WEBVTT 00:00:00.501 --> 00:00:04.428 Okay, let's have a look at risk management in practice 00:00:04.457 --> 00:00:08.474 And what I want to do is to start with some basic concepts 00:00:08.485 --> 00:00:14.015 then focus on two difficult areas in the risk process 00:00:14.242 --> 00:00:19.164 So, I guess if I asked you to define the word 'risk' 00:00:19.174 --> 00:00:22.954 you would have some ideas of what it meant 00:00:22.967 --> 00:00:26.476 We might not have a formal definition that we could quote, 00:00:26.476 --> 00:00:30.253 line:1 but we all have something in our minds when we hear the word 'risk' 00:00:30.274 --> 00:00:33.972 This is what we think, and maybe you think of things like this 00:00:34.234 --> 00:00:38.534 Maybe you feel like this little guy, facing some big ugly challenge 00:00:38.534 --> 00:00:41.791 that you know is just going to squash you flat. 00:00:42.066 --> 00:00:43.766 Maybe you feel like this guy. 00:00:44.024 --> 00:00:46.489 This is a real job in North Korea, 00:00:47.768 --> 00:00:51.367 and his job is to hold the target for other people to shoot at 00:00:51.500 --> 00:00:53.979 Sometimes project managers have the target here 00:00:54.292 --> 00:00:56.911 We feel like everybody is shooting at us in our job 00:00:57.757 --> 00:01:01.987 Or maybe you just know there's something nasty out there, waiting to get you 00:01:02.470 --> 00:01:05.700 And maybe that's what you think of when you think of the word 'risk' 00:01:06.361 --> 00:01:09.574 Well that's partly true but it's not the whole truth. 00:01:10.193 --> 00:01:13.625 Risk is not the same as uncertainty. 00:01:14.220 --> 00:01:16.963 Risk is related to uncertainty but they're different. 00:01:17.670 --> 00:01:23.826 So all risks are uncertain but not all uncertainties are risks. 00:01:24.653 --> 00:01:27.589 If you have a risk register or a risk list, 00:01:27.942 --> 00:01:31.435 you don't have a million items in it, or you shouldn't. 00:01:31.962 --> 00:01:34.512 You don't even probably have a thousand items in it, 00:01:34.512 --> 00:01:35.788 you have a smaller number. 00:01:36.714 --> 00:01:40.007 Although there are millions of uncertainties in the world. 00:01:40.400 --> 00:01:44.313 So how do we decide which uncertainties we're going to call 'risk'? 00:01:44.677 --> 00:01:47.280 And write them down and put them in our risk register 00:01:47.548 --> 00:01:50.057 and decide to do something about them. 00:01:50.483 --> 00:01:56.362 Clearly 'risk' is a subset of uncertainties, but which subset? 00:01:56.942 --> 00:01:58.133 How do you know? 00:01:58.798 --> 00:02:02.948 I think it's very simple to separate risk and uncertainty. 00:02:03.199 --> 00:02:05.274 line:1 And I used 3 English words, 00:02:05.425 --> 00:02:10.019 line:1 these words here, 'risk is uncertainty that matters." 00:02:11.503 --> 00:02:14.783 Because most of the uncertainties in the world don't matter. 00:02:15.564 --> 00:02:19.014 We don't care if it's going to rain in London tomorrow afternoon. 00:02:19.400 --> 00:02:23.780 It might, it might not, it's irrelevant, it doesn't matter. 00:02:24.498 --> 00:02:26.948 We don't care what the exchange rate will be 00:02:26.948 --> 00:02:30.703 if it's between the Russian Ruble and the Chinese Yen in 2020. 00:02:30.703 --> 00:02:32.387 It doesn't matter to us. 00:02:32.888 --> 00:02:35.118 But there are things on our projects, 00:02:35.427 --> 00:02:37.117 and things in our families, 00:02:37.271 --> 00:02:38.871 and things in our country, 00:02:38.979 --> 00:02:41.446 which are uncertain which do matter to us. 00:02:42.195 --> 00:02:45.338 If it's an uncertainty that matters, it's a risk. 00:02:46.188 --> 00:02:49.991 So here's another question, how do you know what matters? 00:02:50.751 --> 00:02:53.396 In your projects, what are the things that matter? 00:02:54.077 --> 00:02:57.875 The things that matter in our projects are our objectives. 00:02:58.532 --> 00:03:02.216 So we must always connect uncertainty with objectives, 00:03:02.991 --> 00:03:05.631 in order to find the risks. 00:03:06.005 --> 00:03:08.355 And if we look at some definitions of risk, 00:03:08.361 --> 00:03:11.405 this is the ISO standard that I mentioned, 00:03:11.445 --> 00:03:13.796 it connects those words very simply. 00:03:13.796 --> 00:03:17.559 Risk is the effect of uncertainty on objectives. 00:03:18.451 --> 00:03:21.201 And we might look at another definition from the UK, 00:03:21.387 --> 00:03:23.916 from our association with project management, 00:03:24.144 --> 00:03:28.134 it says the same thing that risk is an uncertain event 00:03:28.152 --> 00:03:32.212 or a set of circumstances, which is uncertain, 00:03:32.212 --> 00:03:35.372 but it matters because should it occur, 00:03:35.372 --> 00:03:38.587 it will have an effect on achievement of objectives. 00:03:38.603 --> 00:03:40.553 Uncertainty that matters. 00:03:40.867 --> 00:03:44.317 So we should be looking in our risk register for two things. 00:03:44.703 --> 00:03:48.803 Is it uncertain? We don't want problems in our risk register. 00:03:49.183 --> 00:03:52.113 We don't want issues in the risk register. 00:03:52.113 --> 00:03:55.020 We don't want constraints or requirements. 00:03:55.291 --> 00:03:59.631 These things are certain, what we want are uncertainties, 00:03:59.721 --> 00:04:02.241 something that might happen or might not happen. 00:04:03.076 --> 00:04:06.766 But the other important question for our risk register is 00:04:06.766 --> 00:04:08.366 does it matter? 00:04:08.439 --> 00:04:11.739 Which objective would be effective if this thing happened? 00:04:13.304 --> 00:04:15.810 And then when we want to see how big the risk is, 00:04:16.160 --> 00:04:18.322 we can ask those two questions: 00:04:18.338 --> 00:04:19.768 how uncertain is it, 00:04:19.985 --> 00:04:22.095 and how much does it matter? 00:04:22.132 --> 00:04:24.502 And that will tell us how big the risk is. 00:04:24.564 --> 00:04:27.044 So, this idea of uncertainty that matters 00:04:27.084 --> 00:04:30.536 then develops into something which is useful 00:04:30.618 --> 00:04:33.317 by linking uncertainty to our objectives. 00:04:34.767 --> 00:04:37.148 So, we have two dimensions of ‘risk,’ 00:04:37.409 --> 00:04:39.658 we have an uncertainty dimension and we 00:04:39.658 --> 00:04:42.093 have a dimension that affects our objectives 00:04:43.249 --> 00:04:47.419 In projects, we call this probability and impact, 00:04:47.449 --> 00:04:49.502 We could call them other things, 00:04:49.502 --> 00:04:51.233 there are other English 00:04:51.233 --> 00:04:52.767 words we could use, but these 00:04:52.767 --> 00:04:54.553 are the ones, most often, we use. 00:04:54.702 --> 00:04:57.732 And I would like to ask you with this picture of the mouse. 00:04:59.632 --> 00:05:04.647 What effect matters to the mouse? 00:05:05.874 --> 00:05:09.315 So first of all, clearly, he is in a uncertain situation here. 00:05:09.845 --> 00:05:12.193 And he's seen some risks. 00:05:12.457 --> 00:05:15.359 His objective is to get the cheese and stay alive. 00:05:15.938 --> 00:05:18.817 And so, one of the risks he has identified is a bad thing 00:05:18.903 --> 00:05:21.353 that might happen, he might be killed or injured. 00:05:22.177 --> 00:05:24.517 And so, he has been a good project manager, 00:05:24.517 --> 00:05:27.032 he has put his little helmet on, and he is preparing 00:05:27.152 --> 00:05:32.051 so that it doesn't happen to him. So, he doesn't get killed or injured. 00:05:32.051 --> 00:05:32.821 Very good. 00:05:33.690 --> 00:05:36.560 And there are things in our projects, that if they happened 00:05:36.560 --> 00:05:37.875 would kill or injure us. 00:05:37.875 --> 00:05:39.218 They would waste time, 00:05:39.218 --> 00:05:41.566 waste money, damage reputation, 00:05:41.566 --> 00:05:42.986 destroy performance, 00:05:43.202 --> 00:05:45.732 maybe even injure real people. 00:05:46.230 --> 00:05:49.880 And as project managers we have to see those things and stop them happening. 00:05:49.957 --> 00:05:51.792 Protect ourselves in advance. 00:05:51.857 --> 00:05:52.867 Avoid them. 00:05:54.240 --> 00:05:57.870 Are there any other uncertainties that matter for the mouse? 00:05:59.637 --> 00:06:01.327 Well there is... 00:06:01.327 --> 00:06:02.275 the cheese. 00:06:02.678 --> 00:06:05.558 There's an uncertainty here which matters a great deal. 00:06:05.558 --> 00:06:07.887 Will I get the cheese out of the trap? 00:06:08.733 --> 00:06:10.429 He might, or he might not. 00:06:10.967 --> 00:06:14.121 And if he doesn't get the cheese out of the trap, he's failed 00:06:14.961 --> 00:06:17.471 So he has two uncertainties to manage, 00:06:17.471 --> 00:06:20.133 one of them is bad - he might be killed or injured - 00:06:20.419 --> 00:06:22.639 the other is good - he might get the cheese. 00:06:23.129 --> 00:06:24.616 And what he has to do, 00:06:24.968 --> 00:06:28.958 what he has to do is to manage both of these at the same time. 00:06:29.232 --> 00:06:32.159 And as project managers, we have to do the same thing. 00:06:32.788 --> 00:06:36.128 And also we have to do it in the best possible way - 00:06:36.128 --> 00:06:40.546 sometimes there's a better way to get the cheese without being killed or injured. 00:06:41.428 --> 00:06:44.518 In our projects we have to stop the bad things happening, 00:06:44.889 --> 00:06:47.789 but we also have to get the cheese out of our projects. 00:06:49.116 --> 00:06:52.116 So what does 'cheese' mean, in your project? 00:06:52.116 --> 00:06:54.302 What is the 'cheese' in your project? 00:06:55.160 --> 00:06:56.640 'Cheese' means value. 00:06:56.806 --> 00:06:58.445 'Cheese' means benefits. 00:06:58.644 --> 00:07:01.868 'Cheese' means products and services that people want and need. 00:07:02.170 --> 00:07:04.290 'Cheese' means customer satisfaction. 00:07:04.491 --> 00:07:08.689 'Cheese' is the good stuff that we're trying to get out of our difficult projects. 00:07:08.872 --> 00:07:11.962 And if we don't do anything bad - 00:07:11.962 --> 00:07:16.170 we don't waste time, we don't waste money, we don't damage reputation - 00:07:16.170 --> 00:07:17.954 but we don't create value, 00:07:18.278 --> 00:07:19.338 we've failed. 00:07:19.683 --> 00:07:23.183 If the mouse didn't die but he didn't get the cheese, he failed. 00:07:23.950 --> 00:07:28.353 If we create benefits, but we waste time and waste money and destroy reputation, 00:07:28.353 --> 00:07:29.369 we've failed. 00:07:30.015 --> 00:07:32.565 And if the mouse gets the cheese and he's killed, 00:07:32.724 --> 00:07:33.784 he's failed. 00:07:33.784 --> 00:07:36.076 So we have to do both of these things. 00:07:36.353 --> 00:07:39.231 And when we think about risk and think about impact, 00:07:39.468 --> 00:07:41.896 there are two kinds of impact that matter. 00:07:42.525 --> 00:07:45.175 Bad ones, and good ones. 00:07:45.488 --> 00:07:48.125 Uncertainties that could hurt the project, 00:07:48.678 --> 00:07:51.568 and uncertainties that could help the project. 00:07:51.766 --> 00:07:56.364 Both of these matter and both of these need to be managed. 00:07:56.867 --> 00:07:59.078 And we have another word for those. 00:07:59.305 --> 00:08:03.791 So, here's the definition of risk from the Project Management Institute, the PMI, 00:08:04.007 --> 00:08:05.685 from the PMBok Guide. 00:08:05.993 --> 00:08:08.093 It's the same as the others that we've seen: 00:08:08.093 --> 00:08:12.379 an uncertain event or condition, that if it occurs, affects an objective. 00:08:13.222 --> 00:08:18.534 But PMI knows about the mouse. PMI knows about the cheese and the traps, 00:08:18.721 --> 00:08:22.277 and has added three words to the definition of risk here. 00:08:23.233 --> 00:08:26.204 It's not the words 'cheese' and 'traps'. 00:08:26.432 --> 00:08:29.301 It's the words 'positive or negative'. 00:08:30.067 --> 00:08:33.984 What this tells us is that there are good risks, as well as bad risks. 00:08:34.544 --> 00:08:37.997 And we heard that in one of our keynote speeches, earlier this morning. 00:08:38.507 --> 00:08:42.907 In the uncertain situation that this country faces going forward 00:08:42.958 --> 00:08:46.058 with all the changes that their have been, there are threats. 00:08:46.058 --> 00:08:48.061 There are things that could go wrong. 00:08:48.061 --> 00:08:50.226 And you need to see those and address them. 00:08:50.407 --> 00:08:53.188 But there are also opportunities. 00:08:53.248 --> 00:08:56.235 Uncertain things that might happen that could be good. 00:08:56.918 --> 00:08:59.346 And we also need to see those things, 00:08:59.561 --> 00:09:02.699 and to try and proactively make them happen. 00:09:03.249 --> 00:09:05.376 And that is equally true in our projects, 00:09:05.376 --> 00:09:06.938 in our personal lives, 00:09:06.938 --> 00:09:09.308 and also at the national level. 00:09:09.778 --> 00:09:13.578 And I'll be talking about some of those things later on this afternoon 00:09:14.717 --> 00:09:19.161 So, PMI has this definition. The other standards have something very similar. 00:09:19.541 --> 00:09:21.448 The iso standard, at the bottom here, 00:09:21.448 --> 00:09:25.619 says 'risk is the effect of uncertainty on objectives.' 00:09:26.536 --> 00:09:29.252 Note, the effect can be positive or negative. 00:09:31.009 --> 00:09:34.726 And the APM Association, for project management in the UK says the same thing. 00:09:35.426 --> 00:09:39.954 So we have this new idea, that risk is a double-sided concept. 00:09:41.090 --> 00:09:43.959 And it's the same impression, the word you have for risk, 00:09:44.329 --> 00:09:48.002 we mostly think of bad things. But it could be used for good things, 00:09:48.002 --> 00:09:49.877 as well. Isn't that right? 00:09:50.143 --> 00:09:51.862 It's an uncertain word. 00:09:52.281 --> 00:09:55.031 And there are good risks as well as bad risks. 00:09:55.991 --> 00:09:59.364 So in our project, risk management process, 00:09:59.574 --> 00:10:03.181 we should be looking out for the traps and avoiding them 00:10:03.181 --> 00:10:06.004 and protecting ourselves and preventing them happening. 00:10:06.004 --> 00:10:09.147 But we should also be looking out for the cheese 00:10:09.147 --> 00:10:11.549 and chasing it, and making it happen proactively, 00:10:11.549 --> 00:10:14.897 so we get the maximum benefit for the minimum cost. NOTE Paragraph 00:10:15.957 --> 00:10:19.375 That’s why risk management is so important to 00:10:19.712 --> 00:10:22.676 project success. Because it effects our objections. 00:10:23.817 --> 00:10:27.426 It gives us the best possible chance to achieve our goals. 00:10:28.570 --> 00:10:30.290 So how do we do that? 00:10:30.621 --> 00:10:33.104 If we think about the risk management process, 00:10:33.539 --> 00:10:35.899 the process has to do a number of things. 00:10:36.524 --> 00:10:39.564 If risk is uncertainty that affects objectives, 00:10:39.633 --> 00:10:41.753 we have to know what our objectives are. 00:10:42.076 --> 00:10:44.416 Then, we have to identify the uncertainties. 00:10:45.099 --> 00:10:48.459 The uncertainties that would matter to those objectives. 00:10:48.618 --> 00:10:53.058 And remember that they could be good or bad, threats and opportunities. 00:10:53.897 --> 00:10:56.747 That gives us a long list of uncertainties that matter, 00:10:56.777 --> 00:10:58.477 but they don't all matter the same. 00:10:59.218 --> 00:11:03.528 So the next thing we have to do is to prioritize, and ask the question 00:11:04.287 --> 00:11:06.837 "How uncertain, and how much does it matter?" 00:11:07.053 --> 00:11:10.133 Then we get a prioritized list of risks. 00:11:10.210 --> 00:11:14.390 We know which are the worst threats and the best opportunities, 00:11:14.811 --> 00:11:17.061 so that we do something about it. 00:11:17.508 --> 00:11:19.384 Then we plan how to respond. 00:11:19.411 --> 00:11:23.294 We think about what would be appropriate to stop the bad thing happening 00:11:23.344 --> 00:11:24.974 and to make the good thing happen. 00:11:25.583 --> 00:11:28.920 And having decided, we do it of course. 00:11:29.851 --> 00:11:33.641 And then risk is constantly changing so we need to come back and do it again, 00:11:33.873 --> 00:11:35.923 and see what has changed. 00:11:36.518 --> 00:11:42.048 We could express this process as a number of questions that it's important to ask, 00:11:42.184 --> 00:11:45.604 and keep on asking about our project. 00:11:46.337 --> 00:11:49.897 In fact, you can use these questions for anything. 00:11:50.106 --> 00:11:54.076 You could use these questions for your next career move. 00:11:54.524 --> 00:11:58.914 You could use these questions for deciding about your pension. 00:11:59.141 --> 00:12:03.691 You could use these questions to decide how to bring up your children 00:12:04.323 --> 00:12:09.183 or to decide on how to invest the nation's wealth. 00:12:09.996 --> 00:12:11.759 These are the questions: 00:12:11.799 --> 00:12:15.409 What are we trying to achieve? That's setting objectives. 00:12:15.979 --> 00:12:18.439 Then, what could affect us in achieving that? 00:12:18.534 --> 00:12:20.574 That's identifying risks. 00:12:20.915 --> 00:12:24.455 Then, when we have a list of risks, which are the most important ones? 00:12:24.742 --> 00:12:27.392 That's prioritizing, that assessing the risks. 00:12:27.674 --> 00:12:29.814 Then, what could we do about it? 00:12:30.242 --> 00:12:34.402 Planning our responses and doing it, implementing the responses. 00:12:34.846 --> 00:12:39.166 And then, did it work and what's changed, reviewing the risk. 00:12:39.306 --> 00:12:43.766 So if we look at a risk management process, we could link each step in the 00:12:43.800 --> 00:12:46.930 process to one of these questions. 00:12:47.093 --> 00:12:49.773 And this is why risk management is so easy, 00:12:49.876 --> 00:12:56.116 because all we're doing is asking and answering obvious questions. 00:12:56.297 --> 00:13:01.117 Anybody who's doing anything important will ask these questions. 00:13:01.320 --> 00:13:04.000 What am I trying to do? What could affect me? 00:13:04.142 --> 00:13:06.442 Which are the big ones? What shall I do about it? 00:13:06.473 --> 00:13:08.983 Did that work? Now what? 00:13:09.703 --> 00:13:14.383 And you could ask those questions every Monday morning when you drove to work, 00:13:14.402 --> 00:13:16.032 or every Saturday morning. 00:13:16.032 --> 00:13:17.786 You can ask the question, say 00:13:17.791 --> 00:13:20.831 What am I trying to achieve today? This week? 00:13:21.286 --> 00:13:23.636 What could affect me and which are the big ones? 00:13:23.743 --> 00:13:24.835 What shall I do? 00:13:24.871 --> 00:13:30.351 We can manage risk on a very simple basis, or we can use this as the structure for 00:13:30.394 --> 00:13:35.114 a risk process which is much more complex, which involves lots of meetings, 00:13:35.139 --> 00:13:39.079 and lots of stakeholder groups and lots of analysis and statistics. 00:13:39.098 --> 00:13:41.188 It's the same questions. 00:13:41.909 --> 00:13:45.306 So I would like you to remember two important things. 00:13:45.319 --> 00:13:49.229 One is risk is uncertainty that matters. 00:13:49.554 --> 00:13:53.854 And secondly, these questions, these six questions. 00:13:54.535 --> 00:13:58.235 Because that's the heart, that's the basis of managing risk, 00:13:58.245 --> 00:14:00.761 and it really is very, very easy. 00:14:01.402 --> 00:14:06.197 Now, in the time that we have, I want to focus on just two parts of this process, 00:14:06.351 --> 00:14:10.591 and then give us the opportunity to try out some of these things. 00:14:10.618 --> 00:14:14.308 The identification step, clearly very, very important 00:14:14.344 --> 00:14:18.494 because if we don't identify the risks, we can't manage them. 00:14:18.977 --> 00:14:21.617 And then planning responses. 00:14:21.880 --> 00:14:26.310 Understanding how we can deal with the uncertainties that we've identified. 00:14:26.590 --> 00:14:30.190 So, let's think about these things: identifying risks. 00:14:30.363 --> 00:14:32.493 How do we find all of the risks? 00:14:33.496 --> 00:14:35.016 Well, you can't. 00:14:35.016 --> 00:14:38.782 You can't find all of the risks because there are risks that arrive 00:14:38.803 --> 00:14:40.563 that we hadn't seen before. 00:14:40.563 --> 00:14:44.386 There are emergent risks, new risks, different risks 00:14:44.607 --> 00:14:48.907 and I'll be talking about those later this afternoon in my speech. 00:14:49.088 --> 00:14:54.848 What we want to find are the knowable risks: the risks that we could find. 00:14:55.249 --> 00:14:58.609 We don't want somebody on our project team who knows a risk 00:14:58.609 --> 00:15:00.192 and they're not telling anybody. 00:15:00.235 --> 00:15:04.525 So this process is about exposing the uncertainties that matter, 00:15:04.533 --> 00:15:06.773 finding them so we can do something about them. 00:15:06.888 --> 00:15:08.708 And there are lots of techniques, 00:15:08.708 --> 00:15:11.724 brainstorming, workshops, check lists, 00:15:11.724 --> 00:15:15.144 testing our assumptions and so on. 00:15:15.398 --> 00:15:18.028 But I would like to answer a bigger question 00:15:18.262 --> 00:15:20.439 A different question from technics. 00:15:21.479 --> 00:15:24.073 And it's the question, are we finding the real risks? 00:15:25.393 --> 00:15:29.787 When you go to a risk workshop and you write things in your risk register, 00:15:30.007 --> 00:15:33.724 are they really the uncertainties that matter for your project? 00:15:34.434 --> 00:15:39.874 Are these really the things that could drive you off track or really help you? 00:15:40.559 --> 00:15:42.856 Or are they just the obvious things? 00:15:42.896 --> 00:15:45.954 Where all projects have problems with requirements, 00:15:46.734 --> 00:15:49.541 with resources, with testing. These are things that 00:15:49.793 --> 00:15:52.625 always come up, and we have processes to deal with them.