Security

Eliminating risks is not the only risk management strategy

There are a number of ways consultants can respond to risk besides attempting to eliminate the risk altogether. Consider these alternate strategies when approaching a risk-laden task.

Each week, project management veteran Tom Mochal provides valuable advice about how to plan and manage projects. He first describes a common problem scenario, based on real-life situations, and then offers a solution based on practical project management practices.

The dilemma
Project manager John was finishing up a draft version of his project definition for a major office move. All in all, it was a pretty good document. He and I were having a conversation about his risk identification and risk plan.

“I see you’ve identified a number of risks to the project,” I said. “For each risk, you have also identified ways that you could eliminate or reduce the risks. The move is not for three months. Given that timeline, I wonder whether there might be alternatives to some of your risk plans that make more sense.”

“There are a number of potential risks with a project this large,” John replied. “The moving logistics are complex, and everything needs to happen in a sequence. If one move gets delayed, the entire schedule gets pushed back.”

“I have a sense of how interdependent everything is,” I said. “But let’s look at some of the risk plans. For example, your moving company may end up on strike, so you are proposing engaging another company instead. This is a new company you have not used before.”

“Yes,” John agreed.“ If our standard moving contractor is on strike, we need to have a substitute ready.”

“You also are planning for a high volume of calls from people who need some minor tweaking after the moves,” I noted. “You plan to have your staff work paid overtime on nights and weekends to deal with this demand.”

John spoke proudly, “This may cost us a bunch of overtime pay, but we are going to keep our service level up by responding to all requests within 48 hours.”

“I see where you are going with your risk plans,” I summed up. “However, there are a number of responses to perceived risks. You are trying to mitigate or eliminate each risk. Let’s discuss some alternatives and see if they are applicable.”

Mentor advice
Since risks are generally perceived as bad, it makes sense that the first instinct of a project manager is to mitigate them. (There are also positive risks, but that is another story.) A number of options for responding to a risk are available:
  • Leave it: This option works if you can live with the result of the risk event occurring, or if the cost of other approaches is prohibitive.
  • Monitor the risk: You may have enough time to monitor the risk to see if it will go away. The project manager creates a risk plan in the future only if it looks likely that the risk event will occur.
  • Avoid the risk: You may be able to isolate and avoid the condition that is causing the risk. For instance, if a part of the project has high risk associated with it, you may be able to eliminate that entire piece of the project.
  • Move the risk: In some instances, the responsibility for managing a risk can be removed from the project by assigning the risky activity to another entity or third party. For instance, risks might be eliminated by outsourcing a function to a third party who has specific expertise in that area and will absorb any associated risks.
  • Mitigate the risk: In most cases, this is the approach you take to eliminate or minimize the risk.

In John’s case, I pointed out a couple of options. There is a risk of a strike at the moving contractor, but John has three months until the move. He may not want to make any major changes now to do business with a new company. Perhaps the best approach is to monitor it. If the labor contract is renewed in the next month, he won’t need to make any changes. If a strike still seems imminent after a month, he’ll still have two months to put new plans into place.

John is also proposing heavy overtime so that his service level will not drop after the move is complete. Again, this may or may not be the best approach. He should talk to his manager about another option—leaving the risk alone. After a major move, people understand that there is going to be some disruption in service levels. John may be able to reset expectations by letting people know that the turnaround time for requests will be five days instead of 48 hours, for a defined short-term time frame. In other words, this may be a situation that the company can live with.

The purpose of the advice to John was not to tell him his risk plans were wrong. In fact, they may be the best alternatives, given what he knows today. I did want to point out to him that a number of options are available for risk planning, in addition to the standard mitigation plans, and he should make sure his risk plan provides appropriate responses to the severity of the risks.

Project management veteran Tom Mochal is director of internal development at a software company in Atlanta. Most recently, he worked for the Coca-Cola Company, where he was responsible for deploying, training, and coaching the IS division on project-management and life-cycle skills. He's also worked for Eastman Kodak and Cap Gemini America and has developed a project-management methodology called TenStep.

0 comments