Seeing the risks through the trees

In this blog I’m going to talk about the real-world challenge of identifying risks on projects and the way to deal with them. In the world we live in, risks are ubiquitous and we know from experience ignoring them is eventually going to lead to unwanted consequences. If you Google “risk proverbs” it will return a whole list of great quotes for embracing risk to fulfil your dreams and ambitions. Taking risks can bring rewards, but before you embark on something, it’s worth understanding what the dangers are and what to do about them.

On projects, it’s very easy to ignore thinking about them, assume (or hope) that it’s going to be fine and just focus on the here and now. This is not how we live our normal lives. You don’t go to work in the morning hoping you have enough fuel to get to work. You probably check the fuel gauge when starting the car and as a failsafe you have a dashboard warning light. You know you need to get to work, how far it is, how much fuel you have, so the risk has been resolved with those simple checks. Whilst cars are very similar, the nature of projects means each one is often unique, so I’ve built a cheat sheet to call out areas of projects that are susceptible to risk. It applies to Business Intelligence projects, but you could easily adapt it to suit others.

To use the cheat sheet the project team should work through the list and discuss each item. For each one, is it known, understood, measurable and achievable (applying SMART criteria is a good approach). For example, “Time milestones”, do we have any and if so, do we know what’s required to achieve them, how do we know if it’s on track and what are the factors that affect it. The team can then discuss and agree if it’s a possible risk. Using the poker planning cards to score it (1-Very risky -> 13-Piece of cake) will help to ensure everyone’s views are gauged and we are not just going with the strongest opinion. If there is ambiguity and you don’t have an irrefutable reason to ignore an item it’s got to be on the risk radar.

There are always intangible and unknown risks, but at least we have done the due diligence to check on what we do know. Now that we have our candidates, if it is a genuine risk that can’t be avoided, score the likelihood of it happening and what is the impact.

Now that we “can see the wood from the trees” we can apply one of the standard techniques and ROAM through the list. Spend your time on each risk, proportional to its combined likelihood and impact.

With ROAM risk has the four following states:

R – Resolved, O – Owned, A – Accepted, M – Mitigated

If a risk has no ROAM status the project team should discuss whether action can be taken to resolve it altogether, reduce it with mitigation, accept it or work out what action needs to take place to get one of the first three outcomes. Actions are owned by a person with a deadline to carry them out.

So, going back to the earlier example and applying ROAM, if I’m not sure I have enough fuel to get to work it’s a risk. If I checked and confirmed I had enough fuel, the risk would be resolved. If I don’t know what fuel stations are on the way to work I will own the risk to find out if I can get to station before I run out. If I know that I can reach a fuel station, I know the risk is mitigated. If I don’t know where the stations are and I don’t check, I’m accepting the risk knowing I will probably be OK.

Risk registers are living breathing documents that should not belong in a cupboard. The project team should pre-book regular meetings to review owned risks and how they are progressing. Also check the mitigations are still valid and in place. Flicking through the risk cheat sheet also helps to avoid complacency. If you have come up with every risk you can think of, resolved and mitigated as much as it is possible within the project constraints, then you can sleep soundly, knowing that you have prepared all you can.

The people who regularly do risky things and get away with it, are the ones who have prepared the most, done their homework and eliminated as much of the risk as possible, so only an unknown or an unlucky event is going to catch them out. As the golfer Gary Player always said “the more I practice, the luckier I get.”