Managing Project Risk
Risk management is one of today’s hottest topics. Most industries are now highly competitive and the project management mantra is faster, cheaper, better. With these pressures comes risk.
Good risk management or poor risk management can mean the difference between project success and project failure. Good risk management allows us to respond proactively to risk and also allows us to react better to those risks that do occur – issues.
Experience has shown that risk management must be of critical concern to all project managers, as unmanaged or unmitigated risks are a primary cause of project failure. Unfortunately, many managers and project managers believe risk management to be too difficult, too time consuming, or even too complicated to perform. However, such concerns are unfounded and there is no doubt that successful risk management will greatly add to the probability of project success.
The nature of project risk management continues to evolve. For some years now the project management profession has accepted that risk management is an essential, proactive and integral part of a project’s entire life cycle, not simply a one-time, optional, tack-on activity. Also, it’s widely acknowledged that project risk management offers significant benefits to all organisations – established and new, large and small, public, private, and not-for-profit.
Our major project management authorities, including the US-based Project Management Institute (PMI) and the UK-based PRINCE2 methodology owners, now advocate that project risk management be applied to both threats and opportunities. In adopting this inclusive definition we are consistent with the current trend in international best-practice risk management. We now use the same risk process to handle both threats and opportunities alongside each other, giving perhaps double the benefits from a single investment. Formerly, risks were regarded as only bad things – uncertain events with a negative impact on project objectives and/or benefits, and the perceived positives were simply the basis for project justification.
Increasing uncertainty is the new norm. Worldwide credit woes, global recession and climate change all look like being with us for the foreseeable future. Yet somehow we adapt and projects forge ahead. We’re gradually becoming more comfortable with the uncomfortable. We can’t wait for the world to right itself, so we’re adopting new models for project management that will make our projects more efficient, agile and flexible, better able to survive the present, and better positioned to thrive when and if, normalcy returns. All such new models recognise the great significance of risk and the vital need for its proper management.
There are no rewards without risk. Just ask our All Blacks, Graham Henry, Stephen Tindall, Michael Hill, Sam Morgan, John Key, Peter Jackson, or any one of our many Kiwi achievers. Such healthy regard for risk needs to be nurtured. Yet, some of our fine heroic and macho senior managers and inert project sponsors, readers of this article excused of course, can be complicit in keeping project disasters going. Instead of commending those project managers who suggest terminating overly risky projects, at best they view these project managers as inept and at worst they replace them. If we have such project sponsors, we can be assured that disaster has not been left to chance.
I call these doomed endeavours “dead projects walking.” We know exactly where they’re going, but reputations, sunk costs, lack of courage and political considerations often dictate that these projects continue and thereby drain our resource pool and so deny more deserving project opportunities the chance of daylight. There can also be an adverse impact on business-as-usual if our organisation’s limited and shared resources are allocated to inappropriate projects.
While we would like to pull the plug early on overly risky projects, it’s sometimes only later in their life cycle that intolerable risk is identified. Nevertheless, if the project can’t or shouldn’t proceed or be satisfactorily recovered, it’s time to admit failure, cut our losses, and to re-assign those scarce resources. At least with growing attention hopefully now given by our project sponsors in particular to post-project benefit tracking, it seems more likely that future business cases will be grounded in some greater reality and enable us to cull out overly risky project propositions before they are assigned to some unfortunate project manager. One warning sign of pending frustration and futility is when business cases for different projects identify the same benefits.
The advantages of project risk management apply to all organisations. The benefits should be of particular relevance to senior managers who sanction projects, to clients (owners) and customers (users) who will more likely get what they want, when they want it, and for a cost they can afford, and to our project managers who want to bring projects in within budget, on time, and to the required level of performance.
An excellent example of a recent large and high profile project where risk was superbly managed was the royal wedding of Prince William and Catherine Middleton. It would be fascinating to see the risk management plan that no doubt addressed risks such as inclement weather, traffic congestion, strike action, crowd control, and perhaps even some less obvious risks such as cold feet (either bride or groom), bachelor/bachelorette night excesses, fashion faux pas, football hooligans and other terrorists disrupting the wedding, wedding guests upstaging the wedding party, etc. There were some issues such as Samantha Cameron forgot her hat, Princess Eugenie’s unflattering frock, and her sister’s Wagnerian antler hat, but otherwise an incident-free occasion and example of effective project risk management.
Some critical factors that help ensure project risk management success are:
• A risk-aware culture.
• A shared understanding of the principles of risk management and their application.
• A straightforward and scalable risk management process.
• A sufficiency of resources to implement the process, especially risk responses.
Over recent years our approach to risk management has certainly improved. There is that famous photograph taken in 1932 of New York construction workers lunching on a skyscraper crossbeam hundreds of feet above street level. They have no safety boots, hard hats, or harnesses, and are seemingly oblivious to risk. Attitudes towards risk have changed for the better. Imagine today if people recreated that skyscraper scene. The police would be called to talk the people down and their employer would be spending considerable time in court if not jail.
In the final analysis, most post mortems of project disasters conclude that their problems would have been avoided or much reduced if there had been an explicit early concern about identifying and resolving their risk. Frequently, these projects were swept along by a tide of unfounded optimistic, often by their enthusiastic sponsors.
Risk Registers vary in their complexity. A basic register or log is downloadable below: