Why do we have so much trouble dealing with risk? Is it that we don't want to think about our mortality as we hurtle down the road at 80mph against the flow of fellow travelers at similar speeds? We simply buy auto insurance and get on with our lives. Life is a risky business and yet we muddle through it with fingers crossed and a modicum of good luck. Similarly in business, we often turn a blind eye to possible business ending risks like being crushed by disruptors, having margins squeezed by competition or the loss of the smartest people on your team. Entrepreneurs are a passionate and optimistic crowd and by nature walk on the sunny side of the street.
As prudent business people, we don't do risk management justice for a lot of reasons…..none of them good. For large projects you can make a career out of risk management and likely that's the image that we have when we talk about risk. However, it doesn't have to be that hard. Practicing risk management is essential for all businesses and keeping it simple and practical will make it easier for your team.
There isn’t much required in the way of tools to get started. You just need a pad of yellow stickies, a white board or flip chart to provide a surface on which to stick and a marker to divide the surface into quadrants. At the end of the exercise you will need to transfer your information to a spreadsheet for documenting and tracking.....which we call a risk register. Of course, you need your team to identify and analyze project risks and maybe an expert or two that has been through the wars. It’s a collaborative endeavor and one which should take no more than 1 hour to complete for most small projects.
Risks come in two flavors: Negative which is our most familiar and Positive which which we call opportunities. Early to market is a positive risk or opportunity and a new competitor moving into town is of course, a negative risk. Let’s get started on the process.
The 5 Steps to Manage Business risks:
1. Identify Risk Events: Standard methods for risk identification include brainstorming, historical experience, the Delphi Technique (https://en.wikipedia.org/wiki/Delphi_method) and one of my favorites “5 times why?” which is a classical root cause analysis technique to deconstruct errors on prior projects. I recently ran across an article: “Eight new ways to identify risks” at https://www.projectmanager.com/blog/8-new-ways-identify-risks which describes some new techniques you may wish to try.
Regardless of the technique you use, this is a team exercise. Each team member jots down a potential risk event on a “sticky”, puts in on the board or flip chart and tells the team what the risk event is. Don’t overthink it…….just get them written down and pasted up.
2. Assess Probability and Impact: Next analyze each risk and determine if it is likely to happen and if it should happen what the impact will be. i.e. schedule is delayed, additional costs are incurred or are we are just plum out of luck and have to scrap the project. Keep your ratings simple with High, Medium and Low and be sure to define what those terms mean to you. For example for probability something like: likely to happen, might happen, probably won't happen. (nb: If it is certainly going to happen then it’s an assumption and should be factored into your project plan). For impact how about: House is on fire!, Gonna cost us; Oh man that's inconvenient. Mark the priority and impact on each sticky note.
3. Prioritize: Organize and consolidate you risks into groups: High/High; High/Med; Low/Low. Simply divide your workspace into quadrants and move the stickies into the appropriate quadrant.
Once you have the risk events categorized in this way, it’s time to transfer the information to a spreadsheet (risk register) for safekeeping and to simplify tracking. There’s value in simplicity to start and you can increase the content to include responsibilities, dates, actions taken and so on as you get to be an expert.
4. Establish countermeasures for High Priority Risks: Focus on the high probability and high impact risks and consciously decide what you will do should the risk event occur. Doing nothing is an option (accept); taking action to reduce the impact (mitigation) or changing your project plan to avoid the risk (avoidance) are all options. The actions should be specific and need to be added to your project plan updating schedule, budget, or tasks as appropriate. Be sure to take a look at all risks rated high in either probability or impact (medium quadrants) to determine if you should also have countermeasures in place for them.
5. Revisit at Key Milestones and when changes occur: Since we are well into the elections, this is one of those vote early and often topics. Time passes and things change. Risk events either happen or not as the schedule proceeds, some become more probable and additional risks will pop up. Consequently, a regular review of your risk register is good practice and should be done at team meetings and at key milestones.