Lessons Learned and Risk Management

I was recently asked “…what is the difference between ‘lessons learned’ and a ‘risk register’ other than when they are accomplished?” The conversation is still in progress, and I hope to continue it, but as I was responding I realized that I should probably post a follow up to my article “Lessons Learned from Lessons Learned” (https://www.projectmanagement.com/blog-post/73046/lessons-learned-from-lessons-learned) discussing the connection between lessons learned and risk management.

I’m not going to rehash my approach to lessons learned here – you can follow the link for that – but the checklist created and maintained through the process can have direct ties to risk management on future projects. It’s entirely possible for something identified during lessons learned on one project to present itself as a risk on a future project. Here are some real examples:

• The acquisition hasn’t stabilized and priorities keep shifting; project funding may be reduced or cut.
• The legacy system isn’t fully understood; cascading issues may be found during testing, causing delays to the schedule.
• The vendor uses subcontractors that can be slow or uncommunicative, leading to delays and/or additional expenses.
• Overseas tensions are impacting shipping costs and delivery times.
• Technical environment provisioning is slow and/or faulty and we don’t currently have the resources to fix it.
• The organization is displaying signs of change fatigue.
• Estimates are consistently over-optimistic.

The risks that make it onto the lessons learned checklist should go through risk analysis for each project where they are relevant; the probability and impact may not be the same on each one. Some ongoing risks may get absorbed into Business as Usual (BAU). They’re not ignored, it just becomes accepted that it’s likely they’ll have to be dealt with, so they’re included in the plan without being part of that project’s risk analysis.

I don’t have a good average for how long a risk will stay on the lessons learned checklist. This would be either until it is no longer considered a risk or until it becomes part of BAU.

To be clear, this doesn’t change how you manage risks, it just creates a new channel for risk identification. It might even make it easier if you’re one of the few people who reviews old risk registers from past projects to identify risks that may affect future projects.

If you find this helpful and have additional insights, or have a better approach, drop a note in the comments. Feedback is always welcome.