Still Using Spreadsheets for Managing Risks? – Switch to Risk Management Software

Managing risk is essential in every organization to accomplish its key objectives effectively. Risk management not only requires a reliable process to capture risks, but also needs a mechanism to document and administer the organization’s response.

An appropriate risk management tool always helps the risk managers to identify, assess, and prioritize the risks which can be prevented. Here, we will discuss about spreadsheets – commonly used risk management tools and their true costs. We will also know about the best tool to replace spreadsheets for effective risk management.

Spreadsheets are commonly used management tools because they are
• Convenient to use: Many people believe that spreadsheets are convenient to collect, code, sort and analyze data. Yes, they are better than paper based management systems, but they are risky.

• Flexible to enter data: With some basic encoding, spreadsheets offer flexible arrangements of rows and columns to enter data. They allow the user to configure and enter information in a way that suits his unique needs. But risk management involves analysis of various factors and a spreadsheet may not be helpful.

• Low cost or free option: Spreadsheets are either available as freeware or at low-cost. That is why organizations use them extensively. But they fail to understand the fact that the true cost of a tool should be defined by the operational costs that affect the business on long-run; not by the initial cost of the tool.

Are they really beneficial?
Many business owners and risk managers today are using spreadsheets as risk management tools unaware of the risks involved (however some are aware). Here are the risks involved:

• Inability to process huge amounts of data: Although spreadsheets are a good solution for small volumes of data, the processing and calculation will become complicated with the continual growth.

• Time consuming: Risk management requires collecting great deal of information, which often results in huge number of spreadsheets interlinked to each other. A little change to the data structure becomes a great task. This makes risk managers spend countless hours validating data, double checking formulas, and updating values, which is as a time-consuming process.

• Complex to find mistakes: It is quite difficult to find mistakes in a spreadsheet with lot of data. It is often time consuming process to find where exactly the mistakes have occurred.

• Limits the depth of risk analysis: With each change made to a spreadsheet, links between the information are lost making it difficult to analyze relationships over time. Without these links, it becomes tough to link risks and their controls. Also they offer limited access to past and current data making it difficult to compare data overtime.

• Intensive labor: The process of risk management involves continuous updating of data and it increases day by day. Updating data and using spreadsheets effectively requires lot of time and effort. So intensive labor with good knowledge of using the shortcuts and formulas is compulsory.

• Lacks security: A user can accidentally or intentionally delete vast amounts of critical information. Spreadsheets are highly vulnerable to virus attacks, hard disk crashes, and other unexpected disasters.

Underlying costs of using spreadsheets
In general, people think that spreadsheets are free, but they never calculate the underlying costs that can impact the business. Following are the true costs of using them.

• Labor costs: As discussed earlier, it takes lot of effort to create, maintain, organize, and report using spreadsheets. However, the fact that these things require labor, which in turn results in huge costs to the company, is often ignored.

• Opportunity costs: Spreadsheets consume lot of your time and effort, which you can productively use for adding value to the organization. Many business owners, in fact, lose many opportunities hanging around with spreadsheets.

• Risk and non-compliance costs: Spreadsheets lack in company wide visibility, accountability, security and control which results in increased costs in terms of failed audits, unforeseen events, increased insurance costs and so on.

• Scalability costs: A small company can manage and use one spreadsheet to track all records. But as the business grows, the effort of maintaining and consolidating these records increases exponentially. At one point this process fails and negatively impacts the business.

• Human error costs: Spreadsheets are vulnerable to manipulation, which can dramatically impact the company. Moreover, with the increasing chances of human errors, it is difficult to consider that the data is valid and reliable. These human errors can cost a lot to the company.

Effective tool to replace spreadsheet – Risk Management Software
After seeing all the risks and costs involved with spreadsheets, one would certainly ask for a better tool to manage risks and here is the solution – the Risk Management Software. It can effectively replace spreadsheets in the risk management process. Following are the benefits of using risk management software.

• Effective control over GRC processes: Risk management software helps in the effective control over the GRC (governance, risk management, and compliance) processes with proper documentation and work flow. They also help managers in risk assessment and analysis, visualization and reporting.

• Data security: User can limit the availability of data by creating passwords. He can also give full access to all the data to a particular group of people within the organization. This feature eliminates the risk of manipulation of data.

• Real time recording: Recording and updating information regarding risks is easy using this software. You need not spend hours to update the data.

• Reliable audits: This software offers full protection to all the data in the system with fully automated backups. This allows auditors to extract robust and reliable audit trails without unnecessary effort and thus it helps them in identification of risks, and creation of risk management strategies.

• Automated risk reporting: It provides the user with clear information on their objectives and risks associated. It also informs about the required actions and scheduled dates to implement them to prevent risks.

• Clear and consistent reports: A unique feature of this software is that it provides clear and consistent reports making it easy for managers to view the risks in real-time.

How to choose effective risk management software
With growing demand of the risk management software, many companies offering this software evolved in the market. Therefore it is important to choose the effective one to reap the maximum benefits. Following are some tips to choose a good one.

• Reputed vendor: A well established and experienced vendor definitely offers standard products as he fully understands risk management standards.

• Maximum features: Before buying the product, make sure that it has all features to help you in managing the risks properly.

• Customer service and tech support: As this product is new for the organization, it is important to choose a company that offers 24/7 tech support and timely customer service. Moreover, as risk environment demands a constant change of compliance, make sure that the vendor is offering regular product updates and maintenance releases.

An upgrade in the existing technology never says that the existing product is of no use, instead offers the user with more useful features. Upgrading to latest tools like risk management software enhances the organization’s capabilities in managing risk.

Risk Management In Film

In the film industry, Risk Management Plans covering Occupational Health and Safety do exist and must be put in place for every film made in order to conform to legislative requirements. However, because I was unable to obtain any Risk Management Plans for a film which covered other types of risk, it is impossible to know whether Film Studios actually use them other than for Occupational Health and Safety.

When we think of Risk Management in any business, even though very important, we are not just referring to Occupational Health and Safety, we are also considering any other kind of risk associated which has implications on the business itself. The list of risks can be many depending on the context and setting of which the film occurs.

In the film-making process, the setting or environment in which the film occurs can drastically change, causing various risks to befall a production, some risks which may be familiar and others which may have never been dealt with before. In film, this means there are many, many risks which can occur on a production.

When one thinks about how many films are made each year, it would mean film-makers constantly deal with a high turnover of risks, risk which are complex and can vary, depending on the film itself. This actually means that film-makers themselves are Risk Management Experts in their own right because they are not just constantly dealing with risks, they are dealing with risks which constantly change.

Indeed, the utilization of ‘risk benefit’, especially when it comes to stunts and action sequences is extremely heightened, all in the name of the thrill seeking audiences and the money to be made from them.

If Film is one of the highest risk industries, the fact that they travel the globe and visit many communities, shouldn’t they then be obligated, to let communities know, in detail, what’s going on in their own back yard so to speak?

Often in our community or local area, when an apartment complex is going to be built or construction takes place, more likely than not, those in the neighborhood would receive information from the council detailing the exact building plans where the community is consulted. On the contrary, when a film is made in a certain area, town or country, more often than not, film production companies do not provide the exact details of the dangerous activities that may be involved, to the people in the community, often these activities posing much more of a threat than the construction of a building.

The film industry will not communicate and consult with the community in exact detail, because this would simply run a risk of letting their competitors know their plans. Even though fire and explosions are controlled to a certain extent, these dangerous elements are still present and there is always a risk when dealing with these elements no matter how controlled.

This is an example of a reason not to communicate or consult but sometimes at the expense of ethical and moral values, where members of the community are oblivious to exact details, when they should be in fact more informed.

In fact there are many kinds or risk in film and it’s ‘sister’ industry television which breach ethical and moral standards, for example, one only had to look at the numerous times journalists and camera crew, risk their lives in a worn torn or volatile country to secure a story for a major news station.

In film, every time a stunt person performs a stunt, no matter how controlled the stunt, the risk is still high, if a stunt person dies, the film will still go ahead because the stunt person is considered expendable – here we see an extreme case of Risk Benefit utilizing death in exchange for the immortality of the Stars presence and the success of the film. The only other industry I can relate to similarly, which incorporates a similar view is the military or Special Forces.

Considering how risk plays such a big part in film, it’s quite surprising that the subject of Film and Risk at present is a very much neglected by most academics and scholars today which is why I decided to take up this subject as part of my study in Risk and Project management. In regards to the film industry and these topics I came across a knowledge gap. Here are some of the issues I encountered while studying the subject:

- I could not locate or find any sufficient examples of the Project Management Model being applied to the film-making process, even though it’s quite easy to apply when considering the processes the film industry uses.

- On the internet there are many ‘Risk Management Plans’ for a variety of different industries however, for the Film Industry, there was not one example.

- ‘The Australian Film and Television Industry Safety Guidelines’ (144 page document) has been in ‘Draft’ format for 10 years. There are so many Safety Considerations to consider not all of them can be accounted for.

- My local Paddington, Sydney Library had no books or published material on the topics of Risk or Project Management in Film. Both of these areas extremely applicable and valid to the film-making process, one marvels why the lack of information.

- The Australian Film Television and Radio School Library at Fox Studios, despite the enormous collection of books on film-making, again there were no books on either of these topics of ‘Risk Management’ and ‘Project Management’. Both librarians I consulted were baffled and surprised at finding the knowledge gap when I had asked for information on the topic. They believed they had everything there is to find on film-making in their library, however they did not have what I was looking for, perhaps one of the most important things there is to read about in film.

- On top of that, not many professionals in the industry are willing to talk about their work and government bodies like Screen Australia, are not interested in providing examples of ‘Risk Management Plans’ used on previous films because of ‘privacy’ reasons. I consider this excuse quite poor, since many Project Management and Risk Management students, on most cases, easily ask their industry type for a copy in which it will gladly be provided – in the film industry it is quite closed and unhelpful, well at least in Australia that seems to be the case.

There was one rare instant, while I was studying this topic, in which a lady whose name and ex-employer I won’t mention, was resigning from her job and she forwarded me a small example of a ‘Risk Register’ for a film production. I am very grateful for this information. After viewing the Risk Register I realized, as suspected, that it indeed was very much the same kind of ‘Risk Register’ you would use in ANY business type. Sometimes I find all the secrecy in film unnecessarily!

During my research I created a blue, yellow and grey model based on my own understanding of how the Risk Management Process, the Project Management Process is entwined within the Film-making Process.

Even though the environment/setting of every film changes, there are still certain key aspects of Risk to consider, which are relevant for every film.

Even though Risk and Project Management aren’t widely taught at film school, it should be because it actually adds, in a significant way, to a student’s mind, a much better and wholesome understanding and awareness of risks in their industry type, this also adding to a better management and handling of risks overall. Most learning facilities teach their students a widely understood awareness of risk principles applied to their industry type, the film industry should also do the same for the students and filmmakers.

Most people would agree that the film industry is shrouded in secrecy, mystery, exclusivity giving us the impression that the way they run is very different and unique. Through my research I would like to point out that exclusivity and uniqueness is not the case, and that the film industry is just like any other business in the way that it runs and the processes that it uses, only that, when it comes to risk, they may be the biggest risk takers of them all.

Strengthening the CFO’s Role in Strategic Risk Management

Strengthening the CFO’s role in strategic risk management to lead Capital intensive business in market volatility

Capital Intensive Businesses

Capital-intensive business exists with lower margins. Management is always expecting Return on Capital Employed (ROCE) above the cost of capital. The major businesses are Oil & Gas, Infrastructure, Construction, IT etc.

Market Volatility Challenges

Market volatility, ceaseless pressure on margins and demanding stakeholders increase the difficulties of thriving in an increasingly interconnected, interdependent and unpredictable global economy.

Many organizations have yet to adapt to this new state of the economic landscape. Doing nothing is no longer an option – they need to adjust and take action now.

Many organizations are now transforming their businesses to strengthen their organization to save costs, create more client-centricity, restore stakeholder confidence and/or embed new business models.

For many organizations, long-term success depends on the success of these transformation programs. To make it more challenging, the margin for error continues to be small, and the environment in which transformation needs to happen continues to increase in complexity.

Strategic Risk Management

• It’s a process for identifying, assessing, and managing both internal and external events and risks that could impede the achievement of strategy and strategic objectives.

• The ultimate goal is creating and protecting shareholder and stakeholder value.

• It’s a primary component and necessary foundation of the organization’s overall enterprise risk management process.

• It is a component of Enterprises Risk Management (ERM), it is by definition effected by boards of directors, management, and others.

• It requires a strategic view of risk and consideration of how external and internal events or scenarios will affect the ability of the organization to achieve its objectives.

• It’s a continual process that should be embedded in strategy setting, strategy execution, and strategy management.

Identifying concrete steps for CFOs to increase involvement in risk management for investment decisions

Concrete Steps to Increase the CFO’s Involvement in Risk Management

• Build a tight link between risk management and other Business Process

• Lead a corporate-level discussion of Risk Preference, Focusing on Risk Choice and select optimal mix

• Use Risk Analytics to communicate investment and strategic Decisions

Build a tight link between risk management and other Business Process

• Focus on foresee issues which will emerging in the future instead of current issues.

• On the basis of prioritization a guidelines to be issued for which Business performance metrics would be effected.

• Business Planners conduct adhoc analysis of upside versus risk, focusing most, if not all, of other attention on a single “Center Cut” scenario.

• Highlighting exactly where and how risk will affect the Business Plan

• Incorporating systematic stress testing using macro scenarios which will reflects possible impact on financial planning

• Applying probabilistic “financial at risk” modeling for major investment decision these efforts. (Cash in hand vs cash needs)

Lead a corporate-level discussion of Risk Preference, Focusing on Risk Choice and select optimal mix

• It is critical to have clear answers to the following questions before making decisions:

o What is the company’s competence in the market?

o Are the decision makers familiar with the risks involved including the tail risks and understand their potential impact?

o Is the company capable of surviving extreme events?

• Risk appetite articulates the level of risk a company is prepared to accept to achieve its strategic objectives.

• Risk appetite frameworks help management understand a company’s risk profile, find an optimal balance between risk and return, and nurture a healthy risk culture in the organization. It explains the risk tolerance of the company both qualitatively and quantitatively.

• Qualitative measures specify major business strategies and business goals that set up the direction of the business and outline favourable risks.

• Quantitative measures provide concrete levels of risk tolerance and risk limits, critical in implementing effective risk management.

Use Risk Analytics to communicate investment and strategic Decisions

• CFO plays an important role in financial and strategic aspects of investments and the evaluation of major decision. He leads the discussion and rival proposals and solutions and often hold powerful decision rights.

• Major Projects with value at stake comparable to total risk from current company operations are discussed and decided with qualitative list of major risks.

• The CFO is ensuring by defining right set of core financial and risk analytics to run for each option to ensure this value stake is brought to light and debated.

EXAMINING LEADING PRACTICES APPLICABLE TO CFOS THAT CAN AUGMENT A COMPANY’S FINANCIAL HEALTH

Best Practices applicable for Company’s Financial Health

CFO have several options to compete more effectively in the Risk Management decisions. Improving returns starts with rethinking where to play-and with four strategic steps that many companies often overlook when it comes to improving performance.

Where to play: A more profit-focused portfolio

• The most pressing issue for leadership teams in capital intensive industries is whether to stay in businesses in which margins have been relentlessly driven down. Many companies are choosing to exit low-profit businesses that once were considered to be core. As they rebalance their portfolios, they are migrating up the value-added chain, investing in related sectors where new technologies can provide competitive advantages.

• Profit pool mapping is an important tool for assessing whether and where it makes sense to do business. In heavy industries, management teams often are so focused on volumes and tonnage that they overlook where the biggest profit pools are. By understanding the sources and distribution of profits across their industry, companies can gain an inside edge on improving returns.

• The premium end of the business typically represents a very large proportion of the profit pool. The best opportunities often cluster there for companies competing in capital-intensive industries.

• Picking the right place to play in the value chain is also critical to improving returns-and the most profitable spot varies across industries.

Best Practices applicable for Company’s Financial Health How to win: Four strategic steps to improving returns

1. Improve the cost base and review capex continually -

• In capital-intensive industries where low returns have become endemic, reducing costs and improving capex efficiency are important ways to improve performance – New developing market entrants in capital-intensive industries have built a strong competitive advantage by keeping capex relatively low. By contrast, the focus on cutting costs at many established players means they sometimes lose sight of improving capex. One way to get the balance right: Develop a more disciplined approach to managing capex, and benchmark the company’s performance against the industry’s leaders.

• Cost discipline makes a critical difference. One-time efforts usually fail to deliver savings that stick, as our research shows. One explanation is that in tough times, management teams are quick to cut costs, but when the cycle swings up, they tend to take their eye off cost improvement and focus on growth-related priorities.

• Developing a rigorous approach to cost improvement and nurturing the right capabilities to optimize working capital can help capital-intensive companies outperform.

2. Build the lowest-cost position

• Geography is another key factor for improving returns. Investing in geographies that offer the lowest landed cost position can create a strong competitive advantage. It’s particularly important in asset-heavy industries where the one-time cost of closing and moving businesses is high.

• The best-performing firms revisit their geographic footprint regularly, as cost dynamics are constantly evolving.

• Companies that can choose the lowest-cost geography up front gain a competitive edge. Those in mature industries need to weigh the short-term downside against the longer-term benefits of reducing complexity.

3. Use mergers and acquisitions strategically

• Smart acquisitions can help improve performance significantly, but many companies get off to a bad start by investing at the top of the cycle, when prices are at their peak, simply because that’s when cash is available. Leadership teams that take a strategic, disciplined and long-term approach to M&A instead of a tactical and episodic approach can improve returns significantly.

• Companies that nurture M&A as a core competence derive the greatest value from them. Their leadership teams devote time to developing a structured roadmap of the most attractive potential targets, making it easier to acquire assets when the right opportunity comes along-and to target acquisitions at the bottom of the cycle.

• Companies that are most experienced in M&A build their capabilities over time. They search hard for merger or acquisition candidates that will add to their operating profit and fuel balanced growth. They pursue nearly as many scope deals as scale deals, moving into adjacent markets as well as expanding their share of existing markets. Most importantly, they create Repeatable Models for identifying, evaluating and then closing good deals. What they typically find is that there are plenty of good prospects to be pursued and that the risk involved decreases with experience.

4. Service ace

• For traditional capital-intensive industries, service can be a highly profitable business in its own right, generating better and faster return on investment than new production facilities, large-scale R&D programs or acquisitions.

• Indeed, for many industrial manufacturers, investing in service is the only way to sustainably grow profits in a tough economic environment. Investing in a service business also lowers capital intensity.

• Investing in a world-class service business can become a strategic ace, elevating a company above competitors in an environment where differentiation on products and cost is difficult to achieve. The range of service opportunities, some larger than others, will vary by industry and company. Here again, mapping profit pools can help identify the potential size of service businesses and those with the greatest returns.

o There is no question that companies in capital-intensive industries operate in a difficult environment today. But leadership teams that commit to a bold ambition have opportunities to break away from the pack and achieve double-digit returns significantly above the cost of capital.

Best Practices applicable for Company’s Financial Health-Getting there requires a strategic shift toward a more profit-focused portfolio:

• Find the most attractive profit pools in your businesses.

• Adopt a mindset of continual cost improvement and capex optimization.

• Look for opportunities to drive down the company’s landed cost footprint by investing in the right geographies.

• Develop strong in-house M&A expertise and a structured roadmap of potential deals.

• Invest in related service businesses

Leadership teams that take these steps will not only give returns a powerful boost, they also will help to rebuild competitive advantage and position their companies to win in a changed industrial landscape.

Reengineering Strategies to improve the link Between Risk Management and Business Planning Process

• Business process reengineering is one approach for redesigning the way work is done to better support the organization’s mission and reduce costs.

• Reengineering starts with a high-level assessment of the organization’s mission, strategic goals, and customer needs.

• Within the framework of this basic assessment of mission and goals, reengineering focuses on the organization’s business processes–the steps and procedures that govern how resources are used to create products and services that meet the needs of particular customers or markets.

• Reengineering identifies, analyses, and redesigns an organization’s core business processes with the aim of achieving dramatic improvements in critical performance measures, such as cost, quality, service, and speed.

• Reengineering recognizes that an organization’s business processes are usually fragmented into sub processes and tasks that are carried out by several specialized functional areas within the organization.

• The CFO Act focuses on the need to significantly improve the government’s financial management and reporting practices. Having appropriate financial systems with accurate data is critical to measuring performance and reducing the costs of operations

Management & Decision Support Structure

• Investigate suggestion for reducing costs and to make them practical and acceptable

• Obtain definite prices and costs

• Present recommendation in comprehensive report

People & Organization

• Organize around outcomes and not tasks

• Have those who use the output of the process perform the process

• Built control in process systems

• Treat geographically dispersed resources

Policies & Regulations

• Develop policies and procedures

• Comply with compliances

• Environmental compatibility

Information & Technology

• Information should go along with the process

• Link all activities

• Capture information at source

• Create reports and real time online updates

Frame for Assessing Reengineering

• Assessing the Organisation’s Decision to Pursue Reengineering

• Reassessing of Its Mission and Strategic Goals

• Identifying Performance Problems and Set Improvement Goals

• Engagement in Reengineering

• Assessing the New Process’ Development

• Appropriately Managing of Reengineering Project

• Analysis of the Target Process and Developed with Feasible Alternatives

• Completion of Sound Business Case for Implementing the New Process

• Assessing Project Implementation and Results

• Following a Comprehensive Implementation Plan

• Executives Addressing Change Management Issues

• New Process Achieving the Desired Results

FOCUSING ON RISK PREFERENCE AND CHOICES FOR CFOs CONSIDERATION TO DELIVER ECONOMIC PROFIT DURING TOUGH CONDITIONS

CFOs need to develop a stronger focus on the economic and performance drivers of their business and need to understand how the effective allocation of scarce resource will help them achieve financial objectives. The CFO must build a performance management capability that can:

• Provide visibility and analysis of information to support resource allocation

• Support the decision-making process by providing the right information to the right people at the right time

• Demonstrate the financial impacts of different decisions and scenarios to enable the organization to predict and compare outcomes

• Incentivize executives and managers to make decisions that maximize marginal contribution

• Enable a data-driven view on resource allocations across the entire value chain (to include corporate strategy; sales, marketing and customer service; supply chain manufacturing and production; finance, HR, legal and compliance)

• Identify the most critical decision points that drive economic performance

With a unique perspective across the entire business, CFOs can provide valuable insight into the decisions that create or protect marginal contribution across the value chain. Armed with a detailed understanding of how and where growth in sales leads to growth in profits, they can offer an objective assessment of fixed and variable costs, and then identify how a reduction in costs can maintain revenues while improving profit contribution.

• Establish a clear, forward-looking line of sight on relevant data for critical decision points

Finance must have access to a robust data set, built around the decisions that drive most economic value in the organization, including assessment of opportunity cost. This demands accurate, verifiable underlying data and an understanding of how the data relates to value chain decisions. This will enable the CFO to conduct scenario planning around these different decision points.

• Develop aligned performance management processes that drive rational decisions

Finance must be able to translate insights and understanding into the desired end product – rational decisions that maximize the desired economic return. Aligning traditional resource allocation processes with business objectives helps ensure repeatability and the sustainability of the organization.

Risk Management on Projects

Project Risk Management

How does project risk management differ from any other type of risk management? Well in most regards it doesn’t. However, as this is a project focused activity it helps simplify the overall focus by looking only at the core project fundamentals of scope – which are cost, quality and time. Remember that, I may test you later!

There are a number of good training videos available on YouTube that cover this principal. I’ve added a couple below to help bring home the point of this article. I find watching a presentation often easier to take in than reading some else’s thoughts.

Project Risk Management

So what is project Risk Management is all about? In an earlier article I talk about what risk and risk management are about. If you are still confused about what risks are and what risk management is about then read this article, it should bring you into the picture. On projects we talk about risk as any event that could cause an unplanned change to the projects scope – i.e. impact the project costs, timeline or quality of the deliverables, or any combination of the three.

What isn’t always obvious when talking about project risk management is that we also need to consider the positive impact a risk may have on a project – i.e. reduce costs, decrease the time line or increase the quality of deliverables. In reality it’s not very often that project risks present positive opportunities. Never the less, as project managers we have a responsibility to recognize and act on these risks positive or negative. That’s Project Risk Management.

David Hinde wrote a good article back in 2009 about using the Prince 2 Risk Management technique. Without getting imbedded in any particular methodology, the general approach to project risk management should follow a similar framework and this is as good as any for the purpose of this article:

David talks through a Seven Step process,

Step 1: Having a Risk Management Strategy

This means setting up a process and procedure and getting full buy-in from stake holders in how the organization will manage risk management for the project.

Step 2: Risk Management Identification Techniques

Where do you start in the identification of risks around a project? There are many risk management techniques and David suggests a few which are excellent. However, I like to take a step back and make a list of all the critical elements of a project on the basis of “if this task doesn’t happen will it be a show stopper?”. This helps be build a prioritized list of critical tasks against which I can then consider the risks – what could go wrong to impact this task.

Here’s my thought process on risk identification outlined:

List out critical deliverables
List out, against each deliverable, dependent tasks
List out against all dependent tasks and critical deliverables “any” potential event that could delay or stop the delivery to plan.
Grab a template risk analysis matrix and complete the first pass of assessment – probability v impact for each risk.
Take it to a project meeting and use it as the baseline for brainstorming.

Step 3: Risk Management Early Warning Indicators

Don’t rely on basic performance of the project as an indicator that everything is going well. Status reports showing a steady completion of tasks could be hiding a potential risk.

In risk management a number of other factors need to be on the project managers radar on daily basis. Things that I always look for are delivery dates from vendors – how confirmed are they, is there a movement in delivery dates (you’ll only see this if you regularly ask for confirmation updates from the vendor), resource issues – key individuals taking sick leave or personal leave more often than normal.

Delays in getting certain approvals signed-off by the steering committee or other governance bodies – will this impact orders going out or decisions being made on critical tasks? Getting qualified people in for inspections and certification (new buildings for example require a lot of local regulatory inspections). These are just a few of the daily challenges a Project Manager will face and all can be indicators of trouble to come.

As you gain more experience in risk management you start to instinctively recognize the early warning signs and challenge the culprits earlier in the process. You’ll also finds the a good project manager will build-in mitigation for the common project ailments at the very start, sometimes seeing the tell-tale signs when selecting vendors or suppliers will be enough to select better alternatives and this is what I call dynamic risk management at work.

Also keep an eye on the world around you – economic or geological events elsewhere can have a dramatic impact on local suppliers and supplies of key project materials. For example, flooding in Thailand has impacted the delivery of various computer components that are manufactured there, causing impact in both supply lines and pricing. (Yes, I work in Asia so see this type of impact first hand..)

Step 4: Assessing the Overall Risk Exposure in Risk Management

Taken directly from David’s article as he says this quite clearly – “PRINCE2 2009 gives an approach to show the overall risk situation of a project. Each risk is given a likelihood in percentage terms and an impact should it occur in monetary terms. By multiplying one by the other an expected value can be calculated. Totaling the expected values of all the risks gives a monetary figure that easily shows the exposure of the whole project to risk.”

There are many similar ways I’ve seen risk calculated in organizations variations on risk management. Â As long as there is a common approach for showing all risks, prioritization and impact on a project then risk management will work and add value in protecting the investment in the project. Each project and each organization will have their own requirements in terms of how they want to see risks analysed and presented. By and large it doesn’t matter how this is done, as long as it IS doesn’t and it makes sense in the context of the project and organization. There are risk management tools to help organise and manage this.

In another article I’ll talk more about the Risk Management matrix and show a few examples. In my mind the only wrong way to do this is to not do it at all.

Step 5: Considering the Effect of Time on a Risk and Risk Management

The effect of time when analyzing risks is that the more imminent a risk the higher priority it may take. I say “may” as it may be that a very low priority risk with low impact may be about to happen where as a higher priority risk may be weeks or months away. How do you manage this?

Common sense (of which there is no such thing) would suggest that if the higher priority risks are still a long time away then the imminent lower priority risks should be dealt with first, as a higher priority..? Perhaps?

You’ll have to take a pragmatic view on this, every situation needs to be taken on its merits and in risk management, not being an exact science, you’ll be expected to make judgment calls and discuss options with your client and project board or steering committee. After all, the governance board of a project has a responsibility to steer such decisions so the role of a good project manager should be to collate the facts and present the data with recommendations. Let the higher paid guys make the big decisions.

Step 6: Giving a Clearer Approach to Help Define Risks in Risk Management

David gives an example in his article which I’m struggling to relate to the world of projects as I know them. I think essentially what this focuses on is the “mechanics” of the risks in such a way as to help us understand and look at the cause and effect of scenarios that could lead to the risk happening.

In this way we can focus on the lowest common denominator(s) that will generate the risk and mitigate those items. Is that a little confusing? The principal is, I believe to nip the problem in the bud by recognizing what or where the bud is. Don’t get hung up on this, I would say this is something you’d tend to do naturally as you gain experience in reviewing risks and dealing with risk mitigation (prevention).

Step 7: Focus on Opportunities in Risk Management

Finally – and last but not least, where can we make or recognize risks as opportunities. An example David talks about suggests that, for example, a new release of a software product that would offer major benefits if included in the project would be a possible “positive” risk.

This I can relate to more, with the experience of being asked to change the specification on a traders dealing system half way through a major project because the manufacturer had released a major systems improvement, a completely new model, that the bank saw as a strategic advantage.

The analysis of this risk covered the obvious change in costs, the new system was more expensive, the implementation was zero impact compared to the older system however there was a large element of re-training the trading staff and proving the system for the bank before go live. This became the biggest challenge once the cost differential had been signed-off by the project board.

The additional training time required was squeezed into evenings and weekends so the final project delivery schedule was not impacted – but getting vendor and project resources to support the additional work and making sure the system was fully functional and supported operationally when the new facility went live, added cost and stress that hadn’t been anticipated. This is where risk management and change management overlap – a topic for another article.

The client was happy with the result and additional investment made. Simple risk management gets the job done.