Project risks—the good, the bad, the ugly

Another important factor in identifying risk is having a culture that encourages team members to come forward with concerns around risk. In a presentation on ‘Risk Management—Is it adding value to business?’ for the Chartered Institute of Building, speakers Nick Crennan and Gavin Halling proposed that risk management should be given more exposure outside of ordinary project meetings. Allowing any team member to bring a risk to the table for others to help solve will develop a proactive culture, which is more productive than having progress meetings to allocate blame for past events, they say.

Hillson agrees. “You need to encourage people to expose uncertainties, to not be afraid or ashamed of what they don’t know, and expect people to share uncertainties and not hide them away.”

Lastly, the more innovative and creative the method for identifying risks, the more you’ll get from the process. “Too many risk identification sessions just go over the same old ground—‘we know what the risks are, let’s just get on with it’. We should encourage people to think differently: for that we need different techniques for identifying risks,” suggests Hillson.

Prioritising risk

The standard risk matrix measures risks for probability and impact so that those with the highest probability and the highest impact generally become top priorities. This works with both positive and negative risks, reminds Hillson. “If it’s likely to happen and really hurts, that’s a bad threat that we need to deal with. If it’s likely to happen and be really helpful, that’s an opportunity we want to pursue.”

However, a further dimension of prioritisation is a project manager’s ability to handle the risk: it could be that you don’t have the authority to act on a risk, or the risk could simply be unmanageable, which will also affect prioritisation.

“You might have a great opportunity but if you can’t do anything about it, it’s not such a good opportunity—or perhaps you wouldn’t prioritise it. Maybe it would be better to pay attention to a smaller opportunity that you can do something about,” Hillson explains. “Or you might have something that is a big threat but it’s just not manageable. Of course you need to be aware of it and think about contingency planning, but in terms of prioritising responses, maybe you should prioritise something you can do something about.”

Prioritisation thus has two goals, he says. “Find big risks—the worst threats and the best opportunities—and define which ones to act on. It’s not always the same answer.”

Most organisations focus on threats, but Hillson recommends looking for the ‘silver lining’ when managing risk. “We’re not going to have a very successful project if we allow things that could help us to pass us by. We’re missing a trick if we ignore the opportunity.”

The only thing to note before pursuing opportunities is scope creep. If the opportunity falls outside the scope of the existing project, it’s another project, says Hillson. “An out-of-scope threat is escalated to someone outside the project who can decide what to do, perhaps the project sponsor, and the same should happen with opportunities.”

Risk management

Developed in the mid-1990s, the Australian and New Zealand standard (AS/NZS 4360 Risk Management) was the first of its kind in the world. As a sub-discipline of project management, risk management is not necessarily every project manager’s strength, but has begun to mature into a discipline in its own right with its own body of knowledge, professional practitioners, and even industry bodies like the Risk Management Institution of Australia.

For those who enjoy uncertainty, risk management goes beyond projects and business. It’s a way of thinking, says Hillson. “It’s more of an attitude, a mindset, which takes it above the level of a discipline or a profession to the way that people think and behave: to understand that life is uncertain but we have an ability to predict that uncertainty, and scope it, and do something about it.”

And if you were in any doubt about the importance of acknowledging risk, Hillson offers this tip: “The zero-risk project doesn’t exist—get used to it!”