Risk management in development projects

“Ladies and gentlemen, please observe the following safety recommendations.”

We have all heard those words when we are on board an airplane—in fact, many of us could probably recite from memory the cabin instructions from the flight attendant prior to take-off. But beyond that repetitive message, have you ever thought about what is behind those instructions? One thing is clear: despite all technological advances and the statistics suggesting that it is safe to fly, flying still puts us in a vulnerable situation. In following the cabin instructions, we are part of a practical risk management exercise that will increase our chances of arriving safe and sound at our destination.

Risks constitute part of our daily life just as they constitute part of the life of projects. According to the definition of the Project Management Institute, project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more of the project’s management objectives, such as the project scope, schedule, cost, or quality.

But how can we manage uncertain events? The process is always the same: first, identify the risk; second, measure the probability that the risk will occur and its impact; third, respond; and finally, monitor the risks and responses.

“Please be careful when opening and removing objects from the overhead compartments, as items might fall and injure other passengers.”

There are many things that can go wrong during a flight, ranging from a routine delay to turbulence that causes us to spill our coffee to a mechanical failure that puts our lives in danger. Some risks can be easily identified. To know if there is a risk of delays or bad weather, you just have to look at the airline’s web page. On the other hand, certain risks, such as possible mechanical failure, are difficult for a regular passenger to identify. To determine these risks one has to turn to other techniques, such as consulting with experts on the topic.

Obviously, in real life it is difficult to consult with an airline’s mechanics. Fortunately for projects, however, we have an easier alternative to obtain the opinions of all the actors involved. It simply involves carrying out a participatory exercise or, as it is known in risk management terms, a risk workshop.

“In the event of decompression, put on your own mask first before assisting others.” 

When we complete the risk identification exercise, we will have a list of numerous events that could affect our flight…or our project. In a context of limited resources, we cannot address all of those risks, so it is essential to find a way to prioritize them. To do that we use two variables: the probability that a risk will occur, and the impact it would have on our objectives. By combining these two variables, we can define the level of each risk.

For example, if we are traveling on vacation during the peak season, when airports are more frequently overcrowded, there is a high probability that the airline will lose one of our bags. The impact of this loss can be significant. Consequently, this is a high risk that should be prioritized over lesser risks.

Determining the precise level of the risk depends on the historical information available. If we have traveled many times with the same airline and it has never lost our bags, we could adjust the probability level downward and, consequently, adjust the risk level downward as well.

If we have not traveled with this airline, we could—and should—obtain information from social networks or even review statistics to correctly estimate the probability and impact of the loss of the bags. In risk management, information is power. The more information we have, the more precise will be our estimate of the risk level and the more efficient will be the allocation of our resources.

“Safety regulations prohibit the use of large electronic devices during take-off and landing.”

Once we have evaluated our risks, it is normal to begin to think about what actions to take. This is what we call a Response Plan.

Normally when we talk about responding to risks we immediately think of mitigating them—that is, how to reduce the impact of the risk and/or the probability that the risk will materialize. Although this is a viable alternative, there are other strategies.

When we travel, there is a certain possibility that our checked bags will get lost, but in addition to mitigating this risk by attaching personal identification tags to our bags, we can transfer this risk by purchasing insurance to cover against loss of the bags. Another management strategy is to avoid the risk by traveling only with carry-on bags. Or, finally, we can accept the risk and live with the consequences.

“The captain has turned on the fasten your seat belt sign, please return to your seat.”

We have come to the moment of truth, it is time to implement the responses that we have planned. At this stage, the WHEN is just as or more important than the WHAT. Immediately implementing all the responses is not always the most efficient option.

For example, when we board the airplane we are aware that there could be turbulence at any moment during the flight. However, very few of us keep our seatbelts fastened during the entire flight. We only fasten them at certain moments when there is a higher risk of turbulence.

Those moments are not random, but rather are triggered by certain events. The pilot monitors a series of atmospheric variables, and only when they surpass a given threshold (trigger) does he or she tell us that there is a greater risk of turbulence in the minutes ahead and that we need to fasten our seatbelts.

“At this time you may use computers and other large electronic devices.”

Our work does not end with implementation of the response. It can happen that, after having purchased our ticket and planned our trip, new information comes up that prompts us to review the original analysis and plan. It is essential to continually monitor our trip—or project—in order to identify new risks, adjust the level of the risks already identified, and redefine the responses.

The pilots of the airline on which we are going to fly could announce that they are on strike. This new information would certainly change our plans. Automatically, new risks would appear and the levels of other risks would change. The risk of cancellation of the flight, which we had perhaps considered nonexistent under normal conditions, now could be very real. The level of other risks, such as a flight delay, could increase.

Of course, if our risks change, our responses change as well. If the risk of a delay increases, we might need to take more aggressive steps in response, such as buying insurance (transfer) or changing the dates of our flight (avoid), instead of more moderate responses such as buying a flexible ticket that allows for changes (mitigate) or simply accepting the possibility of a delay (accept).

In conclusion, a risk management methodology helps us make better decisions in uncertain situations. By understanding these steps in detail, we increase the probability of achieving our objectives, both in everyday life and for in projects that we lead. If you would like to learn more about project risk management, we invite you to sign up for the online course that will begin at the end of March.