By Marian Haus, PMP
The discipline of project risk management is all about limiting and hindering the adverse impacts of negative events. The complementary discipline of project opportunity management is all about increasing and enabling the beneficial outcomes of positive events.
In this post I want to look at both practices and treat them as a whole— Risk and Opportunity Management (ROM)—while showing that managing them is nothing more than common sense.
Internal vs. External
The risks and opportunities that are triggered by external project sources are generally out of the control of the project manager’s influence (e.g. organizational changes, political climate changes, strategy changes, technology shifts, etc.). External risks and opportunities are generally difficult to anticipate, avoid or eliminate. The best strategy to approach external factors is to mitigate their impact when they occur.
Most often, however, the source of project risks and opportunities are internal and can generally be controlled by the project manager and the project team (e.g. technical and quality issues, stakeholder requests, scheduling, requirements, budgets, etc.). Internal risks and opportunities are generally easier to anticipate, mitigate, control or exploit, since such events will show up in the day-to-day project work.
Now let’s talk about ROM.
The key of practicing effective ROM is twofold:
1. Awareness: The project team has to be aware that ROM will be conducted regularly, like any other project activity.
2. Active: ROM will have to be conducted actively and not reactively (e.g. when really needed).
Allowing things to happen, letting opportunities slip, or, even worse, being risk averse (i.e. zero tolerance for errors and failure) is not only project management negligence or ignorance. It is yet another project risk (of project-internal nature). Hence, make sure you as a project manager will not fall into this trap and become a risk for your own project!
What is the easiest way for your team to be aware and actively conduct ROM? First, put it on the paper—or even better, put it on the board. Allow the project team to write down every risk or opportunity they will encounter during the project course. Next, have the team split the board into four quadrants, based on probability and impact (i.e. low-probability + low-impact, low-probability + high-impact, high-probability + low-impact, high-probability + high-impact).
Then in regular project status meetings validate and agree within the project team on the recorded probabilities and impacts. Certainly there are several more elaborate ways to further qualify and analyze risks and opportunities (e.g. likelihood distributions, decision threes, etc.), but I prefer to keep it simple if possible.
Last but not least, actively capturing and talking about risk or opportunities is not enough. You also have to do something! You need a risk and opportunity response or strategy—whether it’s changing the project plan, getting more resources on board, changing project scope, etc. But that’s a topic for another day.
What do you think? Is ROM nothing more than common sense (at least in its basic form)? What’s your approach to ROM?