
Paper P3: Business analysis
492 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
(4) Where we are. Compare ‘where we want to be’ with ‘where we are’ or ‘where
we will be if nothing is done’.
(5) Gap analysis. The comparison of ‘where we are’ and ‘where we want to be’
should be assessed, to establish the need for movement to get from ‘here to
there’.
(6) Options for closing the gap should be described in broad outline. There may
be several different ways of trying to close the gap.
(7) For each ‘realistic’ option there should be an estimate of the costs and benefits.
Benefits may not be measurable in financial terms, and a comparison of
financial costs with intangible benefits may be appropriate.
(8) Summary. A brief summary of each option should be given, with a
comparison of their ‘net benefits’.
(9) Recommendation. The report should conclude with a recommendation. If a
business case for a new system has been made successfully, the report’s
recommendation should be to develop the preferred option.
47 Risk management process
All projects have risks. The risk management process involves identifying and
assessing these risks, and taking measures to avoid or control them. The
effectiveness of risk control measures should be monitored. The process should be
repeated regularly, as a risk management control cycle.
The process involves:
(a) Risk identification. Risks must be identified, perhaps by a special risk
management committee, or by the project team.
(b) Risk assessment. Each risk must be assessed. The aim is to decide how
significant the risk may be. The reason for assessing significance is to make a
decision about the risk avoidance or control action that might be appropriate,
in view of the size of the risk.
(c) Typically, a risk is assessed by estimating the probability that an adverse
event will happen, and the impact it would have if it did happen. (The
expected value of the cost of a risk is its probability multiplied by its impact.)
(d) Having assessed each risk, management must decide on appropriate
measures to deal with it. Risks that would have an unacceptable impact
should be avoided. For example, the risk of damage from a natural disaster
can be avoided through insurance. For some risks, control measures may be
taken to reduce the risks. For example, the risks of errors in writing new
software for a system can be reduced by means of extensive testing.
(e) Control measures should be implemented.
(f) The effectiveness of control measures should be monitored.
(g) In cases where control measures fail to work, management should investigate
the reason for the control failure, and try to learn lessons for the future. If the
risk remains, more effective control measures should be devised and
implemented.