Analyzing risks is not an exact science, as the very essence of risk is uncertainty. A key challenge of effectively managing risks is not their identification, but rather creating sufficient sense of urgency within risk owners such that they appropriately respond to the risks that pose the greatest threat or opportunity.
You may argue that risk identification poses its own difficulties but those generally have to do with ensuring sufficient input into the process and establishing a risk “friendly” environment for discussion of identified risks. If your team has done an appropriate level of planning to this point, then assumptions analysis, review of the WBS, availability of a risk breakdown structure, expert knowledge, risk identification checklists and a review of lessons learned from past projects should provide more than enough grist for the risk identification mill!
I’ll illustrate why I believe that the perception of risk severity is a significant challenge by means of the following analogy. Even the most stubborn jaywalker will acknowledge that their pastime introduces the risk of being run over. However, the argument they you will likely hear if you try to convince them not to jaywalk is that they don’t think they’ll ever be hit or even if they are, they trust their “cat-like reflexes” to minimize their injuries!
This is one of the reasons why safety campaigns sometimes fail – if the focus is on convincing the audience you are trying to influence that there is a risk, you are likely preaching to the converted. In some cases, the very existence of the risk adds some thrill to the activity! Rather, the focus should be on surpassing the the risk tolerance of the individual by figuring out what’s important to them so that they’ll buy into the severity of the risk.
So back to managing projects, how do we create sufficient concern on the part of a risk owner to act, recognizing that if we do too little, they’ll ignore the risk, and if we overwhelm them with data or push the panic button too early, they might accuse us of being paranoid?
Risk owners are often key stakeholders on projects, so if you’ve performed stakeholder analysis earlier in the project’s lifecycle, you’d want to refresh your memory on what is important to them about the project. For some, it might be the expected outcomes, whereas for others it might be achieving certain milestones or keeping the project within budget. If you are able to demonstrate how the risks you’d want them to focus on will either negatively or positively affect their project “hot buttons” if they are realized, they are likely to be more engaged than if they feel their personal interests won’t be affected.
What I’ve found is that once a risk owner determines that a given risk exceeds their risk impact tolerance, they are more likely to ignore the likelihood of its occurrence, especially in the case of negative risks. In such cases try to provide them with sufficient understanding of the risk’s probability (supported by empirical evidence from the current or other recent projects) to help them perform an appropriate cost/benefit analysis on their risk response.
Generating the appropriate sense of urgency from risk owners to spur action can be best summed up through Tony Robbins quote “Where focus goes energy flows“!