Michael Jordan's Weblog

Any project or program that requires a team and more than a week or so to execute can benefit from establishing a risk management process. I would propose a few tweaks to conventional wisdom about how this is done. The workflow is basically like this:

1. Determine which process steps or program elements need risk assessment (i.e., you don't have unlimited time, so don't try to analyze every little thing before taking action.). Lay out your high level process steps or program categories, then choose the most complex for analysis -- if you want to be more systematic, rate each element for its impact on project resources, budget, and timeline. Which element is most critical for success? Which element has interdependancies outside your team?

Direction of first risk workshop: TODAY --> FUTURE

2. For the program elements you deemed worth of analysis, I'd recommend a team conversation to answer the question "What's not working today?" (This is one of my tweaks to more conventional methods that start with the question "What could go wrong in the future?" I believe this is a simpler entry point for your first project risk workshop. After you've done a couple, your team will be more facile starting in the future.)

Chances are, the things that are not working today, i.e., ISSUES, will, if left unchecked, lead to problems down the road. Your goal is to unearth those future impacts. ISSUES that haven't happened yet are potential CAUSES of future risks, i.e., ISSUES and CAUSES are at the same level in this analysis. (This is another tweak on conventional process.)

3. For each current ISSUE, identify the RISK to a higher level activity. If your ISSUE is that voters don't know your candidate, the RISK is that your candidate will lose the election.

Now you're getting close.

4. For each RISK, identify the IMPACT on your business or on your customers or on the world. If your RISK is losing the election, the IMPACT is that the world will be deprived of your candidate's leadership in office (if Abe Lincoln had lost the election...if FDR had lost the election...certain things would not have happened). It's important to describe the IMPACT in your customer's terms.

Living in the Future.

5. Identify any future impacts that don't have current ISSUES (didn't come up in your "What's not working?" conversation). These are things that are either going ok today or that you might not be working on yet. But it's important to have this future-oriented discussion.

6. Now that you've generated a list of things that you might want to worry about, you need to prioritize your worries along three dimensions: SEVERITY, PROBABILITY, and (Un)DETECTABILITY.

• SEVERITY: If that IMPACT (also known as a FAILURE MODE) is realized, how negative would be the impact on your critical success factors, or on your scope, schedule, budget? Eventually, your team members need to be using the same criteria in rating SEVERITY -- you're looking for a score from 1 to 10 where 10 is as severe as it gets.
• PROBABILITY: On a scale of 1-10 how likely is this IMPACT to occur?
• (Un)DETECTABILITY: Rate on a scale of 1-10 whether you could detect the emergence of this IMPACT / FAILURE MODE before it is felt by your customers. A 1-rating is something easy to intervene and a 10 rating would be a surprise with no opportunity for you to catch before your customers. E.g., a sudden system failure impacts your customer without the opportunity for you to intervene unless you use remote monitoring of some kind.

Multiply your ratings together to yield a RISK PRIORITY NUMBER -- the combination of SEVERITY, PROBABILITY, and DETECTABILITY.

7. Identify the IMPACTS / FAILURE MODES with the highest RISK PRIORITY NUMBER. For any of your top items for which you have not identified RISKS and CAUSES, trace back from the possible future IMPACT to those items. You need to consider RISKS and CAUSES in order to identify next steps.

8. For your highest RPN items, choose 1 of 2 strategies, either mitigation or contingency.

• MITIGATION: How can we redesign our process or project output to prevent this IMPACT?
• CONTINGENCY: What do we do if it happens anyway?

9. For the chosen strategy, assign and track actions as you would other parts of your workplan.

Risk Analysis Template> in SOFFICE 8 spreadsheet format.