English sottotitoli

← "Managing risk in practice" workshop

Ottieni il codice di inserimento
10 Lingue

Mostrare Revisione 56 creata 04/25/2021 da vjsCM.

  1. Okay, let's have a look at
    risk management in practice
  2. And what I want to do
    is to start with some basic concepts
  3. then focus on TWO difficult areas
    in the risk process
  4. So, I guess if I asked you
    to define the word 'risk'
  5. you would have some idea
    of what it meant
  6. We might not have a formal definition
    that we could quote,
  7. but we all have something in our minds
    when we hear the word 'risk'
  8. This is what we think,
    and maybe you think of things like this
  9. Maybe you feel like this little guy,
    facing some big ugly challenge
  10. that you know is just going to
    squash you flat.
  11. Maybe you feel like this guy.
  12. This is a real job in North Korea,
  13. and his job is to hold the target
    for other people to shoot at
  14. Sometimes project managers
    have the target here
  15. We feel like everybody is shooting at us
    in our job
  16. Or maybe you just know there's something
    nasty out there, waiting to get you
  17. And maybe that's what you think of
    when you think of the word 'risk'
  18. Well that's partly true
    but it's not the whole truth.
  19. Risk is not the same
    as uncertainty.
  20. Risk is related to uncertainty
    but they're different.
  21. So all risks are uncertain
    but not all uncertainties are risks.
  22. If you have a risk register
    or a risk list,
  23. you don't have a million items in it,
    or you shouldn't.
  24. You don't even probably have
    a thousand items in it,
  25. you have a smaller number.
  26. Although there are millions
    of uncertainties in the world.
  27. So how do we decide which uncertainties
    we're going to call 'risk'?
  28. And write them down
    and put them in our risk register
  29. and decide to do something about them.
  30. Clearly 'risk' is a subset
    of uncertainties, but which subset?
  31. How do you know?
  32. I think it's very simple to separate
    risk and uncertainty.
  33. And I use 3 English words,
  34. these words here,
    "risk is uncertainty that matters."
  35. Because most of the
    uncertainties in the world don't matter.
  36. We don't care if it's going to rain
    in London tomorrow afternoon.
  37. It might, it might not.
    It's irrelevant, it doesn't matter.
  38. We don't care what the
    exchange rate will be
  39. if it's between the Russian Ruble
    and the Chinese Yen in 2020.
  40. It doesn't matter to us.
  41. But there are things on our projects,
  42. and things in our families,
  43. and things in our country,
  44. which are uncertain which do matter to us.
  45. If it's an uncertainty that matters,
    it's a risk.
  46. So here's another question,
    how do you know what matters?
  47. In your projects,
    what are the things that matter?
  48. The things that matter in our projects
    are our objectives.
  49. So we must always connect uncertainty
    with objectives,
  50. in order to find the risks.
  51. And if we look at
    some definitions of risk,
  52. this is the ISO standard that I mentioned,
  53. it connects those words very simply;
  54. Risk is the effect of uncertainty
    on objectives.
  55. And we might look at another definition
    from the UK,
  56. from our association
    for project management,
  57. it says the same thing that risk
    is an uncertain event
  58. or a set of circumstances,
    which is uncertain,
  59. but it matters because should it occur,
  60. it will have an effect
    on achievement of objectives.
  61. Uncertainty that matters.
  62. So we should be looking
    in our risk register for two things:
  63. "Is it uncertain?" We don't want
    problems in our risk register.
  64. We don't want issues in the risk register.
  65. We don't want constraints or requirements.
  66. These things are certain,
    what we want is uncertainties,
  67. something that might happen
    or might not happen.
  68. But the other important question for our
    risk register is
  69. "Does it matter?"
  70. Which objective would be affected
    if this thing happened?
  71. And then when we want to see
    how big the risk is,
  72. we can ask those two questions:
  73. "How uncertain is it,
  74. and how much does it matter?"
  75. And that will tell us how big the risk is.
  76. So, this idea of uncertainty that matters
  77. then develops into
    something which is useful
  78. by linking uncertainty to our objectives.
  79. So, we have two dimensions of ‘risk,’
  80. we have an uncertainty dimension and we
  81. have a dimension that
    affects our objectives
  82. In projects, we call
    this probability and impact.
  83. We could call them other things,
  84. there are other English
  85. words we could use,
    but these
  86. are the ones,
    most often, we use.
  87. And I would like to ask you with
    this picture of the mouse.
  88. What effect matters to the mouse?
  89. So first of all, clearly,
    he is in an uncertain situation here.
  90. And he's seen some risks.
  91. His objective is to get the cheese
    and stay alive.
  92. And so, one of the risks he has
    identified is a bad thing
  93. that might happen:
    he might be killed or injured.
  94. And so, he has been a
    good project manager,
  95. he has put his little helmet on,
    and he is preparing
  96. so that it doesn't happen to him.
    So, he doesn't get killed or injured.
  97. Very good.
  98. And there are things in our projects,
    that if they happened
  99. would kill or injure us.
  100. They would waste time,
  101. waste money, damage reputation,
  102. destroy performance,
  103. maybe even injure real people.
  104. And as project managers we have to
    see those things and stop them happening.
  105. Protect ourselves in advance.
  106. Avoid them.
  107. Are there any other uncertainties
    that matter for the mouse?
  108. Well there is...
  109. the cheese.
  110. There's an uncertainty here which
    matters a great deal.
  111. "Will I get the cheese out of the trap?"
  112. He might, or he might not.
  113. And if he doesn't get the
    cheese out of the trap, he's failed
  114. So he has two uncertainties to manage,
  115. one of them is bad - he might be killed
    or injured -
  116. the other is good - he might
    get the cheese.
  117. And what he has to do,
  118. what he has to do is to manage both
    of these at the same time.
  119. And as project managers, we have to
    do the same thing.
  120. And also we have to do it in the
    best possible way -
  121. sometimes there's a better way to get the
    cheese without being killed or injured.
  122. In our projects, we have to stop the
    bad things happening,
  123. but we also have to get the cheese out
    of our projects.
  124. "So what does 'cheese' mean,
    in your project?"
  125. "What is the 'cheese' in your project?"
  126. 'Cheese' means value.
  127. 'Cheese' means benefits.
  128. 'Cheese' means products and
    services that people want and need.
  129. 'Cheese' means customer satisfaction.
  130. 'Cheese' is the good stuff
    that we're trying to get
  131. out of our difficult projects.
  132. And if we don't do anything bad -
  133. we don't waste time, we don't
    waste money, we don't damage reputation -
  134. but we don't create value,
  135. we've failed.
  136. If the mouse didn't die but he didn't
    get the cheese, he failed.
  137. If we create benefits, but we waste time
    and waste money and destroy reputation,
  138. we've failed.
  139. And if the mouse gets the cheese
    and he's killed,
  140. he's failed.
  141. So we have to do both of these things.
  142. And when we think about risk
    and think about impact,
  143. there are two kinds of impact that matter.
  144. Bad ones, and good ones.
  145. Uncertainties that could hurt the project,
  146. and uncertainties that
    could help the project.
  147. Both of these matter
    and both of these need to be managed.
  148. And we have another word for those.
  149. So, here's the definition of risk from the
    Project Management Institute, the PMI,
  150. from the PMBok Guide.
  151. It's the same as the others
    that we've seen:
  152. an uncertain event or condition,
    that if it occurs, affects an objective.
  153. But PMI knows about the mouse. PMI knows
    about the cheese and the traps,
  154. and has added three words
    to the definition of risk here.
  155. It's not the words 'cheese' and 'traps'.
  156. It's the words 'positive or negative'.
  157. What this tells us is that there
    are good risks, as well as bad risks.
  158. And we heard that in one of our
    keynote speeches, earlier this morning.
  159. In the uncertain situation that this
    country faces going forward
  160. with all the changes that there have been,
    there are threats.
  161. There are things that could go wrong.
  162. And you need to see those
    and address them.
  163. But there are also opportunities.
  164. Uncertain things that might happen
    that could be good.
  165. And we also need to see those things,
  166. and to try and proactively
    make them happen.
  167. And that is equally true in our projects,
  168. in our personal lives,
  169. and also at the national level.
  170. And I'll be talking about some of
    those things later on this afternoon
  171. So, PMI has this definition. The other
    standards have something very similar.
  172. The ISO standard, at the bottom here,
  173. says 'risk is the effect of
    uncertainty on objectives.'
  174. Note, the effect can be
    positive or negative.
  175. And the APM, Association for Project
    Management in the UK says the same thing.
  176. So we have this new idea,
    that risk is a double-sided concept.
  177. And it's the same impression,
    the word you have for risk,
  178. we mostly think of bad things.
    But it could be used for good things,
  179. as well. Isn't that right?
  180. It's an uncertain word.
  181. And there are good risks as well
    as bad risks.
  182. So in our project
    risk management process,
  183. we should be looking out for the traps
    and avoiding them
  184. and protecting ourselves and
    preventing them happening.
  185. But we should also be looking
    out for the cheese
  186. and chasing it, and making it
    happen proactively,
  187. so we get the maximum
    benefit for the minimum cost.
  188. That’s why risk management is so
    important to

  189. project success: because it effects
    our objectives.
  190. It gives us the best possible chance
    to achieve our goals.
  191. So how do we do that?
  192. If we think about the risk management
    process,
  193. the process has to do a number of things.
  194. If risk is uncertainty that affects
    objectives,
  195. we have to know what our objectives are.
  196. Then, we have to identify the
    uncertainties.
  197. The uncertainties that would matter to
    those objectives.
  198. And remember that they could be good
    or bad, threats and opportunities.
  199. That gives us a long list of uncertainties
    that matter,
  200. but they don't all matter the same.
  201. So the next thing we have to do is
    to prioritize, and ask the question
  202. "How uncertain,
    and how much does it matter?"
  203. Then we get a prioritized list of risks.
  204. We know which are the worst threats and
    the best opportunities,
  205. so that we do something about it.
  206. Then we plan how to respond.
  207. We think about what would be appropriate
    to stop the bad thing happening
  208. and to make the good thing happen.
  209. And having decided, we do it of course.
  210. And then risk is constantly changing
    so we need to come back and do it again,
  211. and see what has changed.
  212. We could express this process as a number
    of questions that it's important to ask,
  213. and keep on asking about our project.
  214. In fact, you can use these questions for
    anything.
  215. You could use these questions for your
    next career move.
  216. You could use these questions for deciding
    about your pension.
  217. You could use these questions to decide
    how to bring up your children
  218. or to decide on how to invest the nation's
    wealth.
  219. These are the questions:
  220. "What are we trying to achieve?"
    That's setting objectives.
  221. Then, "what could affect
    us in achieving that?"
  222. That's identifying risks.
  223. Then, "when we have a list of risks,
    which are the most important ones?"
  224. That's prioritizing at that
    assessing the risks.
  225. Then, "what could we do about it?"
  226. Planning our responses and doing it,
    implementing the responses.
  227. And then, "did it work and what's changed"
    Reviewing the risk.
  228. So if we look at a risk management
    process, we could link each step in the
  229. process to one of these questions.
  230. And this is why risk
    management is so easy,
  231. because all we're doing is asking and
    answering obvious questions.
  232. Anybody who's doing anything important
    will ask these questions:
  233. "What am I trying to do?"
    "What could affect me?"
  234. "Which are the big ones?"
    "What shall I do about it?"
  235. "Did that work?"
    "Now what?"
  236. And you could ask those questions every
    Monday morning when you drove to work,
  237. or every Saturday morning.
  238. You can ask the question, say
  239. "What am I trying to achieve today?"
    "This week?"
  240. "What could affect me and
    which are the big ones?"
  241. "What shall I do?"
  242. We can manage risk on a very simple basis,
    or we can use this as the structure for
  243. a risk process which is much more complex,
    which involves lots of meetings,
  244. and lots of stakeholder groups and
    lots of analysis and statistics.
  245. It's the same questions.
  246. So I would like you to remember
    two important things.
  247. One is, risk is uncertainty that matters.
  248. And secondly, these questions,
    these six questions.
  249. Because that's the heart,
    that's the basis of managing risk,
  250. and it really is very, very easy.
  251. Now, in the time that we have, I want to
    focus on just two parts of this process,
  252. and then give us the opportunity
    to try out some of these things.
  253. The identification step, clearly
    very, very important
  254. because if we don't identify the risks,
    we can't manage them.
  255. And then planning responses.
  256. Understanding how we can deal with
    the uncertainties that we've identified.
  257. So, let's think about these things:
    identifying risks.
  258. How do we find all of the risks?
  259. Well, you can't.
  260. You can't find all of the risks because
    there are risks that arrive
  261. that we hadn't seen before.
  262. There are emergent risks,
    new risks, different risks
  263. and I'll be talking about those
    later this afternoon in my speech.
  264. What we want to find are the knowable
    risks: the risks that we could find.
  265. We don't want somebody
    on our project team who knows a risk
  266. and they're not telling anybody.
  267. So this process is about exposing the
    uncertainties that matter,
  268. finding them so we can
    do something about them.
  269. And there are lots of techniques,
  270. brainstorming, workshops, check lists,
  271. testing our assumptions and so on.
  272. But I would like to answer a
    bigger question,
  273. a different question from techniques.
  274. And it's the question, "are we
    finding the real risks?"
  275. When you go to a risk workshop and you
    write things in your risk register,
  276. are they really the uncertainties that
    matter for your project?
  277. Are these really the things that could
    drive you off track or really help you?
  278. Or are they just the obvious things?
  279. Where all projects have problems with
    requirements,
  280. with resources, with testing.
    These are things that
  281. always come up, and we have processes
    to deal with them.
  282. But are they the real risks?
  283. I would like to suggest to you that often
    in our risk registers
  284. we confuse real risks with other things.
  285. Often, we confuse risks with their causes,
    where does the risk come from?
  286. Or we confuse risk with their effects,
    what do they do if they happen?
  287. But risks are uncertainties that matter.
  288. They are not causes or effects.
  289. So causes are things that are true.
  290. This is true that the project
    is difficult,
  291. it is true that we do not have enough
    people on the project.
  292. it is true that the customer hasn't
    signed the contract yet.
  293. These are not risks, they are facts.
  294. They might be issues.
  295. They might be problems, but they are
    not risks because they are not uncertain.
  296. And a lot of people write these
    things in our risk register.
  297. "We don't have enough time
    for this project."
  298. "It’s a risk!"
  299. No, it’s a problem.
  300. Sometimes we confuse risks
    with their effects.
  301. There could be an accident,
    we could be late.
  302. those are not risks either,
    they are the effects of risks,
  303. how do you manage, we could be late?
    If your late, it’s too late.
  304. What we want to know is,
    why might you be late?
  305. What unplanned thing could happen
    that would result in you being late?
  306. So, risks sit between causes and effects.
  307. We can’t manage causes because
    they're here now, they're facts.
  308. We don't want to manage effects
    because they may never happen.
  309. What we can manage is risks
    that sit in the middle
  310. because they haven't happened yet.
  311. So, risk management has
    to separate risks from
  312. their causes and risks from
    their effects.
  313. And I find looking at hundreds of
    risk registers all around the world.
  314. I've worked in 48 different
    countries, every continent, every culture.
  315. Uh, not the Antarctic, it’s too cold.
    Um, but nearly every continent.
  316. And over half of the stuff in risk
    registers are causes or effects.
  317. Over half.
  318. So the things we are trying to
    manage in the risk register
  319. are not risks and then
    people are surprised that it doesn't work.
  320. So how do we separate cause, risk, and
    effect. Here is a little test.
  321. And these statements are
    written in your notes.
  322. Or you can just think as we go.
  323. Each of these statements and they are
    all very simple is one of these things.
  324. A cause is something that is true today.
  325. A risk is an uncertainty that might,
    or might not happen.
  326. The effect is why it matters
    to our objective.
  327. Okay? So you have to
    think what these are.
  328. The project is based in a
    third-world country.
  329. Cause? Risk? Or effect?
    What do you think?
  330. Cause! Very good.
  331. So, this is a fact, there might be
    uncertainties that come out of this fact.
  332. So we may not get the resources we need,
    there may be security concerns.
  333. We may not get paid. These are
    uncertainties that come from this fact.
  334. Interest rates might go down.
  335. It's a risk.
  336. Or they could stay the same or
    they could go up.
  337. And we could go over budget.
  338. It's an effect.
  339. So, a million things could
    take you over budget,
  340. maybe interest rates is one of them.
  341. Okay? They were easy.
    How about this?
  342. The weather might be better than usual.
  343. So risk could be the same or worse.
  344. It would be a bad thing if you
    were selling umbrellas.
  345. It would be a good thing if you
    were selling ice cream.
  346. It depends what your project is.
  347. Um, I'm allergic to prawns.
  348. It's a cause, it's a fact.
  349. What is the risk that comes from
    this fact, this cause?
  350. You think maybe I could be sick?
  351. I could have a reaction.
    I could be very ill. I could die.
  352. All of those things are effects.
    Aren’t they?
  353. But if something happens
    that I didn't plan,
  354. because I am allergic something might
    happen that makes me sick.
  355. What's the something?
  356. I might eat prawns without knowing.
  357. So then I check, are there prawns in this?
    You know I avoid things with prawn in them
  358. I manage the risk and not the effect.
    And not the cause.
  359. Okay, we have got to use a new technique,
    an unproven technique.
  360. It's a fact, it's a requirement,
    we have to do it.
  361. we might introduce design errors but it
    just is a fact.
  362. A requirement of our project.
  363. The contractor may not deliver on
    time is a risk.
  364. Um, this is going too fast.
  365. It might not work for some reason.
  366. You saw the color, it's an effect.
  367. Okay, I will go more slowly. Uh,
    we don't have enough people.
  368. It's a cause, yes. And lastly,
    there's a risk that we'll be late.
  369. Hmm...mm.
    It's an effect, is it?
  370. Because we want to know what is the
    risk that we'll be late.
  371. Being late is an effect.
  372. So apart from the prawns, all of the blue
    and green things we see in risk registers.
  373. The project environment, new technology,
    lack of resources, or going over budget.
  374. Lack of performance, delivering late.
    These are not risks.
  375. These are causes or effects.
  376. And if we looked at a real risk register
    and this is written in your notes for you
  377. If you want to do this afterward,
    we could do another exercise
  378. In fact, the next page of the notes,
    if you turn over the page
  379. has these written a bit larger for you
  380. English only I'm afraid.
  381. We'll have to do something about that.
  382. Um. You could just try this little
    exercise on a real risk register
  383. This is one of my clients, I asked
    them for their top 10 risks.
  384. This is what they gave me.
  385. They're not risks. They're all sorts of
    things mixed up.
  386. Really, you should do this on your
    risk register.
  387. But let me show you what happened
    when I did this on their risk register.
  388. I found there was a whole mixture
    of things.
  389. So, the current hardware is not fast
    enough to support testing. That's a fact.
  390. It's a cause.
  391. This means that we may be unable
    to test performance
  392. until production hardware is used.
  393. That's the risk.
  394. So we have two things in this
    statement.
  395. The next one down is just a fact.
  396. A number of usability issues have
    been identified by the supplier.
  397. Okay, so what?
  398. What difference does that make?
  399. Let me color code this for you.
    Just to be slightly friendly.
  400. Umm.
  401. But you will have to do it on your own
    if you want to try the complete exercise.
  402. Umm. There is a whole range of different
    things in this so-called risk register.
  403. And I would expect that yours is the same.
  404. That you'll have things in your risk
    register that are just pure facts.
  405. Or things that are a mixture of risks
    and other things
  406. Now, there are two in this list that I
    think are particularly interesting.
  407. It's this one and this one.
    They have all three colors in them.
  408. Because they have a cause and a risk
    and an effect.
  409. So, let take this one. The team
    does not have a documented design.
  410. For this function. That's a fact.
  411. So what?
  412. Well, there's the risk
    that the architecture
  413. may not support
    the required functionality.
  414. That might happen because we don't have
    a documented design.
  415. Why do we care about that?
  416. If that happens, it results in the
    requirements not being met.
  417. or a higher number of defects.
  418. That hits our performance objective
    and our quality objective.
  419. So, now we have three things,
    we know what the risk is.
  420. The risk is that the architecture might
    not support the functionality.
  421. We know why that's happening,
    because we don't have a documented design.
  422. And we know how it could affect the
    project in not meeting the requirements,
  423. or delivering defects.
  424. Those are really useful things to know.
  425. And it will be helpful if every risk
    description had those three things in it.
  426. And, so what we recommend is
    a structured description of risk
  427. that has three parts to it.
  428. That says "as a result of" some fact,
    a cause. Then, an uncertainty might occur.
  429. It might not, but it might.
  430. And if it did, it would be a risk.
  431. and if that thing actually happened,
    it would lead to
  432. An affect on the objectives
  433. And we recommend and PMI recommends
    and the ISO standard recommends
  434. and best practice guidelines recommend.
  435. But you describe your risk in these
    three stages.
  436. What do we know, what uncertainty does
    that gives us, and why does it matter?
  437. And then we can use it to help us
    manage the risk.
  438. In English, we have definite words
    to describe facts
  439. This is true. This has happened.
    This does occur.
  440. We have uncertain words to describe the
    risk. It might or it might not
  441. It's possible.
  442. And then we have conditional words that
    say this would follow
  443. if the risk occurred.
  444. Maybe your language is a little different.
  445. But we can use the language
    to help us perhaps.
  446. So one of the things
    I'd like us to try,
  447. in the short exercise we're
    going to do in a moment,
  448. is to try describing risks
    in that three part way.
  449. What do we know?
  450. What uncertainty does it give us?
  451. And why does that matter
    to our objectives?
  452. And I would recommend that you
    try that for your own
  453. real risk register on your project, and
    see what difference it makes.
  454. You might be surprised.
  455. Now, let's think about the
    next question, which is not,
  456. Well, there is another question.
  457. "How do we prioritize them?"
  458. But the one I want to focus on is,
    "What could we do
  459. about the risks that we've identified?'"
  460. Planning risk responses.
  461. Here are the questions
    we need to ask.
  462. "What are we going to do based on
    the risk?"
  463. How manageable it is.
  464. How bad or good it might be
    if we left it alone
  465. impacts the variety.
  466. Whether we have the people
    and the equipment of the skills
  467. to deal with it.
  468. A resource availability
  469. and cost effectiveness.
  470. Can we spend a small amount
    to save a big amount?
  471. We don't want to spend a big amount
    to save a small amount.
  472. And the next important question
  473. "who is going to do this?"
  474. What could we do to deal with risk?
  475. Often, people think of four things.
  476. Four different types of things
    we could do to address
  477. uncertainties that matter.
  478. And each of these has a name.
  479. It's a strategy. A strategy to focus
    our planning.
  480. To focus our thinking.
  481. And then, once we've focused our thinking
    with a strategy, we can develop tactics
  482. to address each individual risk.
  483. So, what are the four things
    that most people think of?
  484. The first is risk avoidance.
  485. Is there something we can do to
    kill the risk, to remove it altogether?
  486. The second is something we call
    risk transfer.
  487. Can we give it away?
  488. Can we get somebody else
    to take it away for us?
  489. The third is what we call risk reduction.
  490. Some people call this risk mitigation.
  491. And here, we're trying to make
    the risk smaller
  492. so that we could accept it.
  493. And the fourth response after avoid,
    transfer, or reduce
  494. is the one that everyone forgets.
  495. They think if we can't do anything
    about it
  496. we just have to hope and pray and wonder
    and wait.
  497. The other response is
  498. to take the risk.
  499. We call that risk acceptance.
  500. To recognize we're taking this risk
    and to include it in our baseline
  501. and to monitor it very carefully.
  502. So, you might see those four options as
    quite a good set of response strategies.
  503. But there's a problem.
  504. The problem is all these
    things only work for bad risks.
  505. What about opportunities?
  506. We don't want to avoid or
    give away or make smaller
  507. opportunities.
  508. So, how do you respond if you find
    a good thing that might happen
  509. on your project.
  510. Do you just wait and see and hope?
  511. Or is there something active that we
    could do?
  512. Fortunately, there are four response
    strategies for opportunities
  513. that match the four response strategies
    for threats.
  514. So, here are the bad ones.
  515. Avoid a bad thing.
  516. Give it to someone to take away.
  517. Make it smaller.
  518. Or take the risk.
  519. This is not those things
    I'm trying to achieve.
  520. To remove the uncertainty.
  521. To get somebody else to help.
  522. To change the size of the risk.
  523. Or to include it in our project plan.
  524. We could do all of those four things,
  525. for opportunities.
  526. How do you eliminate uncertainty
  527. from opportunity?
  528. You capture it.
  529. Take up a strategy,
  530. which makes it definitely happen.
  531. In English, we call this "Exploit".
  532. Exploit is the same as avoid.
  533. For avoid, you make the probability
    zero.
  534. It can't happen.
  535. For a threat, it's avoid.
  536. For opportunity, exploit.
  537. It's to make the probability 100%
  538. It will happen. It must happen.
  539. So they're aggressive strategies.
  540. You kill the threat,
    you capture the opportunity
  541. It's the same kind of thing.
  542. What could we do, instead of giving away,
    transferring a threat?
  543. We want to involve
    somebody else to help us.
  544. We could share the opportunity.
  545. We could ask them
    to come into our project
  546. and be involved with us in a
    joint venture
  547. or a subcontract, or a partnership.
  548. Where they help us to achieve this
    uncertainy that would help us all?
  549. And we give them some part of the benefit,
    we share the opportunity
  550. How could we change the size
    of an opportunity?
  551. We don't want to reduce it,
    we want to enhance it.
  552. We want to grow it,
    we want to make it more likely.
  553. And bigger impact. It's the same idea but
    the other way around for the opportunity.
  554. And the last one, if we can't do these
    active things, we could just
  555. Accept an opportunity and wait and see
    what happens.
  556. But monitor it very closely if there's
    nothing else we could do.
  557. So what this slide tells us is that
    there's an equal variety
  558. Of potential response times that we can
    choose between for our opportunities
  559. Equal to the number that we have threats.
  560. You see, the secret to thinking
    about opportunities...
  561. Is to recognize that an opportunity
    is the same as a threat.
  562. The only difference is the sign
    of the impact.
  563. So a threat has a negative impact,
    an opportunity has a positive impact.
  564. Apart from that, they're the same.
  565. They are both uncertainties that matter.
  566. They are both things that might or might
    not happen.
  567. But could affect our objectives.
  568. They can both be managed practically.
  569. They both make a difference to the chances
    of succeeding on our project.
  570. And that's why risk management should
    manage threats and opportunities together
  571. in a single process.
  572. Because they are the same things.
  573. And that may be new thinking for
    some of you.
  574. Those of you who always think of risk
    as a big ugly thing waiting to squash me.
  575. Or the unknown thing in the future
    that's going to hurt me.
  576. There are some like that, and we need to
    stop them happening to protect ourselves.
  577. But there are also some very good things
    out that which might happen
  578. Which we need to see, and
    we need to chase them.
  579. And make them happen. So that our
    projects could be more successful.
  580. There is another response strategy
    that we might try.
  581. Which is really not recommended, and
    just pretending that there are no risks
  582. and hiding away and saying maybe
    it will never happen.
  583. We really don't recommend this at all.
  584. In fact, it's probably true that ostriches
    don't bury their heads in the sand.
  585. It's just the way that the sand dunes
    kind of look and it's just a pretend story
  586. And sadly for project managers,
    it's not a pretend story.
  587. We hide our heads and we pretend
    there are no risks.
  588. And then we get surprised.
  589. Well, we can do better than that.
  590. So, let me just finish here just to say
    we do need to do something about this