In today’s business environment, many companies outsource a majority of a program’s work to stay competitive. Far too often, hidden subcontractor’s risks cause unplanned significant cost and schedule growth resulting in serious negative program impact.
Sound familiar? Learn how to mitigate these risks: Continue reading
When applying Enterprise Risk Management (ERM), as in much else in life, the devil is in the details. The details are especially critical when attempting to apply standards such as ISO 31000 to software and IT intensive systems. ISO 31000 describes principles, a framework, and a high level process for ERM. ISO 31000 clause 5 identifies process steps – in this article I will focus on risk assessment and risk treatment as it applies to software and IT intensive contexts.
INTRODUCTION
For almost two weeks the country (the United States) and the press have been mesmerized by the partial shut down of the Federal government and by the threat that the U.S. will default on its financial obligations due to failure to raise the debt limit.
These problems are due to conflicts between the Republicans and the Democrats on spending versus taxes, and more recently on the pros and cons of the Affordable Health Care act commonly known as ‘Obamacare.’
Both Obamacare and the government shut down have risks associated with them. From the external viewpoint of an independent voter whose work involves risk analysis, neither side appears to have done a careful examination of any of the risks from either Obamacare itself or from the shutdown of the government. Continue reading
Following is excerpted from Mastering 21st Century Enterprise Risk Management (forthcoming October 2013):
THE NATURE OF RISK
Most systems masquerading as enterprise risk management are re-jigged workplace health-and-safety risk platforms that attempt to apply a predefined standardized methodology. A one-size-fits-all assessment program cannot be imposed on everyone and achieve any useful results. Risk-assessment must be relevant to their field if people are to take it seriously. It must provide meaningful value to them. It also must go through continual review as the nature of risk changes and evolves. Continue reading
In the late 2000’s I was working as auditor for two German registrars.
Both had somehow contracted to supply ISO 9001 initial registration and surveillance services to a number of car shops providing services for: