Keys to Implementing a Sophisticated Risk Management Capability in Your Organization

Some of you might remember an old TV advert for an oil company on US television – with the punchline: “Pay me now, or pay me later!” It dealt with the need to change a car’s oil. The gist of it was that you could pay the company a small amount now ($39) or be negligent and end up paying considerably more later – about a hundred times more – to replace the car’s blown engine. The same logic applies to a lax risk management approach. Pay now, or pay (a lot more) later!

Managing risks in today’s high-pressured, take-no-prisoners project management world is a vital process that can easily determine the success or failure of an organization striving to achieve its strategic objectives. Don’t let the failure to manage risk events prevent you from delivering high-quality projects on time and within budget. Risk management demands a comprehensive capability of generating and formatting information that facilitates the process.

The secret to effective risk management is the availability of high-quality, thoroughly integrated and easily accessible decision support information. The decision support information that empowers project managers and executives alike doesn’t just happen! The organization must invest adequate time and resources to create the foundation for identifying and managing project risks.

Good risk management is based on good information

Identifying potential project risk events is easy. Managing them is how project managers demonstrate their prowess.  Being consistently successful in managing risks is directly dependent on the product of a PPM process—information.  Information that supports estimating the potential impact of the risk event on the project or other components of the organization.  Additionally, the PPM supports evaluating the probability of the risk event actually occurring. 

Once the analysis of the information is complete, including forecasting and/or trending, the approach to managing the risk must be chosen. There are many choices regarding the handling of a risk event.  The project manager can choose to Avoid, Accept, Transfer or Mitigate the specific risk event. The impact of the handling technique selected can be easily assessed using the PPM to assure it is the most effective choice with the least impact.  Is your organizational leadership enabling project managers to manage risk or are they merely creating the illusion of risk management?  

Is your organization willing to do the necessary work to establish and implement a sophisticated risk management capability?  What does it really take to establish a world-class risk management process? To answer this question I went to Carl Pritchard, one of the world’s foremost risk management professionals.  Carl was quick to agree that the power of a PPM significantly increases the potential for successful risk management.  Carl suggested the framework for the risk management process must be developed before maximum value from a PPM solution can be realized.

To create a standardized risk policy the following must be accomplished:

  1. Establish the risk lexicon (How high is high for impact and probability)
  2. Establish the tolerances (How much can they stand in terms of overruns, or schedule slips)
  3. Establish risk management tools (Build a risk oriented Project Charter—with KILL criteria)

Simply having a risk management process does not guarantee results.  Having a proven PPM solution and a consistent risk management process will help. A PPM solution and the information it generates will affirm that project risk is managed more effectively.  Some of the critical advantages of a PPM are:

  1. Processes create consistency of action.  That leads to predictability, which leads to lower uncertainty and a lower risk profile
  2. As projects evolve the reporting and tracking functions of the PPM solution creates an environment where we can detect trends quickly
  3. Reporting and tracking functions raise visibility to a broader number of stakeholders.  More stakeholders—more people who can identify and escalate risks
  4. Improved communication management. Everyone knows who is supposed to talk to whom, about what. The proper players are in the “loop”

So you purchase a sophisticated PPM solution. Done! That was easy!  Not so fast my friend!  The power of the PPM is unquestionable.  If the users are properly trained on how to use the power of the PPM and the senior decision makers are willing to actually “make decisions” you will have found the pot of gold at the end of the rainbow.  Unfortunately, history shows that it takes time to fully realize the benefits.  Users must be committed to the use of the PPM.  No excuse for not using the PPM is acceptable! Remember, just because you have implemented a PPM doesn’t mean it will be accepted by the user community!

Getting a call from Microsoft’s CIO

I experienced this “lack of use” phenomena at a major U.S. software company.  It was 2010 when I received a phone call from a gentleman named Tony Scott.  I had no idea who he was so I was a little cautious.  He introduced himself as Tony Scott CIO of Microsoft!  He had my attention!  I wondered out loud why he was calling me.  He said that Microsoft was implementing a new project management process and he wanted me to come to Microsoft Headquarters in Redmond, Washington to help kick off their new methodology.  He made it clear what he wanted was a “cheerleader” to fire up the 300+ project managers in attendance.

I was a little intimidated by the thought of addressing 300+ of Microsoft finest PMs. Initially I declined.  Then Tony mentioned the money and I felt much better about accepting the engagement. When I arrived at SeaTac airport I was picked up by limo and taken directly to Microsoft HQ.  The auditorium was standing room only and the first presentation was made by the development team that had just completed a major overhaul of Microsoft Project.  Good stuff—many significant improvements. 

Then it was my turn.  I took the stage and, as usual, I spent a little time establishing expectations.  I admitted to them the reason I was here was to get them “excited” about the power of the new Microsoft Project (at the time they commanded 72% of the project management software market).  Basically, I acknowledged I was here as a “cheerleader”.

Then I pointed out the fact that Microsoft is so powerful I assumed all of the PMs were Microsoft Project users.  To confirm that was the case I asked, by show of hands, how many of you use Microsoft Project to manage your projects? No response. I asked again.  Finally about 37 hands went up.  Only 37 of over 300 were using Microsoft Project. I was stunned. Tony Scott was also stunned. He left the room and he was not smiling. I had to ask: “Why aren’t you all using the most powerful PM tool in the world?”

After a long delay a young lady finally raised her hand and said, “I don’t use it because it is too complicated!”  I closed out the conversation asking: “You are all successful Project Managers. If you’re not using Microsoft Project what are you using?” Answer: Excel Spreadsheets!  Fact: Tony Scott subsequently left Microsoft, but I’m told he made it clear the day after my “pep rally” that Microsoft PMs would no longer use Excel!

Moral of this story

If you have a powerful information system available –USE it.  Don’t “risk” wasting time looking for reasons not to use it! Never forget that a “fool with a tool is still a fool”!  Effective use will define success.

Measuring a project’s performance baseline

Today’s PPM takes the concept of information systems to a new level.  Once a project’s Performance Measurement Baseline (PMB) is prepared the benefits of the new PPM are the abilities it has to prepare and present information in a format that makes it easy to understand and provides timely project data at specified levels.  These reports can be prepared on a regular schedule or on demand by individual decision makers.  The reports and formats are easily “tailored” to the needs of decisionmakers. 

The PPM solution will quickly highlight potential risks and provide the data needed to conduct in-depth analysis. My personal opinion: “If I had a PPM in the 1960s & ’70s I would rule the world of project management.”  There is no reason for any project manager or executive to be surprised about the risks and related challenges facing their projects! PPM solutions, when implemented correctly, provide a holistic view of the project and how it contributes to the strategic objectives of the organization.

While a PPM solution has amazing power: Power to digitize and streamline business processes. Power to centralize and consolidate systems.  Power to prioritize projects and programs. Power to enable much more to be accomplished with significantly less effort; it is that same power that can lead to a very serious problem: The idea that—“If a little information is good, a lot must be even better!” This problem can lead to analysis paralysis and the perceived failure of the PPM solution to deliver value.

Answers You Should Get Before Tackling Risk Management

In summary, if you and your organization have an objective of improving risk management capability remember this:

  1. In order to effectively manage risks the organization must invest the time creating a consistent risk management methodology that incorporates input from throughout the organization.
  2. Once the risk management process has been established the most efficient and cost effective PPM solution necessary to support the process must be selected and implemented.
  3. ALL users in the organization must be trained in the capability and use of the PPM system

By Lee R. Lambert – one of only 70 people in the world to receive the honor of PMI Fellow. Lee became a champion of Cora Systems after seeing a demonstration of their Cora PPM platform. Click here to watch an overview of Cora PPM and see why Lee was so impressed.

Send your email to