Ten Tips for a Management Risk Plan

Whether your project is a new piece of equipment, a new construction, or a new mine, risk assessments are often seen as a necessary evil when it comes to managing and delivering a project. But it shouldn’t be that way. A well run, targeted, efficient risk assessment workshop can provide enormous value to all the participants, the project managers, and most importantly the clients or investors.

As the project manager, your aim is to get the most information, understanding and management of risk possible in the most efficient way – and that means minimising the time and resources required, while maximising the value of the process and the outputs.  To do this requires a specific, practical and experienced approach.

Here’s our top ten tips to make the risk assessments processes for your project  the most efficient and value-adding they can be:

1. Know Your Purpose

Sure, you know you need to “do a risk assessment” because it’s part of the project scope or part of what the client wants, but that in itself doesn’t provide enough direction on what you want to achieve from the process.  The first thing you and your risk facilitator need to understand clearly is why you are undertaking a risk assessment, what you hope to learn from the process, and what risk you are really trying to manage.  Being clear on the aims, objectives and expected outcomes from the process allows the whole team to be pointed in the same direction, and hence work as efficiently as possible. 
   

2. Plan Ahead

Herding all the key people from your project into a single room for a day or two can be as difficult as it sounds.  The date, time and place of your risk assessment workshop should be set as far ahead as possible.  Then all the required attendees should be confirmed and provided with a short overview of what the process is about, what we hope to achieve, and why their attendance is important.  You’ll need to book in your “core team” that will be there for the whole workshop, and your “specialists” who will come in when their specific knowledge is required.  Having the right people in the room is the single most important factor in running a successful, productive and efficient risk assessment workshop.
    

3. Follow ISO31000, but Be Flexible

The international standard ISO31000 provides our overarching guidance on how to appropriately identify, analyse, assess and manage our risks.  The standard, which has now replaced the Australian Standard AS4360, gives excellent detail about the foundations for a proper risk management process, but still allows us to be flexible in our methods.  It’s important that the methodology used in each project is tailored to that project – there can be no one-size-fits-all risk assessment.

4. Pre-Populate

Your risk coordinator can gather a lot of the data required to populate your risk register from documents and information that already exists in your project.  An hour of work by one person prior to the workshop can save ten man-hours of work and time once everyone is in the room (ten people for one hour).  In the workshop the team should be spending their time identifying risks that you hadn’t yet thought of, and developing practical ways to reduce the project risks, not typing things that they already know about into a spreadsheet.

5. Look Deeper into your Controls

In most projects and operations we have pretty much got all the controls we need.  We can list them all into a risk register or spreadsheet, and then ask ourselves whether they are enough to make the risk acceptable.  But this is not enough – we need to take a good look at these controls (or at least the most critical ones) and decide whether they are really working and effective in practice.  Listing a control as existing is not enough, the group must discuss how the control actually works to reduce risk and whether it is adequate and effective in doing its job.
   

6. Focus on Value, not Scores

So much time is spent in risk assessment workshops doing the risk scoring or ranking – for so little value.  The objective of the scoring or ranking exercise should be to get an overall ranking of the risks identified to know are the biggest risks to the project, and which should require the most of our attention. 

The value in a risk assessment is in the risk identification and risk reduction measures – not in deciding between a B3 and a B4.
 

If our risk identification isn’t complete or adequate, then we won’t even apply our risk management skills to the ones we haven’t identified – a risk not identified is a risk not managed.
   

7. Customise your Matrix to the Project

Be specific about what each level of consequence and likelihood means for your specific project.  Define this either before the workshop or at the very start of the workshop.  Project specific definitions for each category of likelihood and consequence make the scoring and risk rating parts of the workshop much more accurate and efficient.
   

8. Don’t Rely on Excel – Think Analogue

Risk assessments love Microsoft Excel – with all it’s tables, formulas and automatic colouring of cells.  But while spreadsheets might be great for capturing the information and scores, they are terrible for people to read and follow when they are projected onto a screen and constantly scrolled up and down.  People think much better when they can see a concise list of what they are talking about.  So get off the computer and use a whiteboard or flipchart for as much of the process as you can.  In particular, the risk/hazard identification stage should always be done “offline” to stimulate as much creative thinking as possible – a risk not identified is a risk not managed.
  

9. Create Great Outputs

Our obsession with Excel also often leaves us with one huge spreadsheet full of information and data from the workshop.  A spreadsheet like this is difficult for everyone to read and use, especially for people who weren’t there.  A thorough risk register / database is important, but it in itself does very little to manage or reduce risk.  What is important is how we use and communicate all that information.  Following your risk assessment workshop, develop a summary of the highlights, and a communication package to get the word out to the entire project team about the highest risks and most important controls. 

Tailor your reports and presentations to your original purpose and to your audience – make the results something that people can really use!
    

10. Use an Industry Experienced Facilitator

The role of a risk workshop facilitator is a lot more than just telling you what the fire alarm sounds like, that you can’t use your mobile, and making sure the right information goes into the right cell on the spreadsheet.  The skills and experience of the facilitator you choose to run your workshop ensures that people stay interested and engaged, and ensures you meet your objectives in the time allowed. 

You must find a facilitator who understands your specific industry, project and challenges.  The facilitator needs to know the terminology you use, the types of hazards and risks you’ll be facing (even if you don’t), and be able to communicate effectively with all the different people in your team.  Find someone who can ask the probing questions, share what others are doing, and keep the group focussed on how to really manage your risk.