QUESTION

Dear Mr Risk,

We run intensive risk workshops every month where we run through an ever growing register of what might go wrong and form all sorts of aspects – quality, finance, war!, subcontractor problems, flood, collapse, changes as well as specific design or approval issues that the client may disagree with etc. We spend hours and hours on building the list, assigning the items with likelihood as well as how bad, or good (but we have few good ones) the result might be. Where are we going wrong and how do we improve the situation? Please keep me anonymous as I work for a consultant and my client would argue that I should know better.

We also emply a Risk Manager (cos it says so in the Clients man-month schedule of payments) - he says he manages risk and not the schedule. I am party to some of the Guild of Controls discussion and see that they are discussion of risk is part of the planning and schedule career path or if it is a separate one. What are your thoughts? .

Regards…

SUGGESTED ANSWER

Dear Sir,

Thanks for your enquiry.  First let me say that in my personal opinion too much time is spent making contingency plans for risks which never materialize.  This includes most work that people do with risk registers.  If a risk is more than 50% likely to occur it should become the base case.  If a risk is less than about 5% likely to occur it is probably best not to worry about it until it happens.  So, the usefulness of risk registers is limited to the intervening range.

If you try to list all the things which could possibly go wrong (or right) you end up spending a lot of time (a) trying to decide whether a risk is 1% or 2% likely, which makes no practical difference, and (b) making 100 plans for every one which gets implemented.   This sounds like where your company is at.

Quantitative schedule risk analysis – what you call “<software name removed> type” – is another thing entirely, because it analyses the practical consequences of uncertainty about tasks which you know will be necessary or which have a high probability of being necessary.  And though it might seem more mundane, it generally produces surprising results.  In particular, often the project completion date obtained by a conventional deterministic CPM has a very small chance of being achieved.   Which comes back to the user not fully understanding what is going on; and proper understanding is very important in risk analysis.

Finally, as you obviously sense, the idea of a risk manager for a project who is not concerned about the schedule is absurd.

I hope this helps.