Latest / Project Podcast / State-of-the-art risk management in projects: What you need to know

Transcript

State-of-the-art risk management in projects: What you need to know · Project Podcast

0:08
Welcome to the APM Podcast. APM is the chartered body for
0:11
the project profession. My name is Emma De Vita and I'm
0:15
the editor of Projects, APM's Quarterly Journal and your host
0:19
this podcast. I'm speaking with Peter Simon, a
0:22
director at Lucidus Consulting and a member of the APM Risks
0:25
Committee. He is co-author with Alexander
0:28
for Brooke, Marianne Bosch Reichelt, both of the Technical
0:32
University of Delft and Sara Rye of the University of Bradford.
0:36
Venue report to be published by APM in the autumn, this
0:40
groundbreaking research looks into opportunity management as
0:43
part of the overall project risk management process.
0:46
The findings of the research and survey revealed a number of
0:49
notable areas where what is defined in the standards and
0:52
written in textbooks do not in fact match what's happening.
0:56
But quite simply, few organisations do it.
0:59
Some have tried and failed, while others don't believe in
1:02
it. Listen on for Pete's expert
1:04
consideration and advice. Welcome, Peter.
1:13
Thanks for joining us today at the APM podcast.
1:16
Why don't we start at the beginning?
1:18
How would you define risk management?
1:22
First, management is the management of those things that
1:25
might happen that, if they did, would impact the objectives of
1:29
the project. It could be more than just
1:31
objectives. We talk about time, cost and
1:33
quality. It could be the benefits.
1:36
Some types say the outputs and the outcomes and the benefits.
1:40
And I would say there also that it might be, it's things that
1:42
might happen by chance. We might come onto that later
1:45
on. So things that could just
1:47
happen, but it's a marriage with the votes.
1:49
Where does the opportunity and threat of risk fit within this
1:54
and how would you define those concepts?
1:58
In 1996, the PMI redefined the term risk to be something that
2:05
ever happened, could have a positive or negative impact on
2:09
the project's objectives, and likewise APM followed I think in
2:13
1997. So the concept there is that
2:17
things might happen, but they could either have a beneficial
2:21
impact on your project, which is an opportunity, or they could
2:25
have a negative impact on your project, which would be a
2:28
threat. Unfortunately a lot of people
2:31
don't recognise that because risk to many people is a purely
2:34
negative term. So risk management or
2:37
opportunity management is the management of the good things
2:39
that might happen and threat management both as subsets of
2:43
risk management is the management of the negative
2:46
things that might happen. Why was it redefined in the 90s?
2:50
You know, I've tried to look at this.
2:52
I actually stopped this and research and I couldn't find an
2:55
answer except a lot of it led down.
2:59
You might have heard of it technique called SWAT,
3:01
strengths, weaknesses, opportunities, and threats.
3:03
So that's where my research found the terms came from.
3:08
Opportunity and threat out of there.
3:11
But there's also recognition that sometimes, if you like,
3:16
things might take longer to to happen and they might be
3:19
shorter. Things might cost more, they
3:22
might cost less. And if we only only ever focus
3:27
on the bad things that might happen.
3:29
Then we don't get the chance to improve anything.
3:32
And if you only really managing the bad things that happen, what
3:36
happened on the project, then your project will at best be on
3:39
time. But inevitably, because you're
3:41
not, you'd have to be the luckiest person in the world.
3:44
But none of the bad things that might happen to happen.
3:46
Your project's going to be late, but if you manage the good
3:50
things that might happen, then it's like a counterbalance.
3:53
It will pull the project back or make it better in some way.
3:57
So that's where the ideal came from.
3:59
Let's look at the good things as well.
4:03
I mean we're talking about this right now that the, the language
4:05
around opportunity and threat and risk and risk management
4:08
because of the work you've been involved with recently which
4:12
will be published by PM in the autumn, I think.
4:15
Do you, do you want to give us a bit of background on that or a
4:18
little kind of overview about the survey and the research and
4:21
and what that threw up? So I've been working in and
4:27
around risk management for a very long time, probably 40
4:31
years. What what I see and what I've
4:34
observed in my many years as a practitioner is that even though
4:39
we talk about risk being threat and opportunity.
4:44
Having the positive, negative side, most organisations I come
4:48
across don't do it. Some don't even attempt to do
4:53
it, and some claim to do it but don't really do it.
4:58
But I still think there is value at looking at good things that
5:01
might happen and there are other ways of doing it.
5:04
So within the the research team. So half of it really was the APM
5:09
ristic with Sarah and myself, and then we had some friends of
5:13
mine, colleagues from TU Delft, Netherlands Alexander.
5:17
And Marian and we worked out some hypotheses around that to
5:23
test whether organisations really did take risk to be
5:28
threatened opportunity and if they did, did they perform it.
5:33
As part of that study, and I won't go into any of the details
5:37
of the findings, what we found was.
5:39
Certainly the majority and I mean that as more than 51% and
5:43
it's probably more than that do attempt to do.
5:47
Threaten opportunity management, but they don't call it
5:50
threatened opportunity management.
5:51
They call it risk and opportunity management, which is
5:54
which is appears to be the most understood terminology.
5:59
And also when it comes to opportunity management, I sort
6:03
of added into an earlier definition.
6:05
That a risk is something that might happen by chance.
6:10
That means that if you don't even influence in any way, it
6:13
could happen. It's like saying, you know, if
6:16
you it might rain in the next 10 days.
6:19
It's a chance it will. Actually, we can't prevent it
6:22
from raining, but we could put an umbrella up to stop it having
6:25
an effect on this. But we can't stop it raining.
6:27
It can happen by chance. So when it comes to thinking
6:31
about threats, we do tend to think of the things that happen,
6:33
could happen purely by chance, but one of the problems with
6:36
opportunity management. Is that a lot of the things that
6:41
I see described as opportunities are not things that will happen
6:46
purely by chance. They are choices, we call them.
6:50
So try not to think of anything too technical here, but there
6:56
might be something. We might be able to use a
6:59
different material which would save us money.
7:02
That material isn't just going to drop out of the sky and come
7:05
onto your building site and integrate itself into what
7:07
you're doing. You're going to have to choose
7:09
that to happen. It'll never happen by chance.
7:13
So if we actually take those choices out of an opportunity
7:18
management focus, very little people do it properly at all in
7:21
fact. There's another discipline you
7:24
might have heard of called Value Management.
7:27
Value management is very, very good at looking at good things
7:31
that might happen. So anyway, we had all these
7:34
ideas and the survey was sent out.
7:37
But, but the results of the survey clearly show.
7:41
To me anyway, that we should stop calling the process risk
7:46
management as threats and opportunities.
7:48
We should call it risk and opportunity.
7:50
And we should potentially look at other ways of managing
7:54
opportunities. By using other techniques.
7:57
And that's where the world of value management and value
8:00
engineering could help. Because what's also apparent
8:05
from my own working practise and it also came out in the survey.
8:09
If I asked 10 people in a room tell me what tell me the risks
8:13
on the project, they will all make automatically think of bad
8:17
things. And if I said OK, now think of
8:19
good things that might happen, They'll find it very difficult.
8:23
Because your mindset is in the negative way if I set to.
8:27
But if I started afresh and literally came in and gave you
8:32
all a yellow baseball cap, you ever heard of Edward de Bono 6
8:37
Thinking hats? Think happy.
8:38
Think sunshine. Now, before you say anything
8:40
else, think of good things that might happen.
8:43
You'll do it. And what I'm suggesting there is
8:45
that processes need separated. Now that's a bit of a personal
8:49
opinion, but that also comes out in the case study.
8:53
If we change the terminology of the way we talk about risk, how
8:58
would this impact on the delivery of the project that
9:02
would be more successful? The terminology is is already
9:06
changed so I won't name any names, but no I'm.
9:09
Most of the Copic corporate members of APM actually used the
9:14
term risk and opportunity. But what I would also suggest is
9:18
absolutely an advocate for looking at the good things that
9:23
might happen, or even the choices that you could do to
9:26
make things better and not ignoring them.
9:29
But my practitioner view now is if you try and throw that in
9:34
with the bad things that might happen, you probably do a bad
9:38
job of both. What should you be doing instead
9:41
as a project professional? Well, I think and others like me
9:47
agree is you have a risk management effort, risk
9:50
management process which focuses on the bad things that might
9:54
happen and you have a an opportunity management process
9:58
that could be facilitated, administered, governed by the
10:03
same group, but you separate the two.
10:08
And really go about the opportunity management in a more
10:12
using techniques and facilitation skills that are
10:16
more akin to what I've mentioned before.
10:19
What value management would look at?
10:22
Are you suggesting that on a project as much attention should
10:26
be given to the opportunities, and I'm thinking of those as the
10:29
positive side of things, as to the risks and the and the
10:33
threats and and if and if so, would that then shift the
10:39
mindset or the energy on a project towards some more
10:43
positive? I don't want to just think of
10:47
projects as purely as costing money and and taking time, but
10:52
all projects do have a budget. When things go wrong, they can
10:56
go very very wrong. So something can cost twice as
11:00
much as you anticipated or take twice as long.
11:04
It's very unlikely for something to cost.
11:08
Half as much as you thought it was going to be.
11:11
I'll take half as long. So what that's what I mean by
11:14
that is the it's a skew the term which is it's a skewed
11:17
distribution. Things can get a lot worse than
11:21
they can get. Then On the contrary, they can
11:24
get a lot better. So that's one of the dilemmas.
11:27
Do we spend time trying to find the little things that might
11:31
happen when there's a lot more bigger things out there that, if
11:34
they happen, could destroy the project?
11:37
So there is that dilemma. So should you put as much effort
11:40
in? And the answer therefore is
11:42
probably not. But don't ignore it, because
11:44
there might be using a a metaphor, some low hanging fruit
11:48
somewhere that you can pick and get, but but putting the same
11:52
amount of effort in? Probably not, but also what
11:55
tends to happen. In projects and you will be
11:59
aware that projects go through a life cycle.
12:02
And a certain point in that life cycle, the project gets signed
12:06
off. And it doesn't matter if this is
12:08
a an agile or iterative lifecycle, There's a point where
12:11
we can decide to spend some money because we've got
12:13
something we're going to do. What tends to happen is.
12:18
Psychologically, and that you might have heard the term
12:22
optimism bias, all the good things that might happen.
12:26
Tend to be put into our baseline.
12:29
It's like saying it's going to be a sunny day every day, we
12:32
assume, but it's not. On all the good things, we might
12:36
be able to get that little bit cheaper.
12:37
So we put that in a base case and that happens a lot,
12:41
especially when people want to get their project to go ahead
12:44
for some reason. They've got to meet a hurdle of
12:47
it's got to cost less than this. So it's got to be done in a
12:49
shorter time than that or something.
12:52
Which means if you've built in all those opportunities, and
12:56
this is borne out in the research that people do
12:59
opportunity management right at the beginning, then things can
13:02
only get worse. You know if if you put a plan
13:06
together and it doesn't matter what it is the schedule together
13:09
and it's and it's based on 8 hours productivity everyday
13:14
doesn't matter what you're doing.
13:15
It being a sunny day everyday all the equipment arriving on
13:20
time all IT code working first time and people do that then it
13:26
can. It can't get better than and
13:29
that's what the dynamics would opportunity.
13:31
We do it and we we grasp it too early.
13:36
So what's your advice about mitigating that kind of optimism
13:40
bias or our natural proclivity towards opportunities?
13:46
Understanding that you're doing it is one thing, but what also
13:50
then can overcome that If you do end up doing, and again you
13:55
might have heard the term quantitative risk analysis where
13:57
you do simulation models, then that exposes that.
14:01
That will expose the fact that everything's very optimistic.
14:05
But be aware you're doing it and maybe thinking.
14:09
Just think it might not be a sunny day every day.
14:12
A lot of that also comes down to and another word that gets used
14:15
in mismanagement even though it's a commonly used term is his
14:19
assumptions. You know what are we assuming
14:22
and you know you could say we it might be sunny everyday or and
14:26
that's fine, but are you assuming it's going to be sunny
14:29
everyday And if you are then it can only get worse.
14:32
So sometimes think of what? What are you assuming and
14:36
whether you're over assuming things because it's the
14:38
assumptions of the good things. In that sense, what do you think
14:43
needs to change about the way the project profession views
14:47
risk management in the context, you know, what we've been
14:50
discussing? Well, I think it's always been,
14:54
it's been high on the agenda of the project management
14:58
profession since since I joined it and it's always been there
15:03
and if you look at any of the. Sort of surveys that come up
15:08
with you know why do projects fail?
15:09
9 out of 10 that ten of those will see ineffective or
15:13
inadequate risk management. So it's important, but it's
15:17
obvious that people still don't do it as well as it could be
15:21
done. Now that's a generalisation and
15:26
so and and I think it would be fair to say most and if what the
15:29
51% or even 80% of organisations don't do it as well as it could
15:34
be done but some do it very well.
15:35
I won't name any names. Some who have have, I think have
15:38
cracked it but that but the other organisations need need to
15:42
just focus on it and take the hit.
15:46
Because one of the problems with doing risk management is it
15:49
doesn't always give you the answer you want.
15:52
What I mean by that is someone's got this great idea to do A to
15:57
for a project that's going to deliver a change that's really
16:01
needed, and then says, well, hang on a minute, let's do a
16:04
risk assessment and you do look at all the risks.
16:07
When you come up with all these things and it's now, it's gloom
16:11
and doom. You know, we, you know, we, we
16:13
were happy till you said that. And if you then do a
16:16
quantitative risk analysis, it might come up with, but you've
16:20
only got a 10% chance of achieving what you've just told
16:23
the world you're going to achieve.
16:24
So it's often the bringer of bad news.
16:27
And so people, some people don't like it for that very reason.
16:32
It also takes time. It costs money and it's it
16:37
requires a. The level of understanding that
16:40
some people. Don't really appreciate it isn't
16:45
as natural as some people think it is and it's needs constantly
16:50
to be looked at. But at that point, I always
16:53
think it's it's, you know, the health, health and safety in
16:57
many arenas of project management is absolutely
16:59
paramount. I wouldn't say that's been using
17:03
a phrase I used earlier cracked completely, but that's really
17:07
taken seriously. And that's an element of risk
17:10
management, it's what's what is the chance that someone might
17:13
get hurt or worse and and the consequences of that
17:17
organisations take that really seriously.
17:20
But when it comes to. Money and time and benefits.
17:27
It doesn't always get taken seriously because it's not your
17:31
money. I bet you don't miss many
17:35
flights for your holiday or missed trains, or go over budget
17:39
when too far over budget. When it comes to any home
17:42
project, most people don't. Some do.
17:44
That's always outliers. But if you take personal
17:47
projects and how successful they are compared with wider
17:51
projects, it appears that we do a better job of managing.
17:56
Our own than it does for managing others and in fact one
17:59
organisation I work with says you should spend the money as if
18:03
it's your own. Well, data analytics or AI bear
18:09
fruit for risk management. Is it something you regard as
18:13
helpful in doing risk management?
18:17
Has to people find it more difficult to refute data.
18:22
It's just a lot of a I is about big data.
18:25
If you use the right technology and you've promised someone
18:30
you're going to deliver your project for a certain budget in
18:34
a certain amount of time, and the AI says that's impossible
18:40
and unless and will it be based on is it's impossible because
18:44
we've found 4000 other projects that have similar.
18:47
Countries and none of those achieved in that type.
18:50
And there are software tools, I won't mention the names that
18:52
actually do that at the moment, who allow you to look at your
18:57
schedule and compare it with thousands of others and they'll
19:00
tell you how risky it is. And that's really, it's not AI
19:05
in that because it doesn't learn, but it's it's a I in the
19:09
terms it's it's sucking on lots of data.
19:12
So I think it will improve things.
19:15
What are the key findings from 4 decades of experience when it
19:20
comes to risk management that that you'd like listeners to
19:24
take away, particularly for those people who are kind of
19:28
fresher to the profession? Take it seriously and and any
19:34
plan that you put together and plan with the big P so that I'm
19:39
in that sense, I'm talking about a schedule, a cost estimate, a
19:44
contracting plan, communication. Whatever you put together should
19:49
take into account things that might happen that if they did
19:54
could impact what you're trying to achieve.
19:56
So take it, take it seriously and always consider what might
20:01
happen. To to to affect this
20:04
immediately. That will make people think
20:06
negatively because that's the way we talk talk and earlier on
20:10
you actually said something about how do we mitigate this
20:13
mitigate is a negative word. It's a word that pervades risk
20:15
management in APM's term. We in the APM body of knowledge,
20:19
we use the term response because you can't mitigate an upside
20:22
risk, but because that's a oxymoron in that sense, you know
20:27
you don't want to reduce an upside risk.
20:29
Going back to go back to what you actually said, I would, you
20:32
know, take it seriously but also make it happen to the point
20:37
where senior management wanted, many years ago when I was
20:42
working with David Hilson and Ruth Murray Webster for a
20:45
company we all worked at together, we worked with some
20:49
big companies that actually no longer exist in name, but they
20:53
do as part of other big organisations and we work with
20:55
them. And to make risk management work
20:58
in those organisations, it needed to be pulled.
21:01
And what I mean by that is senior management needed to want
21:04
it. They needed to want it by always
21:07
asking questions. We'd want to bid for some work.
21:11
And what are the risks? Ohh, we're a client, we want to
21:14
go ahead with this. But what are the risks they they
21:17
they ask, rather than it being bottom up.
21:19
So mismanagement needs to come be demanded from the top and
21:23
supported from the bottom. It needs the term we often use
21:27
as a champion in the organisation.
21:30
Have you got any advice to senior project professionals who
21:34
would like to influence senior leadership within an
21:39
organisation so that they appreciate how serious risk
21:43
management should be taken? So you're trying to create a
21:46
champion within the broader organisation who is able to
21:51
place more emphasis and legitimacy on the importance of
21:54
risk management within that organisation.
21:57
In some organisations they do have a CR Chief Risk Officer.
22:02
That's not as uncommon. Or it sits somewhere under
22:06
finance, which I don't always think that's a good place, but
22:09
some organisations already recognise this.
22:12
But parts of allowing risk management to influence the
22:15
C-Suite is they have to also have to take project management
22:17
seriously and and recognise what that is delivering and the
22:23
change it brings about. But I think it's it.
22:27
It does need a very special person to do that.
22:29
Someone who who is charismatic you.
22:33
You can't just get and want to say not everybody can do it.
22:37
But it does take a certain person because you have to be
22:39
able to story and you have to make people understand the
22:42
consequences of failure and also understand how much and you
22:49
might have heard the term, how much risk they can tolerate.
22:52
What is their attitude towards risk.
22:55
So it built, it builds up into the the cost of failure if, if,
23:00
but it has to have a an outcome that people really want to
23:04
achieve and so the influence will come from.
23:09
It has to be understood the C-Suite level.
23:12
I don't think you can come necessary to them and make it,
23:16
you know, open the door and fly in and say you've got to
23:19
consider the risks. They've also got to realise how
23:22
important it is to deliver whatever they're delivering.
23:25
And I think the big organisations do that now and
23:29
and the government even mandates it, since since Nick Smallwood
23:35
who I knew from Shell has got into the into IPA, he's changed
23:40
things dramatically and made it more palatable in that sense.
23:44
So I don't think there is, as I said your silver bullet on how
23:47
you can make it happen. But you have to emphasise the
23:51
and find out what what happens if we fail in this.
23:55
And one way of preventing failure is making sure that you
24:00
understand what's realistic at the beginning.
24:02
That takes into account in the risk and then when you enter
24:07
into the delivery of the project making sure that you stop those
24:11
risks delaying or having a detrimental effect.
24:16
One thing about risk management, it's about making good decisions
24:20
in projects so. So when you tell someone this
24:24
project is going to take so long and cost so much and deliver
24:27
these benefits that should be risk should be factored into
24:32
that to try and take away some of that optimism bias.
24:36
But then once you've told everybody it's going to be
24:39
delivered in this time frame for this budget at this performance
24:44
and deliver these benefits on whatever, then you use risk
24:46
management to protect it. And that's what risk management
24:49
does and it's it, if you think about it the two setting the
24:54
baseline if you like and then ensuring you meet the baseline
25:00
and then if you can make people the C-Suite understand that,
25:03
then I think it will work. Typically, when are these risks
25:09
assessed or considered in a business case?
25:12
Are they right from the very start?
25:16
Does that happen in practise? The organisations I have worked
25:20
for and work with, when they put a business case together, they
25:25
will always include in it the major risks and they'd all be
25:30
negative. So in the business case and then
25:32
as you go through an Apms like our lifecycle through the
25:35
definition phase and develop your project management plan,
25:38
then there would be an intense understanding of the risks and
25:43
risk register would be put in place and then the plans are
25:46
produced at the end of the definition place should all take
25:50
into account the risks that have been identified and where
25:54
relevant responded to. I worked many years ago for BP
25:58
and they actually said the prime role of a project manager was as
26:03
a risk management risk manager because if everything's going to
26:08
plan, you have nothing to do. It's only the things that might
26:12
happen that will cause you to deviate from the plan, or any
26:15
things that go wrong that you need to worry about.
26:19
So you work the plan. So the prime role of a project
26:22
manager is to manage the things that might happen which will
26:25
cause that deviation. Now that's a very high level
26:29
broad statement and a lot of people might not agree with
26:31
that. But when you think about it, but
26:34
you can sit behind your desk with your feet up, everything go
26:37
to plan. Someone says we've just found
26:39
out this might happen or we're going to do something about that
26:41
though. Or using APM language, something
26:44
has gone badly wrong and we have an issue which we can't ignore
26:47
because we've looked outside of our tolerances or something's
26:50
gone. Is there anything you'd like to
26:53
add or any other points of advice you'd like to pass on
26:57
when it comes to risk management?
26:59
Well, I would like to everybody please have a look at the the
27:02
survey report and it it comes out, it may change the language
27:07
and I know that there are people in a PM willing to think about
27:10
that and there's a new body of knowledge coming out in the not
27:13
too distant future that may bear that in mind, but there's a lot
27:17
out there about about risk management.
27:19
It's not difficult to practise it do it is integral part of
27:25
project management. Have a go and make sure your
27:29
plans are risk based but. It's been fantastic talking to
27:34
you. Thank you so much.
27:35
Just mentioned to listeners that the report will be published by
27:40
a PM in the autumn. So very much looking forward to
27:43
for everyone to get hold of a copy.
27:45
So thanks so much again, Peter. Thank you.
27:54
Thanks again to Peter for joining us and to you for
27:56
listening to the APM Podcast. Don't forget to look out for
28:00
more episodes or to rate and review us wherever you get your
28:02
podcasts. We'd welcome you to get in touch
28:05
with your comments, feedback and suggestions by emailing us at
28:08
apmpodcast@thinkpublishing.co.uk. This podcast has been brought to
28:15
you by APM, The Chartered Body for the project profession.
28:18
For more information on APM, visit apm.org.uk.