0:00:00.501,0:00:04.428 Okay, let's have a look at[br]risk management in practice 0:00:04.457,0:00:08.474 And what I want to do[br]is to start with some basic concepts 0:00:08.485,0:00:14.015 then focus on two difficult areas[br]in the risk process 0:00:14.242,0:00:19.164 So, I guess if I asked you[br]to define the word 'risk' 0:00:19.174,0:00:22.954 you would have some ideas[br]of what it meant 0:00:22.967,0:00:26.476 We might not have a formal definition[br]that we could quote, 0:00:26.476,0:00:30.253 but we all have something in our minds[br]when we hear the word 'risk' 0:00:30.274,0:00:33.972 This is what we think,[br]and maybe you think of things like this 0:00:34.234,0:00:38.534 Maybe you feel like this little guy,[br]facing some big ugly challenge 0:00:38.534,0:00:41.791 that you know is just going to[br]squash you flat. 0:00:42.066,0:00:43.766 Maybe you feel like this guy. 0:00:44.024,0:00:46.489 This is a real job in North Korea, 0:00:47.768,0:00:51.367 and his job is to hold the target[br]for other people to shoot at 0:00:51.500,0:00:53.979 Sometimes project managers[br]have the target here 0:00:54.292,0:00:56.911 We feel like everybody is shooting at us[br]in our job 0:00:57.757,0:01:01.987 Or maybe you just know there's something[br]nasty out there, waiting to get you 0:01:02.470,0:01:05.700 And maybe that's what you think of[br]when you think of the word 'risk' 0:01:06.361,0:01:09.574 Well that's partly true[br]but it's not the whole truth. 0:01:10.193,0:01:13.625 Risk is not the same[br]as uncertainty. 0:01:14.220,0:01:16.963 Risk is related to uncertainty[br]but they're different. 0:01:17.670,0:01:23.826 So all risks are uncertain[br]but not all uncertainties are risks. 0:01:24.653,0:01:27.589 If you have a risk register[br]or a risk list, 0:01:27.942,0:01:31.435 you don't have a million items in it,[br]or you shouldn't. 0:01:31.962,0:01:34.512 You don't even probably have[br]a thousand items in it, 0:01:34.512,0:01:35.788 you have a smaller number. 0:01:36.714,0:01:40.007 Although there are millions[br]of uncertainties in the world. 0:01:40.400,0:01:44.313 So how do we decide which uncertainties[br]we're going to call 'risk'? 0:01:44.677,0:01:47.280 And write them down [br]and put them in our risk register 0:01:47.548,0:01:50.057 and decide to do something about them. 0:01:50.483,0:01:56.362 Clearly 'risk' is a subset[br]of uncertainties, but which subset? 0:01:56.942,0:01:58.133 How do you know? 0:01:58.798,0:02:02.948 I think it's very simple to separate[br]risk and uncertainty. 0:02:03.199,0:02:05.274 And I used 3 English words, 0:02:05.425,0:02:10.019 these words here,[br]'risk is uncertainty that matters." 0:02:11.503,0:02:14.783 Because most of the[br]uncertainties in the world don't matter. 0:02:15.564,0:02:19.014 We don't care if it's going to rain[br]in London tomorrow afternoon. 0:02:19.400,0:02:23.780 It might, it might not,[br]it's irrelevant, it doesn't matter. 0:02:24.498,0:02:26.948 We don't care what the [br]exchange rate will be 0:02:26.948,0:02:30.703 if it's between the Russian Ruble [br]and the Chinese Yen in 2020. 0:02:30.703,0:02:32.387 It doesn't matter to us. 0:02:32.888,0:02:35.118 But there are things on our projects, 0:02:35.427,0:02:37.117 and things in our families, 0:02:37.271,0:02:38.871 and things in our country, 0:02:38.979,0:02:41.446 which are uncertain which do matter to us. 0:02:42.195,0:02:45.338 If it's an uncertainty that matters, [br]it's a risk. 0:02:46.188,0:02:49.991 So here's another question,[br]how do you know what matters? 0:02:50.751,0:02:53.396 In your projects, [br]what are the things that matter? 0:02:54.077,0:02:57.875 The things that matter in our projects[br]are our objectives. 0:02:58.532,0:03:02.216 So we must always connect uncertainty[br]with objectives, 0:03:02.991,0:03:05.631 in order to find the risks. 0:03:06.005,0:03:08.355 And if we look at [br]some definitions of risk, 0:03:08.361,0:03:11.405 this is the ISO standard that I mentioned, 0:03:11.445,0:03:13.796 it connects those words very simply. 0:03:13.796,0:03:17.559 Risk is the effect of uncertainty[br]on objectives. 0:03:18.451,0:03:21.201 And we might look at another definition[br]from the UK, 0:03:21.387,0:03:23.916 from our association [br]with project management, 0:03:24.144,0:03:28.134 it says the same thing that risk[br]is an uncertain event 0:03:28.152,0:03:32.212 or a set of circumstances, [br]which is uncertain, 0:03:32.212,0:03:35.372 but it matters because should it occur, 0:03:35.372,0:03:38.587 it will have an effect on achievement of objectives. 0:03:38.603,0:03:40.553 Uncertainty that matters. 0:03:40.867,0:03:44.317 So we should be looking [br]in our risk register for two things. 0:03:44.703,0:03:48.803 Is it uncertain? We don't want [br]problems in our risk register. 0:03:49.183,0:03:52.113 We don't want issues in the risk register. 0:03:52.113,0:03:55.020 We don't want constraints or requirements. 0:03:55.291,0:03:59.631 These things are certain,[br]what we want are uncertainties, 0:03:59.721,0:04:02.241 something that might happen[br]or might not happen. 0:04:03.076,0:04:06.766 But the other important question for our[br]risk register is 0:04:06.766,0:04:08.366 does it matter? 0:04:08.439,0:04:11.739 Which objective would be effective [br]if this thing happened? 0:04:13.304,0:04:15.810 And then when we want to see[br]how big the risk is, 0:04:16.160,0:04:18.322 we can ask those two questions: 0:04:18.338,0:04:19.768 how uncertain is it, 0:04:19.985,0:04:22.095 and how much does it matter? 0:04:22.132,0:04:24.502 And that will tell us how big the risk is. 0:04:24.564,0:04:27.044 So, this idea of uncertainty that matters 0:04:27.084,0:04:30.536 then develops into something which is useful 0:04:30.618,0:04:33.317 by linking uncertainty to our objectives. 0:04:34.767,0:04:37.148 So, we have two dimensions of ‘risk,’ 0:04:37.409,0:04:39.658 we have an uncertainty dimension and we 0:04:39.658,0:04:42.093 have a dimension that [br]affects our objectives 0:04:43.249,0:04:47.419 In projects, we call[br]this probability and impact, 0:04:47.449,0:04:49.502 We could call them other things, 0:04:49.502,0:04:51.233 there are other English 0:04:51.233,0:04:52.767 words we could use,[br]but these 0:04:52.767,0:04:54.553 are the ones,[br]most often, we use. 0:04:54.702,0:04:57.732 And I would like to ask you with [br]this picture of the mouse. 0:04:59.632,0:05:04.647 What effect matters to the mouse? 0:05:05.874,0:05:09.315 So first of all, clearly, [br]he is in a uncertain situation here. 0:05:09.845,0:05:12.193 And he's seen some risks. 0:05:12.457,0:05:15.359 His objective is to get the cheese[br]and stay alive. 0:05:15.938,0:05:18.817 And so, one of the risks he has [br]identified is a bad thing 0:05:18.903,0:05:21.353 that might happen,[br]he might be killed or injured. 0:05:22.177,0:05:24.517 And so, he has been a [br]good project manager, 0:05:24.517,0:05:27.032 he has put his little helmet on, [br]and he is preparing 0:05:27.152,0:05:32.051 so that it doesn't happen to him.[br]So, he doesn't get killed or injured. 0:05:32.051,0:05:32.821 Very good. 0:05:33.690,0:05:36.560 And there are things in our projects, [br]that if they happened 0:05:36.560,0:05:37.875 would kill or injure us. 0:05:37.875,0:05:39.218 They would waste time, 0:05:39.218,0:05:41.566 waste money, damage reputation, 0:05:41.566,0:05:42.986 destroy performance, 0:05:43.202,0:05:45.732 maybe even injure real people. 0:05:46.230,0:05:49.880 And as project managers we have to[br]see those things and stop them happening. 0:05:49.957,0:05:51.792 Protect ourselves in advance. 0:05:51.857,0:05:52.867 Avoid them. 0:05:54.240,0:05:57.870 Are there any other uncertainties[br]that matter for the mouse? 0:05:59.637,0:06:01.327 Well there is... 0:06:01.327,0:06:02.275 the cheese. 0:06:02.678,0:06:05.558 There's an uncertainty here which [br]matters a great deal. 0:06:05.558,0:06:07.887 Will I get the cheese out of the trap? 0:06:08.733,0:06:10.429 He might, or he might not. 0:06:10.967,0:06:14.121 And if he doesn't get the [br]cheese out of the trap, he's failed 0:06:14.961,0:06:17.471 So he has two uncertainties to manage, 0:06:17.471,0:06:20.133 one of them is bad - he might be killed[br]or injured - 0:06:20.419,0:06:22.639 the other is good - he might [br]get the cheese. 0:06:23.129,0:06:24.616 And what he has to do, 0:06:24.968,0:06:28.958 what he has to do is to manage both[br]of these at the same time. 0:06:29.232,0:06:32.159 And as project managers, we have to[br]do the same thing. 0:06:32.788,0:06:36.128 And also we have to do it in the[br]best possible way - 0:06:36.128,0:06:40.546 sometimes there's a better way to get the [br]cheese without being killed or injured. 0:06:41.428,0:06:44.518 In our projects we have to stop the [br]bad things happening, 0:06:44.889,0:06:47.789 but we also have to get the cheese out[br]of our projects. 0:06:49.116,0:06:52.116 So what does 'cheese' mean,[br]in your project? 0:06:52.116,0:06:54.302 What is the 'cheese' in your project? 0:06:55.160,0:06:56.640 'Cheese' means value. 0:06:56.806,0:06:58.445 'Cheese' means benefits. 0:06:58.644,0:07:01.868 'Cheese' means products and [br]services that people want and need. 0:07:02.170,0:07:04.290 'Cheese' means customer satisfaction. 0:07:04.491,0:07:08.689 'Cheese' is the good stuff that we're [br]trying to get out of our difficult projects. 0:07:08.872,0:07:11.962 And if we don't do anything bad - 0:07:11.962,0:07:16.170 we don't waste time, we don't [br]waste money, we don't damage reputation - 0:07:16.170,0:07:17.954 but we don't create value, 0:07:18.278,0:07:19.338 we've failed. 0:07:19.683,0:07:23.183 If the mouse didn't die but he didn't [br]get the cheese, he failed. 0:07:23.950,0:07:28.353 If we create benefits, but we waste time [br]and waste money and destroy reputation, 0:07:28.353,0:07:29.369 we've failed. 0:07:30.015,0:07:32.565 And if the mouse gets the cheese[br]and he's killed, 0:07:32.724,0:07:33.784 he's failed. 0:07:33.784,0:07:36.076 So we have to do both of these things. 0:07:36.353,0:07:39.231 And when we think about risk [br]and think about impact, 0:07:39.468,0:07:41.896 there are two kinds of impact that matter. 0:07:42.525,0:07:45.175 Bad ones, and good ones. 0:07:45.488,0:07:48.125 Uncertainties that could hurt the project, 0:07:48.678,0:07:51.568 and uncertainties that [br]could help the project. 0:07:51.766,0:07:56.364 Both of these matter [br]and both of these need to be managed. 0:07:56.867,0:07:59.078 And we have another word for those. 0:07:59.305,0:08:03.791 So, here's the definition of risk from the[br]Project Management Institute, the PMI, 0:08:04.007,0:08:05.685 from the PMBok Guide. 0:08:05.993,0:08:08.093 It's the same as the others [br]that we've seen: 0:08:08.093,0:08:12.379 an uncertain event or condition, [br]that if it occurs, affects an objective. 0:08:13.222,0:08:18.534 But PMI knows about the mouse. PMI knows [br]about the cheese and the traps, 0:08:18.721,0:08:22.277 and has added three words [br]to the definition of risk here. 0:08:23.233,0:08:26.204 It's not the words 'cheese' and 'traps'. 0:08:26.432,0:08:29.301 It's the words 'positive or negative'. 0:08:30.067,0:08:33.984 What this tells us is that there [br]are good risks, as well as bad risks. 0:08:34.544,0:08:37.997 And we heard that in one of our [br]keynote speeches, earlier this morning. 0:08:38.507,0:08:42.907 In the uncertain situation that this [br]country faces going forward 0:08:42.958,0:08:46.058 with all the changes that their have been,[br]there are threats. 0:08:46.058,0:08:48.061 There are things that could go wrong. 0:08:48.061,0:08:50.226 And you need to see those[br]and address them. 0:08:50.407,0:08:53.188 But there are also opportunities. 0:08:53.248,0:08:56.235 Uncertain things that might happen[br]that could be good. 0:08:56.918,0:08:59.346 And we also need to see those things, 0:08:59.561,0:09:02.699 and to try and proactively [br]make them happen. 0:09:03.249,0:09:05.376 And that is equally true in our projects, 0:09:05.376,0:09:06.938 in our personal lives, 0:09:06.938,0:09:09.308 and also at the national level. 0:09:09.778,0:09:13.578 And I'll be talking about some of [br]those things later on this afternoon 0:09:14.717,0:09:19.161 So, PMI has this definition. The other [br]standards have something very similar. 0:09:19.541,0:09:21.448 The iso standard, at the bottom here, 0:09:21.448,0:09:25.619 says 'risk is the effect of[br]uncertainty on objectives.' 0:09:26.536,0:09:29.252 Note, the effect can be [br]positive or negative.