1 00:00:00,501 --> 00:00:04,428 Okay, let's have a look at risk management in practice 2 00:00:04,457 --> 00:00:08,474 And what I want to do is to start with some basic concepts 3 00:00:08,485 --> 00:00:14,015 then focus on TWO difficult areas in the risk process 4 00:00:14,242 --> 00:00:19,164 So, I guess if I asked you to define the word 'risk' 5 00:00:19,174 --> 00:00:22,954 you would have some idea of what it meant 6 00:00:22,967 --> 00:00:26,476 We might not have a formal definition that we could quote, 7 00:00:26,476 --> 00:00:30,253 but we all have something in our minds when we hear the word 'risk' 8 00:00:30,274 --> 00:00:33,972 This is what we think, and maybe you think of things like this 9 00:00:34,234 --> 00:00:38,534 Maybe you feel like this little guy, facing some big ugly challenge 10 00:00:38,534 --> 00:00:41,791 that you know is just going to squash you flat. 11 00:00:42,066 --> 00:00:43,766 Maybe you feel like this guy. 12 00:00:44,024 --> 00:00:46,489 This is a real job in North Korea, 13 00:00:47,768 --> 00:00:51,367 and his job is to hold the target for other people to shoot at 14 00:00:51,500 --> 00:00:53,979 Sometimes project managers have the target here 15 00:00:54,292 --> 00:00:56,911 We feel like everybody is shooting at us in our job 16 00:00:57,757 --> 00:01:01,987 Or maybe you just know there's something nasty out there, waiting to get you 17 00:01:02,470 --> 00:01:05,700 And maybe that's what you think of when you think of the word 'risk' 18 00:01:06,361 --> 00:01:09,574 Well that's partly true but it's not the whole truth. 19 00:01:10,193 --> 00:01:13,625 Risk is not the same as uncertainty. 20 00:01:14,220 --> 00:01:16,963 Risk is related to uncertainty but they're different. 21 00:01:17,670 --> 00:01:23,826 So all risks are uncertain but not all uncertainties are risks. 22 00:01:24,653 --> 00:01:27,589 If you have a risk register or a risk list, 23 00:01:27,942 --> 00:01:31,435 you don't have a million items in it, or you shouldn't. 24 00:01:31,962 --> 00:01:34,512 You don't even probably have a thousand items in it, 25 00:01:34,512 --> 00:01:35,788 you have a smaller number. 26 00:01:36,714 --> 00:01:40,007 Although there are millions of uncertainties in the world. 27 00:01:40,400 --> 00:01:44,313 So how do we decide which uncertainties we're going to call 'risk'? 28 00:01:44,677 --> 00:01:47,280 And write them down and put them in our risk register 29 00:01:47,548 --> 00:01:50,057 and decide to do something about them. 30 00:01:50,483 --> 00:01:56,362 Clearly 'risk' is a subset of uncertainties, but which subset? 31 00:01:56,942 --> 00:01:58,133 How do you know? 32 00:01:58,798 --> 00:02:02,948 I think it's very simple to separate risk and uncertainty. 33 00:02:03,199 --> 00:02:05,274 And I use 3 English words, 34 00:02:05,425 --> 00:02:10,019 these words here, "risk is uncertainty that matters." 35 00:02:11,503 --> 00:02:14,783 Because most of the uncertainties in the world don't matter. 36 00:02:15,564 --> 00:02:19,014 We don't care if it's going to rain in London tomorrow afternoon. 37 00:02:19,400 --> 00:02:23,780 It might, it might not. It's irrelevant, it doesn't matter. 38 00:02:24,498 --> 00:02:26,948 We don't care what the exchange rate will be 39 00:02:26,948 --> 00:02:30,703 if it's between the Russian Ruble and the Chinese Yen in 2020. 40 00:02:30,703 --> 00:02:32,387 It doesn't matter to us. 41 00:02:32,888 --> 00:02:35,118 But there are things on our projects, 42 00:02:35,427 --> 00:02:37,117 and things in our families, 43 00:02:37,259 --> 00:02:38,859 and things in our country, 44 00:02:38,979 --> 00:02:41,446 which are uncertain which do matter to us. 45 00:02:42,195 --> 00:02:45,338 If it's an uncertainty that matters, it's a risk. 46 00:02:46,188 --> 00:02:49,991 So here's another question, how do you know what matters? 47 00:02:50,751 --> 00:02:53,396 In your projects, what are the things that matter? 48 00:02:54,077 --> 00:02:57,875 The things that matter in our projects are our objectives. 49 00:02:58,532 --> 00:03:02,216 So we must always connect uncertainty with objectives, 50 00:03:02,991 --> 00:03:05,631 in order to find the risks. 51 00:03:06,005 --> 00:03:08,355 And if we look at some definitions of risk, 52 00:03:08,361 --> 00:03:11,405 this is the ISO standard that I mentioned, 53 00:03:11,445 --> 00:03:13,796 it connects those words very simply; 54 00:03:13,796 --> 00:03:17,559 Risk is the effect of uncertainty on objectives. 55 00:03:18,451 --> 00:03:21,201 And we might look at another definition from the UK, 56 00:03:21,387 --> 00:03:23,916 from our association for project management, 57 00:03:24,144 --> 00:03:28,134 it says the same thing that risk is an uncertain event 58 00:03:28,152 --> 00:03:32,212 or a set of circumstances, which is uncertain, 59 00:03:32,212 --> 00:03:35,372 but it matters because should it occur, 60 00:03:35,372 --> 00:03:38,587 it will have an effect on achievement of objectives. 61 00:03:38,603 --> 00:03:40,553 Uncertainty that matters. 62 00:03:40,867 --> 00:03:44,317 So we should be looking in our risk register for two things: 63 00:03:44,703 --> 00:03:48,803 "Is it uncertain?" We don't want problems in our risk register. 64 00:03:49,183 --> 00:03:52,113 We don't want issues in the risk register. 65 00:03:52,113 --> 00:03:55,020 We don't want constraints or requirements. 66 00:03:55,291 --> 00:03:59,631 These things are certain, what we want is uncertainties, 67 00:03:59,721 --> 00:04:02,241 something that might happen or might not happen. 68 00:04:03,076 --> 00:04:06,766 But the other important question for our risk register is 69 00:04:06,766 --> 00:04:08,366 "Does it matter?" 70 00:04:08,439 --> 00:04:11,739 Which objective would be affected if this thing happened? 71 00:04:13,304 --> 00:04:15,810 And then when we want to see how big the risk is, 72 00:04:16,160 --> 00:04:18,322 we can ask those two questions: 73 00:04:18,338 --> 00:04:19,768 "How uncertain is it, 74 00:04:19,985 --> 00:04:22,095 and how much does it matter?" 75 00:04:22,132 --> 00:04:24,502 And that will tell us how big the risk is. 76 00:04:24,564 --> 00:04:27,044 So, this idea of uncertainty that matters 77 00:04:27,084 --> 00:04:30,536 then develops into something which is useful 78 00:04:30,618 --> 00:04:33,317 by linking uncertainty to our objectives. 79 00:04:34,767 --> 00:04:37,148 So, we have two dimensions of ‘risk,’ 80 00:04:37,409 --> 00:04:39,658 we have an uncertainty dimension and we 81 00:04:39,658 --> 00:04:42,093 have a dimension that affects our objectives 82 00:04:43,249 --> 00:04:47,419 In projects, we call this probability and impact. 83 00:04:47,449 --> 00:04:49,502 We could call them other things, 84 00:04:49,502 --> 00:04:51,233 there are other English 85 00:04:51,233 --> 00:04:52,767 words we could use, but these 86 00:04:52,767 --> 00:04:54,553 are the ones, most often, we use. 87 00:04:54,702 --> 00:04:57,732 And I would like to ask you with this picture of the mouse. 88 00:04:59,632 --> 00:05:04,647 What effect matters to the mouse? 89 00:05:05,874 --> 00:05:09,315 So first of all, clearly, he is in an uncertain situation here. 90 00:05:09,845 --> 00:05:12,193 And he's seen some risks. 91 00:05:12,457 --> 00:05:15,359 His objective is to get the cheese and stay alive. 92 00:05:15,938 --> 00:05:18,817 And so, one of the risks he has identified is a bad thing 93 00:05:18,903 --> 00:05:21,353 that might happen: he might be killed or injured. 94 00:05:22,177 --> 00:05:24,517 And so, he has been a good project manager, 95 00:05:24,517 --> 00:05:27,032 he has put his little helmet on, and he is preparing 96 00:05:27,152 --> 00:05:32,051 so that it doesn't happen to him. So, he doesn't get killed or injured. 97 00:05:32,051 --> 00:05:32,821 Very good. 98 00:05:33,690 --> 00:05:36,560 And there are things in our projects, that if they happened 99 00:05:36,560 --> 00:05:37,875 would kill or injure us. 100 00:05:37,875 --> 00:05:39,218 They would waste time, 101 00:05:39,218 --> 00:05:41,566 waste money, damage reputation, 102 00:05:41,566 --> 00:05:42,986 destroy performance, 103 00:05:43,202 --> 00:05:45,732 maybe even injure real people. 104 00:05:46,230 --> 00:05:49,880 And as project managers we have to see those things and stop them happening. 105 00:05:49,957 --> 00:05:51,792 Protect ourselves in advance. 106 00:05:51,857 --> 00:05:52,867 Avoid them. 107 00:05:54,240 --> 00:05:57,870 Are there any other uncertainties that matter for the mouse? 108 00:05:59,637 --> 00:06:01,327 Well there is... 109 00:06:01,327 --> 00:06:02,275 the cheese. 110 00:06:02,678 --> 00:06:05,558 There's an uncertainty here which matters a great deal. 111 00:06:05,558 --> 00:06:07,887 "Will I get the cheese out of the trap?" 112 00:06:08,733 --> 00:06:10,429 He might, or he might not. 113 00:06:10,967 --> 00:06:14,121 And if he doesn't get the cheese out of the trap, he's failed 114 00:06:14,961 --> 00:06:17,471 So he has two uncertainties to manage, 115 00:06:17,471 --> 00:06:20,133 one of them is bad - he might be killed or injured - 116 00:06:20,419 --> 00:06:22,639 the other is good - he might get the cheese. 117 00:06:23,129 --> 00:06:24,616 And what he has to do, 118 00:06:24,968 --> 00:06:28,958 what he has to do is to manage both of these at the same time. 119 00:06:29,232 --> 00:06:32,159 And as project managers, we have to do the same thing. 120 00:06:32,788 --> 00:06:36,128 And also we have to do it in the best possible way - 121 00:06:36,128 --> 00:06:40,546 sometimes there's a better way to get the cheese without being killed or injured. 122 00:06:41,428 --> 00:06:44,518 In our projects, we have to stop the bad things happening, 123 00:06:44,889 --> 00:06:47,789 but we also have to get the cheese out of our projects. 124 00:06:49,116 --> 00:06:52,116 "So what does 'cheese' mean, in your project?" 125 00:06:52,116 --> 00:06:54,302 "What is the 'cheese' in your project?" 126 00:06:55,160 --> 00:06:56,640 'Cheese' means value. 127 00:06:56,806 --> 00:06:58,445 'Cheese' means benefits. 128 00:06:58,644 --> 00:07:01,868 'Cheese' means products and services that people want and need. 129 00:07:02,170 --> 00:07:04,290 'Cheese' means customer satisfaction. 130 00:07:04,371 --> 00:07:06,802 'Cheese' is the good stuff that we're trying to get 131 00:07:06,802 --> 00:07:08,465 out of our difficult projects. 132 00:07:08,872 --> 00:07:11,962 And if we don't do anything bad - 133 00:07:11,962 --> 00:07:16,170 we don't waste time, we don't waste money, we don't damage reputation - 134 00:07:16,170 --> 00:07:17,954 but we don't create value, 135 00:07:18,278 --> 00:07:19,338 we've failed. 136 00:07:19,683 --> 00:07:23,183 If the mouse didn't die but he didn't get the cheese, he failed. 137 00:07:23,950 --> 00:07:28,353 If we create benefits, but we waste time and waste money and destroy reputation, 138 00:07:28,353 --> 00:07:29,369 we've failed. 139 00:07:30,015 --> 00:07:32,565 And if the mouse gets the cheese and he's killed, 140 00:07:32,724 --> 00:07:33,784 he's failed. 141 00:07:33,784 --> 00:07:36,076 So we have to do both of these things. 142 00:07:36,353 --> 00:07:39,231 And when we think about risk and think about impact, 143 00:07:39,468 --> 00:07:41,896 there are two kinds of impact that matter. 144 00:07:42,525 --> 00:07:45,175 Bad ones, and good ones. 145 00:07:45,488 --> 00:07:48,125 Uncertainties that could hurt the project, 146 00:07:48,678 --> 00:07:51,568 and uncertainties that could help the project. 147 00:07:51,766 --> 00:07:56,364 Both of these matter and both of these need to be managed. 148 00:07:56,867 --> 00:07:59,078 And we have another word for those. 149 00:07:59,305 --> 00:08:03,791 So, here's the definition of risk from the Project Management Institute, the PMI, 150 00:08:04,007 --> 00:08:05,685 from the PMBok Guide. 151 00:08:05,993 --> 00:08:08,093 It's the same as the others that we've seen: 152 00:08:08,093 --> 00:08:12,379 an uncertain event or condition, that if it occurs, affects an objective. 153 00:08:13,222 --> 00:08:18,534 But PMI knows about the mouse. PMI knows about the cheese and the traps, 154 00:08:18,721 --> 00:08:22,277 and has added three words to the definition of risk here. 155 00:08:23,233 --> 00:08:26,204 It's not the words 'cheese' and 'traps'. 156 00:08:26,432 --> 00:08:29,301 It's the words 'positive or negative'. 157 00:08:30,067 --> 00:08:33,984 What this tells us is that there are good risks, as well as bad risks. 158 00:08:34,544 --> 00:08:37,997 And we heard that in one of our keynote speeches, earlier this morning. 159 00:08:38,507 --> 00:08:42,907 In the uncertain situation that this country faces going forward 160 00:08:42,958 --> 00:08:46,058 with all the changes that there have been, there are threats. 161 00:08:46,058 --> 00:08:48,061 There are things that could go wrong. 162 00:08:48,061 --> 00:08:50,226 And you need to see those and address them. 163 00:08:50,407 --> 00:08:53,188 But there are also opportunities. 164 00:08:53,248 --> 00:08:56,235 Uncertain things that might happen that could be good. 165 00:08:56,918 --> 00:08:59,346 And we also need to see those things, 166 00:08:59,561 --> 00:09:02,699 and to try and proactively make them happen. 167 00:09:03,249 --> 00:09:05,376 And that is equally true in our projects, 168 00:09:05,376 --> 00:09:06,938 in our personal lives, 169 00:09:06,938 --> 00:09:09,308 and also at the national level. 170 00:09:09,778 --> 00:09:13,578 And I'll be talking about some of those things later on this afternoon 171 00:09:14,717 --> 00:09:19,161 So, PMI has this definition. The other standards have something very similar. 172 00:09:19,541 --> 00:09:21,448 The ISO standard, at the bottom here, 173 00:09:21,448 --> 00:09:25,619 says 'risk is the effect of uncertainty on objectives.' 174 00:09:26,536 --> 00:09:29,252 Note, the effect can be positive or negative. 175 00:09:31,009 --> 00:09:34,726 And the APM, Association for Project Management in the UK says the same thing. 176 00:09:35,426 --> 00:09:39,954 So we have this new idea, that risk is a double-sided concept. 177 00:09:41,090 --> 00:09:43,959 And it's the same impression, the word you have for risk, 178 00:09:44,329 --> 00:09:48,002 we mostly think of bad things. But it could be used for good things, 179 00:09:48,002 --> 00:09:49,597 as well. Isn't that right? 180 00:09:49,597 --> 00:09:51,384 It's an uncertain word. 181 00:09:51,875 --> 00:09:55,031 And there are good risks as well as bad risks. 182 00:09:55,991 --> 00:09:59,364 So in our project risk management process, 183 00:09:59,574 --> 00:10:03,181 we should be looking out for the traps and avoiding them 184 00:10:03,181 --> 00:10:06,004 and protecting ourselves and preventing them happening. 185 00:10:06,004 --> 00:10:09,147 But we should also be looking out for the cheese 186 00:10:09,147 --> 00:10:11,549 and chasing it, and making it happen proactively, 187 00:10:11,549 --> 00:10:14,897 so we get the maximum benefit for the minimum cost. 188 00:10:15,957 --> 00:10:19,375 That’s why risk management is so important to 189 00:10:19,712 --> 00:10:22,676 project success: because it effects our objectives. 190 00:10:23,817 --> 00:10:27,426 It gives us the best possible chance to achieve our goals. 191 00:10:28,570 --> 00:10:30,290 So how do we do that? 192 00:10:30,621 --> 00:10:33,104 If we think about the risk management process, 193 00:10:33,539 --> 00:10:35,899 the process has to do a number of things. 194 00:10:36,524 --> 00:10:39,564 If risk is uncertainty that affects objectives, 195 00:10:39,633 --> 00:10:41,753 we have to know what our objectives are. 196 00:10:42,076 --> 00:10:44,416 Then, we have to identify the uncertainties. 197 00:10:45,099 --> 00:10:48,459 The uncertainties that would matter to those objectives. 198 00:10:48,618 --> 00:10:53,058 And remember that they could be good or bad, threats and opportunities. 199 00:10:53,897 --> 00:10:56,747 That gives us a long list of uncertainties that matter, 200 00:10:56,777 --> 00:10:58,477 but they don't all matter the same. 201 00:10:59,218 --> 00:11:03,528 So the next thing we have to do is to prioritize, and ask the question 202 00:11:04,287 --> 00:11:06,837 "How uncertain, and how much does it matter?" 203 00:11:07,053 --> 00:11:10,133 Then we get a prioritized list of risks. 204 00:11:10,210 --> 00:11:14,390 We know which are the worst threats and the best opportunities, 205 00:11:14,811 --> 00:11:17,061 so that we do something about it. 206 00:11:17,508 --> 00:11:19,384 Then we plan how to respond. 207 00:11:19,411 --> 00:11:23,294 We think about what would be appropriate to stop the bad thing happening 208 00:11:23,344 --> 00:11:24,974 and to make the good thing happen. 209 00:11:25,583 --> 00:11:28,920 And having decided, we do it of course. 210 00:11:29,851 --> 00:11:33,641 And then risk is constantly changing so we need to come back and do it again, 211 00:11:33,873 --> 00:11:35,923 and see what has changed. 212 00:11:36,518 --> 00:11:42,048 We could express this process as a number of questions that it's important to ask, 213 00:11:42,184 --> 00:11:45,604 and keep on asking about our project. 214 00:11:46,337 --> 00:11:49,897 In fact, you can use these questions for anything. 215 00:11:50,106 --> 00:11:54,076 You could use these questions for your next career move. 216 00:11:54,524 --> 00:11:58,914 You could use these questions for deciding about your pension. 217 00:11:59,141 --> 00:12:03,691 You could use these questions to decide how to bring up your children 218 00:12:04,323 --> 00:12:09,183 or to decide on how to invest the nation's wealth. 219 00:12:09,996 --> 00:12:11,759 These are the questions: 220 00:12:11,799 --> 00:12:15,409 "What are we trying to achieve?" That's setting objectives. 221 00:12:15,979 --> 00:12:18,439 Then, "what could affect us in achieving that?" 222 00:12:18,534 --> 00:12:20,574 That's identifying risks. 223 00:12:20,915 --> 00:12:24,455 Then, "when we have a list of risks, which are the most important ones?" 224 00:12:24,742 --> 00:12:27,392 That's prioritizing at that assessing the risks. 225 00:12:27,674 --> 00:12:29,814 Then, "what could we do about it?" 226 00:12:30,242 --> 00:12:34,402 Planning our responses and doing it, implementing the responses. 227 00:12:34,846 --> 00:12:39,166 And then, "did it work and what's changed" Reviewing the risk. 228 00:12:39,306 --> 00:12:43,766 So if we look at a risk management process, we could link each step in the 229 00:12:43,800 --> 00:12:46,930 process to one of these questions. 230 00:12:47,093 --> 00:12:49,773 And this is why risk management is so easy, 231 00:12:49,876 --> 00:12:56,116 because all we're doing is asking and answering obvious questions. 232 00:12:56,297 --> 00:13:01,117 Anybody who's doing anything important will ask these questions: 233 00:13:01,320 --> 00:13:03,820 "What am I trying to do?" "What could affect me?" 234 00:13:03,896 --> 00:13:06,462 "Which are the big ones?" "What shall I do about it?" 235 00:13:06,473 --> 00:13:08,983 "Did that work?" "Now what?" 236 00:13:09,703 --> 00:13:14,383 And you could ask those questions every Monday morning when you drove to work, 237 00:13:14,402 --> 00:13:16,032 or every Saturday morning. 238 00:13:16,032 --> 00:13:17,786 You can ask the question, say 239 00:13:17,791 --> 00:13:20,831 "What am I trying to achieve today?" "This week?" 240 00:13:21,286 --> 00:13:23,636 "What could affect me and which are the big ones?" 241 00:13:23,743 --> 00:13:24,835 "What shall I do?" 242 00:13:24,871 --> 00:13:30,351 We can manage risk on a very simple basis, or we can use this as the structure for 243 00:13:30,394 --> 00:13:35,114 a risk process which is much more complex, which involves lots of meetings, 244 00:13:35,139 --> 00:13:39,079 and lots of stakeholder groups and lots of analysis and statistics. 245 00:13:39,098 --> 00:13:41,188 It's the same questions. 246 00:13:41,909 --> 00:13:45,306 So I would like you to remember two important things. 247 00:13:45,319 --> 00:13:49,229 One is, risk is uncertainty that matters. 248 00:13:49,554 --> 00:13:53,854 And secondly, these questions, these six questions. 249 00:13:54,535 --> 00:13:58,235 Because that's the heart, that's the basis of managing risk, 250 00:13:58,245 --> 00:14:00,761 and it really is very, very easy. 251 00:14:01,402 --> 00:14:06,197 Now, in the time that we have, I want to focus on just two parts of this process, 252 00:14:06,351 --> 00:14:10,591 and then give us the opportunity to try out some of these things. 253 00:14:10,618 --> 00:14:14,308 The identification step, clearly very, very important 254 00:14:14,344 --> 00:14:18,494 because if we don't identify the risks, we can't manage them. 255 00:14:18,977 --> 00:14:21,617 And then planning responses. 256 00:14:21,880 --> 00:14:26,310 Understanding how we can deal with the uncertainties that we've identified. 257 00:14:26,590 --> 00:14:30,190 So, let's think about these things: identifying risks. 258 00:14:30,363 --> 00:14:32,493 How do we find all of the risks? 259 00:14:33,496 --> 00:14:35,016 Well, you can't. 260 00:14:35,016 --> 00:14:38,782 You can't find all of the risks because there are risks that arrive 261 00:14:38,803 --> 00:14:40,563 that we hadn't seen before. 262 00:14:40,563 --> 00:14:44,386 There are emergent risks, new risks, different risks 263 00:14:44,607 --> 00:14:48,907 and I'll be talking about those later this afternoon in my speech. 264 00:14:49,088 --> 00:14:54,848 What we want to find are the knowable risks: the risks that we could find. 265 00:14:55,249 --> 00:14:58,609 We don't want somebody on our project team who knows a risk 266 00:14:58,609 --> 00:15:00,192 and they're not telling anybody. 267 00:15:00,235 --> 00:15:04,525 So this process is about exposing the uncertainties that matter, 268 00:15:04,533 --> 00:15:06,773 finding them so we can do something about them. 269 00:15:06,888 --> 00:15:08,708 And there are lots of techniques, 270 00:15:08,708 --> 00:15:11,724 brainstorming, workshops, check lists, 271 00:15:11,724 --> 00:15:15,144 testing our assumptions and so on. 272 00:15:15,398 --> 00:15:18,028 But I would like to answer a bigger question, 273 00:15:18,262 --> 00:15:20,439 a different question from techniques. 274 00:15:21,479 --> 00:15:24,173 And it's the question, "are we finding the real risks?" 275 00:15:25,393 --> 00:15:29,787 When you go to a risk workshop and you write things in your risk register, 276 00:15:30,007 --> 00:15:33,724 are they really the uncertainties that matter for your project? 277 00:15:34,434 --> 00:15:39,874 Are these really the things that could drive you off track or really help you? 278 00:15:40,249 --> 00:15:42,419 Or are they just the obvious things? 279 00:15:42,419 --> 00:15:45,954 Where all projects have problems with requirements, 280 00:15:45,954 --> 00:15:49,541 with resources, with testing. These are things that 281 00:15:49,541 --> 00:15:52,625 always come up, and we have processes to deal with them. 282 00:15:53,733 --> 00:15:55,754 But are they the real risks? 283 00:15:56,034 --> 00:15:59,014 I would like to suggest to you that often in our risk registers 284 00:15:59,014 --> 00:16:02,018 we confuse real risks with other things. 285 00:16:03,021 --> 00:16:07,725 Often, we confuse risks with their causes, where does the risk come from? 286 00:16:08,555 --> 00:16:13,125 Or we confuse risk with their effects, what do they do if they happen? 287 00:16:14,005 --> 00:16:16,525 But risks are uncertainties that matter. 288 00:16:17,565 --> 00:16:20,405 They are not causes or effects. 289 00:16:20,470 --> 00:16:22,767 So causes are things that are true. 290 00:16:23,252 --> 00:16:25,743 This is true that the project is difficult, 291 00:16:26,237 --> 00:16:29,370 it is true that we do not have enough people on the project. 292 00:16:29,730 --> 00:16:33,233 it is true that the customer hasn't signed the contract yet. 293 00:16:33,553 --> 00:16:36,631 These are not risks, they are facts. 294 00:16:36,786 --> 00:16:38,426 They might be issues. 295 00:16:38,426 --> 00:16:42,164 They might be problems, but they are not risks because they are not uncertain. 296 00:16:42,607 --> 00:16:45,437 And a lot of people write these things in our risk register. 297 00:16:45,437 --> 00:16:47,589 "We don't have enough time for this project." 298 00:16:47,589 --> 00:16:48,819 "It’s a risk!" 299 00:16:48,819 --> 00:16:51,360 No, it’s a problem. 300 00:16:52,236 --> 00:16:55,164 Sometimes we confuse risks with their effects. 301 00:16:55,335 --> 00:16:58,635 There could be an accident, we could be late. 302 00:16:58,835 --> 00:17:02,204 those are not risks either, they are the effects of risks, 303 00:17:02,204 --> 00:17:06,941 how do you manage, we could be late? If your late, it’s too late. 304 00:17:07,264 --> 00:17:10,547 What we want to know is, why might you be late? 305 00:17:10,777 --> 00:17:15,230 What unplanned thing could happen that would result in you being late? 306 00:17:15,542 --> 00:17:19,439 So, risks sit between causes and effects. 307 00:17:19,939 --> 00:17:23,673 We can’t manage causes because they're here now, they're facts. 308 00:17:24,193 --> 00:17:27,339 We don't want to manage effects because they may never happen. 309 00:17:27,799 --> 00:17:30,857 What we can manage is risks that sit in the middle 310 00:17:30,857 --> 00:17:33,322 because they haven't happened yet. 311 00:17:34,282 --> 00:17:38,028 So, risk management has to separate risks from 312 00:17:38,028 --> 00:17:41,258 their causes and risks from their effects. 313 00:17:42,108 --> 00:17:46,090 And I find looking at hundreds of risk registers all around the world. 314 00:17:46,920 --> 00:17:51,758 I've worked in 48 different countries, every continent, every culture. 315 00:17:52,108 --> 00:17:56,480 Uh, not the Antarctic, it’s too cold. Um, but nearly every continent. 316 00:17:56,670 --> 00:18:02,360 And over half of the stuff in risk registers are causes or effects. 317 00:18:02,690 --> 00:18:03,707 Over half. 318 00:18:04,233 --> 00:18:07,063 So the things we are trying to manage in the risk register 319 00:18:07,103 --> 00:18:10,486 are not risks and then people are surprised that it doesn't work. 320 00:18:11,506 --> 00:18:16,153 So how do we separate cause, risk, and effect. Here is a little test. 321 00:18:17,013 --> 00:18:19,838 And these statements are written in your notes. 322 00:18:20,028 --> 00:18:22,299 Or you can just think as we go. 323 00:18:22,299 --> 00:18:26,080 Each of these statements and they are all very simple is one of these things. 324 00:18:26,120 --> 00:18:28,436 A cause is something that is true today. 325 00:18:28,996 --> 00:18:31,730 A risk is an uncertainty that might, or might not happen. 326 00:18:32,220 --> 00:18:35,120 The effect is why it matters to our objective. 327 00:18:36,167 --> 00:18:38,557 Okay? So you have to think what these are. 328 00:18:38,987 --> 00:18:41,806 The project is based in a third-world country. 329 00:18:41,906 --> 00:18:44,055 Cause? Risk? Or effect? What do you think? 330 00:18:44,695 --> 00:18:46,139 Cause! Very good. 331 00:18:46,309 --> 00:18:50,130 So, this is a fact, there might be uncertainties that come out of this fact. 332 00:18:50,340 --> 00:18:54,924 So we may not get the resources we need, there may be security concerns. 333 00:18:55,364 --> 00:18:59,907 We may not get paid. These are uncertainties that come from this fact. 334 00:19:01,107 --> 00:19:03,516 Interest rates might go down. 335 00:19:03,816 --> 00:19:04,816 It's a risk. 336 00:19:04,826 --> 00:19:07,094 Or they could stay the same or they could go up. 337 00:19:07,094 --> 00:19:09,692 And we could go over budget. 338 00:19:10,013 --> 00:19:11,302 It's an effect. 339 00:19:11,332 --> 00:19:13,622 So, a million things could take you over budget, 340 00:19:13,622 --> 00:19:15,393 maybe interest rates is one of them. 341 00:19:15,393 --> 00:19:17,200 Okay? They were easy. How about this? 342 00:19:17,200 --> 00:19:19,796 The weather might be better than usual. 343 00:19:20,056 --> 00:19:21,756 So risk could be the same or worse. 344 00:19:22,806 --> 00:19:26,270 It would be a bad thing if you were selling umbrellas. 345 00:19:27,250 --> 00:19:30,290 It would be a good thing if you were selling ice cream. 346 00:19:31,220 --> 00:19:32,987 It depends what your project is. 347 00:19:34,007 --> 00:19:36,454 Um, I'm allergic to prawns. 348 00:19:38,234 --> 00:19:39,920 It's a cause, it's a fact. 349 00:19:39,920 --> 00:19:44,353 What is the risk that comes from this fact, this cause? 350 00:19:47,818 --> 00:19:49,846 You think maybe I could be sick? 351 00:19:50,236 --> 00:19:53,180 I could have a reaction. I could be very ill. I could die. 352 00:19:54,640 --> 00:19:57,948 All of those things are effects. Aren’t they? 353 00:19:58,578 --> 00:20:00,864 But if something happens that I didn't plan, 354 00:20:00,864 --> 00:20:03,911 because I am allergic something might happen that makes me sick. 355 00:20:04,621 --> 00:20:06,532 What's the something? 356 00:20:07,342 --> 00:20:09,264 I might eat prawns without knowing. 357 00:20:09,614 --> 00:20:14,421 So then I check, are there prawns in this? You know I avoid things with prawn in them 358 00:20:14,741 --> 00:20:18,247 I manage the risk and not the effect. And not the cause. 359 00:20:18,354 --> 00:20:21,684 Okay, we have got to use a new technique, an unproven technique. 360 00:20:23,144 --> 00:20:25,725 It's a fact, it's a requirement, we have to do it. 361 00:20:25,725 --> 00:20:28,843 we might introduce design errors but it just is a fact. 362 00:20:28,843 --> 00:20:30,593 A requirement of our project. 363 00:20:30,593 --> 00:20:33,375 The contractor may not deliver on time is a risk. 364 00:20:34,155 --> 00:20:36,005 Um, this is going too fast. 365 00:20:36,365 --> 00:20:38,517 It might not work for some reason. 366 00:20:39,197 --> 00:20:40,857 You saw the color, it's an effect. 367 00:20:40,857 --> 00:20:44,759 Okay, I will go more slowly. Uh, we don't have enough people. 368 00:20:47,039 --> 00:20:50,942 It's a cause, yes. And lastly, there's a risk that we'll be late. 369 00:20:53,781 --> 00:20:57,229 Hmm...mm. It's an effect, is it? 370 00:20:58,069 --> 00:21:01,112 Because we want to know what is the risk that we'll be late. 371 00:21:01,502 --> 00:21:03,133 Being late is an effect. 372 00:21:03,423 --> 00:21:08,619 So apart from the prawns, all of the blue and green things we see in risk registers. 373 00:21:09,743 --> 00:21:16,568 The project environment, new technology, lack of resources, or going over budget. 374 00:21:16,568 --> 00:21:20,890 Lack of performance, delivering late. These are not risks. 375 00:21:20,980 --> 00:21:22,610 These are causes or effects. 376 00:21:23,549 --> 00:21:28,020 And if we looked at a real risk register and this is written in your notes for you 377 00:21:28,019 --> 00:21:31,116 If you want to do this afterward, we could do another exercise 378 00:21:32,016 --> 00:21:35,891 In fact, the next page of the notes, if you turn over the page 379 00:21:35,891 --> 00:21:38,511 has these written a bit larger for you 380 00:21:39,010 --> 00:21:40,495 English only I'm afraid. 381 00:21:40,588 --> 00:21:42,758 We'll have to do something about that. 382 00:21:43,588 --> 00:21:47,808 Um. You could just try this little exercise on a real risk register 383 00:21:49,153 --> 00:21:52,889 This is one of my clients, I asked them for their top 10 risks. 384 00:21:52,889 --> 00:21:54,132 This is what they gave me. 385 00:21:54,132 --> 00:21:57,059 They're not risks. They're all sorts of things mixed up. 386 00:21:58,496 --> 00:22:01,476 Really, you should do this on your risk register. 387 00:22:02,355 --> 00:22:06,205 But let me show you what happened when I did this on their risk register. 388 00:22:06,699 --> 00:22:09,411 I found there was a whole mixture of things. 389 00:22:10,033 --> 00:22:14,333 So, the current hardware is not fast enough to support testing. That's a fact. 390 00:22:15,333 --> 00:22:16,163 It's a cause. 391 00:22:17,019 --> 00:22:20,669 This means that we may be unable to test performance 392 00:22:20,669 --> 00:22:22,862 until production hardware is used. 393 00:22:23,521 --> 00:22:24,711 That's the risk. 394 00:22:25,518 --> 00:22:27,767 So we have two things in this statement. 395 00:22:28,749 --> 00:22:31,130 The next one down is just a fact. 396 00:22:31,467 --> 00:22:35,467 A number of usability issues have been identified by the supplier. 397 00:22:36,273 --> 00:22:37,872 Okay, so what? 398 00:22:38,638 --> 00:22:40,218 What difference does that make? 399 00:22:40,977 --> 00:22:44,560 Let me color code this for you. Just to be slightly friendly. 400 00:22:44,560 --> 00:22:45,330 Umm. 401 00:22:45,330 --> 00:22:49,102 But you will have to do it on your own if you want to try the complete exercise. 402 00:22:49,523 --> 00:22:53,863 Umm. There is a whole range of different things in this so-called risk register. 403 00:22:54,543 --> 00:22:57,481 And I would expect that yours is the same. 404 00:22:57,916 --> 00:23:02,192 That you'll have things in your risk register that are just pure facts. 405 00:23:02,473 --> 00:23:05,824 Or things that are a mixture of risks and other things 406 00:23:06,997 --> 00:23:10,997 Now, there are two in this list that I think are particularly interesting. 407 00:23:11,444 --> 00:23:14,645 It's this one and this one. They have all three colors in them. 408 00:23:15,708 --> 00:23:18,207 Because they have a cause and a risk and an effect. 409 00:23:19,518 --> 00:23:23,518 So, let take this one. The team does not have a documented design. 410 00:23:24,109 --> 00:23:26,438 For this function. That's a fact. 411 00:23:26,944 --> 00:23:27,734 So what? 412 00:23:28,042 --> 00:23:30,659 Well, there's the risk that the architecture 413 00:23:30,659 --> 00:23:33,769 may not support the required functionality. 414 00:23:33,769 --> 00:23:37,467 That might happen because we don't have a documented design. 415 00:23:38,177 --> 00:23:39,534 Why do we care about that? 416 00:23:39,534 --> 00:23:43,543 If that happens, it results in the requirements not being met. 417 00:23:43,608 --> 00:23:45,648 or a higher number of defects. 418 00:23:45,648 --> 00:23:49,161 That hits our performance objective and our quality objective. 419 00:23:49,958 --> 00:23:53,633 So, now we have three things, we know what the risk is. 420 00:23:54,344 --> 00:23:57,784 The risk is that the architecture might not support the functionality. 421 00:23:58,875 --> 00:24:02,498 We know why that's happening, because we don't have a documented design. 422 00:24:02,498 --> 00:24:06,768 And we know how it could affect the project in not meeting the requirements, 423 00:24:07,226 --> 00:24:09,326 or delivering defects. 424 00:24:10,261 --> 00:24:12,329 Those are really useful things to know. 425 00:24:13,011 --> 00:24:17,961 And it will be helpful if every risk description had those three things in it. 426 00:24:18,257 --> 00:24:22,076 And, so what we recommend is a structured description of risk 427 00:24:22,076 --> 00:24:24,014 that has three parts to it. 428 00:24:24,789 --> 00:24:31,389 That says "as a result of" some fact, a cause. Then, an uncertainty might occur. 429 00:24:31,886 --> 00:24:33,516 It might not, but it might. 430 00:24:33,855 --> 00:24:35,825 And if it did, it would be a risk. 431 00:24:37,614 --> 00:24:40,623 and if that thing actually happened, it would lead to 432 00:24:40,880 --> 00:24:42,647 An affect on the objectives 433 00:24:43,252 --> 00:24:48,816 And we recommend and PMI recommends and the ISO standard recommends 434 00:24:49,367 --> 00:24:51,267 and best practice guidelines recommend. 435 00:24:51,377 --> 00:24:53,967 But you describe your risk in these three stages. 436 00:24:53,967 --> 00:24:57,967 What do we know, what uncertainty does that gives us, and why does it matter? 437 00:24:59,118 --> 00:25:02,568 And then we can use it to help us manage the risk. 438 00:25:03,769 --> 00:25:08,201 In English, we have definite words to describe facts 439 00:25:08,201 --> 00:25:11,832 This is true. This has happened. This does occur. 440 00:25:13,088 --> 00:25:17,343 We have uncertain words to describe the risk. It might or it might not 441 00:25:17,343 --> 00:25:18,523 It's possible. 442 00:25:19,284 --> 00:25:23,134 And then we have conditional words that say this would follow 443 00:25:23,134 --> 00:25:24,724 if the risk occurred. 444 00:25:25,481 --> 00:25:27,631 Maybe your language is a little different. 445 00:25:27,631 --> 00:25:30,547 But we can use the language to help us perhaps. 446 00:25:31,465 --> 00:25:33,355 So one of the things I'd like us to try, 447 00:25:33,444 --> 00:25:36,224 in the short exercise we're going to do in a moment, 448 00:25:36,784 --> 00:25:41,474 is to try describing risks in that three part way. 449 00:25:41,579 --> 00:25:42,759 What do we know? 450 00:25:43,134 --> 00:25:45,029 What uncertainty does it give us? 451 00:25:45,337 --> 00:25:47,507 And why does that matter to our objectives? 452 00:25:47,857 --> 00:25:50,933 And I would recommend that you try that for your own 453 00:25:50,933 --> 00:25:55,113 real risk register on your project, and see what difference it makes. 454 00:25:56,072 --> 00:25:57,532 You might be surprised. 455 00:25:58,184 --> 00:26:02,554 Now, let's think about the next question, which is not, 456 00:26:02,554 --> 00:26:04,094 Well, there is another question. 457 00:26:04,094 --> 00:26:05,494 "How do we prioritize them?" 458 00:26:05,494 --> 00:26:08,015 But the one I want to focus on is, "What could we do 459 00:26:08,015 --> 00:26:09,938 about the risks that we've identified?'" 460 00:26:09,938 --> 00:26:12,278 Planning risk responses. 461 00:26:12,781 --> 00:26:14,790 Here are the questions we need to ask. 462 00:26:15,268 --> 00:26:18,018 "What are we going to do based on the risk?" 463 00:26:18,489 --> 00:26:19,779 How manageable it is. 464 00:26:20,626 --> 00:26:23,841 How bad or good it might be if we left it alone 465 00:26:24,057 --> 00:26:25,677 impacts the variety. 466 00:26:26,227 --> 00:26:29,575 Whether we have the people and the equipment of the skills 467 00:26:29,689 --> 00:26:30,719 to deal with it. 468 00:26:30,931 --> 00:26:32,581 A resource availability 469 00:26:33,234 --> 00:26:34,674 and cost effectiveness. 470 00:26:34,864 --> 00:26:37,614 Can we spend a small amount to save a big amount? 471 00:26:38,486 --> 00:26:42,156 We don't want to spend a big amount to save a small amount. 472 00:26:42,892 --> 00:26:44,812 And the next important question 473 00:26:44,848 --> 00:26:46,248 "who is going to do this?" 474 00:26:47,681 --> 00:26:50,531 What could we do to deal with risk? 475 00:26:51,787 --> 00:26:54,127 Often, people think of four things. 476 00:26:54,127 --> 00:26:57,733 Four different types of things we could do to address 477 00:26:57,733 --> 00:26:59,209 uncertainties that matter. 478 00:26:59,690 --> 00:27:02,231 And each of these has a name. 479 00:27:02,804 --> 00:27:05,884 It's a strategy. A strategy to focus our planning. 480 00:27:06,804 --> 00:27:08,734 To focus our thinking. 481 00:27:08,734 --> 00:27:13,689 And then, once we've focused our thinking with a strategy, we can develop tactics 482 00:27:13,740 --> 00:27:15,693 to address each individual risk. 483 00:27:15,783 --> 00:27:18,403 So, what are the four things that most people think of? 484 00:27:18,752 --> 00:27:20,842 The first is risk avoidance. 485 00:27:21,237 --> 00:27:25,237 Is there something we can do to kill the risk, to remove it altogether? 486 00:27:26,491 --> 00:27:29,471 The second is something we call risk transfer. 487 00:27:30,181 --> 00:27:31,601 Can we give it away? 488 00:27:31,721 --> 00:27:34,011 Can we get somebody else to take it away for us? 489 00:27:35,726 --> 00:27:38,346 The third is what we call risk reduction. 490 00:27:38,851 --> 00:27:41,521 Some people call this risk mitigation. 491 00:27:41,880 --> 00:27:44,290 And here, we're trying to make the risk smaller 492 00:27:44,746 --> 00:27:46,096 so that we could accept it. 493 00:27:47,879 --> 00:27:52,139 And the fourth response after avoid, transfer, or reduce 494 00:27:52,958 --> 00:27:54,788 is the one that everyone forgets. 495 00:27:55,640 --> 00:27:57,770 They think if we can't do anything about it 496 00:27:58,101 --> 00:28:01,091 we just have to hope and pray and wonder and wait. 497 00:28:02,633 --> 00:28:03,925 The other response is 498 00:28:04,289 --> 00:28:05,619 to take the risk. 499 00:28:05,812 --> 00:28:08,012 We call that risk acceptance. 500 00:28:08,224 --> 00:28:12,444 To recognize we're taking this risk and to include it in our baseline 501 00:28:12,478 --> 00:28:14,559 and to monitor it very carefully. 502 00:28:15,405 --> 00:28:21,967 So, you might see those four options as quite a good set of response strategies. 503 00:28:22,640 --> 00:28:23,896 But there's a problem. 504 00:28:24,969 --> 00:28:28,689 The problem is all these things only work for bad risks. 505 00:28:29,604 --> 00:28:31,614 What about opportunities? 506 00:28:32,088 --> 00:28:35,788 We don't want to avoid or give away or make smaller 507 00:28:35,905 --> 00:28:37,445 opportunities. 508 00:28:37,656 --> 00:28:41,784 So, how do you respond if you find a good thing that might happen 509 00:28:41,784 --> 00:28:43,004 on your project. 510 00:28:43,609 --> 00:28:45,919 Do you just wait and see and hope? 511 00:28:46,641 --> 00:28:49,621 Or is there something active that we could do? 512 00:28:50,815 --> 00:28:54,895 Fortunately, there are four response strategies for opportunities 513 00:28:55,392 --> 00:28:59,623 that match the four response strategies for threats. 514 00:29:00,236 --> 00:29:01,932 So, here are the bad ones. 515 00:29:01,932 --> 00:29:03,319 Avoid a bad thing. 516 00:29:03,702 --> 00:29:05,282 Give it to someone to take away. 517 00:29:05,362 --> 00:29:06,648 Make it smaller. 518 00:29:06,740 --> 00:29:08,041 Or take the risk. 519 00:29:09,262 --> 00:29:11,552 This is not those things I'm trying to achieve. 520 00:29:12,208 --> 00:29:13,718 To remove the uncertainty. 521 00:29:13,938 --> 00:29:15,655 To get somebody else to help. 522 00:29:16,174 --> 00:29:18,014 To change the size of the risk. 523 00:29:18,228 --> 00:29:20,643 Or to include it in our project plan. 524 00:29:21,654 --> 00:29:23,964 We could do all of those four things, 525 00:29:24,230 --> 00:29:25,500 for opportunities. 526 00:29:26,008 --> 00:29:28,078 How do you eliminate uncertainty 527 00:29:28,383 --> 00:29:29,713 from opportunity? 528 00:29:30,964 --> 00:29:32,114 You capture it. 529 00:29:32,520 --> 00:29:33,830 Take up a strategy, 530 00:29:34,436 --> 00:29:36,456 which makes it definitely happen. 531 00:29:37,474 --> 00:29:39,864 In English, we call this "Exploit". 532 00:29:40,034 --> 00:29:42,174 Exploit is the same as avoid. 533 00:29:42,556 --> 00:29:45,206 For avoid, you make the probability zero. 534 00:29:45,667 --> 00:29:46,856 It can't happen. 535 00:29:47,811 --> 00:29:50,201 For a threat, it's avoid. 536 00:29:50,447 --> 00:29:52,107 For opportunity, exploit. 537 00:29:52,422 --> 00:29:54,932 It's to make the probability 100% 538 00:29:55,579 --> 00:29:57,839 It will happen. It must happen. 539 00:29:58,116 --> 00:29:59,826 So they're aggressive strategies. 540 00:30:00,005 --> 00:30:02,970 You kill the threat, you capture the opportunity 541 00:30:03,687 --> 00:30:05,127 It's the same kind of thing. 542 00:30:05,852 --> 00:30:09,932 What could we do, instead of giving away, transferring a threat? 543 00:30:10,301 --> 00:30:12,811 We want to involve somebody else to help us. 544 00:30:13,384 --> 00:30:15,174 We could share the opportunity. 545 00:30:15,217 --> 00:30:17,857 We could ask them to come into our project 546 00:30:17,857 --> 00:30:21,032 and be involved with us in a joint venture 547 00:30:21,085 --> 00:30:23,772 or a subcontract, or a partnership. 548 00:30:23,847 --> 00:30:27,639 Where they help us to achieve this uncertainy that would help us all? 549 00:30:27,689 --> 00:30:31,123 And we give them some part of the benefit, we share the opportunity 550 00:30:31,168 --> 00:30:35,008 How could we change the size of an opportunity? 551 00:30:35,008 --> 00:30:38,608 We don't want to reduce it, we want to enhance it. 552 00:30:38,639 --> 00:30:41,649 We want to grow it, we want to make it more likely. 553 00:30:41,649 --> 00:30:45,981 And bigger impact. It's the same idea but the other way around for the opportunity. 554 00:30:47,595 --> 00:30:50,925 And the last one, if we can't do these active things, we could just 555 00:30:50,998 --> 00:30:53,738 Accept an opportunity and wait and see what happens. 556 00:30:53,898 --> 00:30:57,898 But monitor it very closely if there's nothing else we could do. 557 00:30:58,541 --> 00:31:03,731 So what this slide tells us is that there's an equal variety 558 00:31:03,940 --> 00:31:09,480 Of potential response times that we can choose between for our opportunities 559 00:31:09,480 --> 00:31:12,880 Equal to the number that we have threats. 560 00:31:12,951 --> 00:31:16,831 You see, the secret to thinking about opportunities... 561 00:31:16,938 --> 00:31:21,518 Is to recognize that an opportunity is the same as a threat. 562 00:31:21,625 --> 00:31:25,775 The only difference is the sign of the impact. 563 00:31:28,206 --> 00:31:32,586 So a threat has a negative impact, an opportunity has a positive impact. 564 00:31:33,535 --> 00:31:35,695 Apart from that, they're the same. 565 00:31:36,374 --> 00:31:38,846 They are both uncertainties that matter. 566 00:31:38,936 --> 00:31:41,506 They are both things that might or might not happen. 567 00:31:41,581 --> 00:31:43,151 But could affect our objectives. 568 00:31:43,314 --> 00:31:45,764 They can both be managed practically. 569 00:31:45,795 --> 00:31:49,725 They both make a difference to the chances of succeeding on our project. 570 00:31:50,465 --> 00:31:55,005 And that's why risk management should manage threats and opportunities together 571 00:31:55,154 --> 00:31:57,534 in a single process. 572 00:31:57,607 --> 00:32:00,117 Because they are the same things. 573 00:32:00,319 --> 00:32:03,613 And that may be new thinking for some of you. 574 00:32:03,656 --> 00:32:08,466 Those of you who always think of risk as a big ugly thing waiting to squash me. 575 00:32:09,068 --> 00:32:11,888 Or the unknown thing in the future that's going to hurt me. 576 00:32:12,344 --> 00:32:16,334 There are some like that, and we need to stop them happening to protect ourselves. 577 00:32:16,959 --> 00:32:20,569 But there are also some very good things out that which might happen 578 00:32:21,168 --> 00:32:23,488 Which we need to see, and we need to chase them. 579 00:32:24,218 --> 00:32:27,698 And make them happen. So that our projects could be more successful. 580 00:32:29,383 --> 00:32:32,683 There is another response strategy that we might try. 581 00:32:33,440 --> 00:32:37,840 Which is really not recommended, and just pretending that there are no risks 582 00:32:38,590 --> 00:32:41,940 and hiding away and saying maybe it will never happen. 583 00:32:42,309 --> 00:32:44,579 We really don't recommend this at all. 584 00:32:44,629 --> 00:32:49,639 In fact, it's probably true that ostriches don't bury their heads in the sand. 585 00:32:49,680 --> 00:32:54,560 It's just the way that the sand dunes kind of look and it's just a pretend story 586 00:32:55,827 --> 00:32:58,677 And sadly for project managers, it's not a pretend story. 587 00:32:58,680 --> 00:33:01,460 We hide our heads and we pretend there are no risks. 588 00:33:01,460 --> 00:33:03,458 And then we get surprised. 589 00:33:03,458 --> 00:33:05,738 Well, we can do better than that. 590 00:33:05,738 --> 00:33:10,180 So, let me just finish here just to say we do need to do something about this