Project Risk Management – What’s the Point? Recently I have been helping a couple of family members to prepare for their first overseas trip. It hasn’t been too onerous, mainly simply recommending that they visit some of the places that I rated as highlights when I travelled through the countries that they will be visiting. In addition however, I also described some of the issues that I faced or problems that I had encountered and how that they could plan to avoid these when they were alone and fending for themselves on their upcoming and exciting journey. No doubt they will encounter many things that I didn’t and will have to respond and adjust accordingly but at least they have reduced the likelihood of having to deal with the exactly the same things that knocked me off balance many years ago. They have deliberately imagined their way through their travel plans, trying to predict future issues and in addition have effectively “learned from my mistakes”. There is nothing particularly insightful about my actions; I am simply trying to help someone that I care about, have a successful and enjoyable trip. All of these principles are basically an application of common sense and most people would see this as a necessary and typical approach taken when we plan for success on something like a long trip in what for us is unknown or at least uncertain territory. However, what we have applied here is risk management and although the definition of a typical project certainly closely reflects the description of “a long trip in unknown or uncertain territory”; in my experience many organisations do not see Project management courses as a necessity for the successful management of their projects. Over many years of conducting competency assessments for practising Project managers, it is only occasionally that I see a robust approach taken in terms of project risk management and I always feel that this reflects the organisation equally as much as the individual. So let’s have a look at it in a bit more detail. What is Project Risk Management? Project risk management is about identifying and managing all of the risks that may affect the successful achievement of your project objectives. What could happen that would affect my project? Then we consider Where, How, Why and When could it happen? Many organisations (rightly) have mature and consistent risk methodology when it comes to assessing OH&S risk but although the process is largely similar, it requires a change in your frame of reference to focus from broader categories of operational risk and think specifically about all of risks that may prevent the successful delivery of your project. Your project risk
plan is not your job safety (OH&S) plan which although often critically important, is simply one category or a subset of your overall project risk plan. What is the Project Context? Just as what specific countries we visit determines how we might plan for our overseas trip, so the scope i.e. the boundaries of our project and how it fits in organisationally or strategically drives the identified risks for our project. Specific exclusions identified when scoping the project for example may eliminate some risks from our project just as an illdefined scope is likely to drastically increase both the number and severity of risks to success. Be honest in Risk evaluation and treatment! In risk analysis we will typically assign a value to both the likelihood of a risk occurring and the impact if it does occur. The accuracy of this is obviously informed by our experience as Project Managers but even more so if we are able to draw on the collective experience of our peers either through our processes or by access to historical records of previous projects. This is an example of our overall project methodology and systems supporting successful delivery. What do I know? What do we know collectively? As an organisation we don’t want to have to ‘re-learn’ the lessons of previous projects! In any case, we want to try and make a valid assessment of what the likelihood or impact will be so that we so that we can treat it accordingly. We don’t want to be Chicken Little (the sky is falling) but neither do we want to be Homer Simpson (“everyone is stupid but me, mmm potato chips”). If we rank the risks of our overseas too highly, we will never leave home, likewise a blasé approach may cause us to be robbed before we have left the airport. Let’s try and be positive and proactive but as honest as we can. Treatment is what we do about the risk to try and prevent it impacting our project. The treatments should be specific, tangible and actually make a difference. Generally the treatment taken should be lowering the initial rating that we evaluated for the initial risk. We should be able to put our hand on our heart and make sure that our prescribed treatment actually does lower this. If not, we should either come up with a new treatment or leave the initial rating alone. Don’t leave it in the bottom draw! Often I see a high level risk assessment conducted very early in the project and no evidence of anything further in risk management after that. It seems like they have simply ticked off the requirement to manage risk by this approach and now don’t have to worry about it. This is the most important time! We are not doing this to conform to a process. We are trying to execute our plan and try to ensure success for our project. We need to monitor and control against our initial risk plan. Are our treatment strategies working? Are their new risks that
we need to evaluate? Can some of them be closed off as they are no longer a risk to our project? In Conclusion – should we bother? As previously mentioned, we plan and implement a risk plan to maximise the likelihood that our project will be a success. Based on the scope of the project, we draw on our individual experience, the collective wisdom of our organisation and systems and perhaps accepted practice in our industry to accomplish this. We want to manage this project at least as well as we managed the previous one. The risk plan incorporates our organisational learning about our projects i.e. what works and what doesn’t! If we are conducting a large system rollout, how do we do it so that it applies what we know about successful approaches to ensure that we achieve the goal? Are we going to cut it over at all sites on a Monday morning (Big Bang!) or are we going to pilot at a small quiet site, learn from that and then roll it out in stages? Will it be done during business hours or at night or on weekends? Can we back it out and restore it quickly if it doesn’t go well? All of these would be part of our risk mitigation strategies and risk plan? Just as taking some time to think about possible future issues and learning from previous experience to minimise problems and maximise success is a necessary and common sense approach when planning for an overseas trip. It is imperative that we think in a similar fashion when we are managing projects. Projects are important. Often career prospects for an individual can be manacled to a requirement for a happy ending. So while you may have become a project manager because you like a fast, high risk and exciting life. It is likely that the priorities of your key stakeholders, is for Low risk or even No risk project! Why don’t we try and maintain a low resting pulse rate for both us and our stakeholders by adopting a robust risk management approach and also watch the number of projects that we successfully deliver increase as well. Good Luck with your Projects!