How often has the promise of risk management exceeded its capability to deliver on your capital projects? Organisations invest plenty of time and money developing a risk procedure and risk register; however, complex plans and time-consuming processes drive driving little to no meaningful engagement from frontline project teams.
There are four key steps core to effective risk management:
While risk teams need to walk through each step in detail, the fast pace of projects often leaves frontline team members questioning whether following complex risk processes truly adds value. An effective risk management process does not need to be overly detailed or complex, but it is essential to project success.
Below are a few tips to kick-start your risk management process (and align your team around its importance).
As with any process in your organisation, it is critical to focus on the ‘precious few.’ A risk register with too many risks listed becomes a daunting task, and people will tend to ‘leave it for another day.’ Only list the high priority risks which either have immediate consequences or actions that need to be taken immediately.
It is common to keep track of risks and their corresponding actions in a risk register. The register is extremely useful tool for a risk professional; however, a particularly ineffective tool to display in a risk management meeting. Limit the discussion to high priority risks. Do not display the entire register, just the risk title (what are we worried about) and the risk response (what are we doing about it).
It is a common misconception on projects that the risk process is for executives and board members, and that risk registers are populated by information coming from risk professionals and management experts. The reality is that hazards and risks are primarily experienced by frontline workers. As such, project managers need to consult the frontline on risk and hazard identification, causes and possible response strategies. Including frontline teams in the risk process pulls useful information into the risk register, then pushes risk responses to where they will be used, at the front line.
If a risk does not have at least one action associated with the risk response, then it is not actively being managed. The simple existence of a risk process and risk register on your project is not enough. Regular risk meetings (once a week) are necessary to follow up on actions, assess current priorities, monitor effectiveness of controls in place and identify new critical risks that may affect your project. These meeting should be focused – if the purpose is to identify new risks, assemble the correct group of individuals on your project for that task and do only that. Do not attempt to analyse the risks or mitigate them – save that is for another day.
Remember… Risk meetings do not need to be long. In fact, if well-planned they should be less than 30 minutes. Try using the 5Ps ahead of your next meeting to streamline and focus the discussion – ensure participants understand the Purpose, Place, Pay-off, Process and come Prepared.