How do you plan for risks in your project's estimates?

Question

I have been working on the risk-management topic in software development for a while. According to the different literature there could be knowns knowns (typical risks), known unknowns (product related risks), and unknown unknowns (black swans).- **known knowns** You have some industry statistics and can use some simulations (e.g. RISKOLOGY) so you can add say 20% to scope and schedule.- **known unknowns** Here you can brainstorm with the team and come up with the list of project related risks, and come up with preventive actions and estimate them, so these can be included into the scope. But what about the remainder of the known unknowns? Should you plan for contingencies? How much? 10%?- **black swans** Just plan for contingency? How much? 20-30%?How do you plan for these risks at the project initiation or planning phase, especially when customer asks for estimates? How do you usually present all these different types of risks to the customer, especially if the risks double the budget or schedule estimates?

Answer 1

Here's how I calculate risks and my recommendaton on what to put into the budget.

First of all I build a statistical Risk Cost Model using the principal equations for work, duration and resources.

The model estimates each element in the Deliverable Work Breakdown Structure (DWBS) and has several lines where I meet with the team to identify three point estimates for work. This estimate includes efficiency.

Known-Knowns: For me this is the variation driven by efficiency of during the work. I use Crystal Ball and the result is a normal distribution.

Known-Unknowns: This is more like the traditional risk. However, I list the risks and tie them to the elements in the DWBS. For me the risk is having to rework the elements. So the calculation is made using a percentage of each element impacted by the risk. The knowns are the elements and the unknown is the variation in reworking the elements. Since the elements already have variation the approach produces another normal distribution

Unknowns-Unknowns: There is no direct way to estimate these- after all they are unknown. However, I studied several projects and discovered a method to back our way into this. I found patterns between the original estimates and the final costs. For me the unknowns-unknowns are the difference between the total of efficiency and risks. I applied this technique to current projects, forecasted the final cost, and tracked them. The results were fairly accurate considering we were working with unknowns. I plotted projects on a continuum and found they formed clusters. So by looking for patterns that are similar to projects in each of the clusters I was able to forecast final cost that included all of the known and unknown costs.

Now for my recommendation on what to put into the budget. Let me say that I do not believe in using thumb rules like adding 20%. This is because the number can be much higher and mislead everyone on the true final cost.

My point estimate is pulled off of the efficiency distribution is always higher than P50- the higher the uncertainty I have about the project the higher the value. Most of the time I use the P70. I would prefer to present a range but most managers are uncomfortable with a variation.

For the Risk Reserves I pull from known-unknown distribution. Here I pull from P20 to P100 depending on the uncertainty in the project.

For the Unknown-Unknowns: I recommend showing the number as a separate risk reserve number and let management decide what to include in the budget. Yes this is politically charged but management needs to take responsibility for taking on projects with large unknowns.