2-D Risk Management
StumbleUponA research project by Peter Kulik investigating how organisations perceive risk management's value included two very interesting questions. Firstly "How important is risk management to project success?" And secondly "How effective is risk management on your projects?"
Risk Managment: Important Or Effective?
By David Hillson
Two years ago a research project by Peter Kulik investigated how organisations perceive the value of risk management. The survey addressed a number of different aspects, but two questions were particularly interesting.
[ Register and post your own comments on this article below... ]
The first question asked “How important is risk management to project success?”, with possible answers chosen from extremely important, very important, important, somewhat important, not important. The second question asked “How effective is risk management on your projects?”, with answers ranging from extremely effective, very effective, effective, somewhat effective, or ineffective.
Of course the raw data was interesting in itself, but the correlation between answers to these two questions was fascinating. If the answers to each question are simplified into two options (positive or negative), then there are four possible combinations :
1. Risk management is important and effective
2. Risk management is important but not effective
3. Risk management is not important and not effective
4. Risk management is not important but it is (somehow) effective
Perhaps the fourth combination is not really feasible, since it would be unusual for risk management to be effective if the organisation does not consider it to be important. Indeed if it is viewed as unimportant it might not be done at all. But the other three combinations represent different levels of risk management maturity, and organisations in each of these three groups might be expected to act in very different ways.
Where risk management is seen as important and it is also effectively delivering the promised benefits (Combination 1), those organisations could become champions for risk management, demonstrating how it can work, and persuading others to follow their lead. These risk-mature organisations might be prepared to supply case studies and descriptions of best-practice, allowing others to learn from their good experience.
If an organisation believes that risk management is important but is not finding it to be effective in practice (Combination 2), then they should consider launching an improvement initiative to benchmark and develop their risk management capability. Tackling the Critical Success Factors (CSFs) for effective risk management will lead to enhanced capability and maturity, allowing the organisation to reap the expected benefits. Key CSFs include a risk-aware culture, efficient processes, experienced and skilled staff, and consistent application, among others.
It is not surprising that risk management is ineffective in organisations which believe that it is unimportant (Combination 3), as it is not possible to manage risk effectively without some degree of commitment and buy-in. These risk-immature organisations should be persuaded and educated about the benefits of risk management to the business – a task best performed by convinced insiders who can show how proactive management of risk could be applied to meet the specific challenges of the organisation.
It is a good idea for every organisation to review its position on risk management against the two dimensions of importance and effectiveness, and to take appropriate action to move up the scale of risk management maturity. Risk management offers genuine and significant benefits to organisations, their projects and their stakeholders, but these will never be achieved without recognition of the importance of managing risk at all levels in the business, matched with operational effectiveness in executing risk management in practice.
[ Register and post your own comments on this article below... ]
--------
To provide feedback on this Briefing Note, or for more details on how to develop effective risk management, contact the Risk Doctor (info@risk-doctor.com), or visit the Risk Doctor website.
About the author:
Dr David Hillson PMP FAPM FIRM MCMI is an international risk management consultant, and Director of Risk Doctor & Partners (www.risk-doctor.com). He is a popular conference speaker and award-winning author on risk. He is recognised internationally as a leading thinker and practitioner in the risk field, and has made several innovative contributions to improving risk management. His recent emphasis has been the inclusion of proactive opportunity management within the risk process, which is the topic of his latest book.
By David Hillson
Two years ago a research project by Peter Kulik investigated how organisations perceive the value of risk management. The survey addressed a number of different aspects, but two questions were particularly interesting.
[ Register and post your own comments on this article below... ]
The first question asked “How important is risk management to project success?”, with possible answers chosen from extremely important, very important, important, somewhat important, not important. The second question asked “How effective is risk management on your projects?”, with answers ranging from extremely effective, very effective, effective, somewhat effective, or ineffective.
Of course the raw data was interesting in itself, but the correlation between answers to these two questions was fascinating. If the answers to each question are simplified into two options (positive or negative), then there are four possible combinations :
1. Risk management is important and effective
2. Risk management is important but not effective
3. Risk management is not important and not effective
4. Risk management is not important but it is (somehow) effective
Perhaps the fourth combination is not really feasible, since it would be unusual for risk management to be effective if the organisation does not consider it to be important. Indeed if it is viewed as unimportant it might not be done at all. But the other three combinations represent different levels of risk management maturity, and organisations in each of these three groups might be expected to act in very different ways.
Where risk management is seen as important and it is also effectively delivering the promised benefits (Combination 1), those organisations could become champions for risk management, demonstrating how it can work, and persuading others to follow their lead. These risk-mature organisations might be prepared to supply case studies and descriptions of best-practice, allowing others to learn from their good experience.
If an organisation believes that risk management is important but is not finding it to be effective in practice (Combination 2), then they should consider launching an improvement initiative to benchmark and develop their risk management capability. Tackling the Critical Success Factors (CSFs) for effective risk management will lead to enhanced capability and maturity, allowing the organisation to reap the expected benefits. Key CSFs include a risk-aware culture, efficient processes, experienced and skilled staff, and consistent application, among others.
It is not surprising that risk management is ineffective in organisations which believe that it is unimportant (Combination 3), as it is not possible to manage risk effectively without some degree of commitment and buy-in. These risk-immature organisations should be persuaded and educated about the benefits of risk management to the business – a task best performed by convinced insiders who can show how proactive management of risk could be applied to meet the specific challenges of the organisation.
It is a good idea for every organisation to review its position on risk management against the two dimensions of importance and effectiveness, and to take appropriate action to move up the scale of risk management maturity. Risk management offers genuine and significant benefits to organisations, their projects and their stakeholders, but these will never be achieved without recognition of the importance of managing risk at all levels in the business, matched with operational effectiveness in executing risk management in practice.
[ Register and post your own comments on this article below... ]
--------
To provide feedback on this Briefing Note, or for more details on how to develop effective risk management, contact the Risk Doctor (info@risk-doctor.com), or visit the Risk Doctor website.
About the author:
Dr David Hillson PMP FAPM FIRM MCMI is an international risk management consultant, and Director of Risk Doctor & Partners (www.risk-doctor.com). He is a popular conference speaker and award-winning author on risk. He is recognised internationally as a leading thinker and practitioner in the risk field, and has made several innovative contributions to improving risk management. His recent emphasis has been the inclusion of proactive opportunity management within the risk process, which is the topic of his latest book.
Comments
You must be logged in to comment.