Risk

Many people think that risk is bad.  This is nonsense.  Almost every human activity includes an element of risk, and commerce is often about the transformation and translation of risk.  As a change manager you are in the business of risk, you must be an expert in risk management, and you should create an infectious sense of passion and excitement about risk.

A risk is simply the chance of something happening which has an adverse impact on the achievement of your project's objectives.

Take this sentence apart and it tells you that:

  • Risks have an opposite concept known as "opportunity" which concerns positive effects.
  • Risks are not certain, you can take action to mitigate or manage their impacts.
  • Be very careful about what you define as a project objective.  Think always in terms of business outcomes that people can experience, rather than abstract theoretical concepts.

When describing a risk always try to use a meaningful and concise description preferably employing language in the form  "a consequence may occur as a result of an event which is due to a cause".  One should always remember that:

  • You (change manager) are responsible for managing project risks.
  • Risk management is part of everything we do. Good managers continuously identify, evaluate and manage risks, and they embed the awareness of risk throughout the organisation, in such a way that every decision is risk informed.
  • Always know exactly how your commercial agreements handle risk.
  • Risks do not always need to be eliminated, they can be accepted and their impact managed.
  • Consider all forms of risk, including safety & security, environmental, commercial, financial, reputational and legal risks.
  • Risk, opportunity and issue management are interlinked, and should be considered together. A risk may become and issue, or the resolution of a risk may reveal and opportunity.

The process of managing risk is like many things based on a "plan-do-review" cycle:

PlanDoReview
Build control systems into project         Embed those controls           Build into governance
Hold regular risk workshopsTake rapid actionContinuously monitor
Analyse and regularly re-assess Update RADIO logsClose out / escalate

Huge and complex papers have been written on risk measurement.  They will be particular methods appropriate for your industry.  In addition I always measure:

  • Number of risks without credible action plans
  • Number of risks open more than 2 months
  • Number of risks that become issues
  • Weighted cost of risks as a percentage of the anticipated final cost (AFC)

The lessons of risk management are well documented elsewhere.  Here are some of the practical lessons I have learned:

  • People often talk of "thinking the unthinkable", the real trick in risk management is to "unthink the thinkable". That is to let go of the normal way we have always done things and respond to what a risk is telling us.
  • Some problems are best solved by "throwing people at them". Short term intense manual effort in a workaround or mitigation, may prove cheaper than engineering out the risk. Consider this.
  • Make risk management fun! This is an important way of protecting your outcomes.
  • Engage top-talent early. Always look for the cleverest and most experienced people to help address your risks. They will have been there before.
  • Do not try to include every risk in the organisation, be clear what influences project outcomes and when a risk should be owned by operational management.