Challenges to Sustainable Risk Management

This paper summarizes the intermediate lessons learned from the analyses of the risk management problems in three technological endeavors. These problems are: the absence of a structure for rewarding successful project risk management; the need for an ever-more accurate economic measure of risk; and the difficulty of transferring risks to contract-bound independent outsourcing entity. This paper also describes recent advancement towards providing answers to these challenges and future research endeavors in this field. Introduction Risk management is an integral part of any project endeavor. Risks can be classified into three general types which coincide with the three primary concerns in project management: risk of delay in schedule; risk of over-spending; and risk of under-performance. Obviously, these three concerns are very much related such that one affects the other. The amount of available resources affects the rate at which the project progresses, and also affects the overall performance. Current economic, technological and business situations have renewed the importance of risk management. One such situation is the slowdown of the economy resulting to stricter scrutiny of highbudget government and private endeavors, stricter adherence to planned spending and an even more prudent spending for risk management activities. Another situation is the increasing number and complexity of network-based information systems projects. One of the biggest concerns for this kind of projects is the apparent difficulty of protecting such networks against malicious security attacks and the accompanying uncertainty of the risks involved. Another situation is the popularity of relying on independent organizations for services critical to the progress of the project, or here termed as outsourcing. Together, these situations create a challenging environment for continuous and consistent (i.e. sustainable) management of risks. This is especially true for projects that have particularly high technological components such as software development and maintenance, network infrastructure development, and others. The central purpose of this paper is to highlight several general challenges in managing risks in the face of these recent situations. These challenges are: a) the absence of a structure for rewarding successful risk management; b) the need for an ever-more accurate economic measure of risk; and c) the difficulty of transferring risks to contract-bound independent entity. These challenges will be exemplified through preliminary analyses of three studies involving the software project risk management at the National Aeronautics and Space Administration (NASA), the economic quantification of information security risk at the Lawrence Berkeley National Laboratory (LBNL), and a proposed incentive scheme for outsourced information security services at the Navy Marine Corps Intranet (NMCI). This paper is organized as follows: a background on basic risk analysis and management is provided, followed by exposition of the three case studies. This is followed by conclusion statements and identified future topics of research. Background Risk management can be described in terms of two sets of activities: risk assessment and risk mitigation. Risk assessment can be summarized by posing the following questions (Kaplan and Garrick, 1981): what can go wrong, what is the likelihood that it could go wrong, and what are the consequences. After risks have been assessed, the following questions have to be posed for risk mitigation (Haimes, 1998): What can be done, what are the tradeoffs, and what are the impacts on future options. During assessment, risk can be quantified as a function of consequences and the likelihood of its occurrence. The Society for Risk Analysis (SRA, 2004) describes risk “based on the expected value of the conditional probability of the event occurring times the consequence of the event given that it has occurred.” Consider a particular scenarioY with likelihood . Furthermore, suppose that this event has