問32
頻出度★★★
システム開発プロジェクトにおけるリスク管理として, 適切なものはどれか。
平成21年度 春期 ITパスポート試験 問32
マネジメント系プロジェクトマネジメント › プロジェクトマネジメント
This question's explanation and your answers so far.
解説
問 32
Incorrectア
The timing for starting risk management is wrong. Risk management is begun in the initiation and planning stages of a project and is carried out continuously until closing, repeating the cycle of identifying, analyzing, planning responses to, and monitoring risks. Requirements definition itself also carries risks such as ambiguous requirements, insufficient agreement among stakeholders, estimation errors, and securing staff, and the earlier the stage, the greater the effect of taking action. Limiting the start to after requirements definition is complete means missing the risks of the most important period.
Incorrectイ
The scope of what is managed is wrong. Events caused by people (staff), such as insufficient skills, the departure or sick leave of a key person, and variation in productivity, are themselves typical examples of project risks, so naturally they are included in what is managed. Concrete responses can also be prepared, such as education and training, adding experienced members, cross-training staff so that work does not depend on one person, and outsourcing. There is no reason to exclude things that depend on individuals.
- ウ
正解 The correct answer is ウ. A risk is “an uncertain event that has not happened yet but, if it happens, will adversely affect the quality, cost, and delivery schedule of the project,” and no matter how much effort is made, its probability of occurrence cannot be reduced to zero. For that reason, project risk management prepares by combining both (1) preventive measures that hold down the occurrence itself (avoidance, mitigation) and (2) measures that keep the damage to a minimum if a risk occurs anyway (reducing the impact, transference, and preparing a contingency plan). Choice ウ states exactly this two-track way of thinking, “prevention” plus “minimizing damage,” so it is appropriate as a basic policy for risk management.
Incorrectエ
The premise that “occurrence can be prevented if preventive measures are thoroughly implemented, and in that case post-occurrence countermeasures become unnecessary” is wrong. Preventive measures can lower the probability of occurrence, but they cannot rule out external factors or unforeseen events, so residual risk always remains. Therefore, measures to minimize damage in case a risk does occur, and a contingency plan (alternative means, backup staff and budget, escalation procedures, and so on), must be prepared in advance. In regarding post-occurrence countermeasures as unnecessary, it takes exactly the opposite view from ウ, so it is not appropriate.
ここがポイント
- Project risk management is an activity that keeps the cycle of identifying risks, analyzing them (assessing probability of occurrence and degree of impact), planning responses, and monitoring and controlling them running continuously from the initiation and planning stage of the project through to closing. What it covers includes not only technology, schedule, and cost, but also human risks such as insufficient staff skills and staff leaving.
- Risk response strategies include avoidance, mitigation, transference, and acceptance; prepare by combining measures that lower the probability of occurrence itself (avoidance, mitigation) with measures that hold down the impact and loss when a risk does occur (transference, and preparing a contingency plan). Prevention alone cannot completely stop risks from occurring, so post-occurrence countermeasures for residual risk are always necessary.
用語