Published in the Project Post-Gazette: February 2014 PPG
by Cheryl A. Wilson, PMP, RMP, CCEP
Recently I read a blog from a project manager (PM) telling what they felt was the top ten (10) risks in managing government projects. From reading through the list of risks that this PM felt were noticeable obstacles to government project success, I noticed that there is still a considerable level of confusion about what constitutes risk potentials from the normal issues when managing projects as a PM. Every PM is going have to manage some level of team conflict, communication breakdown or scope challenges on our projects, but not every problem we face as PM are project risk potentials. Being a PM involves: decision making, communicating, directing, coaching and mentoring the project team, stakeholders and sponsor. Inherent in this position are problems that fall under the umbrella of normal PM functions.
However, if the PM were to log all the problems they face with managing a project as risk potentials, the risk register will be full of problems that are unrelated to the project’s deliverables. So what is a less confusing way for the PM to know the difference between risk potentials and normal problems that go with managing all projects which is the goal of this article?
KEY POINT: If a normal PM problem is treated like a risk potential and assigned a risk owner, what is actually happening is the risk owner team is managing the project instead of the PM. These risk potentials are handed off to risk owners to try and mitigate instead of being actively managed as normal project activities by the PM. Lines are blurred when every problem is designated as a risk potential and the team tries to mitigate external issues that should have been escalated to the upline management by the PM.
Below are questions each PM should ask prior to listing any risk in the risk register:
- Is this project obstacle tied to one of my projects “fit-for-use” (FFU) deliverables?
- Have I identified the root cause(s) of my risk potential?
- Have I identified the trigger for each root cause behind my risk potential?
- Can I identify the correct mitigation steps (within my project’s control) for my risk potential that will reduce the potential impact to my project FFU deliverable?
Each of these important questions deserves further discussion for adequate coverage and understanding.
Q1: Is this project obstacle tied to one of my projects “fit-for-use” (FFU) deliverables?
Remember: no deliverables – no risks!! In the many articles written for the Project Post-Gazette, I have talked about the fact that all risks are tied to the projects FFU deliverables. If you are the PM or a member of the project team finding that many of your risk potentials listed in the risk register are not tied to your FFU deliverables, there is good chance the register is being used to list causes, normal project management activities or triggers instead of true risks. Below I have listed some risks that were listed in the above mentioned blog to help walk you through understanding the difference between a risk potential that is tied to your deliverables and an obstacle this should be managed by an experienced PM. As we work through this list of obstacles you will start to notice several patterns emerge. Be forewarned that the list contains a confusing mixture of risk potentials, issues, and project management activities – not as the blog claims are all risks.
The list contained issues and project parameters that are external to what the PM and the project team can control such as security clearances granted by the government, the use a firm fixed price contract, and even payment turnaround time to the contractor. These are external problems the PM needs to deal with either by escalation to their upline management or to the government program management team, but they are not risk potentials that should be managed by an assigned risk owner within the project environment. Scheduling meetings, contractor expectations, communications are all PM related responsibilities that any seasoned and experienced PM should be able to manage on their projects. Unclear requirements, staying within the scope of the project, again are obstacles or problems that a seasoned PM will face or has faced on most projects they have managed. These obstacles are problems you cannot tie to one of your project deliverables therefore they are just that – a problem on the not within the risk environment. The list from the blog is listed below for both coverage and ownership by the discussion initiator, not the PPG:
- Security clearance and access
- Scheduling meetings
- Unclear requirements
- Staying within scope
- Having high contractor expectations
- Client’s inability or resists affecting change
- The PM liked the old contractor
- Firm Fixed Price
- Payment turnaround time to the contractor
Q2: Have I identified the root cause(s) of my risk potential?
By identifying the root causes of risk potentials the PM and the project team will be able to better understand their differences. Each risk will more than likely have one or more root causes. What happens is the PM or the project team will soon find that they are unable to mitigate the obstacle because they have not identified a risk that is tied to the project deliverable. Let me give you an example that I give my project teams to help illustrate this point. Let us say you are scheduled to have major surgery next month and one of the project deliverables is a pre-surgical appointment that you have to be at in order to facilitate the surgery. The main deliverable in this case is the surgery. One of the sub deliveries in this case is the appointment that you have to attend. So the risk for the main deliverable is not being able to have the surgery. The risk to the sub delivery is not completing the surgical appointment. For the sake of understanding we are only going to talk about the surgical appointment sub-deliverable.
So a root cause of the risk potential for not completing the surgical appointment could be: weather-related for instance, ice on the road, the car slipping on ice, being late to the appointment due to inclement weather, etc. If as a PM or project team member you identify the risk as ‘the ice on the road,’ your next step would be to go down the path of putting together a mitigation strategy for the cause and not the risk itself. The time wasted on mitigating a cause rather than the risk is why most project risk programs start out with good intentions, but soon become over-extended, over-bearing, time-consuming, ineffective, and finally ignored. In this case weather or weather-related events such as the ice is not the risk because the ice on the road is not tied to the sub-deliverable of completing this preoperative appointment. Again, the risk is not completing this preoperative appointment in order to support the larger deliverable of having the surgery. Ice on the road is only one of the possible CAUSES of the risk potential not the risk itself. Learn how to differentiate between the cause and effect in identifying your risks.
By ensuring that you have identified the true risk by understanding the risk is tied to the deliverable you will in turn better be able to identify the cause or causes of the risk. If you try to mitigate ice on the road you will be “spinning your wheels” going down the wrong road. The PM needs to understand that the mitigation strategy needs to be to reduce the risk itself and not cause(s). For instance mitigation strategy could be in this case to leave earlier in the day to allow more time due to the root causes of ice being on the road.
Q3: Have I identified the trigger for each root cause behind my risk potential?
By understanding the actual risk potential and the true causes of these potentials, the PM and the project team members will now be able to identify risk triggers for each of the causes. Many PM and project team members really struggle identifying risk triggers because they have identified the wrong risk potential or classified risk causes as the potentials. Let us go back to the risk potential of not completing the pre-operative appointment due to possible ice on the road. If the PM and the project team identified ice as the risk potential the then they will likely identify the wrong trigger and more than likely miss the real triggers that turn the risk into an issue. This is why many teams have multiple risks triggering because they had not identified the true risk potential nor identified the correct triggers.
Q4: Can I identify the correct mitigation steps (within my project’s control) for my risk potential that will reduce the potential impact to my project FFU deliverable?
We have briefly talked about risk potentials that are internal and external to our projects. Internal risks of those risks in which the PM and the project team have some control over the mitigation strategy put into place. External risks are those risks in which the PM or the project team have little or no control within their project to do anything about reducing the potential risk’s impact to their project. We call these risk potentials: systemic. For instance the above mentioned blogger spoke above about security clearances as a risk potential. Identifying security clearances as a risk potential the PM has identified an obstacle in which the PM has no control over mitigating. This particular obstacle of not having security clearances for project team members should actually be escalated to government program management team. So to correctly identify risk potentials for our project, we must return to the project deliverables and what will hinder us from completing these deliverables as ‘fit-for-use.’ This also includes identifying the correct causes, effects, and triggers of now properly identified and deliverable-associated risk potentials. By going through this process the PM and the project team members should be able to identify specific steps within the project’s control authorizations to mitigate the impact of these risks to the projects FFU deliverables.
Having worked at the program level where I managed the risk environment for 12+ programs to include well over 128 projects I have found the above mistakes to be common with most PM and project teams. As most project management methodologies do not break down how to truly identify risk potentials, the root causes, and risk triggers, these concepts I have discussed in this article will need to be studied in detail so you will not go down the path that most PMs and project team members tend to transit when it trying to identify the risk potentials.