WEBVTT

00:00:00.501 --> 00:00:04.428
Okay, let's have a look at
risk management in practice

00:00:04.457 --> 00:00:08.474
And what I want to do
is to start with some basic concepts

00:00:08.485 --> 00:00:14.015
then focus on two difficult areas
in the risk process

00:00:14.242 --> 00:00:19.164
So, I guess if I asked you
to define the word 'risk'

00:00:19.174 --> 00:00:22.954
you would have some ideas
of what it meant

00:00:22.967 --> 00:00:26.476
We might not have a formal definition
that we could quote,

00:00:26.476 --> 00:00:30.253 line:1
but we all have something in our minds
when we hear the word 'risk'

00:00:30.274 --> 00:00:33.972
This is what we think,
and maybe you think of things like this

00:00:34.234 --> 00:00:38.534
Maybe you feel like this little guy,
facing some big ugly challenge

00:00:38.534 --> 00:00:41.791
that you know is just going to
squash you flat.

00:00:42.066 --> 00:00:43.766
Maybe you feel like this guy.

00:00:44.024 --> 00:00:46.489
This is a real job in North Korea,

00:00:47.768 --> 00:00:51.367
and his job is to hold the target
for other people to shoot at

00:00:51.500 --> 00:00:53.979
Sometimes project managers
have the target here

00:00:54.292 --> 00:00:56.911
We feel like everybody is shooting at us
in our job

00:00:57.757 --> 00:01:01.987
Or maybe you just know there's something
nasty out there, waiting to get you

00:01:02.470 --> 00:01:05.700
And maybe that's what you think of
when you think of the word 'risk'

00:01:06.361 --> 00:01:09.574
Well that's partly true
but it's not the whole truth.

00:01:10.193 --> 00:01:13.625
Risk is not the same
as uncertainty.

00:01:14.220 --> 00:01:16.963
Risk is related to uncertainty
but they're different.

00:01:17.670 --> 00:01:23.826
So all risks are uncertain
but not all uncertainties are risks.

00:01:24.653 --> 00:01:27.589
If you have a risk register
or a risk list,

00:01:27.942 --> 00:01:31.435
you don't have a million items in it,
or you shouldn't.

00:01:31.962 --> 00:01:34.512
You don't even probably have
a thousand items in it,

00:01:34.512 --> 00:01:35.788
you have a smaller number.

00:01:36.714 --> 00:01:40.007
Although there are millions
of uncertainties in the world.

00:01:40.400 --> 00:01:44.313
So how do we decide which uncertainties
we're going to call 'risk'?

00:01:44.677 --> 00:01:47.280
And write them down 
and put them in our risk register

00:01:47.548 --> 00:01:50.057
and decide to do something about them.

00:01:50.483 --> 00:01:56.362
Clearly 'risk' is a subset
of uncertainties, but which subset?

00:01:56.942 --> 00:01:58.133
How do you know?

00:01:58.798 --> 00:02:02.948
I think it's very simple to separate
risk and uncertainty.

00:02:03.199 --> 00:02:05.274 line:1
And I used 3 English words,

00:02:05.425 --> 00:02:10.019 line:1
these words here,
'risk is uncertainty that matters."

00:02:11.503 --> 00:02:14.783
Because most of the
uncertainties in the world don't matter.

00:02:15.564 --> 00:02:19.014
We don't care if it's going to rain
in London tomorrow afternoon.

00:02:19.400 --> 00:02:23.780
It might, it might not,
it's irrelevant, it doesn't matter.

00:02:24.498 --> 00:02:26.948
We don't care what the 
exchange rate will be

00:02:26.948 --> 00:02:30.703
if it's between the Russian Ruble 
and the Chinese Yen in 2020.

00:02:30.703 --> 00:02:32.387
It doesn't matter to us.

00:02:32.888 --> 00:02:35.118
But there are things on our projects,

00:02:35.427 --> 00:02:37.117
and things in our families,

00:02:37.271 --> 00:02:38.871
and things in our country,

00:02:38.979 --> 00:02:41.446
which are uncertain which do matter to us.

00:02:42.195 --> 00:02:45.338
If it's an uncertainty that matters, 
it's a risk.

00:02:46.188 --> 00:02:49.991
So here's another question,
how do you know what matters?

00:02:50.751 --> 00:02:53.396
In your projects, 
what are the things that matter?

00:02:54.077 --> 00:02:57.875
The things that matter in our projects
are our objectives.

00:02:58.532 --> 00:03:02.216
So we must always connect uncertainty
with objectives,

00:03:02.991 --> 00:03:05.631
in order to find the risks.

00:03:06.005 --> 00:03:08.355
And if we look at 
some definitions of risk,

00:03:08.361 --> 00:03:11.405
this is the ISO standard that I mentioned,

00:03:11.445 --> 00:03:13.796
it connects those words very simply.

00:03:13.796 --> 00:03:17.559
Risk is the effect of uncertainty
on objectives.

00:03:18.451 --> 00:03:21.201
And we might look at another definition
from the UK,

00:03:21.387 --> 00:03:23.916
from our association 
with project management,

00:03:24.144 --> 00:03:28.134
it says the same thing that risk
is an uncertain event

00:03:28.152 --> 00:03:32.212
or a set of circumstances, 
which is uncertain,

00:03:32.212 --> 00:03:35.372
but it matters because should it occur,

00:03:35.372 --> 00:03:38.587
it will have an effect on achievement of objectives.

00:03:38.603 --> 00:03:40.553
Uncertainty that matters.

00:03:40.867 --> 00:03:44.317
So we should be looking 
in our risk register for two things.

00:03:44.703 --> 00:03:48.803
Is it uncertain? We don't want 
problems in our risk register.

00:03:49.183 --> 00:03:52.113
We don't want issues in the risk register.

00:03:52.113 --> 00:03:55.020
We don't want constraints or requirements.

00:03:55.291 --> 00:03:59.631
These things are certain,
what we want are uncertainties,

00:03:59.721 --> 00:04:02.241
something that might happen
or might not happen.

00:04:03.076 --> 00:04:06.766
But the other important question for our
risk register is

00:04:06.766 --> 00:04:08.366
does it matter?

00:04:08.439 --> 00:04:11.739
Which objective would be effective 
if this thing happened?

00:04:13.304 --> 00:04:15.810
And then when we want to see
how big the risk is,

00:04:16.160 --> 00:04:18.322
we can ask those two questions:

00:04:18.338 --> 00:04:19.768
how uncertain is it,

00:04:19.985 --> 00:04:22.095
and how much does it matter?

00:04:22.132 --> 00:04:24.502
And that will tell us how big the risk is.

00:04:24.564 --> 00:04:27.044
So, this idea of uncertainty that matters

00:04:27.084 --> 00:04:30.536
then develops into something which is useful

00:04:30.618 --> 00:04:33.317
by linking uncertainty to our objectives.

00:04:34.767 --> 00:04:37.148
So, we have two dimensions of ‘risk,’

00:04:37.409 --> 00:04:39.658
we have an uncertainty dimension and we

00:04:39.658 --> 00:04:42.093
have a dimension that 
affects our objectives

00:04:43.249 --> 00:04:47.419
In projects, we call
this probability and impact,

00:04:47.449 --> 00:04:49.502
We could call them other things,

00:04:49.502 --> 00:04:51.233
there are other English

00:04:51.233 --> 00:04:52.767
words we could use,
but these

00:04:52.767 --> 00:04:54.553
are the ones,
most often, we use.

00:04:54.702 --> 00:04:57.732
And I would like to ask you with 
this picture of the mouse.

00:04:59.632 --> 00:05:04.647
What effect matters to the mouse?

00:05:05.874 --> 00:05:09.315
So first of all, clearly, 
he is in a uncertain situation here.

00:05:09.845 --> 00:05:12.193
And he's seen some risks.

00:05:12.457 --> 00:05:15.359
His objective is to get the cheese
and stay alive.

00:05:15.938 --> 00:05:18.817
And so, one of the risks he has 
identified is a bad thing

00:05:18.903 --> 00:05:21.353
that might happen,
he might be killed or injured.

00:05:22.177 --> 00:05:24.517
And so, he has been a 
good project manager,

00:05:24.517 --> 00:05:27.032
he has put his little helmet on, 
and he is preparing

00:05:27.152 --> 00:05:32.051
so that it doesn't happen to him.
So, he doesn't get killed or injured.

00:05:32.051 --> 00:05:32.821
Very good.

00:05:33.690 --> 00:05:36.560
And there are things in our projects, 
that if they happened

00:05:36.560 --> 00:05:37.875
would kill or injure us.

00:05:37.875 --> 00:05:39.218
They would waste time,

00:05:39.218 --> 00:05:41.566
waste money, damage reputation,

00:05:41.566 --> 00:05:42.986
destroy performance,

00:05:43.202 --> 00:05:45.732
maybe even injure real people.

00:05:46.230 --> 00:05:49.880
And as project managers we have to
see those things and stop them happening.

00:05:49.957 --> 00:05:51.792
Protect ourselves in advance.

00:05:51.857 --> 00:05:52.867
Avoid them.

00:05:54.240 --> 00:05:57.870
Are there any other uncertainties
that matter for the mouse?

00:05:59.637 --> 00:06:01.327
Well there is...

00:06:01.327 --> 00:06:02.275
the cheese.

00:06:02.678 --> 00:06:05.558
There's an uncertainty here which 
matters a great deal.

00:06:05.558 --> 00:06:07.887
Will I get the cheese out of the trap?

00:06:08.733 --> 00:06:10.429
He might, or he might not.

00:06:10.967 --> 00:06:14.121
And if he doesn't get the 
cheese out of the trap, he's failed

00:06:14.961 --> 00:06:17.471
So he has two uncertainties to manage,

00:06:17.471 --> 00:06:20.133
one of them is bad - he might be killed
or injured -

00:06:20.419 --> 00:06:22.639
the other is good - he might 
get the cheese.

00:06:23.129 --> 00:06:24.616
And what he has to do,

00:06:24.968 --> 00:06:28.958
what he has to do is to manage both
of these at the same time.

00:06:29.232 --> 00:06:32.159
And as project managers, we have to
do the same thing.

00:06:32.788 --> 00:06:36.128
And also we have to do it in the
best possible way -

00:06:36.128 --> 00:06:40.546
sometimes there's a better way to get the 
cheese without being killed or injured.

00:06:41.428 --> 00:06:44.518
In our projects we have to stop the 
bad things happening,

00:06:44.889 --> 00:06:47.789
but we also have to get the cheese out
of our projects.

00:06:49.116 --> 00:06:52.116
So what does 'cheese' mean,
in your project?

00:06:52.116 --> 00:06:54.302
What is the 'cheese' in your project?

00:06:55.160 --> 00:06:56.640
'Cheese' means value.

00:06:56.806 --> 00:06:58.445
'Cheese' means benefits.

00:06:58.644 --> 00:07:01.868
'Cheese' means products and 
services that people want and need.

00:07:02.170 --> 00:07:04.290
'Cheese' means customer satisfaction.

00:07:04.491 --> 00:07:08.689
'Cheese' is the good stuff that we're 
trying to get out of our difficult projects.

00:07:08.872 --> 00:07:11.962
And if we don't do anything bad -

00:07:11.962 --> 00:07:16.170
we don't waste time, we don't 
waste money, we don't damage reputation -

00:07:16.170 --> 00:07:17.954
but we don't create value,

00:07:18.278 --> 00:07:19.338
we've failed.

00:07:19.683 --> 00:07:23.183
If the mouse didn't die but he didn't 
get the cheese, he failed.

00:07:23.950 --> 00:07:28.353
If we create benefits, but we waste time 
and waste money and destroy reputation,

00:07:28.353 --> 00:07:29.369
we've failed.

00:07:30.015 --> 00:07:32.565
And if the mouse gets the cheese
and he's killed,

00:07:32.724 --> 00:07:33.784
he's failed.

00:07:33.784 --> 00:07:36.076
So we have to do both of these things.

00:07:36.353 --> 00:07:39.231
And when we think about risk 
and think about impact,

00:07:39.468 --> 00:07:41.896
there are two kinds of impact that matter.

00:07:42.525 --> 00:07:45.175
Bad ones, and good ones.

00:07:45.488 --> 00:07:48.125
Uncertainties that could hurt the project,

00:07:48.678 --> 00:07:51.568
and uncertainties that 
could help the project.

00:07:51.766 --> 00:07:56.364
Both of these matter 
and both of these need to be managed.

00:07:56.867 --> 00:07:59.078
And we have another word for those.

00:07:59.305 --> 00:08:03.791
So, here's the definition of risk from the
Project Management Institute, the PMI,

00:08:04.007 --> 00:08:05.685
from the PMBok Guide.

00:08:05.993 --> 00:08:08.093
It's the same as the others 
that we've seen:

00:08:08.093 --> 00:08:12.379
an uncertain event or condition, 
that if it occurs, affects an objective.

00:08:13.222 --> 00:08:18.534
But PMI knows about the mouse. PMI knows 
about the cheese and the traps,

00:08:18.721 --> 00:08:22.277
and has added three words 
to the definition of risk here.

00:08:23.233 --> 00:08:26.204
It's not the words 'cheese' and 'traps'.

00:08:26.432 --> 00:08:29.301
It's the words 'positive or negative'.

00:08:30.067 --> 00:08:33.984
What this tells us is that there 
are good risks, as well as bad risks.

00:08:34.544 --> 00:08:37.997
And we heard that in one of our 
keynote speeches, earlier this morning.

00:08:38.507 --> 00:08:42.907
In the uncertain situation that this 
country faces going forward

00:08:42.958 --> 00:08:46.058
with all the changes that their have been,
there are threats.

00:08:46.058 --> 00:08:48.061
There are things that could go wrong.

00:08:48.061 --> 00:08:50.226
And you need to see those
and address them.

00:08:50.407 --> 00:08:53.188
But there are also opportunities.

00:08:53.248 --> 00:08:56.235
Uncertain things that might happen
that could be good.

00:08:56.918 --> 00:08:59.346
And we also need to see those things,

00:08:59.561 --> 00:09:02.699
and to try and proactively 
make them happen.

00:09:03.249 --> 00:09:05.376
And that is equally true in our projects,

00:09:05.376 --> 00:09:06.938
in our personal lives,

00:09:06.938 --> 00:09:09.308
and also at the national level.

00:09:09.778 --> 00:09:13.578
And I'll be talking about some of 
those things later on this afternoon

00:09:14.717 --> 00:09:19.161
So, PMI has this definition. The other 
standards have something very similar.

00:09:19.541 --> 00:09:21.448
The iso standard, at the bottom here,

00:09:21.448 --> 00:09:25.619
says 'risk is the effect of
uncertainty on objectives.'

00:09:26.536 --> 00:09:29.252
Note, the effect can be 
positive or negative.