Managing technical risk

The current accepted process for managing technical risk addresses only a tiny fraction of the relevant risks, looks for consequences in the wrong places, and assesses risk and consequence in a way that offends mathematical rigor and confounds very serious problems with trivial ones. This paper lays out a more solid probabilistic approach that goes a long way toward explaining the cost and schedule overruns that afflict large system developments. It shows that technical risk exists in almost every system design throughout a large system development program. Rather than managing ten or twenty risks, a program faces thousands of risks, and they are interrelated. A general stochastic solution is presented, grounded in subjective expected utility theory. However, a stochastic solution may not be sufficient for a problem that is fundamentally social and organizational. The future of risk management may be in applied game theory, which might swing the pendulum back toward today´s methods, focusing more on management attention and the perception of problems rather than carefully balanced solutions.