Overview: Risk management is a key, if under-appreciated, part of project management. Managing things that you’ve mapped out thoroughly and understand in detail is challenging at times, a science in its own right. However, a knack for managing unknowns elevates your work to the level of art.
Every professional Project Manager understands the triple constraints of scope, schedule and budget. We also understand that everything affects everything else. Of course there are other constraints such as quality, customer satisfaction and so on that we also have to consider. External constraints impact your projects such in the form of weather, labor conditions and even legal requirements. Dealing with these known constraints is a big part of the planning effort and putting those different parts into a coherent and effective whole is every bit as much an art as composing a symphony.
Now… imagine performing your grand opus in the middle of a desert in Dubai or in the middle of retooling for a manufacturing plant. Imagine performing your symphony without a dropped note while changing out the IT infrastructure for the banking industry during a financial crisis. You no longer have quite the same opus.
You have a series of choices to make to deal with the unknowns you’ll face. Each choice will affect other parts of your project. Chances are good that your project will spin off into chaos. A very large part of all projects do fail in at least one of the triple constraints.
To stretch the musical metaphor just a bit further, imagine your project not so much as a symphony, with every note placed just so in the idealized setting of the concert hall… imagine it as jazz.
Risk management is the tool set and approach that allows you to work within the chaos to produce beautiful music, even if you arrive at the end by a different route every time you play.
Framework: First, let me sell you a little on why risk management is worth the extra effort. Then let’s look at how you can promote risk management to your stakeholders and use it most effectively. Finally, some thoughts about risk management in general to help put everything into perspective.
Somewhere on the Internet is a web site devoted to “The 2 Rules”. It contains a long list of heuristics, rules of thumb, for hundreds of professions. For example, boxing has the following two rules:
1. Hit the other guy
2. Don’t get hit
For amateur project managers, the two rules might be: 1. Things go wrong
2. See rule 1
For a professional PM with some experience:
1. Things go wrong
2. Deal with it
For a PM who really understands Risk Management…
1. Things go wrong
2. Take advantage of it
True, doing a credible job at risk management takes extra time and effort, along with the active participation of the project team – things which are all usually in short supply. However, it’s one of the few parts of project management, aside from the work breakdown structure itself, where you get multiple benefits for a single activity.
Here are some things to consider about Risk Management. You get more accurate estimates, sometimes lower than originally planned but almost always more accurate. You get the Work Breakdown Structure clearly understood, communicated and even critiqued by all the key project team members. You have actively looked for possible problems and also possible opportunities that will help the project. You project team not only understands what needs to be done, it now understands how problems in one area affect the other areas. You get the chance early in the project, when changes cost the least, to identify and fix potential issues.
If those things helped convince you of the value of Risk Management, consider these things when you try to advocate for it:
When “Things go wrong”, you have a plan to deal with them in the most effective manner possible, as early as possible.
When things go right, you get the choice of going to your stakeholders and returning reserves from the project budget or of bringing in the project further under budget.
If you have planned well, you may have the chance to take advantage of unexpected opportunities. Not all risks are negative risks. For example, because of risk reserves set aside for price fluctuations in energy, when fuel prices dropped, you were able to buy all your asphalt paving and asphalt based roofing materials at a steep discount. When the prices rose again, you’ already locked in at the lower price.
As any professional PM will know, when things go wrong it’s ultimately your job to deal with it. If your planning has been effective and if you have been successful in building good contingency plans, you won’t be left wondering what to do next in the event of problems.
General Thoughts On Risk Management and Project Management —
It seems to me that it’s a lot easier on the ego to learn from the mistakes other people make but it seems to stay with you better when you do it yourself.
Building on my earlier musical metaphor, give some thought to how a jazz combo goes about producing an improvisational piece that’s more inspired than the original. Jazz is anything but spontaneous; a good musician has practiced for years and truly understands the territory. The group practices and rehearses together. There is a solid framework underpinning the music that never goes away. A riff may go far from the original tune, but at some point always returns to the original direction. The best jazz musicians work well together; know what to expect from each other and play to make each other sound better. While jazz is being produced, nobody just “phones it in”. Everyone is fully engaged and paying attention. See any parallels to what a great project team should look like?
We can draw Risk Management lessons from the armed services. I’m referring to combat of course, but specifically I’m thinking about damage control. In combat, THINGS GO WRONG. That’s what combat is. If you don’t have a plan, have it understood by everyone, have it well rehearsed and prepared in advance, people die. People you care about die.
Some general principles in combat risk management that apply to all risk management:
1. Have a plan
2. Make certain it is flexible
3. Keep it simple (at least simple to execute for the guy on the front line)
4. Make sure it’s understood by everyone
5. Practice, rehearse and think it through in advance.
6. Always have reserves in place
7. Be prepared for the worst case
8. Be prepared to jump on opportunities
9. Have a back-up plan
10. Have a fall back position prepared
11. Someone always fails to get the word, be ready for that.
12. Always guard your supply lines
Sometimes, Risk Management can be daunting. It’s helpful to have templates and checklists to help think through and brainstorm about things that can go off track.
Use a Risk Register to track risks and the trigger points when those risks must be dealt with. It’s a great way to keep from getting blindsided.
When brainstorming, tell the team that you will make several passes through the list of risks to get a better picture. Try to go through at least one pass that’s just “silly stuff” like asteroid collisions to get the team to loosen.
Realize that all risks get written down but only risks considered to be above the tolerance threshold are going to actually require follow-up. Others will only need to be monitored.
Try throwing out lists of categories, like “Manpower”, “Money”, “Management”, etc. to give people a starting point to drill down and capture general risks. Try “Politics”, “Processes”, “Payment” or the more familiar Initiation, Planning, Execution, Management, Closing cycle. See if you can get two or three risks from every category.Be sure to work through risks that are specific to each work package in the Work Breakdown Structure.
Once you’ve captured a list of risks that you think is comprehensive, try making a pass through it to see if you can identify positive risks, (opportunities).
It’s rare that a problem can’t be turned to some advantage.
Once you have your risk register populated, it’s time to evaluate, quantify and plan for contingencies. Be certain you have a good understanding of your stakeholder risk tolerance levels and be sure to communicate with them regarding the way you’ll set your risk tolerance thresholds. You may want to consider dual risk tolerance thresholds for large projects. A lower one where a trigger for action is defined and an owner assigned to monitor the risk, then an upper tolerance threshold beyond which contingency plans must be developed.
For smaller projects, for risk of low impact and low likelihood, it’s probably a safe bet to make the assumption that one or two will occur (add into the reserves) and ignore the rest.
Getting accurate estimates for the work needed to deal with risks will allow your overall budget estimate to be more accurate. The reserve planning for both time and budget can be used to communicate with the project team why it’s not a good idea to pad estimates. As you develop the risk estimates, you have the opportunity to explain the purposes of the risk reserves and management reserves.
Risks with very high probabilities, 90% or above, are equivalent to issues or events. You might as well deal with them as if they have already occurred. If you do get lucky and the 90% probability doesn’t happen, you’ll have taken a calculated risk, pun intended, that in this case simply didn’t pay off. Think of it as buying insurance. If you had failed to act and not committed resources when the risk became reality, you’d have been much worse off.
Summary — Risk Management tools and techniques and the team’s awareness of the need to accommodate risk allow you the ability to remain relatively calm while dealing with chaos. Risk Management allows you the freedom to plan for the truly unexpected because you don’t have to waste time dealing with those risks that could be reasonably expected. You may even get the chance to grab onto opportunities you’d never see or be able to capitalize upon without this preparation. You are the conductor in the symphony of your projects. Risk Management might just be the grace note you should consider emphasizing in your next composition.