Although risk management is a classic discipline and part of a standard curriculum on most project management courses, it doesn’t mean that the average project manager knows everything there is to know about it or that they are doing it really well. Unfortunately!
Far too many of us make basic mistakes that negatively impact the outcomes of the project. We carry out the risk assessment on our own without involving the team. We identify what could go wrong at the beginning of the project but fail to later update the risks and we rarely identify positive risks, people risks and unknown unknowns.
The underlying problem may be that many of us treat risk management as a mechanical process instead of really engaging with it and ensuring that it adds value. It’s ironic that even though we know that the road to project delivery is unlikely to be straightforward, we don’t take the necessary steps and mitigate what could go wrong.
Risk management is a fundamental part of successful project delivery, which works best when all team members collaborate and share their knowledge and insight. When risks are analyzed, planned and assigned in collaboration, not only does it improve the process, it also reinforces accountability and ownership.
Project managers sometimes assign themselves to most of the items in the risk register. But that doesn’t leverage the team or create a shared sense of responsibility. It’s important to have the courage to assign the right owners and to gain their buy-in and acceptance for fully managing a risk.
Different Scenarios and Viewpoints
When project managers do risk management well, they consider different scenarios and viewpoints, and they examine each part of the project. They also include risks that relate to strategy and interpersonal conflict, which more inexperienced managers may miss out.
Examples of such risks are changes to the client’s strategy, the possibility that client and supplier will interpret the requirements or the contract differently, the risk that trust breaks down between delivery partners, the personality and character of the key players and their ability to collaborate, or the risk that one or more stakeholder groups will be opposed to the change.
People Problems Will Occur
Good project managers plan for the assumption that people-problems will occur and mitigate them ahead of time by putting in place techniques to manage relationships and communication. They are prepared for the unexpected and involve the team in the process.
They set up meetings with the sole purpose of identifying and dealing with risks and they ask people what they worry about and what could prevent them from delivering on their promises. They do this, not just with the purpose of mitigating risks in the short-term, but also so that they can create a risk-awareness-culture, which enables the team to better spot risks in the future.
Risks and Opportunities
Positive risks are as important to handle well as negative risks because they represent opportunities to deliver even more value to the client. It is when we challenge the status quo and find ways to continuously improve and innovate that we exploit opportunities. But these positive risks may not always stare us in the face – especially not if we are too concerned with following the plan we have laid out.
More often that not we have to train ourselves – and others – to spot these opportunities and we have to deliberately take time out to analyze how things could be done differently.
The Overall Risk Profile
Another aspect, which junior project managers often omit, is assessing the overall risk profile of the project. Risk isn’t just a label to be added to each individual threat, as the overall risk of a project may well be greater than all risks added up. David Hillson, AKA the Risk Doctor, sums it up in this way;
“Another conceptual limitation that is common in the understanding of project risk is to think only about detailed events or conditions within the project when considering risk. This ignores the fact that the project itself poses a risk to the organization, at a higher level, perhaps within a programme or portfolio, or perhaps in terms of delivering strategic value. The distinction between “overall project risk” and “individual risk” is important, leading to a recognition that risk exists at various levels, reflecting the context of the projects. It is therefore necessary to manage overall project risk (risk of the project) as well as addressing individual risk events and conditions (risks in the project).”
Expected and Unexpected Risks
According to Elmar Kutsch, lecturer at Cranfield University, there are further two problems when it comes to how we manage risk. Kutsch explains that firstly project managers don’t properly deal with expected risks – i.e. the known unknowns.
These are the risks we understand and that we can identity and predict. According to Kutsch project managers are often over optimistic and delay dealing with these expected risks simply because it’s easier to do nothing. His research shows that people shy away from committing to risk mitigating actions and instead wait and see how the risk develops before doing something about it.
The second issue, according to Kutsch, is that project managers are paying very little attention – if any – to the unexpected risks; i.e. the unknown unknowns.
It seems there is a tendency to focus on familiar and measurable risks as opposed to those that the project team cannot predict.
One of the ways in which we can get around this is to involve people in the risk identification process from outside the project. People who think in unconventional ways and have a different viewpoint may be able to spot the unknowns that we cannot spot ourselves.
Some risks however cannot be spotted either by the team or by outsiders, as they are inherently unknown. All we can do in those cases is to build in resilience and flexibility so that we can cope with the impact of the unexpected, wherever it comes from.
Getting Better at Managing Risks
To get better at managing risks – and ensuring that the process adds value – consider these tips:
- Set up risk meetings with key team members and stakeholders with the sole purpose of jointly identifying and dealing with risks and creating a shared sense of responsibility.
- Ask people what they worry about and what could prevent them from delivering their assignments.
- Involve people from outside the project to help you spot the unknown unknowns.
- Include risks that relate to change in client strategy, breakdown of trust and interpersonal relationships.
- Determine how to best mitigate risks that have a medium to high impact and probability. Decide what you can do to lower the probability of negative risks and increase the probability of positive risks.
- Explore the root cause of each major risk by asking why, why, why.
- Take a step back and assess the overall risk of the project. It may be greater than all risks added up.
- Use risk maps to understand feedback loops and relationships between individual risks.
- Assign the most appropriate owner to each risk (not just yourself) and gain their acceptance.
- Encourage people to also watch out for positive risks and exploiting opportunities.
- Encourage a discussion around the project’s main risks at the monthly steering committee meeting – especially those that impact the project’s success criteria or where you need additional funding or time to implement the risk response.
- Always communicate important risks to senior stakeholders in person before they see it in writing.
In summary, far too many project managers treat risk management as a mechanical tick boxing exercise that ends up not adding any value.
To become risk management masters we have to fully engage the team and create a risk-awareness culture were all risks are taken seriously, including people-related risks, positive risks and unknown unknowns.
In addition we have to regularly take a step back, assess the overall risk profile of the project and take great care to communicate the most severe risks and the mitigating actions to the project’s steering committee.
Photo credit: IvanWalsh.com