Business Risks

There are two types of risks to be considered for a project: project risks and business risks. Project risks are potential problems/events that may impede the success of a project. These are typically identified by the PM and include things like a resource not being available when needed. Business risks are potential problems/events that may impede the success of the business with respect to the project. These risks should be identified by the BA working with the SMEs. It is important to understand these risks because they help to prioritize requirements, test cases, and implementation plans. When a business has a risk like “if the new software calculates taxes incorrectly, government penalties will be incurred,” the BA knows that clearly eliciting and analyzing the tax calculations and rules are important. The risk also highlights the importance of thoroughly testing this calculation before implementation.

It is worthwhile to think about risks and formally document them on medium- to high-impact projects. Each risk should be clearly stated, along with the potential loss/result and a risk strategy. Contingency plans are also included. A great resource on risk is Risk Management (Mulcahy, 2003). See Table 3.5 for an example of a business risk assessment table.

Table 3.5: Sample Business Risk Assessment
Business Risk	Probability	Risk Response/ Contingency Strategy	Impact
Students who want to attend a class will not be able to register due to full enrollments.	High	Mitigate: By automating our registration process, we will have time to schedule more classes.	High
Students who are registered fail to show up for class.	Medium	Mitigate: Send a reminder e-mail a few days before class.	Medium
Instructors who are scheduled to teach fail to show up for a class.	Low	Avoid: Accurate, up-to-date schedules will always be avail-able and training administration personnel will talk with each instructor before each class.	High

There are four main risk strategies:

• Avoid: Change the project to eliminate the threat

• Transfer: Shift the risk to another project or group

• Mitigate: Reduce the probability or impact of the risk

• Accept: Allow the risk to exist as is and develop a contingency plan

Items Out of Scope

This list provides a place to notify all stakeholders of specific items, requirements, features, objectives, etc. that will not be addressed by the project. It is important to get clarification on what is out of scope. This section is necessary when there are specific items that seem to be very closely related to the project scope and could easily be assumed to be included. Explicitly stating that particular items will not be addressed clearly sets expectations about these items and also tells stakeholders that the items/requests were heard and not ignored. Items are identified for this list during initial project discussions with the project sponsor and key SMEs. The PM and BA work together with the business area to develop a project scope that can be accomplished in a relatively short amount of time. Business people are not always aware of how long a particular requirement will take to develop and implement. They need to understand the organizational cost of each request, along with the expected time required to complete it. When armed with this information, they can make good business decisions about what to include in the project/iteration vs. what to leave out.