What’s the down-side? Risk Management 101

How about those tech stocks you bought in 1999? And the real estate you rushed to purchase in 2005?

Risk Management. Our country does it. We identify the risks of terrorist attacks. We try to create contingency plans, in case the risk materializes. We create mitigations by figuring out ways to prevent the risk from materializing.

Our cities do it. Palo Alto recently had a 2-day test run for emergency preparedness in the case of a bio-warfare attack causing pneumonic plague. There were simulations at community centers, and groups of volunteers and service people showing up to be assigned to help. Now they will examine the exercise for lessons learned and improve both the mitigation strategies and the contingency plans.

Our families do it. We do risk management with our teenagers – without giving it a label. “Be home by 12.” “Call me when you get to Tahoe.” “I need to know the address of the party and that an adult is present.” These are risk mitigations. We’re taking steps to ensure our child’s safety, to try and prevent bad things from happening to good people.

Dale Carnegie has a formula to use when worrying about a situation:
1. What’s the worst that can happen?
2. Prepare to accept the worst.
3. Take steps to improve on the worst and prevent it from happening.

Wouldn’t that be called ‘Risk Management’?
1. Identify the risk
2. Prepare a contingency plan should it happen
3. Create mitigation plans to try and prevent the risk from happening

How do we do this at work?

At minimum, every project we do should have continuous risk identification and management as part of the project activities. Weekly meetings should include review of risks. All people involved in the project should be encouraged to be alert to potential risks and document them.

A basic template for risk creation and maintenance could be:

Risk ID, Name, Creator, Date Created, Owner, Priority, Probability, Impact, Description of Impact, Mitigation Plan, Contingency Plan.

You could spend 5 minutes creating an Excel sheet with the above columns. Or, taking it a step further, put it in a database. And yet a step further, if you use Microsoft Office Project Server, put it in the Risks area of Project Web Access. Doing this gives you the benefit of being able to link the risk to specific projects and tasks.

Reporting on risks could include trending reports… is the probability of the risk happening going up or down from week to week? Have mitigation steps been completed from week to week?

Tracking risk activities could be done in project schedules. The advantage in doing this is being able to link the risk activities to predecessors and successors, automatically generating a Start and Finish date. In addition, resources can be assigned and the risk activities will be in a person’s task lists.

You might want to differentiate between risks to a project’s schedule, budget or quality. The risk template you use could be modified accordingly.

OK. Now it’s time to stop reading website articles and return to work… or you’ll be creating contingency plans surrounding ‘Risk of job loss’.