Risk management and business success by David Hillson, the Risk Doctor on 18-Jul-2013

The Risk Doctor brand was launched ten years ago, in July 2003, and we've been looking back to see what's changed since then. While there have been definite improvements, some things remain depressingly similar.

Let's look first at the improvements:

• Scope
  Risk management used to focus only on technical threats to time and cost in major projects. Now we use the risk process to identify opportunities alongside threats. We assess impact against other project objectives as well as schedule and budget. We use a Risk Breakdown Structure (RBS) to consider multiple sources of risk, not just technical risks. Risk management is applied across the business, not just on projects. We are also starting to consider a wide range of uncertainties that might affect outcomes, not just uncertain events.


• Integration
  This has improved in two ways. We used to keep risk management separate from overall management of the project or the business, but now risk-based decision-making is increasingly common. We've also learned how to manage risk at various levels in the organisation, developing a truly enterprise-wide approach to risk management.


• Software
  The first Risk Doctor risk register was produced using dBase III, and we did Monte Carlo simulation using paper-tape to control a program running on a water-cooled mainframe! Today's risk tools are cheap, fast and reliable, with powerful functionality and great user interfaces.

Unfortunately however, some things have not changed much from the early days. These unwelcome similarities mostly relate to the culture surrounding risk management in today's project and business environment. Two aspects of this are common:

• Box-ticking
  It is still common to find project teams and management boards who just go through the motions, 'doing risk management' instead of actually managing risk. They follow the risk procedure because it is required by the quality system or by a client contract, but they show no commitment to action and no understanding that managing risk is supposed to add value to the project or support better decision-making in the business. Instead risk management is seen as additional cost, an optional extra, and a necessary evil to be endured and got through as quickly as possible.


• Experts only
  Senior management still tend to view risk management as a technical function or a specialist discipline for engineers and technicians, safety specialists, or people interested in statistics etc. They don't see how managing risk links to creating value for the business or the project. As a result risk management is treated as something which is performed by risk experts, and it is not viewed as relevant to the overall management of the project or business.

So, looking back we can see that considerable progress has been made, but there's still some way to go before risk management is seen to deliver on its full promise as a major contributor to project and business success. Here at Risk Doctor & Partners we'll continue to play our part in spreading best practice, as well as developing new thinking and improved approaches. Like everything else about the future, the way that risk management will develop in the coming years remains uncertain. But as risk practitioners we should expect nothing less!

For more information or to contact Dr David Hillson, the Risk Doctor, please visit: www.risk-doctor.com

Tweets by @biz_works