Risk For The Rest Of Us – Managing Elephants in Rooms

Risk Management is a huge area with lots of specialist people, companies, books, qualifications and so on. So should we even go there if we’re not black belts…? And what’s this about elephants?

My own opinion is that even for us “non-experts”, giving risks just a bit more priority in planning, projects and management has a big positive impact on delivering results.

One thing that we tend to do at CAL for the majority of our projects is maintain a risks and issues log. This was born of our PRINCE2 experience (and the need for something lighter than full PRINCE for the majority of our projects).

At its simplest, a risk log is just a list of the things that could go or have gone wrong, which you review regularly (the last bit being the important thing!).

Anything you add to the list is really just helping you rank or prioritise risks, quantify them, or plan to mitigate (avoid) or manage (contain) them.

An honest discussion with key people at the start of a project, large or small, will usually turn up some concerns that people have – things that could stop success from being achieved.

So, You Mentioned An Elephant…?

In these meetings and discussions, it is not uncommon for “the elephant in the room” to make itself known too, and perhaps this is why people don’t like doing even basic formal risk management. Somehow it doesn’t feel right to be worrying about all the things that could go wrong when really, it’s the time to get everyone fired up. Especially the elephants – the big things that we all know are potential problems, but no-one likes to admit or bring up in meetings…

However, done correctly, I think risk logs are very positive – they give the team a sense that “we have a plan for anything we might face”. They identify early on the things we need to watch out for, and if we can mitigate or avoid a risk, we even save ourselves the pain and effort of having to manage the fallout. That’s why I use mitigate and manage as two separate terms by the way – almost “before and after”, or the difference between “risk” (hey, it might happen) and “issue” (oops, it has happened).

The last point was succinctly put to me by a client – “if you can smell it, it’s a risk; if you’re standing in it, it’s an issue…” Erm, back to elephants perhaps…

The last thing I usually put in a risk/issue log is a list of the assumptions we make to keep a project moving along. My view here is that an assumption is a risk until it is a fact or not – maybe “latent risk” is a descriptive way of putting it.

A Risk Log Is A Form Of Communication

As I wrote at the start, the best risk log in the world is pointless if it is not regularly reviewed and communicated appropriately across the team. I see the risk log as being as important as the project plan or weekly/monthly report. It is how we share with our team what we are concerned about, and what we are doing to avoid and contain risks.

It does take discipline to make all of this happen, but stick with it, it’s surprising how quickly you feel uneasy if you don’t have a basic, up to date view of the risks you are working with.

I’d love to hear your thoughts on how risk management has helped you, or how an Elephant trashed your project!