The Project Management Institute (PMI) defines risk management as, “the chance of certain occurrences adversely affecting project objectives.“
Following the uncertainty of 2020, the industry has seen a rise in the interest in effective risk management in organizations.
This rise is echoed in our State of Project Management Report, which shows a 4 percent increase in organizations that engage in risk management. Additionally, the value of the task has seen a sharp rise, placing it only second behind stakeholder engagement.
New Rules for Risk Management
Axelos Management of Risk guidance provides seven principles that underpin an effective process, and we can use those to modernize how we identify, assess, respond, and measure risk.
1. Risk management aligns with organizational objectives
Considering the current environment for projects and organizations, it’s important to understand the current aspirations. Are we less risk averse because of the level of risk we’ve dealt with, or has our attitude changed? Has the organization fundamentally changed its operating model, or has it battened down the hatches until the uncertainty blows over? Our risk approach needs to reflect the current reality of the organization, its objectives, and its strategic view of the future.
Rule: Review the current appetite for risk management and identify the areas where you need to expand or contract touchpoints.
2. Risk management is designed to fit the context
The amount of managing risk delivery teams are expected to do may have grown from uncertainty or diminished due to the lack of consistency in the availability of key players. This is, therefore, a perfect time to review our approach to risk management and align it to our current level of maturity, risk capacity, and appetite. As with governance, consider if different types of change activities need a different approach to risk.
Rule 2: Create a scaled approach that allows more complex activities to benefit from enhanced risk management while others need less, creating a dynamic process.
3. Risk management engages stakeholders and deals with differing perceptions of risk
Because stakeholders play a wide range of roles, there may be disparate views of the need for and approach to risk management. The key here is to focus on consensus during risk identification. Ensuring it is thorough and that differences are understood and resolved ensures that money and time are not wasted on unnecessary or over-engineered responses to risks.
Rule 3: Develop a community of practice that educates and supports those taking part in risk activities so that they have available tools to gain consensus during a risk assessment.
4. Risk management provides clear and coherent guidance to Stakeholders
Part of creating a coherent language around risk management is ensuring that our approach is logical, consistent, and orderly. This requires information and education to be available to delivery team members (as well as others) so that there’s a joint understanding of what risk is and how it’s responded to and managed across the organization.
Rule 4: Develop your PMO or project and portfolio management (PPM) information systems to contain clear user guidance, are easily accessible, and are supported by learning events.
5. Risk management is linked to and informs decision-making across the organization
Risk management must help decision-makers understand the relative merits, threats, and opportunities. This means that the information collected and collated should be consistent and supportive of the governance arrangements of the change initiatives. The main mechanism to achieve this is to understand the risk tolerance thresholds and apply them to the risk assessment process, as when exceeded, they’ll trigger an escalation.
Rule 5: Develop risk tolerance thresholds with the senior team so they understand their role in decision-making for risk events, and set their expectations appropriately.
6. Risk management uses historical data and facilitates learning and continual improvement
Actual data is key to managing risk because it supports the inception of new initiatives and because historical records allow us to analyze and judge whether something can be improved. If it can be improved, lessons can be learned, planning and estimating can be improved (both of which continue to be challenges for organizations), and delivery teams can feel, see, and communicate positive outcomes.
Rule 6: Create a mechanism to feed risk information into the improvement loops of the project organization, enabling clear change that benefits delivery in the long term.
7. Risk management creates a culture that recognizes uncertainty and supports considered risk-taking
Axelos says that zero risks are neither possible nor desirable. An acceptable level of risk is needed by organizations to understand their wins and losses, so creating a culture that transcends ‘tick-box compliance to risk management enables an open exchange, balance, and transparent control of risks, ensuring that it can attain the full value of the investment in the process.
Rule 7: Make risk management part of the day job. Every project board meeting allows new risks to be discussed so that team members don’t feel self-conscious when bringing up potential situations.
The PMO Perspective
Over the last year, we have seen organizations take time to understand what they can do better using the medium of maturity assessments. One of the consistent outputs of these reviews has been the need to improve the management of risks.
The PMO is pivotal in designing and disseminating risk management in organizations. It provides not just the framework but also demonstrates the attitude to risk that ensures it is taken seriously by the Senior Stakeholders. Why? As a function that enables success, it is often overlooked when reviews of value-adding business functions occur, meaning that many PMOs live daily with the uncertainty that their role will not remain in the organization for the long haul.
For the PMO, bringing to life the seven rules for risk management for the modern world will enable them to be seen in this arena and provide a measurable way to demonstrate that they add value and can support the mechanism to preserve Shareholder confidence in their organizations.
