Risk Management: The Underrated Pillar of Project Success

A "more interesting question for me is whether risk is underrated in practice". Yes, it is. IMHO, one of the root causes is the misalignment between the risk management process for projects and the organisational risk management. Very few project managers are aware that there is an ISO Risk Management standard that is, in my opinion, more mature than project risk management standards. One reason is that ISO 31000 was created for the whole organisation, regardless of the activity. Another reason is that ISO was developed based on an occupational health and safety standard. Unlike projects, where good risk management is desired but not mandatory, in WHS there are national regulations that must be followed.

Stelian ROMAN I have read PMBOOK and Rita Macaulay several times and I have never for once see or reference to ISO 3000. As you stated earlier, this code is design for organizational wide risk management but it still baffles me that these text didn’t even state it for once. May I missed it.

Thank you.
I agree that the interface between project risk management and organizational risk management is important, particularly when project exposures need to inform portfolio, strategic, or governance decisions.

I am less certain, however, that misalignment between the two necessarily explains why risk management is “underrated.” It may instead help explain why risk is recognized but insufficiently integrated.
Even perfectly aligned risk processes would not guarantee that uncertainty actually changes a consequential decision.

That is why I tend to see the deeper issue as the connection between risk information and the organizational decision system: when our understanding of uncertainty changes, does anything materially change in the decision while there is still time to influence the exposure?

One small point on ISO 31000: my understanding of its documented lineage is different.
ISO 31000 grew substantially from AS/NZS 4360, the Australian/New Zealand generic risk management standard, first published in 1995 and subsequently revised, rather than from an occupational health and safety standard. I may be missing another historical connection you have in mind, though.

Perhaps this reinforces the broader point: the strength of ISO 31000 is precisely that it treats risk management as something to be integrated into organizational governance and decision-making, rather than as an isolated project process.

I agree, maybe the next version of PMI's Risk Management Standard will have references to ISO 31000. When I manage significant initiatives (project/programs), I have challenges communicating with the Enterprise Risk Management team. It starts with terminology, but there are many other aspects. I was fortunate to meet some of the people who developed the ISO Standard (it is based on an Australian standard), and I was amazed at how far behind we are in understanding risk in project management. Many years ago, I tried to align IT and Civil project delivery methodologies in a large government organisation. Civil projects' understanding of a 'small project', how it can be managed, including risk, was that "small" means a project with less than 150 Million dollar budget. Putting things in a similar perspective, a Major risk in an IT project may be classified as insignificant at the enterprise level.

On a separate note, Rita's book is used to pass the PMP exam certification, not to learn project management. That's why PMI requires certain experience and education to apply for the PMP exam. I had a very interesting experience with the Certified Lean Six Sigma Black Belt certification from ASQ. It started as a challenge from a friend. It is an open-book exam that costs roughly 1/3 of a day's pay for an Agile Coach, and yet in almost 10 years of searching, I couldn't find even one 'Lean Agile' expert who has it. It's a certification that can't be achieved without practical experience, although it also requires a 3-week training course. Risk Management is a fascinating topic and one of the most useful skills for a PM. Congratulations for your interest.

@Luis, "Even perfectly aligned risk processes would not guarantee that uncertainty actually changes a consequential decision." I agree, but disconnected processes lead to waste. IMHO, the 'underrating' comes from a lack of understanding of what risk is and how to manage it. Disconnected processes lead to information blockages and impact decisions at the organisation level.

Re AS/NZS 4360; I had the privilege of meeting Prof. Jean Cross, the chair of Safety Engineering at the University of NSW in 1988, where she taught safety risk management for 20 years. She has also been involved in standards development in the field of risk management and reliability. She was chair of the Australian Standards Committee that developed AS4360 Risk Management from 1992 until 2004. She retired from UNSW in 2008 but continued to work on standards development in the area of risk assessment, including the development of ISO 31000.