Why project risk management is outdated
Risk profile - the new way of thinking of risks
Organizations are changing rapidly. The business environment today is fast paced and highly competitive. To deliver successful projects for your company, you need to rethink how you handle risk on a project.
Risk management is out. Risk profiling is in. In this article, I'll explain exactly what a risk profile means to your project.
The myth about risk
Risk management implies you can rid yourself of risks on a project by managing and mitigating every single one. This, of course, just isn't true. Projects by their very nature will always contain risk and it is not your job as a project manager to reduce risk down to a minimum, which is something traditional risk management strives for.
Risks are good
Risks have a negative connotation on a project. A risk is the threat of something going wrong. Invariably, it means the potential for your project to cost more money, to deliver later, to deliver incomplete or to deliver poor quality. Of course it is natural to want to avoid that as a project manager.
However, whilst some project risks will always need mitigating, some risk can be good. In today's environment that statement is truer than ever. Risk allows businesses to be competitive, to stretch themselves and to innovate. Without risk in this world, there is a whole variety of things that would never have been invented. Think of medicine, aviation, science to name but a few.
Risks have the potential for good on a project. Take this example: You are building new software. There is a cutting-edge development language your technical manager wants to trial on this project. It is untested. If it works, it will reduce all future development time by half.
Should you avoid it simply because this is a risky proposition? Of course not. It has great potential. Conversely, should you go for it precisely because it shows such promise? The answer is also no. Confused? I'll explain.
Your project's tolerance towards risk
When dealing with financial products, you will hear the term risk come up often. It might even be one of the most popular words you associate with finance. Every financial investment has a risk associated with it. Bonds are lower risk than stocks. This is not a guess; historical evidence and current evidence backs this up. When an investor is deciding where to invest their money, a good (ethical) investment consultant will ask the customer what their appetite is for risk. Can they handle a big risk? The higher the risk, the higher the reward.
This financial example gives us two facts to explore:
1) Risk can be calculated
2) The choice about whether or not to take a risk depends on the individual's appetite, or tolerance, of risks
A project works in exactly the same manner. Firstly, if a project does a thorough analysis of the risks a project is exposed to you can calculate that level of risk. There are a number of ways you can do this, but the most simple method is assigning scores to the likelihood and the impact, and looking at the product of those two numbers for each risk to give you the severity. You can then average the severity score across all the risks on a project:
Key: 1 = Very Low 2 = Low 3 = Medium 4 = High 5 = Very High
Risk 1: Low Likelihood, High Impact = Severity score of 8
Risk 2: Very High Likelihood Low Impact = Severity score of 10
Your project's average risk score is 9.
You can compare it to the level of risk on a similar project, or a historical project. This gives you data to work with.
Secondly, you can work out a project's tolerance towards risk. This is less scientific, but it should be quite possible for a project manager to make an assessment of this. There are a number of questions you can explore that will lead you to an answer:
- Does the project have a contingency budget, and if so, how much?
- What is the customer's flexibility over dates? Not at all, somewhat or very?
- What is the business's flexibility over dates? Not at all, somewhat or very?
- Can anything in the project be de-scoped if required?
You should now be able to see where this is leading to. By assessing your project's tolerance level towards risk, you can start to get an understanding of how much risk your project should be exposed to.
But how do you know how much risk is suitable?
Hang on, you're thinking. So if a project has a high tolerance to risk, how much risk should it be exposed to? What sort of number (i.e. average severity number) are we talking about? 10? 15? 20?
There is no correct answer. You can only do the same thing the financial world does. You look at historical data. In the financial world, historical data is the best predictor of the future. This logic is true here too. By starting to collate this sort of data on your projects you can begin to build up a risk profile that can be a useful tool to apply on future projects.
Why not just minimize the risk if you can?
Even if your project has a high tolerance for risk and historical data tells you that the project can handle plenty of risk, why not just manage each risk anyway? Why not just minimize it and give yourself peace of mind?
Of course, you will still be minimizing some risks. There are going to be risks on there which always need to be managed because they may be fatal to a project. However, as with all projects, there will be some risks that you can either manage or you can accept. By following risk profile, you are simple choosing to accept some risks, rather than follow a strategy for minimizing every single one. Here are three reasons for doing so:
1) Taking a risk is suitable for innovating projects. Innovation is inherently risky.
2) Minimizing risks costs money. Your money may be better spent elsewhere.
3) Higher risk carries higher reward. This may vary tremendously, but as a simple example: you take a risk to cut production time down on a project and bring it in three weeks early in order to win a follow-on contract with that customer.
By re-thinking risk in this way, you can start looking at how you can transform your project management into something that is working with your business as a whole. You can lead the business by delivering innovative, cutting edge, and highly competitive projects that will stand your business in good stead in today's fast paced environment.
Further reading - some recommendations
A guide to applying project management to today's dynamic business environments