Is your risk management process efficient or wasteful?Gavin Halling
Since the first standalone risk management standard (AS/NZS 4360 – 1996) there has been a significant growth in risk management as a specialisation. These “experts” have espoused a range of processes which, although mostly well intentioned, are often far from efficient. The result is a considerable waste in time and hence costs. Over the years we have focussed in on an “essentials only’ process.
The process comprises:
- Context based on a risk breakdown structure (RBS) (2) and project objectives
- Using a single sentence structure to describe a risk “(Something happens) leading to (outcomes expresses in terms of impact on objectives)” (1)
- Analysis – Likelihood and Impact on objectives (2)
- Treatments each with an owner and action/review date. (3)
This is a total of eight (*) pieces of data for managing a risk.
When an “essentials only” process is first suggested to an organisation it is normal to receive objections along the lines of “what about (residual risk, causes, consequences, risk owners etc)”. Whilst interesting these discussions are not particularly fruitful. There is only one question that needs to be addressed:
Are you able to manage risks with the above “essentials only” data?
The answer is yes.
It follows that anything other than the above are non-essential and hence wasteful. For one risk this is not an issue but multiply this by the number of risks in a project (and other risk areas), the number of times a risk is reviewed, the number of projects in an organisation and the wasted time really starts to add up.
Here is a sheet where you can make a quick assessment of the waste for yourself. Data efficiency checklist.
Although this sheet is primarily for your use I am interested in your results as a bit of informal research. I must add your feedback will not be related to yourself or your organisation – it is an overall picture I would like to understand. If you were happy to email me a copy of your results ([email protected]) I will send you part 1 of my book Integrated Project Risk Management. This part covers the “essentials only” process in more detail and includes some additional commentary on non-essential items.