...
Assuming that RBS stands for risk breakdown structure, some risks might be summarised this way but it is important to remember the purpose of the exercise. It might be to capture the situation within one project or it might be to aggregate the view across several projects, perhaps to support portfolio management.
As Figure 3 shows, there are at least four other ways to link detailed risks together to create a useful aggregate view.
- Sometimes one risk, identified at a low level and only arising in one location, has implications that are significant all the way to the top of the organisation, perhaps something that could have a severe effect on the organisation's reputation.
- The fact that the one risk arises in many parts of a project or in many projects within a portfolio might be reason to have it addressed at a higher level, risks that are a sign of a general decline in probity standards might be an example.
- Sometimes several risks identified at a low level are signals of a pervasive strategic risk that should be addressed at a higher level, such as multiple instances of a supplier failing to meet quality and delivery commitments that might indicate a growing problem with a strategic source of services or materials. They might be expressed in terms of many different deliverables and milestones but share a common underlying cause that can only be understood and given appropriate priority when they are all drawn together.
- Some risks arise from interactions between projects and need to be addressed at a level above the individual projects to avoid wasteful internal disputes, such as when one project is due to release critical specialist resources in time for another project to use them on time sensitive work but their current tasks are taking longer than expected.
A RBS can be a useful checklist but it is unlikely to embody all the relationships set out above. In fact, no single structure or framework could cover off all four at once. We have to keep thinking about why we are summarising risks and this will hopefully always be for more than just reporting purposes.
