A false sense of security in project risk management
02 Dec 2011Posted by John Murphy
One of the accepted practices in project risk management is identifying mitigation actions for specific project risks. Clearly, this is a sensible and practical way to approach dealing with a potential risk.
But then, in my opinion, many teams go a step too far. They re-assess a risk based on the planned mitigation actions having been implemented. This creates a second set of risk scores. These reflect the teams’ assessment of how well the mitigation actions would reduce the impact of the risk. To me this makes little sense and in some ways can be dangerous.
Often a team will generate a false sense of security about a risk if they view it only in the terms of the mitigated version. When challenged, an argument is put forward that management need to understand what the potential residual risk will be. How does a purely paper exercise provide any more assurance that the mitigation will be effective?
No-one can really re-assess a risk until a risk mitigation action has been implemented and the effect re-evaluated. Let's not dampen the importance of project risk control by mitigating it on paper until the action has been proven to work.
Comments
24 April 2012 07:59 Scott Draeger M-EDP says
Great observation. In general, I have seen that project teams under-report risk. The Program Management Offices then balance out the minimised risk ratings, diluting them further.
As a result, some of the projects can be more dangerous than expected, and have a material adverse effect on the PMO's strategy.
Once things are on paper, there is an illusion of control. As you point out, the paper creates the exercise that measures the risk based on a preconceived notion. You cannot reverse engineer your risk assessments. I am not advocating that a poject to evaluate copiers should include mitigation for a Martian invasion or pandemic flu. But, have some impacts that are really outside the domain knowledge of the project team. The big risks are the surprises.
- Technology, Media and Telecommunications
- Business Strategy & Operations
- Benchmarking
- Benefits Management
- Continuous Improvement
- Strategy Review & Validation
- Change Management
- Knowledge & Records Management
- Merger & Acquisition Services
- Divestments
- IPO
- Joint Ventures
- Organisational Development
- Talent Management
- Project, Program & Portfolio Management
- PMO
- Project Audit
- Technology Integration
- Advisory Services
- Systems Implementation Support
- Accreditations/Partners
