Risk Management and Opportunity

Risk Management and Opportunity

Click for Dick's Barn web site

Published October 30, 2007
by Dick Morley
 
Risk management and its compatriot, opportunity, bring many surprises. My preconceived notions of risk management had to be tossed out the window in order to write this column.
 
The most interesting of several interviews was a talk with the chair of the Project Management Institute, Risk Management Group, Chuck Bosler. He had to repeat himself often because I really didn't understand the language. I felt as though I was a Yankee translating for a New Yorker into Canadian English -- most difficult. Although the vocabulary was understood, I missed the whole concept. I'm not sure I've got it now. He did point out that risk management has to be a neverending leadership function across the entire project and enterprise.
 
Chuck suggested that risk managers should never hold up work. We should not stop work and wait for the risk management process to be completed. It's also important to keep in mind the difference between risk and uncertainty. Risk can be measured by its impact and its probability of occurrence. For example, if we prioritize the risk management process too much, it could keep an organization from completing or starting a project.
 
Chuck and I talked about our past projects. I can remember only one of my projects that was on time, on budget and with no bugs. This is after 50 years of doing stuff in the engineering business. It's important that my risk management was poor at best. My solution was to nag when something did not happen. As Time magazine in 2006 pointed out, "we tend to look at the situations that are near-term important vs. situations that have high probability and high impact. We look at low probability and low impact risks -- it's human nature.”
 
Risk management changes the human recognition of risk, risk assessment and developing strategies. Actual implementation of risk reduction uses standard managerial resources. The Dept. of Defense, for example, says that we have to accept some risks, control some others, avoid some other ones and transfer others to other situations.
 
 I was surprised when Chuck pointed out that all risks are not really technical or budget risks, some risks may include hurricanes, political changes, dollar exchange funds, lack of well-trained installers, the understanding of gain vs. risk and the likelihood of intrusions. Internal risks can be controlled. External risks are most difficult to control and can only be generally anticipated.
 
The highest priority in risk management is understanding, knowing and examining the risks and personnel involved in the project. The second is a technical lack of knowledge and letting things fall between the cracks.
 
One of Chuck’s favorite stories is about an oil platform that was heavily engineered, cost a jillion dollars and yet when launched, it sank to the bottom off the coast of Brazil. Why? Because of cracks in the analysis, no one calculated the ultimate buoyancy needed to keep the platform afloat.
 
One of the priorities is that we tend to over-manage costs, and we leave the engineers alone -- we don't review engineering and look at risks associated with technical implementation. Management and marketing (the suits) have a different approach to risk. They don't like to talk about risk; it's not in their lexicon. For them, only short-term costs are relevant. They don’t need to have risk and there should be “no risk” in any project. Management expects all risk to have negative impact and can never learn or get better for the next project.
 
Risk management uses tools. Chuck suggests that we should be cautious of using any tools, including his own. We tend, as engineers, to overemphasize the resolution of error and he points out that "value is inversely proportional to the decimal points of the resolution." What we really want to know is, will a plane crash?
 
The pyramid of risk management is you collect the data, manage the knowledge, extract the wisdom and make a decision. Like medical emergencies, you need triage in your risk management -- fix the easy ones first. Failure to address risk means that events overcome the decisions.
 
Our whole culture rewards the hero, not the guy who actually makes the thing happen. An old friend of mine, a captain in the Navy, was the supply officer for an aircraft carrier. His job was to make sure that the ship, carrying 20 years of fuel, had enough food for the men and personnel to complete the mission. If he makes a mistake, lots of things can happen. He didn't make a mistake, but was never honored as a hero. I'm beginning to think that the good guy is not one who overcomes all the mistakes in the blaze of publicity, but the hero, like a mother, like a father, like the man in the back room who actually makes stuff -- that's the hero.
 
Let's use some examples. I'm convinced it takes a day to make a trip to anywhere. I know on every trip I take it's not "did I forget anything?" but "what did I forget?" Every plane, train and automobile trip is fraught with risk and it takes a day to go anywhere.
 
A little story on the humorous side. It takes me a day to go WalMart with my wife. She says she can be ready in 20 minutes. All husbands know how long that really takes. She also suggests it takes only 45 minutes to get to the airport to meet a flight. Au contraire, says I. I have to be there two hours ahead of time; I have artificial knees in both legs and I have to go through security. It takes only 45 minutes to meet the plane if the car is outside, it's 2 am, the doors are open and the car is running. And when you get to the airport there's no security, you leave the car running, step out and get on the airplane. Then possibly, with no traffic, you can make the trip in 45 minutes. I roughly count on two to three hours to get to the airport to meet her 45 minute deadline. The hero gets to the plane on time.
 
There are many other instances. In the book "The Mythical Man Month," it is pointed out that software fails 96% of the time and that the more people on the software project, the longer the project takes. This leads to an absurdism reduction suggesting that it would take no time to do software if there were nobody on the project. I wonder if that's not the right answer. We don't listen. Someone always knows what the problems are, but is not given (or does not have) a voice. This suggests that small organizations can inherently do better work than large ones because the people doing the work can analyze risk. Leadership is risk and asks can I do this? Can I carry it out and is it part of my vision?
 
What to do? First, assign a risk officer; a team member other than the project manager and responsible for seeing potential problems. A typical characteristic of a risk officer is a healthy skepticism (not a nag and not totally negative).
 
The first thing a risk officer must do is get gold-plated documents. These documents must be signed off, analyzed and become a design review for the entire project. Second, he must define how much change in a project is acceptable. There will be change no matter what, and the worst changes -- particularly those that are uncontrollable -- come from the outside.
 
There's a motto up on my wall that says "Don't look under the light." What does this mean? It means not to look where it's easy, look where it's hard, because that's where you lost your keys.
 
Have a risk management process, not a project. The process should be easy to implement, repeatable and scheduled. There are many tools, as I've mentioned earlier, but as Chuck points out, be cautious of tools. Ask dumb questions like, is the plane going to crash?
 
On a side note, if risks are improperly prioritized we can waste time dealing with losses that are not going to occur. Spending too much time managing unlikely risks (low probability) can divert our resources. Unlikely events do occur, but if the risk is unlikely, it might be simpler to retain the risk and deal with the result if the loss does occur.
 
Enough of the conversation. Let's list the recommendations. They are:
  •  Have a process that is simple, easy and repeatable
  • Walk around with implementers
  • A good way to analyze and look at a project is managed by walking around as the boss, detecting what you seem to see as a risk and say to the number two person, "Fix that."
  • Standardize the process. Like these quick lube places, have a checklist which is easy to understand, easy to use and is a tool for the average person.
  • Don't use an immature process for analysis
  • Use the natural habitat of the project
  • Teach and train, formally and often
  • Think risk beginning to end, collect data from beginning to end
  • Risk and opportunity go hand-in-hand
You cannot achieve something new without risk and failure. Risk alone is not bad, it is essential to progress and failure teaches us a lot.
 
Risk, the probability of something happening that affects your objective, is a chance to make either a gain or a loss. It is measured in terms of likelihood and consequence and, in this business, "holy shit" is an acceptable term.
 
Dick Morley
 
***
 
My thanks and appreciation to Chuck Bosler, Project Management Institute, Risk Management Group (www.risktrak.com).
 
Dick Morley is best known as the father of the programmable controller and is the leading visionary in the field of advanced technological development. He is also an entrepreneur whose consistent successes in the founding of high technology companies has been demonstrated through more than three decades of revolutionary achievements. Mr. Morley is the recipient of the Franklin Institute's prestigious Howard N. Potts Award and is an inductee of the Automation Hall of Fame. He holds more than twenty US and foreign patents, including those for the parallel inference machine, the hand-held terminal, the programmable logic controller and magnetic thin film. Currently, he is the Chairman of the Board of National Center of Manufacturing Sciences (NCMS), Director at Large for the Society Manufacturing Engineers (SME) and a member of the Manufacturing Advisory Board for Worcester Polytechnic Institute (WPI). For more information, visit www.barn.org.
 
Dick's most recent endeavour is Wolf Rock Chocolate, some of the finest dark chocolate available in the U.S. market. More information on this fabulous chocolate.