from Simon Moore
 
Many systems exist for complex risk management - Monte Carlo analysis is one example. However, many organizations main problem is not poor analytics, but poor inputs and basic process. We need greater focus on the human side of risk management.

This article focuses on three basic steps to improving risk inputs. They are simple, but mastering them is crucial for effective risk management.


It's very easy to influence people's answers based on the questions you ask. For example, if you ask a leading question such as... So you'll have that report on South America finished by Friday, right? Then you'll be much more likely to get a positive (and possibly misleading) response than if you ask something more balanced along the lines of... When will the report on South America be complete? Of course, there's a big difference between getting the superficial answer you want and getting the true, underlying data you need to make an accurate estimate or decision. This is harder than it sounds because with deadlines looming everyone wants to believe everything will pan out OK, especially under stress, but of course that's not what good risk management is. The questions you ask determine whether you will get realistic information back or not. Be careful how you phrase them. Balanced questioning can be critical in spotting potential problems early. Everyone from the most junior employee to the CEO must master this skill to effectively understand and learn about risks.

Organizations are often dysfunctional and power relationships can distort effective decision making. This is crucial for risk management. Post mortems on poor risk management often identify group think as a cause. Group think occurs when people share an underlying set of beliefs and assumptions and fail to question them. Organizations common culture tends to promote group think. Group think can be countered by building a diverse team across disciplines, skills and past experiences. Assigning a devil's advocate in meetings can be effective to ensure that the contrary opinion is heard even if it's not popular, especially if the meeting attendee is relatively senior. Even with an apparently valuable risk management process, group think can mitigate the benefits. Finally, group think can be hard to overcome within an organization as even for different groups there can be cultural similarities. Therefore, consider bringing in external parties (vendors, customers etc.) to help analyze thinking and counter strongly held beliefs because they will invariably bring a fresh perspective helping to manage risks, by identifying them earlier.


In some sense risk management is an analytical exercise, but it is also an exercise in creativity, some events can have dramatic (risky) consequences, but fall outside of our range of experience before they happen. Using tools such as scenario planning to think creatively about future states of the world can be more valuable than the number crunching side of risk management. Such exercises can also build team rapport, further enhancing the teams effectiveness. There are a number of methods for scenario planning, one effective tool can be to assume that the project failed and think about the reasons for the failure - coming up with as many reasons as possible and exploring them in depth. This frees up the team to think creatively about potential weaknesses in the plan, and again bringing in external parties to participate can be useful to help avoid groupthink.

So, I am not trying to dismiss the power of quantitative techniques in managing risk, but rather calling upon organizations to recognize how people and processes can also be improved to drive better risk management results.

Simon Moore is the product planner for Microsoft's Enterprise Project Management solution and author of Strategic Project Portfolio Management, the Strategic PPM blog and has engaged with project and portfolio executives from Brazil to Japan. Moore has worked with Anheuser-Busch, and the Bank of England, and has also served as a strategic consultant to firms in the technology, retail and financial industries. His writing credits include The Guardian and he is a member of the Project Management Institute. Born in the UK, Simon currently resides in Seattle.

Next Month
Arras People reviews Moore's recent release, "Strategic Project Portfolio Management"

What kind of risk management questions can you expect at a job interview? - Mike, Leicester

Mike, thanks for your questions and comments. There is no true way to pinpoint exactly what questions you'll get at an interview, let alone pin down exactly what risk management questions you would be asked. However, the sample questions we've culled together do provide a bit of insight into an interviewer's risk management philosophy and give you a chance to brush up on what your answers would be.

Here are just a few possible risk management questions you might come across.

• "What do you do with your risk plan once you have completed it?"
• "At what point do you release risk contingency to the project P&L?"
• "How do you share your risk plan with your client?"
• "What areas of a project would you consider when creating a risk plan?"
• "What tools / methods have you used for risk analysis?"
• "How would you prioritise interdependent risks across multiple projects?"
• "Which stages of the life-cycle would you consider risk management to be most important? (trick question)"
• "What procedures have you used for escalating risk to senior management?"
• "Define a risk. Can you tell me the difference between a risk and an issue?"
• "How do you measure risk?"
• "What in your opinion is the most effective way to communicate risk resolution across the project team?
• "At what point in the project would you consider risks?"
• "What elements are key to mitigating risk?"
• "What are the key risk management processes you would use on your project?"
• "How do you assess risks?"
• "How important is the project team when managing risks? And why?"
• "How often do you look at risk management in the delivery of the project?"
• "How do you delegate certain responsibilities in risk management to others?"
• "How do you communicate risk to your stakeholders?"

We also posed this question to our Twitter connections, and found some very useful responses from Rolf Goetz:

• "Why should we manage risk seperatly from the rest of the project?"
• "When do you choose to ignore a risk?"
• "Why is it best to ignore complex time-related effects of mitigating actions?"
  

Got a question for us, contact us today.