Risk is always paid
in the stock market,
underwriting, and in
These are typically calculated using
traditional estimation approaches.
The cost components may be assisted
by estimation tools. The value side is
usually calculated using some internal
assessment of operational cost containment, market expansion, revenue
return, and the like. Neither of these
processes is particularly easy, but they
are quite well-defined.
Likelihood of Cost/Value
These can be computed using techniques such as Monte Carlo analysis
operating on the ranges of key variables
that contribute to the cost (or value).
There are tools available that can perform these calculations easily.c More
sophisticated financial planners will
typically use this approach when laying
out projections for their customers.
shape of Risk/Value
This is a complex subject, the detail of
which is beyond the scope of this column. The “shape” of risk/value is driven by the expected likelihood of costs
and value over- or underrunning. The
mistake the straight-line ROI makes it
is assumes the risk profile looks like
Figure 1. This probability distribution
shows there is one and only one likelihood of a result. The chart shows the
cost (or delivered value) of the project
is 100% guaranteed at the expected
value. This means the project is carrying no risk. It also means the project
has no unknown factors or variables
that affect cost or value. Such projects
do not exist in the real world.
c For example, the The SLIM-Estimate tool,
marketed by QSM Inc., McLean, VA, can quote
explicit cost of risk.
The simplest and most common
probability distribution is the Gaussian (see Figure 2). With this distribution the likelihood of over- or underrunning budget (or value) from the
midpoint “most likely” is equal. While
cost and value distributions are rarely
symmetrical in real life, this can be a
useful distribution provided the “
expected” cost or value is set off-center.
Cost profiles usually look something like the curve shown in Figure 3.
The distribution shows there is much
more likelihood of the project overrunning its budget than there is in underrunning. Unless the likelihood of cost
containment is very high (the project’s
expected cost is set to the right of the
midpoint on the x-axis) this project is
carrying a high cost of risk.
Value profiles (see Figure 4) are
often the reverse of the cost profiles.
In general, experience shows we are
more likely to underachieve our value
goals than we are to overachieve them.
Therefore, to better guarantee returns
we would need to have our expected
value moved to the left (we expect lower value delivered) of the midpoint.
Using these models, we can calculate a risk-weighted return for our projects and either choose not to carry such
a high risk or to more realistically resource our projects based on the challenges they are likely to experience.
The difference between straight-line
return and risk-weighted return is
simply the aggregate cost of risk as expressed in the likelihood of a project
both running over budget and underachieving in the value it delivers. Risk
is always paid for somewhere: in the
stock market, in insurance underwriting, and in software projects. It seems
that few companies perform this kind
of calculation, even when it is one of
their core competencies—which is
odd to say the least. In the business
of software, we can’t complain about
our performance if we resource our
projects but don’t quantify and resource the risk on the projects. When
that risk comes home—and it will—
our projects will fail. And they do.
Phillip G. Armour ( firstname.lastname@example.org) is a senior
consultant at corvus International Inc., deer park, Il.
copyright held by author.
contact: delsing Katarina,
Principles and Practice of
Programming in Java,
contact: Krall andreas,
Quantitative evaluation of
contact: evgenia Smirni,
2010 acM/ieee international
Symposium on empirical
Software engineering and
contact: giancarlo Succi,
hci in Work & learning, life &
contact: herbert Janing,
conference on automated
Sponsored: SigSOFt, Sigart,
contact: charles Pecheur,
the 16th annual international
conference on Mobile
computing and networking
and the 11th acM international
Symposium on Mobile ad hoc
networking and computing,
contact: nitin h. Vaidya,
international Symposium on
intelligent Virtual agents,
contact: norman i Badler,