Everyone on the team is involved. People know how to assess risk impact and probability subjectively. They seek to understand the source of the risk and address the root cause in order to proactively prevent the risk from happening.
The next shift to occur on the road to risk management maturity is the movement from qualitative to quantitative analysis of risks, stage 4. Predictability and decision making becomes more precise because alternatives are easier to compare with quantified predictions. A core set of metrics provides better early indicators of risk events, and the need for preventive action is more easily anticipated. In addition to the project team, a risk review board or risk management committee is often in place to provide expert oversight.
Finally, for the most mature organizations there is yet another paradigm shift in which the other face of risk management is seen - stage 5 on the road to risk management maturity. This is the side of risk management in which uncertainty also means opportunities to save money and be more efficient and effective. Risk is no longer a negative concept. Wherever there is risk, there is also opportunity or the chance of a good outcome. People and teams are empowered by management to try new things to find the opportunities without fear of failure since this is the way of progress. Risk management is in everyone’s hands as they all look for ways to save time and money in a positive environment.
What does it take to manage risk and progress on the road to risk management maturity? It takes a company infrastructure that supports risk management, a risk management process, and people who perform risk management.
Let’s start with process. The Project Management Institute (PMI) has articulated a systematic process for project and program risk management. [1] Other authors and organizations have used a variety of terms, but the process is the same – identification, analysis, response planning, monitoring and control. The establishment of this process as a requirement for project management is needed to move from a reactive to a proactive stance regarding risks. Here are the benefits of each step in the process.
The benefits of the identification step are that it uncovers risks while there is still time to resolve them, allows communication to those who can help with the resolution, and prevents surprises.
The benefits of the analysis step are that it helps determine the source of the risk, how serious it is, how much time we have to resolve it, and helps us prioritize our planning for the most severe risks.
The benefits of the response planning step are that it helps develop resolution alternatives and an action plan and puts in place thresholds for early warning signals of when the risk plan needs to be put into action.
[1] Wideman, M. Project and Program Risk Management: A Guide to Managing Project Risks and Opportunities. Pennsylvania: Project Management Institute, 1992.