Question

You are the project manager for an upgrade of computers in your company. You need to upgrade 30 systems, including 10 desktops (for office personnel) and 20 laptops (for remote workers). Each system must access the company network, as well as a common installation of software, security components, and so forth. You must submit your risk identification in a summary that will be used during a presentation for the CIO.

In a 3–5 page document, complete the following:

• Identify four (4) risks.
• Describe the different types and how they are unique to this IT project.
• What techniques did you use to identify these?
• Explain how these risks are similar and may overlap.

You are the project manager for an upgrade of computers in your company. You need to upgrade 30 systems, including 10 desktops (for office personnel) and 20 laptops (for remote workers). Each system must access the company network, as well as a common installation of software, security components, and so forth. You must submit your risk identification in a summary that will be used during a presentation for the CIO

• Identify four (4) risks.
• Describe the different types and how they are unique to this IT project.
• What techniques did you use to identify these?
• Explain how these risks are similar and may overlap.

Answer 1

The nature of any business is to adopt and adapt to changes. Therefore, an organization that is successful needs to embrace changes in a way that new threats and vulnerability that emerge on a daily basis is thwarted. One of the key steps in this process is to maintain software and systems that the employee use and executive management has the responsibility to oversee that this is successfully carried out. The organization has to recognize that IT functions in any organization is an important one as it ensures efficient and effective management of business. One of the critical functions of IT department is to make sure that all employees are equipped with current and secure software without which the risk of jeopardizing the business is high. Software and system upgrades are inevitable as the organizations that use them change as the business progresses.

Upgrading of systems and software in an organization is to be done with utmost care. There are risks that need to be managed in any upgrade project. A misstep in execution of upgrade project can have the negative impact of operations and service delivery that can result in the value reduction of the organization as well as the missed opportunities that would hinder the growth of the organization. Risk management in the IT World is quite complex with tasks that are tightly coupled and with many inter-dependencies. A well-defined management methodology of implementation of software and system upgrade can help in successfully completing this mission-critical project.

The first and foremost risk that is to be evaluated is the on-time and on-budget completion of the upgrade project. The risk arises due to direct and indirect cost associated with this project. The cost of upgrade procedures have to be evaluated from every angle, from the cost of the software and license of terms and conditions to the scheduled completion of the upgrade from start to finish. Every day, that a personnel is without a system, would amount to loss in productivity and hence a loss in revenue.

Risk of extended upgrade time can be managed quite effectively, if the steps involved are broken down in such a way that the system and software upgrades happen in a modular fashion with a set of related software upgraded at a time. This will ensure stability of the systems, especially in the situation where the upgrade is happening not in sequence.

Another risk that needs to be considered is the security compromise in the upgrade process. It is possible that there are security breaches in new version of the software, especially those that are releasing major versions. To avert the risk of compromising security, the software upgrade has to be tried in an isolated environment outside of the firewall so that any adverse effects are not affecting the enterprise network. A comprehensive evaluation of the software’s security architecture and its applicability to the company’s security policy is to be done before undertaking the upgrade.

It is possible that an upgrade of software, even though improves the system performance, could result in additional training for the employees. This cost is usually not anticipated many a times, but the lack of training could lead to lack of adoption and reduced productivity. This risk is to be averted in software upgrade. A way to mitigate this risk is to check into the functionalities of the new software and analyze them for the purpose of ease of use and radical changes from the previous version.

Even though the new software and system upgrade is economical and has packed features, it is possible that it is not compatible with the tools that are popularly used by the employees in the organization. These legacy tools probably would have wide adoption within the organization due to its simplicity and coverage of essential functionalities that are required by the personnel in carrying out their daily duties. This would cost quite a bit for the organization as the users will be at a loss to fill the gaps created by the void. A good way to degrade this risk is to perform a thorough auditing of the legacy tools and view them in the light of new system architecture.

The risks identified here are related to different aspects of software upgrades – adoption, security and productivity. There are similarities in these risk assessments in that they all relate to success of an organization. There is an overlap of risks in these tasks identified in IT system and software upgrade. Not analyzing thoroughly the legacy applications and providing ad hoc methods to carry out the functionalities with the upgrade will open up security holes that can bring the system down. Lack of training will lead to not being adopted and result in successful implementation of the upgrade as well.