Risk Analysis is in everyone’s mouth and hopefully mind. It is easy to talk about, but is it easy to do? If you have never done one it sounds intimidating. Most also talk about the very detailed and complex risk analysis you need for the kind of rocket science projects. But where do I start with my projects?
It is simple, start where you are! When I first attempted to do risk analysis I wanted to do the rocket science project level and thought that’s what is needed. But I realized 2 things very quickly:
- I had no idea how to do it
- My bosses were not ready for this and were not ready to give me all the details I needed, especially information on cost of sales, Opex and “Director cost”
Hence I needed a simpler approach. At that time I was not just trying to come up with all the processes in project management, all templates etc, but I was also trying to figure out which of our Data Infrastructure Projects I need to actually get involved in. We were 2 Project Managers – one trained one not trained in project management – and 4 Technicians who would run about 40-50 projects simultaneously at any given time. These were spread out all over the country and some were simple 1-3 day installations. I could not be involved in all projects, it was physically impossible. I ended up developing a simple scoring sheet with the help of my team, which helped to determine the complexity of a project by scoring 10 areas. All our projects were client projects. However the IT knowledge, the ease to work with them, security considerations and accessibility of the project sites varied widely. In our discussions we realized quickly that scoring a project on monetary value or number of data points alone does not work. Our score sheet ended up with scores for accessibility by public transport, IT knowledge of the client, previous installations, willingness of client counterpart to cooperate with us, number of data points, number of systems to be installed, complexity of integrations etc. We defined for each scoring area 5 different responses which had scores from 0 to 4 attached to them. The reason we used fixed answers was to avoid very subjective responses. We wanted to make it as easy and clear as possible.
Then for the total score possible, we again defined 4 different levels of complexity of projects.
Level 1: Technician handles the project alone, only reports in the weekly meeting and escalates if issues come up.
Level 2: Technician handles project with regular supervision calls by the Project Manager
Level 3: Project Manager handles the project, Technician handles the technical Team on site
Level 4: Project is very complex and needs a dedicated Project Manager – usually our Project Managers handled several projects in parallel.
When we had just developed and implemented the scoring sheet I watched a webinar on a new risk management tool and was surprised. What we had developed was a simplified version of what the speaker had used at NASA and used as the basis if his risk assessment part of the tool. That’s when I started understanding what risk management practically means. You find your risks by analyzing the complexity of the project.
With that risk analysis suddenly became something that was doable. I looked for a suitable risk analysis template on the internet. You find many on www.projectmanagement.com and other places. Then I adjusted it to our needs and we quickly had a usable tool, with which I could do first risk analysis. I concentrated on identifying risks and defining what prevention, mitigation, avoidance, and transfer measures would be used and who would be responsible for each. In our circumstances calculating costs of the risk, wasn’t really possible. But we scored the risks in to low, medium low, medium, medium high, high and very high, again clearly defined in percentages.
Over time I then prepared reports for Senior Management, gave them some workshops where I taught them about the possibilities of Risk Management and slowly sensitized them to the need to be more proactive in this area.
I hope this example shows you how you can start simple, learn as you go along and slowly get to the sophisticated level of risk management you want to reach.