Wednesday, 03 April 2013 07:53

The Risks of Project Risk Management

Written by 
Rate this item
(3 votes)

Project risk management is in itself a rather risky undertaking and the communication of project risk is in need of a major overhaul. In this perspective, Nigel Chisnall considers the current quality of risk communication and examines metaphorical approaches to better visualise project risk when navigating through the project route.

Examples of major contracts diverted at the last moment

Otherwise viable multi-million dollar ICT Infrastructure projects changed direction at the last moment will impact not only on time, cost and quality, but also the reputation of the project team.

  • A large firm having completed a yearlong tender process for a complex ICT managed service selected and announced a preferred supplier. Within days, the supplier posted poor annual financial results. The sourcing team wary of director level perception cancelled the contract and negotiated with the second placed bidder.
  • Another large firm having completed an extensive discovery exercise decided to invest in a new Data Centre in Iceland. Within days, volcanic activity which affected air traffic caused second thoughts and what was a proven solution was ditched in favour of an alternative geographic location with less volcanic risk.

These illustrate how innately human bias is skewed to placing unreasonable weighting on more recent occurrences. Psychologists know how a recent event affects the decision-making process and project scientists and actuaries are aware of the misjudgements that can derive from such events. Project professionals are probably naïve to believe that senior executives behave in this reactionary manner.

Professional conclusion

In these projects, it seems major risks either appeared, or were at least communicated, at the last moment. Wikipedia has no answer but it crisply defines the challenge:

“Risk communication is a complex cross-disciplinary academic field. Problems for risk communicators involve how to reach the intended audience, to make the risk comprehensible and relatable to other risks, how to pay appropriate respect to the audience's values related to the risk and how to predict the audience's response to the communication. A main goal of risk communication is to improve collective and individual decision making.”

This got us thinking about the “naïve” aspect of risk communication seen even on major projects. Risk is possibly the most esoteric discipline of the project sciences and managing the unforeseen looks professionally menacing, but with some clear thinking and new communications tools we should be better equipped to communicate uncertainty to different audiences.

Our premise is that risk management is indeed risky, and we need a practical new way to share risk information in the context of the project if we are ever to master it as a professional discipline.

Return to clear thinking

The language of risk is inconsistent across the project sciences, but the CISSP security professional has a helpful logic that seems to hold promise which I illustrate through two stories.

  • A Threat is a circumstance – volcanic ash and poor market perception to annual results are threats to which the project may or may not be exposed
  • Vulnerability is a weakness in the firm making it susceptible to specific threats – if a project will only single source suppliers, it is vulnerable to specific climatic threats or supplier perception threats.
  • A risk or risk event is the combination of a threat and vulnerability and as both a likelihood and impact. Specifically, project risks are risks to the time, cost and quality of the project.
  • The risk, once mitigated, is often termed as a residual risk.

The size (impact x likelihood) is estimated before mitigation and the project risk manager will propose actions or counter measures to reduce the impact and sometimes the likelihood. Should the counter-measures be deemed uneconomical, the project may accept the risk. A risk which actually occurs is more helpfully known as an issue.

Risk communication – the current method

Risks are typically compiled in detailed logs through an initial assessment and on-going review. The log may be distilled into a matrix visualization table. The size of the risk is the multiple of the impact and likelihood and this often reflected as a red/amber/green status of which three risks are illustrated in the following diagram:
chisnell Img01 April3

There are three main issues with this structure:

Firstly, the suggestion of a determined value of a risk such that it becomes a point value on a chart. Sensible actuarial and estimation techniques yield a wide range of possible outcomes. While such professional techniques can improve ‘accuracy’ the numbers generated are rarely scrutinised in this manner. If estimation techniques were used, the dot would be replaced by a ‘probability cloud’.

Secondly, and which has attracted significant academic attention , is the very high impact but very low probability risk - this has been popularized as the black swan and is elusive to representation through a matrix model.

Thirdly, is the difficulty to distinguish mitigated from unmitigated risks.

Improving the current method or exposing its flaws?

An improved visualization will show the movement to the residual risk position and in the following image, all three risks have been mitigated to a less unfavourable position.
chisnell Img02 April3

While there is an improved communication, three new questions now appear relevant to risk communication:

Firstly, are we certain that a residual risk cannot be further mitigated, and what is the incremental impact on time, cost and quality of this further mitigation?

Secondly, by persisting with a point representation of a risk , there is the assumption that the project team knows the firm’s value at risk and has the capability to trade project time, cost and quality in pursuit of diminished risk.

Thirdly, there is no time dimension to this analysis. It’s essentially a moment in time snapshot. While providing a sense of movement, the matrix fails to communicate meaningfully the behaviour of risk over the project term. The last-hour risks in the above stories are unlikely to appear in this type of visualisation.

Creating a matrix is not managing risk. It becomes an end in itself. In fact, the ‘dumbing down’ to a matrix is positively disingenuous, giving the appearance of insight but failing to communicate the need for action. It’s time for a new metaphor that emphasises the project’s movement through time and its dynamic interplay with an environment full of threats.

A new metaphor

We started a conversation with project managers and academic professionals to find a better way to equip the project manager to:

  • Communicate with consistent language
  • Communicate an estimate rather than an ‘exact’ size of a risk (cloud not dot)
  • Show black swans
  • Distinguish mitigated and unmitigated risks
  • Show potential scope for further mitigation
  • Align a risk with its impact on project time, cost and quality
  • Visualize the risk’s time-based characteristics over the project term

We explored a variety of database-generated Infographic formats such as weather maps, pinball machines, airline route maps and ocean crossing. In short we need a new metaphor. While recognising the limits of metaphor, one that seems to hold most promise is the visualisation used by police motorcycle training programs.

Piloting through the risk model

The novice rider is taught to view threats, construction, and other driver unpredictability as threat clouds and the rider is taught to ‘ride defensively’. Our first visualisation might look like this:
chisnell Img03 April3

Police motorcycle training has a powerful, path based, time bound and intuitive thought metaphor of risks as bubbles of (negative) influence. A stretch of road is a time-bound project image and active deviation of bubbles incurs a time cost quality penalty on the project.

Extensions to the metaphor

The most important aspect of this is the visualisation of the interplay of risks which is denied us through logs and matrices. A proper log however has the essential information from which this Infographic could be derived.

This is also a rich picture that shows the project manager actively piloting a project using a project (time- cost- quality) dashboard and positive risk avoidance measures, clearly communicated, rather than being the passive victim of circumstance. Consider this further mock up:
chisnell Img04 April3

A call for action

Would such a risk communication help a project manager avoid the ‘last minute’ events we discussed up front? We suggest it would. The accessibility of the motorcyclist metaphor encourages engagement with the widest range of audiences and an easy visual form in which to consider events from left field.

Why is project risk not communicated in this fluid form? Would the essential data from which this metaphor could be derived be in any detailed risk log and most importantly time-based estimations? Point risks such as end-of-year results or newspaper headlines could be rapidly accommodated into an open ‘risk conversation’.

We need better project risk communications especially as the balance of enterprise spends increases through the project route. The metaphor could be extended to multiple project journeys as a program of journeys – after all, many of the risks are systemic and shared across the portfolio. Additionally, projects may themselves be in conflict and a program level visualisation may be helpful. Finally, the hardest thing is closing the dysfunctional project – visualisation like this can make the ‘close decision’ one in response to business risk.

Don't forget to leave your comments below.

Read 7538 times Last modified on Wednesday, 03 April 2013 08:52
Nigel Chisnall

Nigel Chisnall is a specialist educational consultant at PTS Consulting Group and is regarded as a leading influential figure in the Educational ICT consultancy workstream having advised on groundbreaking Pathfinder future schools programmes such as Bristol City Council, Leeds City Council and Newcastle City Council. Nigel’s understanding of the education market has been in part influenced by six years secondary sector science teaching.Outside of the education industry, Nigel has spent 12 years in the ICT industry, developing consultancy skills in IT Strategy, programme development, financial analysis, cost management, and financial/ environmental sustainability. Nigel has business experience in several European countries, and is deeply interested in, and sensitive to, organisation cultures. He is a regular industry speaker and writer.

Comments  

+2 # Lawrence Tsuji 2013-04-05 09:00
Thank you for this article. One of the points I always emphasize when speaking to people about project management is the need to better integrate risk maangement with the project plan. How often do we diligently go through a risk management process, which then promptly gets parked somewhere on a project site as a stand-alone entity? Or, to the point made in the article, how often do we miss things because our risk reviews are really just snapshot in time? Some of my managers have gotten tired of just looking at a risk register table with red/yellow/gree n every month and having to ask the same type of questions to determine the impact, etc. Having a more visual tool to integrate the time, cost, quality impacts to the project would be valuable and effective.
Reply | Reply with quote | Quote
+1 # Anand Chittoor 2013-04-11 10:29
Good Article Nigel.

Lawrence>> I share your same exact thought. The Risks are discussed, put on a spreadsheet at kick off time and then forgotten. The risks are often generic risks like Resource shortage and schedule. This does not help.

To address this gap in our PM toolkit, I have founded and developed Vue-Matrix a web-based Project Risk Management software application that is visual, combines dynamic dashboards with powerful reports - unlimited users.

Please check it out and let me know what your thoughts are:
www.vue-matrix.com.

Regards,
Anand Chittoor, PMI-RMP, PMP, CSM
Founder and COO Workstreamz Solutions,
Product: Vue-Matrix.
Reply | Reply with quote | Quote
0 # Katie Mark 2013-04-16 05:49
To cover risk of project management, Proofhub (ww.proofhub.co m) is basically the best wayout, I found. It has better project risk communication than other project management software.
Reply | Reply with quote | Quote
0 # Katie Mark 2013-04-16 05:51
]To cover risk of project management, Proofhub (www.proofhub.com) is basically the best wayout, I found. It has better project risk communication than other project management software.
Reply | Reply with quote | Quote
0 # Eric Harter 2013-04-18 11:57
Interesting article. A couple of months ago I was trying to figure out how to capture the concpet the project as a path over time and represent the risks. Started looking like an operational graphic for a military operation - various obstacles, objectives, phase lines, etc. If a low impact risk is present through a large part of the schedule, begins to look like a ridge. A big risk down the road might look like a hill/mountain/v olcano! Deliverables and phases start to look like rivers across the project path..... need to flesh it out.

Thank you Nigel for clearly articulating this - very much appreicated. Thought provoking.
Reply | Reply with quote | Quote
0 # Nigel Chisnall 2013-05-14 08:54
Eric - thanks for your comment - you arrived at a different metapor for the risk landscape based on the theatre of war. I like the idea of rivers and phases especially. You'd think with the visualization behind console based games that a racetrack or onstacle course metaphors would not be entirely elusive to a project rendition. Maybe there needs to be a conversation with the project software industry? - Nigel
Reply | Reply with quote | Quote
0 # Lilly Brown 2013-08-31 05:16
I am a project manager and I think that risk of project management can be reduced by using good project management tools like proofhub and basecamp. These tools have helped me a lot to manage my team as well as projects.
Reply | Reply with quote | Quote
0 # Rose 2014-01-08 06:22
Really wonderful article. To get rid of risk, every organization needs a project management tool like proofhub to manage their tasks. I am a ProofHub user and I am sharing my experience after adopting this tool.
Reply | Reply with quote | Quote
0 # Rose 2014-01-08 06:22
Really wonderful article. To get rid of risk, every organization needs a project management tool like proofhub to manage their tasks. I am a ProofHub user and I am sharing my experience after adopting this tool.
Reply | Reply with quote | Quote
0 # DerekJ 2014-01-29 21:57
I would certainly agree that project risks may need to be treated differently (certainly from a timeline perspective) than the usual method of managing risks which should ideally follow the ISO 31000 standard on risk management.

Although I have no exposure to the PM tools highlighted in responses, I would say that only actions can really help prevent, detect or direct mitigation when determining residual risk levels. Also, I like the analogy of the Police motorbike training scenario but bear in mind that with ISO 31000, the risk picture should be constantly moving with new ratings with risk analysis being routinely performed on an on-going basis. I think the true issue is the project manager's ability to effectively manage risks whilst following the enterprise risk management methodology may prove problematic for some.
Reply | Reply with quote | Quote

Add comment


Security code
Refresh