Managing technical risk

The current accepted process for managing technical risk addresses only a tiny fraction of the relevant risks, looks for consequences in the wrong places, and assesses risk and consequence in a way that offends mathematical rigor and confounds very serious problems with trivial ones. This paper lays out a more solid probabilistic approach that goes a long way toward explaining the cost and schedule overruns that afflict large system developments. It shows that technical risk exists in almost every system design throughout a large system development program. Rather than managing ten or twenty risks, a program faces thousands of risks, and they are interrelated. A general stochastic solution is presented, grounded in subjective expected utility theory. However, a stochastic solution may not be sufficient for a problem that is fundamentally social and organizational. The future of risk management may be in applied game theory, which might swing the pendulum back toward today's methods, focusing more on management attention and the perception of problems rather than carefully balanced solutions.