How many of us have been in PMO meetings where the topic of risk is discussed, and there is an uncomfortable pause in the room? I believe that this pause is because we all are relatively adept at identifying risk, but after that identification we are uncertain of how to handle it. Sometimes the plan is either only partially completed or can be executed only with extreme difficulty. We tend to have trouble regarding the next steps to accomplish and grasping what it means regarding those risks/opportunities.
- Who do we talk to about them?
- At what interval do we discuss them?
- Who is responsible?
- How long should we keep them on the register? our risk matrix?...our minds?
A Matter of Perspective
Before we can talk about uncertainty management (risks and opportunities) let's review some definitions and frameworks.
Individual uncertainty in a project or program is "a specific event or condition that might have an effect on project objectives" (Standard for Risk Management, 2009, p.10)
Overall project uncertainty "represents the effect on the project as a whole." It is "more than just the sum of individual uncertainties on a project, and "represents the exposure of stakeholders to the implications of variations in project outcome(s)" (Standard for Risk Management, 2009, p.10)
In other words, each individual risk (or opportunity) is an entity for management that combine in a complex fashion to shape the overall uncertainty management framework for the project. "Framework" is also a key concept. I've studied and practiced one (or a combination of both) of these in my career.
1. Project Uncertainty Management Process (PUMP), (Chapman & Ward, 2011)
2. PMBOK Risk Management Knowledge area
The PUMP framework emphasizes an early identification of risks in the process, but what to do about them is deferred until later. During identification a tracking interval and series of metrics should be established so trends can be tracked for proper monitoring and impact analysis of risk.
The PUMP structure follows (Chapman & Ward, 2011).
- Identification phase
- Search—Using a range of techniques find sources and techniques regarding uncertainty
- Classify—Aggregation and de-aggregation of the items found in the search portion to provide a structure for management
- Clarify—Proactive and reactive potential response should be outlined here
- Consider—Secondary effects responses of uncertainty management
- Iterate—Identify items for further study and create a risk watch list
- Structure phase
- Develop the order of sources and responses—provide order from chaos for future resource allocation
- Characterize interactions—understand the additive and clustering of potential uncertainties
- Classification refining—after more information is known, realign groups of uncertainties
- Restructure appropriately—this is an iterative process that continues throughout the project lifecycle
- Clarify Ownership
- Every element of the PUMP must have a person or team responsible for monitoring/controlling that uncertainty. Otherwise it could get lost in the structure, and remain a passive task that comes back to cause problems in the project (Chapman & Ward, 2011).
The PMBOK risk management (Project Management Institute, 2017) procedure includes the following:
- Plan risk management
- Align with project charter
- Identify stakeholders
- Align resources & register stakeholders
- Identify the risks
- Uses a variety of inputs from other processes to make a list of risks
- Perform quantitative & qualitative risk analysis of impacts
- Leverages the risk management plan created in the first step above to mitigate each risk
- Plan responses
- Updates the project management plan with appropriate risk response
- Control risks
- An analysis of trends and strategic reserve are evaluated periodically
- Updates to the project plan are derived
Pivoting from Theory to Practice
Now for the pivot--the flowchart below is a framework that has been working for me. Note that blue denotes what to KNOW and orange denotes what to DO.
1. Bring up uncertainty management at the very beginning of the process. Uncertainty should be part of the decision space during the project evaluation phase. If your organization has a steering committee or a portfolio management group consider bringing in high level risks during the decision process to pair with the schedule, cost, benefits realization and organizational change factors. This is where the first high level uncertainties should be recorded in your PMIS. These are individual elements (we call them cases) which will be continually monitored throughout the project (assuming it becomes a project). They can fruit into issues and maintain the pedigree of the original risk. We also attach these uncertainties to major tasks in the WBS. Our PMIS allows us to use "tags" for easy sorting and review so we tag them as #risk, #opp. This action makes it really handy to go back later and retrieve all the #risk and #opp across your programs/portfolios for lessons learned.
2. Perform a qualitative assessment of the uncertainties with the project team
Once the steering committee says "go" and your project is in the planning phase, it's time to involve others in the planning. During planning sessions encourage as many different people with disparate skill sets on the project team to "weigh in" on the uncertainties. Their perspectives regarding what the risk/opportunity will mean for scope, cost or schedule will be different than yours, and this will create a healthy debate among the team. This debate also enhances the chances that the entire team will take ownership of these cases and manage them proactively. Note: I believe that the PM should always maintain ownership of each uncertainty on the project, but there can be other contributors that bring subject matter expertise to the table to enrich the management of these uncertainties. After the team meets to discuss update the rankings according to probability and impact in your PMIS.
3. Complete a quantitative analysis on the top 3 - 5 uncertainty cases on the project
If you have a team dedicated to risk and that can devote the time, by all means flesh out all of the quantitative measures for each risk you can. However, our team is small, and we must be judicious regarding our time. I have found that the 80% rule of thumb works here too. Twenty percent of the uncertainties will consume eighty percent of your time. Therefore, make it count--work as a team to quantify the cost or schedule impact that the uncertainty will have on the project. Remember, opportunities will have a positive affect on cost/schedule. There are many templates that go over some ways to accomplish this.
4. Update and maintain uncertainties and try your best to keep them from fruiting into issues
Risks are items of interest that may happen in the future. An issue is a risk that has become reality. These must be dealt with now! Sometimes issues seem to "pop up". This happens to all of us, but that doesn't mean that the risk wasn't there--it just means that it went unrecognized and that the team didn't know how to or that they should prepare for the eventuality. I argue that the more we can standardize the uncertainty management framework, the less likely these unrecognized issues will arise.
I believe that as project professionals it is our job to manage uncertainty. Business opportunity is not without this uncertainty, and strategic leaders are aiming to make informed decisions regarding which new ventures, change initiatives, and markets in which to enter. With this framework both before and after project initiation, we can assist our organizations in this endeavor.
Thank you as always for reading and I welcome your comments around this topic.
Chapman, C. & Ward, S. (2011). Project risk management: Processes, insights and techniques (3rd ed.). West Sussex, UK: John Wiley & Sons Ltd.
Project Management Institute (2017). Guide to the Project Management Body of knowledge (PMBOK® Guide)—6th Edition. Newtown Square. PA. 2017. Retrieved from http://www.pmi.org/PMBOK-Guide-and-Standards/Standards-Library-of-PMI-Global-Standards.aspx
Project Management Institute (2009). Practice standard for risk management. Newtown Square, PA 2009. Retrieved from https://www.pmi.org/pmbok-guide-standards/framework/practice-standard-project-risk-management