DA and Enterprise Risk Management

 

Risks are inherent with projects. They are an attribute of doing something new or novel that distinguishes projects from regular operational work. How well we navigate risk often decides the success of not just a project but also an organization.

In a recent blog post, we looked at how Disciplined Agile (DA) teams can effectively navigate risk, both threats and opportunities, at the project level. This post examines DA’s Enterprise view of risks at the program and portfolio level.

Often team members and project managers focussing on the success of their project may not see how their efforts at project optimization can be misaligned at an enterprise level. In Lean terms, this is known as local vs. global optimization.

Program Risks Can Compound

We know that breaking large endeavors into smaller ones helps reduce risk. Reducing complexity, the number of stakeholders involved, and the project’s duration (horizon of risk) all help increase the likelihood of success.  

However, risks compound when the overall benefit is contingent on the success of multiple dependant projects.  If a business outcome depends upon “Project” A completing, followed by “Project B,” “C,” and “D” each at 75% of success, the overall program only has a .75 X .75 X.75  X.75= 32% chance of a successful outcome. Working on our endeavor, it is sometimes difficult to appreciate the dependency implications of connected chains.

Downstream Risks

Project teams are often incented to take a limited view of success based on how they are measured. Did we complete it on time? Was all the scope signed off? Did we finish within budget? Again, putting on our Lean hat and taking a global vs. local optimization view, how did we really do?

The DA Governance process blade looks beyond the project for possible downstream risks. Project teams may ignore risks associated with increased operational load or sustainability. Sure, we shipped on time, but if we created increased maintenance costs, the organization might be worse off rather than better off as a result.

Aggregate Risks

Knowledge sharing is critical. Individually, a risk exposure may seem acceptable, but if it is common to 50 inflight projects, the aggregate risk may exceed the organization’s risk appetite. Likewise, if many different risks could be triggered by a single event, then that aggregate risk may not be fully appreciated at a project or product level.

Sharing risk information allows for better steering at an organizational level. However, it takes a culture of support for bad-news communications as well as good-new communications for this to work. Creating psychological safety where leaders demonstrate the desired behavior is a good starting point. Then encourage information sharing throughout the organization and help rather than punish the messenger.

The upside is that opportunities aggregate also. The time or cost savings for buying a tool or improving a process may not make economic sense for a single team, but it may be viable if applied to all teams.

Ongoing Risk Governance

We should make sure teams are actively managing the risks on their projects. Check that the appropriate risk tolerances and response strategies are being applied. For instance, one team lead’s view of an acceptable risk might be very different from another’s.

Check that teams understand and are applying the basics of risk management. Have they established risk thresholds for recording risks and escalating them? Are they identifying and acting on risks and opportunities? Are they engaging the right stakeholders and with review and response actions?  In short, are they following the advice captured in the Address Risk process goal?

Reviews can seem like micromanagement and lead to a lack of trust and resentment. To avoid this, explain why risk management is essential and look for evidence of understanding and intent-based actions over compliance to rigid standards unless those standards are required for your industry.

At the enterprise level, check risk tolerances are normalized, and teams are sharing their threats and opportunities across the organization appropriately. When teams are focused on delivering features or meeting a deadline, they may lose sight of risk management work.

Risks as a Positive Sign of Progress and Growth

It is important to recognize risks are a sign of healthy activity. By their very nature, projects are risky because they try new things. They create or change products and services which carry a risk of problems and failure. However, there is an ever-present opposing-risk of enterprise-inertia.

Organizations that do not innovate, improve or even just keep pace with the speed of their industry’s evolution are moving backward compared to their competitors. The risk of reduced competitiveness, loss of market share, or market presence in new communication channels have real consequences. Innovation and evolution through projects counter-act this risk.

“A ship in harbor is safe, but that is not what ships are built for.” This quote parallels the need for projects and some risk-taking. Organizations need project development, product development and other initiatives to stimulate change and to keep moving forward. They carry risk, but so too does standing still. DA provides Lean inspired guidance for applying global as well as local suggestions to help exploit opportunities and avoid or reduce the inevitable threats associated with innovation.