Life is risky and since time immemorial
human beings have found a myriad of ways to maim, injure and kill
themselves and others. However, the vast majority of us are still
alive and well, through risk management practices that we are often
unaware of. Driving on the roads is risky but we mitigate the risk by
having speed limits and road rules.
Before I got into project management I
spent three years as a risk manager in a healthcare setting.
Healthcare settings are risky but a good risk practitioner looks for
a way to minimise and mitigate risk. It is only in rare circumstances
that we can actually eliminate risk. I suppose one could stop
treating patients and that would stop the risk of treatment side
effects but immediately another and larger risk will present itself –
death from the risk of non treatment. The rule of thumb that the
organisation I worked for was to identify all the risks and
pro-actively manage the top ten on an ongoing basis. This allowed
real progress to be made on reducing the risk profile without seeing
monsters around every corner.
As we all know one of the cornerstones
of effective project management is to keep an active risk register
along with an issues register. For those of you who are unaware of
the distinction a risk may happen, but an issue has already happened
and needs action. The challenge is to manage risk effectively by
following a small number of principles:
Risk Identification
At the initiation stage of your project
identify all the potential risks with the project board, team and key
stakeholders. Be realistic and resist the temptation to go overboard.
Reputational risk from a botched project is real, the risk that your
whole business will be destroyed by a catastrophic event is not very
likely (but does happen as our colleagues in Christchurch can
testify).
Risk Review
Review the risk register on a regular
basis. Has the risk profile changed? Have new risks appeared? Have
old risks been further mitigated? Have some of the risks become
issues? All these questions should be asked but this should not take
hours to do. Check out the risk controls to ensure that these are
still working, if not, rework them.
Risk Reporting
I like to see full risk reporting on a
monthly basis with a risk reporting section in all weekly project
exception reports. The monthly report lets me track risks across my
portfolio and associated programmes and forms the basis of the
monthly risk reporting through to the project, programme and
executive boards. Of more interest to me are the weekly exception
reports. All I want to see in the risk section is new risks or an
escalation/or dramatic de-escalation of existing risks. Any risk
that is realised as a new issue is also reported. That way I can keep
a regular view on the risk profile across the organisation without
wasting a day reading full risk reports.
In my experience when risk registers
get over-bloated then senior project and business stakeholders lose a
sense of the real risk profile, this in itself raises another risk
that real risks get obscured by the noise of smaller risks. It is
unusual that any project manager is actively managing more than five
active risks in any week so I only want to know what is happening to
the top five on a weekly basis. Of course I do expect my project
managers to escalate any significant risk that is worrying them when
it occurs. While I see all the risk reports on a monthly basis only
the top ten make it to the executive management for review. Once
again this is a pragmatic approach. Senior executives are very busy
and your report is usually one of many items on the agenda, so focus
what you report to allow them to see the real view.
End of Project Risk and Issue Review
At the project close out a final review
of the risk and issue registers needs to be performed. Any risk that
has not turned into an issue can be closed. Issues need to be
reviewed to see if they are still active or not. If they are active
transfer them to someone in the business, if not close them out. This
is an important exercise and should feed into the lessons learned
section of the project close out. It also provides a reality check as
to which risks can be dropped off the next project and which ones can
really bite you in the rear.
Effective risk management will help you
project manage without tying you up in minutiae.
Grant Goodman
Grant is an experienced programme director
who has worked on a large number of programmes and projects
nationally and internationally. He has recently returned from a three
year consulting stint in the United Kingdom. Grant is also the
Waikato Sub-Branch Coordinator.
No comments:
Post a Comment