A risk is simply the chance of something happening which has an adverse impact on the achievement of your project's objectives.
Take this sentence apart and it tells you that:
- Risks have an opposite concept known as "opportunity" which concerns positive effects.
- Risks are not certain, you can take action to mitigate or manage their impacts.
- Be very careful about what you define as a project objective. Think always in terms of business outcomes that people can experience, rather than abstract theoretical concepts.
When describing a risk always try to use a meaningful and concise description preferably employing language in the form "a consequence may occur as a result of an event which is due to a cause". One should always remember that:
- You (change manager) are responsible for managing project risks.
- Risk management is part of everything we do. Good managers continuously identify, evaluate and manage risks, and they embed the awareness of risk throughout the organisation, in such a way that every decision is risk informed.
- Always know exactly how your commercial agreements handle risk.
- Risks do not always need to be eliminated, they can be accepted and their impact managed.
- Consider all forms of risk, including safety & security, environmental, commercial, financial, reputational and legal risks.
- Risk, opportunity and issue management are interlinked, and should be considered together. A risk may become and issue, or the resolution of a risk may reveal and opportunity.
The process of managing risk is like many things based on a "plan-do-review" cycle:
| Plan | Do | Review |
|---|---|---|
| Build control systems into project | Embed those controls | Build into governance |
| Hold regular risk workshops | Take rapid action | Continuously monitor |
| Analyse and regularly re-assess | Update RADIO logs | Close out / escalate |
Huge and complex papers have been written on risk measurement. They will be particular methods appropriate for your industry. In addition I always measure:
- Number of risks without credible action plans
- Number of risks open more than 2 months
- Number of risks that become issues
- Weighted cost of risks as a percentage of the anticipated final cost (AFC)
The lessons of risk management are well documented elsewhere. Here are some of the practical lessons I have learned:
- People often talk of "thinking the unthinkable", the real trick in risk management is to "unthink the thinkable". That is to let go of the normal way we have always done things and respond to what a risk is telling us.
- Some problems are best solved by "throwing people at them". Short term intense manual effort in a workaround or mitigation, may prove cheaper than engineering out the risk. Consider this.
- Make risk management fun! This is an important way of protecting your outcomes.
- Engage top-talent early. Always look for the cleverest and most experienced people to help address your risks. They will have been there before.
- Do not try to include every risk in the organisation, be clear what influences project outcomes and when a risk should be owned by operational management.
