates compared with worst-case duration estimates
• Number of critical (or near-critical) paths in project network
• Logical project complexity (the ratio of activity dependencies to activities)
• Maximum number of predecessors for any milestone
• Total number of external predecessor dependencies
• Project independence (ratio of internal dependencies to all dependencies)
• Total float (sum of total project activity float)
• Project density (ratio of total length to total length plus total float)

General risk

• Number of identified risks
• Quantitative (and qualitative) risk assessments (severity analysis)
• Adjusted total effort (project appraisal: comparing baseline plan with completed similar projects, adjusting for significant differences)
• Survey-based risk assessment (summarized risk data collected from
  project staff, using selected assessment questions)
• Aggregated overall schedule risk (or aggregated worst-case duration estimates)
• Aggregated resource risk (or aggregated worst-case cost estimates)

And the last example, the Dilbert Correlation Factor: collect 30 recent Dilbert cartoons and circulate to staff. Have people mark each one that reminds them of your organization. If the team average is

• under 10: Low organization risk.
• 10-20: Time for some process improvement.
• Over 20: Hire a cartoonist and make your fortune….)