Risk Assessment: How You Do It – Matters!

Everybody’s favorite upbeat subject: Risk Management. Best to avoid it all together huh? If I don’t think about risk, I guess there isn’t any.

OK, the first thing I acknowledge when working with groups on risks, is, that this subject has a tendency to put the damper on all that enthusiasm about the project that could be/should be challenging, interesting and maybe a little fun. But this isn’t a forever subject. And, when better to address the negative stuff, then before it’s happened? To help convince you. I’ll just ask; if we skip risk processing would you agree that risks all sit in the category of “unknown” (or, at least “unprocessed”)? So, the first goal of risk processing is to move as many risks from “unknown” to… You guessed it “known”. This particular heap of musings is about that – and, a little more. It’s Risk Assessment. What I won’t deal with here is the follow-on subject of Risk Management (i.e., preventives and/or mitigation).

To do risk assessment properly a few things really matter, perhaps surprisingly, they are: Philosophy, Attitude and Facilitation technique. Of course, Process and People are vital as well, but those factors seem obvious.

I’ll start with the people; risk assessment is, like many project management process steps best done by blending the greatness of multiple people. Who? Perhaps it’ll be the same people you’ve used to build the plan. Certainly, you’ll need people with a wide range of knowledge and experience, I understand on some projects that can be challenging, so, you’ll have to do the best you can, and, rely on the process, and your best facilitation techniques to help produce the best results possible from the people you do have.

The process I use is one that those who love KISS (Keep It Simple Silly) will embrace. Whether face to face or virtual, I’ll facilitate a brainstorming session. At the outset, typically, I’ll write on a white board (and repeat several times – much like a mantra) “what could get in the way of project success?” Participants raise their hands and I scribe. As much as I like to spread the work in projects to team members, I’ll wear both the scribe hat and facilitator hat. Because, I’ll need to clarify and “crisp up” the ideas that participants generate. A classic example of a brainstormed risk is: “quality issues.” Here is where metrics are your friend. I don’t criticize any idea, but I do need to put a metric with the possible risk. Without the metric then the assessment that follows will fall apart. So, I’ll say “give me a metric for quality that would get in the way of project success?” After a moment or two someone will say something like “failure rate > than 4% during initial testing.” Bang! There’s a risk. Or, supplier late on shipments of “x”, “y” or “z”. I’ll do the same thing and say “I need a metric for how late?” 1 second, an hour, a month? You get the idea. As usual when the brainstorming starts to die off, I’ll have ready a flipchart, white board, or if virtual a “screen” that has multiple rows and columns with headers for: Potential impact to the project, Likelihood of occurrence, Difficulty of timely detection, and Overall rating. A key point here is NOT to wait to do the assessment. Breaking a meeting here or even after assessment is not wise. That’s because people will have had their mood/enthusiasm brought down, and, you don’t want them to leave your session in that condition. Try to have enough time to get all the way through prevention/mitigation, both of those will help return the mood to a more positive place.

Earlier I mentioned that process AND facilitation technique matters. Here’s where that kicks into overdrive. First, in honor of KISS I only recommend and use rankings of High, Medium and Low (no fancy ratios, formulas, etc., you’ll pick up on the reasoning later). Second, I make sure I allow every participant to express their opinion when I ask about a particular risk and their ranking of: Potential Impact, Likelihood, etc. Note: Asking that everybody express their opinion is one thing; but you HAVE to really hear everybody. Because sometimes even a quiet or shy person has (or, could have) an opinion that outweighs everybody else’s. Do not waste your time on consensus for this process. Consensus is detrimental to successful risk assessment because, a shyer person’s opinion can easily get pushed aside. Here’s how simple it is: Just take the highest ranking you hear, and that becomes the assessment for that characteristic. So, in some cases you’ll be over ranking a risk. So what? It’s far better to over rank a risk than under rank a risk, because quite frankly, high risks will deserve more “homework” (i.e., looking at preventives and/or mitigations). And, in the grand scheme of things; that homework doesn’t cost much – really. Moreover, it’ll allow the team to know that they are better prepared than they have been here-to-fore. Total time for a combination brainstorm and assessment session should run less than an hour for most projects. A significant time investment? Perhaps. But it beats the alternative of waiting until what could have been anticipated popping up as an instant issue.

Risk Management is integral to successful project management. Think of it this way: While better risk management doesn’t eliminate issue management, it can reduce the frequency of “we should have anticipated that when we were planning the project.”