When Risk Management Isn’t Enough
Jeff Ryall
The conventional approach to risk management, based on AS4360 is well known. You can download this process from Quality Award Partners’ website at http://www.qap.com.au/risk/risk-process.htm. However there are situations when this isn’t enough to ensure successful outcomes.
This can typically occur when you are managing large, long term projects that involve multiple stakeholders. These can be of many types: for example construction, relocation, new product introduction, software development. Within these kinds of projects it can be impossible to foresee all of the risks. Sometimes the complexity is just too great for the typical organisation to manage. More often risks emerge unannounced as the project progresses. They can develop as knock-on effects within processes, or seemingly trivial and insignificant risks can come together to create a major problem. It is impractical to pre-plan for every eventuality and the costs of doing so mitigate against it.
Why do these events occur? There are a number of explanations.
- Some events are unknown and unknowable and cannot be anticipated.
- It is not cost effective to prepare contingency plans for every possible situation.
- Contingency planning when it is done is based on rational expectations and information available at the time. This may not hold true in an evolving environment.
- In spite of the best planning people make mistakes and errors of judgement and the conflicting demands of business, political and technical agendas can compromise decision outcomes.
- Because of the incremental nature of evolutionary change within projects, the updating of risk management plans becomes very difficult.
Consequently it is necessary to assume that disruptive events are in fact GOING to occur no matter how carefully a project is planned.
Management often view the emergence of unexpected events as a failure of project management. We all know of cases which resulted in punishment of the innocent and rewarding of the uninvolved!
Despite the most thorough planning, it is the nature of large, long term and/or complex projects that there will be unexpected disruptions. Indeed it is inevitable.
To deal with this a new tool kit is needed - one which contains the necessary skills to apply reactive risk management to project troubleshooting. The core competencies that are needed within this are:
- Advanced and creative (indeed laterally thinking) problem solving skills; and
- High performance teamwork.
Yet when managers are under pressure in a failing project they often are unable to apply these skills within the pressure environment.
What are the characteristics of reactive risk management teams?
- Trust and respect - team members are drawn from diverse backgrounds and encouraged to speak openly without fear or inhibition.
- Constructive conflict is encouraged in order to draw out and test ideas.
- Commitment is total and participation is full.
- Accountability amongst team members to deliver outcomes and results is mandatory.
- Teams maintain clarity of common goals and individual goals are put aside.
Research indicates the optimum size of facilitated reactive risk management teams is between 7 and 10 active participants.
There a number of key principles that need to be applied in reactive risk management in project contexts.
- The corrective action process embedded within the risk continuum model (a core element of Quality Award Partners® risk methodology) should be followed, beginning with containment of the problem, and moving through to business-as-usual as the process is followed.
- Problems must be aggressively identified and dealt with before they spiral out of control.
- Single point accountability for problem ownership is essential.
- Those with most expertise rather than most authority need to be the decision makers.
- Look for bad news and reward its revelation.
- Be aware that external events are often the precursor to internal problems.
- When crisis and organisation often reverts to what is does best, not what it needs to do.
- Avoid micro management – focus on troubleshooting.
- Sometimes the real problem is not what it appears to be. For example a technical problem such as failure to meet expectations may in fact have its roots in flawed communications. Poor customer relationships may exacerbate the impact of this kind of problem.
- Be aware of the dangers of groupthink. An engineering or sales based culture for example can result in discussions and problem solving approaches being herded into the comfortable norm.
- Look for upside opportunities. While there can be a strong focus on removing the pain and getting the project back under control, there may be opportunities waiting to be accessed.
- Beware of poor decisions. They will worsen the problem and escalate the costs.
- When outside specialists are involved they need to be fully integrated into the team.
So there you have it. Reactive project risk troubleshooting teams should be a prepared contingency for any major project. Their effectiveness comes from the open and honest communications they embody, constructive conflict that is a feature of their operation, and the creative analysis that they produce to deal with unexpected, but predictably occurring risk events.
Précis of a paper ‘Project Troubleshooting: Tiger Teams for Reactive Risk Management’ by Alex Pavlak, Project Management Journal December 2004 pp5-14