In my 30+ years of experience in P3M, I found that many project managers face difficulties justify the time and effort spent on Project Risk Management efforts.
Oftentimes, sponsors in organizations with sub-optimal project management maturity question project managers on why time is "wasted" on detailed planning in many areas, especially in Risk Management.
With ill-effects of negative risks fairly far in the future, they ask why the project manager and team are spending time on planning when deliverables could be produced.
I've used some effective techniques which I will post after hearing from you on the best practices have you used. Saving Changes...
I tackled this in one of my early blog posts from 2011:
"For organizations lacking standard practices in project portfolio and project management, risk management might seem like an unnecessary use of resources. I’ve even heard some executives say that with insufficient resources to deliver the expected scope on all of their “critical” projects, how can they afford to have project teams “waste” effort on risk management activities.
For those of us that have come through the PM “school of hard knocks”, such statements might appear myopic if not downright idiotic. However, this leadership perception of low value in this knowledge area often stems from poor implementation of risk management practices – an article I wrote a couple of years back highlights some of these issues. Buried within that article was an analogy that might help you convince your executives of the benefits that value-based risk management can offer.
Ask the nay-saying executive whether they have purchased house insurance.
If they have a mortgage on your property, their lender will probably insist on coverage for at least the value of their loan. However, once a mortgage is paid off, the home owner could elect to avoid insuring their house, but most people would likely still maintain this insurance over the duration of their home ownership. If you ask the executive why they do this, they’d likely offer some variant on the following rationale: “to protect my investment from the unknown”.
Probing deeper, if you ask the same executive how much they spend on home insurance each year, and you multiply that by twenty years, you would likely come to a figure that is at least 2% of the original purchase price of the home. Insurance is just an example of the transfer risk response approach. If we added all the costs we incur to mitigate home risks, the 2% estimate would likely be significantly higher.
So, after having led the executive through this analogy, leave them with the question “You agree that it is important to insure your home against the unknown, so why not apply the same approach to the projects you are sponsoring – surely they are as important to the organization as your home is to you?”.
Investing in the right amount of risk management “insurance” can protect your project from the catastrophic costs of fire-fighting." Saving Changes...
For me is simple. Why a project is started? To create something that will allow the organization to take an opportunity. Is the organization sure about the opportunity will be taken? If the answer is yes then there is no risk and risk management is not needed. If the answer is yes then risk management is needed. Saving Changes...
It may also be a sign that the business case is NOT meant to create value but to gain approval to start the project (and then see what happens). So anything is stripped of the cost that is not following the optimistic view that the project will follow its planned path, which includes risk contingencies and sometime quality measures.
A project manager might be chosen to implement just this plan, and if they fail, they are the scapegoat. The sponsor might say, sorry, you provided me with a bad project manager. Often project recovery results in tripling the cost.
The question is how to protect yourself against this political game: - reject the project - do a project assessment and document the shortcomings (harder if you were in charge of the business case) - focus on bringing the issue of feasibility to steering committee level, try to commit upper management - become politically savvy Saving Changes...
What I often do to communicate risk and why it needs to be addressed is to visualize it so it becomes tangible. When stakeholders can grab the potential impact of a risk they are more understanding to the required actions needed to mitigate it. Monte Carlo techniques work great for this in my experience. Saving Changes...
Convincing people of the value in risk management can be very challenging for a PM. It involves both the technical side of how we identify, plan, and manage risks, as well as the psychological aspect of how people deal with the unknown. Here are some of the best practices I use:
- Understand the risk appetite. A risk that will result in everyone working over the weekend will be considered differently than a risk that will impact the annual balance sheet. Risks that have been a problem historically will also be perceived differently than something all new that has not occurred before. Understanding how they will be perceived should influence how you will communicate the risks.
- Use facts and data whether it is a cost or schedule risk. This can be difficult but I often try to use the most conservative assumptions to build a picture of the risk without overstating it. If everyone agrees that every assumption is on the low end, the estimated risk based on the combined assumptions is probably smaller than the actual risk. If you approach it instead by communicating the worst case scenario which rarely occurs, you will get a reputation for overreacting.
- Communicate not only the risk, but some idea of how difficult it is to manage. Unknowns often elicit a fear response where some people freeze rather than respond proactively. (You told me a problem but the solution might be even worse.) Explaining that the potentially large problem can be an easy fix alleviates the fear and people will be more willing to take action. The solution isn’t nearly as bad as the problem.
- Don’t overwork the risks. Very large projects may have very robust mitigation plans. Other times risk management is limited to a small number of specific things. If you show that you are focusing on all the “must do” items and not all the “nice to do” items, you are less likely to be seen as wasting money.
- Build your reputation. Be open about risks but differentiate between what we need to go work, and what you may need to go work later, and that you will need help if you do. Once you have communicated the risks, management may not want to act. If it is a very big risk, then I might elevate it. If it is a minor risk, I might let the risk turn into an issue. They will remember the next time that when I warned them before and they did not act, it became a real problem. Then I am their ally when I communicate risks, and not someone just pointing out problems with their plan. Saving Changes...