Purpose

In the context of validating business requirements, risk analysis is used to identify and manage risks that could invalidate, or otherwise impact the value or degree of success that can be achieved for a requirement or design.

This assignment will provide a hands on example of how uncertainty can create risk and the impacts that it can have on a project. It will also demonstrate a methodical approach to managing these risks. Manitoba Mutual Insurance Co (MMIC) is a fictitious organization, developed based on the content providers knowledge and experience, and will be used throughout the course to explore the content.

Later in this course, you will see how risk analysis is an important tool in many aspects of solution assessment and validation. In the parts of the BABOK covered by this course, risk analysis is discussed in 6 out of 8 chapters. As a result of this assignment, you will be better equipped to understand how it applies in future scenarios.

How to Proceed

1. Begin by reviewing the following resources:
   1. Unit 1 notes; and
   2. Section 10.38 - Risk Analysis in the BABOK.
2. Review the case study below.
3. Based on the information in the case study, complete the exercise below.
4. Submit your responses to the Assignment 1 dropbox on UM Learn.

Table 1: Requirements

ID	Description
R1	Provide functionality to allow customers to change the coverage limit on their property policy on the self-serve portal.
R2	When customer applies changes to their policy via the self-serve portal, bind and issue the changes immediately.
R3	Distribute an updated Policy Change Document when policy changes are issued via the self-serve portal.
R4	Reduce document printing and mailing expenses.
R5	Provide optional email distribution of documents for customers that opt in.

Table 2: Assumptions

Assumption ID	Req. ID	Assumption Description	Stakeholder Concerns
A1	R1	We assume that customers will not apply changes to their coverage limits more than once per month.	The Document Management team is concerned that customers will apply many changes in a day, causing the documents solution to print and mail many Policy Change documents. This process will be costly for the business in printing and mailing expenses, and the customer will be confused and unhappy receiving the additional mail.

The project team brainstormed how to manage the risks associated with the listed concerns. Table 3 shows what they decided.

Table 3: Treatment Options

ID	Treatment options notes from brainstorming session	Treatment Types
A1	Force users of the self-serve portal to sign up for electronic document distribution (emailed documents). Note that this change could increase the load on the email servers and might drive away some customers that still want printed documents. Limit the solution to issuing only the last change each day. This limit would require some additional logic to keep track of these changes, and it could cause some confusion if it appears to customers that each change is bound and issued. Accept the risk. This situation shouldn't happen very often. Provide a warning to users on the self-serve portal that each change will result in a new document being mailed. There is some concern the warning would be ineffective. Do not implement this change; it is too risky.

Exercise

Populate the Assignment 1: Risk Register Spreadsheet, based on the information in the case study, as follows:

1. Using the Assumption A1 from the Case Study, populate the "Risk Event or Condition" and "Consequence" for each stakeholder concern.
2. Estimate the "Probability," "Impact," and "Risk Level," prior to "Treatment." Within each cell, briefly (one short sentence) explain your reasoning. To assess the impact, use Table 10.38.1: Example of a Risk Impact Scale, from the BABOK.
3. Review the Treatment Options in Table 3 and select an appropriate treatment.
   1. Populate the "Treatment" column with the selected treatment, and indicate what type of treatment it is (e.g., Avoid, Transfer, Accept, Mitigate or Increase).
   2. Justify your selection of treatment in the "Justification" column.
4. Will the selected treatment of the issue result in a residual risk? Populate the final three columns, along with a brief (one short sentence) explanation in each cell.
5. Identify the treatment types for each treatment, in the last column of Table 3.
6. Lastly, can you observe any conflicts between requirements, related to this risk? What does this result mean in terms of validating R1?