Overcoming Biases to Improve Project Risk Management Effectiveness

Risk management is a project management knowledge area which is very susceptible to individual biases. If not acknowledged and managed, these biases can significantly impact the value realized by taking a consistent approach to risk management.

A common instance of such biases relates to risk impact. Most practitioners are familiar with the relationship between tolerance to a risk and its perceived impact – low levels of impact are likely to be highly tolerated, but as impact increases, we reach a tipping point after which even incremental increases in perceived impact will result in a dramatically reduced risk tolerance, and often times, the cure may be worse than the potential of the disease.

A very tragic example of this took place within the first year following the 9/11 terrorist attacks. A drastic reduction in airline passenger volume in North America was mirrored by a significant increase in the number of road fatalities as tourists chose to employ an alternate, statistically riskier method of travelling.

Media also helps to elevate our fears beyond reason – many will recall that the summer of 2001 was dubbed the “Summer of the Shark” due to a few highly publicized shark attacks, and yet, at year end, the number of shark-related attacks was no greater than in most years.

Risk management training covers the need to assess risks from more than just one dimension, but knowledge of such practices doesn’t help us if we let our natural (but prehistoric) “fight or flight” reaction drive our risk response.

Dan Gardner’s tag-line for his 2006 book Risk captured the essence of these biases best: “Why we fear the things we shouldn’t – and put ourselves in greater danger”.

In the project context, we are usually not having to manage impacts of life and death, but the same behaviors persist. Think back to the last risk qualitative analysis session you participated in – did you feel that there was the same amount of time spent discussing lower impact risks as was spent on the higher impact ones in spite of their likelihood of realization?

You may question why such biases should be of concern as long as there is sufficient air time given to identifying and assessing risks. Unfortunately, these biases usually impact the most important step in risk management which is the development and execution of risk responses. Identifying and communicating risks is valuable, but if that is where activity ends, all we have done is to change “unknown unknowns” into “known unknowns”.

It is important to realize that the project team are analogous to the media when it comes to key stakeholders – where focus goes, energy flows. Risk response owners are rarely likely to participate in risk sessions themselves, hence they are relying on the quality and objectivity of the output and requests made to them. If insufficient highlighting is done of low impact, but higher probability risks, little is done to respond to them and such risks get realized, sometimes repeatedly. The net impacts to cost or schedule resulting from such repeat occurrences may be significant – the project version of creeping normalcy!

So what are some of the ways to deal with natural biases when assessing and communicating risks?

1. Use an unbiased risk facilitator – trying to play the dual role of project manager and risk workshop leader can be very challenging as we have “skin in the game”. The benefit of soliciting assistance from a facilitator who is not directly involved with the project is that they can identify negative group-think or can call out biases without perception of prejudice. This doesn’t always mean requesting additional staffing from your corporate PMO or having your project take a financial hit by bringing in a third-party consultant – it could be as simple as establishing a relationship with one of your project manager peers such that they will facilitate your risk session while you support them in theirs.
2. Once bitten, twice shy – while a low impact, high or moderate probability risk presents a lower priority than a high impact, low or moderate probability one, if the lower impact risk has been realized previously on the same project, that should justify it being moved off a watch-list.
3. Step back to gain perspective – it can get too easy in a risk analysis session to get caught up in working on the “sensational” risks within your project’s risk register, so once the session is over, review the project risk portfolio as a whole and identify whether sufficient effort has been spent on the less dramatic ones. If you find that there does appear to be an imbalance in emphasis, there is likely some value in holding a separate session to address the ones which were perceived to have lower priority.

Jurassic Park captured the danger of risk tunnel vision well.

Volunteer: That doesn’t look very scary. More like a six-foot turkey.

Dr. Alan Grant: A turkey, huh? OK, try to imagine yourself in the Cretaceous Period. You get your first look at this “six foot turkey” as you enter a clearing. He moves like a bird, lightly, bobbing his head. And you keep still because you think that maybe his visual acuity is based on movement like T-Rex – he’ll lose you if you don’t move. But no, not Velociraptor. You stare at him, and he just stares right back. And that’s when the attack comes. Not from the front, but from the side, from the other two raptors you didn’t even know were there.

While your project team or risk response owners might be predisposed to focus on T. Rex, don’t let them forget about the Velociraptors!

Don’t forget to leave your comments below.