1
00:00:00,501 --> 00:00:04,428
Okay, let's have a look at
risk management in practice

2
00:00:04,457 --> 00:00:08,474
And what I want to do
is to start with some basic concepts

3
00:00:08,485 --> 00:00:14,015
then focus on TWO difficult areas
in the risk process

4
00:00:14,242 --> 00:00:19,164
So, I guess if I asked you
to define the word 'risk'

5
00:00:19,174 --> 00:00:22,954
you would have some idea
of what it meant

6
00:00:22,967 --> 00:00:26,476
We might not have a formal definition
that we could quote,

7
00:00:26,476 --> 00:00:30,253
but we all have something in our minds
when we hear the word 'risk'

8
00:00:30,274 --> 00:00:33,972
This is what we think,
and maybe you think of things like this

9
00:00:34,234 --> 00:00:38,534
Maybe you feel like this little guy,
facing some big ugly challenge

10
00:00:38,534 --> 00:00:41,791
that you know is just going to
squash you flat.

11
00:00:42,066 --> 00:00:43,766
Maybe you feel like this guy.

12
00:00:44,024 --> 00:00:46,489
This is a real job in North Korea,

13
00:00:47,768 --> 00:00:51,367
and his job is to hold the target
for other people to shoot at

14
00:00:51,500 --> 00:00:53,979
Sometimes project managers
have the target here

15
00:00:54,292 --> 00:00:56,911
We feel like everybody is shooting at us
in our job

16
00:00:57,757 --> 00:01:01,987
Or maybe you just know there's something
nasty out there, waiting to get you

17
00:01:02,470 --> 00:01:05,700
And maybe that's what you think of
when you think of the word 'risk'

18
00:01:06,361 --> 00:01:09,574
Well that's partly true
but it's not the whole truth.

19
00:01:10,193 --> 00:01:13,625
Risk is not the same
as uncertainty.

20
00:01:14,220 --> 00:01:16,963
Risk is related to uncertainty
but they're different.

21
00:01:17,670 --> 00:01:23,826
So all risks are uncertain
but not all uncertainties are risks.

22
00:01:24,653 --> 00:01:27,589
If you have a risk register
or a risk list,

23
00:01:27,942 --> 00:01:31,435
you don't have a million items in it,
or you shouldn't.

24
00:01:31,962 --> 00:01:34,512
You don't even probably have
a thousand items in it,

25
00:01:34,512 --> 00:01:35,788
you have a smaller number.

26
00:01:36,714 --> 00:01:40,007
Although there are millions
of uncertainties in the world.

27
00:01:40,400 --> 00:01:44,313
So how do we decide which uncertainties
we're going to call 'risk'?

28
00:01:44,677 --> 00:01:47,280
And write them down 
and put them in our risk register

29
00:01:47,548 --> 00:01:50,057
and decide to do something about them.

30
00:01:50,483 --> 00:01:56,362
Clearly 'risk' is a subset
of uncertainties, but which subset?

31
00:01:56,942 --> 00:01:58,133
How do you know?

32
00:01:58,798 --> 00:02:02,948
I think it's very simple to separate
risk and uncertainty.

33
00:02:03,199 --> 00:02:05,274
And I use 3 English words,

34
00:02:05,425 --> 00:02:10,019
these words here,
'risk is uncertainty that matters."

35
00:02:11,503 --> 00:02:14,783
Because most of the
uncertainties in the world don't matter.

36
00:02:15,564 --> 00:02:19,014
We don't care if it's going to rain
in London tomorrow afternoon.

37
00:02:19,400 --> 00:02:23,780
It might, it might not,
it's irrelevant, it doesn't matter.

38
00:02:24,498 --> 00:02:26,948
We don't care what the 
exchange rate will be

39
00:02:26,948 --> 00:02:30,703
if it's between the Russian Ruble 
and the Chinese Yen in 2020.

40
00:02:30,703 --> 00:02:32,387
It doesn't matter to us.

41
00:02:32,888 --> 00:02:35,118
But there are things on our projects,

42
00:02:35,427 --> 00:02:37,117
and things in our families,

43
00:02:37,271 --> 00:02:38,871
and things in our country,

44
00:02:38,979 --> 00:02:41,446
which are uncertain which do matter to us.

45
00:02:42,195 --> 00:02:45,338
If it's an uncertainty that matters, 
it's a risk.

46
00:02:46,188 --> 00:02:49,991
So here's another question,
how do you know what matters?

47
00:02:50,751 --> 00:02:53,396
In your projects, 
what are the things that matter?

48
00:02:54,077 --> 00:02:57,875
The things that matter in our projects
are our objectives.

49
00:02:58,532 --> 00:03:02,216
So we must always connect uncertainty
with objectives,

50
00:03:02,991 --> 00:03:05,631
in order to find the risks.

51
00:03:06,005 --> 00:03:08,355
And if we look at 
some definitions of risk,

52
00:03:08,361 --> 00:03:11,405
this is the ISO standard that I mentioned,

53
00:03:11,445 --> 00:03:13,796
it connects those words very simply;

54
00:03:13,796 --> 00:03:17,559
Risk is the effect of uncertainty
on objectives.

55
00:03:18,451 --> 00:03:21,201
And we might look at another definition
from the UK,

56
00:03:21,387 --> 00:03:23,916
from our association 
for project management,

57
00:03:24,144 --> 00:03:28,134
it says the same thing that risk
is an uncertain event

58
00:03:28,152 --> 00:03:32,212
or a set of circumstances, 
which is uncertain,

59
00:03:32,212 --> 00:03:35,372
but it matters because should it occur,

60
00:03:35,372 --> 00:03:38,587
it will have an effect on achievement of objectives.

61
00:03:38,603 --> 00:03:40,553
Uncertainty that matters.

62
00:03:40,867 --> 00:03:44,317
So we should be looking 
in our risk register for two things:

63
00:03:44,703 --> 00:03:48,803
"Is it uncertain?" We don't want 
problems in our risk register.

64
00:03:49,183 --> 00:03:52,113
We don't want issues in the risk register.

65
00:03:52,113 --> 00:03:55,020
We don't want constraints or requirements.

66
00:03:55,291 --> 00:03:59,631
These things are certain,
what we want is uncertainties,

67
00:03:59,721 --> 00:04:02,241
something that might happen
or might not happen.

68
00:04:03,076 --> 00:04:06,766
But the other important question for our
risk register is

69
00:04:06,766 --> 00:04:08,366
"Does it matter?"

70
00:04:08,439 --> 00:04:11,739
Which objective would be affected 
if this thing happened?

71
00:04:13,304 --> 00:04:15,810
And then when we want to see
how big the risk is,

72
00:04:16,160 --> 00:04:18,322
we can ask those two questions:

73
00:04:18,338 --> 00:04:19,768
"How uncertain is it,"

74
00:04:19,985 --> 00:04:22,095
"and how much does it matter?"

75
00:04:22,132 --> 00:04:24,502
And that will tell us how big the risk is.

76
00:04:24,564 --> 00:04:27,044
So, this idea of uncertainty that matters

77
00:04:27,084 --> 00:04:30,536
then develops into something which is useful

78
00:04:30,618 --> 00:04:33,317
by linking uncertainty to our objectives.

79
00:04:34,767 --> 00:04:37,148
So, we have two dimensions of ‘risk,’

80
00:04:37,409 --> 00:04:39,658
we have an uncertainty dimension and we

81
00:04:39,658 --> 00:04:42,093
have a dimension that 
affects our objectives

82
00:04:43,249 --> 00:04:47,419
In projects, we call
this probability and impact,

83
00:04:47,449 --> 00:04:49,502
We could call them other things,

84
00:04:49,502 --> 00:04:51,233
there are other English

85
00:04:51,233 --> 00:04:52,767
words we could use,
but these

86
00:04:52,767 --> 00:04:54,553
are the ones,
most often, we use.

87
00:04:54,702 --> 00:04:57,732
And I would like to ask you with 
this picture of the mouse.

88
00:04:59,632 --> 00:05:04,647
What effect matters to the mouse?

89
00:05:05,874 --> 00:05:09,315
So first of all, clearly, 
he is in a uncertain situation here.

90
00:05:09,845 --> 00:05:12,193
And he's seen some risks.

91
00:05:12,457 --> 00:05:15,359
His objective is to get the cheese
and stay alive.

92
00:05:15,938 --> 00:05:18,817
And so, one of the risks he has 
identified is a bad thing

93
00:05:18,903 --> 00:05:21,353
that might happen:
he might be killed or injured.

94
00:05:22,177 --> 00:05:24,517
And so, he has been a 
good project manager,

95
00:05:24,517 --> 00:05:27,032
he has put his little helmet on, 
and he is preparing

96
00:05:27,152 --> 00:05:32,051
so that it doesn't happen to him.
So, he doesn't get killed or injured.

97
00:05:32,051 --> 00:05:32,821
Very good.

98
00:05:33,690 --> 00:05:36,560
And there are things in our projects, 
that if they happened

99
00:05:36,560 --> 00:05:37,875
would kill or injure us.

100
00:05:37,875 --> 00:05:39,218
They would waste time,

101
00:05:39,218 --> 00:05:41,566
waste money, damage reputation,

102
00:05:41,566 --> 00:05:42,986
destroy performance,

103
00:05:43,202 --> 00:05:45,732
maybe even injure real people.

104
00:05:46,230 --> 00:05:49,880
And as project managers we have to
see those things and stop them happening.

105
00:05:49,957 --> 00:05:51,792
Protect ourselves in advance.

106
00:05:51,857 --> 00:05:52,867
Avoid them.

107
00:05:54,240 --> 00:05:57,870
Are there any other uncertainties
that matter for the mouse?

108
00:05:59,637 --> 00:06:01,327
Well there is...

109
00:06:01,327 --> 00:06:02,275
the cheese.

110
00:06:02,678 --> 00:06:05,558
There's an uncertainty here which 
matters a great deal.

111
00:06:05,558 --> 00:06:07,887
"Will I get the cheese out of the trap?"

112
00:06:08,733 --> 00:06:10,429
He might, or he might not.

113
00:06:10,967 --> 00:06:14,121
And if he doesn't get the 
cheese out of the trap, he's failed

114
00:06:14,961 --> 00:06:17,471
So he has two uncertainties to manage,

115
00:06:17,471 --> 00:06:20,133
one of them is bad - he might be killed
or injured -

116
00:06:20,419 --> 00:06:22,639
the other is good - he might 
get the cheese.

117
00:06:23,129 --> 00:06:24,616
And what he has to do,

118
00:06:24,968 --> 00:06:28,958
what he has to do is to manage both
of these at the same time.

119
00:06:29,232 --> 00:06:32,159
And as project managers, we have to
do the same thing.

120
00:06:32,788 --> 00:06:36,128
And also we have to do it in the
best possible way -

121
00:06:36,128 --> 00:06:40,546
sometimes there's a better way to get the 
cheese without being killed or injured.

122
00:06:41,428 --> 00:06:44,518
In our projects, we have to stop the 
bad things happening,

123
00:06:44,889 --> 00:06:47,789
but we also have to get the cheese out
of our projects.

124
00:06:49,116 --> 00:06:52,116
"So what does 'cheese' mean,
in your project?"

125
00:06:52,116 --> 00:06:54,302
"What is the 'cheese' in your project?"

126
00:06:55,160 --> 00:06:56,640
'Cheese' means value.

127
00:06:56,806 --> 00:06:58,445
'Cheese' means benefits.

128
00:06:58,644 --> 00:07:01,868
'Cheese' means products and 
services that people want and need.

129
00:07:02,170 --> 00:07:04,290
'Cheese' means customer satisfaction.

130
00:07:04,371 --> 00:07:06,802
'Cheese' is the good stuff 
that we're trying to get

131
00:07:06,802 --> 00:07:08,465
out of our difficult projects.

132
00:07:08,872 --> 00:07:11,962
And if we don't do anything bad -

133
00:07:11,962 --> 00:07:16,170
we don't waste time, we don't 
waste money, we don't damage reputation -

134
00:07:16,170 --> 00:07:17,954
but we don't create value,

135
00:07:18,278 --> 00:07:19,338
we've failed.

136
00:07:19,683 --> 00:07:23,183
If the mouse didn't die but he didn't 
get the cheese, he failed.

137
00:07:23,950 --> 00:07:28,353
If we create benefits, but we waste time 
and waste money and destroy reputation,

138
00:07:28,353 --> 00:07:29,369
we've failed.

139
00:07:30,015 --> 00:07:32,565
And if the mouse gets the cheese
and he's killed,

140
00:07:32,724 --> 00:07:33,784
he's failed.

141
00:07:33,784 --> 00:07:36,076
So we have to do both of these things.

142
00:07:36,353 --> 00:07:39,231
And when we think about risk 
and think about impact,

143
00:07:39,468 --> 00:07:41,896
there are two kinds of impact that matter.

144
00:07:42,525 --> 00:07:45,175
Bad ones, and good ones.

145
00:07:45,488 --> 00:07:48,125
Uncertainties that could hurt the project,

146
00:07:48,678 --> 00:07:51,568
and uncertainties that 
could help the project.

147
00:07:51,766 --> 00:07:56,364
Both of these matter 
and both of these need to be managed.

148
00:07:56,867 --> 00:07:59,078
And we have another word for those.

149
00:07:59,305 --> 00:08:03,791
So, here's the definition of risk from the
Project Management Institute, the PMI,

150
00:08:04,007 --> 00:08:05,685
from the PMBok Guide.

151
00:08:05,993 --> 00:08:08,093
It's the same as the others 
that we've seen:

152
00:08:08,093 --> 00:08:12,379
an uncertain event or condition, 
that if it occurs, affects an objective.

153
00:08:13,222 --> 00:08:18,534
But PMI knows about the mouse. PMI knows 
about the cheese and the traps,

154
00:08:18,721 --> 00:08:22,277
and has added three words 
to the definition of risk here.

155
00:08:23,233 --> 00:08:26,204
It's not the words 'cheese' and 'traps'.

156
00:08:26,432 --> 00:08:29,301
It's the words 'positive or negative'.

157
00:08:30,067 --> 00:08:33,984
What this tells us is that there 
are good risks, as well as bad risks.

158
00:08:34,544 --> 00:08:37,997
And we heard that in one of our 
keynote speeches, earlier this morning.

159
00:08:38,507 --> 00:08:42,907
In the uncertain situation that this 
country faces going forward

160
00:08:42,958 --> 00:08:46,058
with all the changes that there have been,
there are threats.

161
00:08:46,058 --> 00:08:48,061
There are things that could go wrong.

162
00:08:48,061 --> 00:08:50,226
And you need to see those
and address them.

163
00:08:50,407 --> 00:08:53,188
But there are also opportunities.

164
00:08:53,248 --> 00:08:56,235
Uncertain things that might happen
that could be good.

165
00:08:56,918 --> 00:08:59,346
And we also need to see those things,

166
00:08:59,561 --> 00:09:02,699
and to try and proactively 
make them happen.

167
00:09:03,249 --> 00:09:05,376
And that is equally true in our projects,

168
00:09:05,376 --> 00:09:06,938
in our personal lives,

169
00:09:06,938 --> 00:09:09,308
and also at the national level.

170
00:09:09,778 --> 00:09:13,578
And I'll be talking about some of 
those things later on this afternoon

171
00:09:14,717 --> 00:09:19,161
So, PMI has this definition. The other 
standards have something very similar.

172
00:09:19,541 --> 00:09:21,448
The ISO standard, at the bottom here,

173
00:09:21,448 --> 00:09:25,619
says 'risk is the effect of
uncertainty on objectives.'

174
00:09:26,536 --> 00:09:29,252
Note, the effect can be 
positive or negative.

175
00:09:31,009 --> 00:09:34,726
And the APM, Association for Project 
Management in the UK says the same thing.

176
00:09:35,426 --> 00:09:39,954
So we have this new idea,
that risk is a double-sided concept.

177
00:09:41,090 --> 00:09:43,959
And it's the same impression,
the word you have for risk,

178
00:09:44,329 --> 00:09:48,002
we mostly think of bad things.
But it could be used for good things,

179
00:09:48,002 --> 00:09:49,877
as well. Isn't that right?

180
00:09:50,143 --> 00:09:51,862
It's an uncertain word.

181
00:09:52,281 --> 00:09:55,031
And there are good risks as well 
as bad risks.

182
00:09:55,991 --> 00:09:59,364
So in our project 
risk management process,

183
00:09:59,574 --> 00:10:03,181
we should be looking out for the traps
and avoiding them

184
00:10:03,181 --> 00:10:06,004
and protecting ourselves and 
preventing them happening.

185
00:10:06,004 --> 00:10:09,147
But we should also be looking
out for the cheese

186
00:10:09,147 --> 00:10:11,549
and chasing it, and making it
happen proactively,

187
00:10:11,549 --> 00:10:14,897
so we get the maximum
benefit for the minimum cost.

188
00:10:15,957 --> 00:10:19,375
That’s why risk management is so 
important to

189
00:10:19,712 --> 00:10:22,676
project success: because it effects 
our objectives.

190
00:10:23,817 --> 00:10:27,426
It gives us the best possible chance
to achieve our goals.

191
00:10:28,570 --> 00:10:30,290
So how do we do that?

192
00:10:30,621 --> 00:10:33,104
If we think about the risk management
process,

193
00:10:33,539 --> 00:10:35,899
the process has to do a number of things.

194
00:10:36,524 --> 00:10:39,564
If risk is uncertainty that affects
objectives,

195
00:10:39,633 --> 00:10:41,753
we have to know what our objectives are.

196
00:10:42,076 --> 00:10:44,416
Then, we have to identify the
uncertainties.

197
00:10:45,099 --> 00:10:48,459
The uncertainties that would matter to
those objectives.

198
00:10:48,618 --> 00:10:53,058
And remember that they could be good
or bad, threats and opportunities.

199
00:10:53,897 --> 00:10:56,747
That gives us a long list of uncertainties
that matter,

200
00:10:56,777 --> 00:10:58,477
but they don't all matter the same.

201
00:10:59,218 --> 00:11:03,528
So the next thing we have to do is
to prioritize, and ask the question

202
00:11:04,287 --> 00:11:06,837
"How uncertain,
and how much does it matter?"

203
00:11:07,053 --> 00:11:10,133
Then we get a prioritized list of risks.

204
00:11:10,210 --> 00:11:14,390
We know which are the worst threats and
the best opportunities,

205
00:11:14,811 --> 00:11:17,061
so that we do something about it.

206
00:11:17,508 --> 00:11:19,384
Then we plan how to respond.

207
00:11:19,411 --> 00:11:23,294
We think about what would be appropriate
to stop the bad thing happening

208
00:11:23,344 --> 00:11:24,974
and to make the good thing happen.

209
00:11:25,583 --> 00:11:28,920
And having decided, we do it of course.

210
00:11:29,851 --> 00:11:33,641
And then risk is constantly changing 
so we need to come back and do it again,

211
00:11:33,873 --> 00:11:35,923
and see what has changed.

212
00:11:36,518 --> 00:11:42,048
We could express this process as a number
of questions that it's important to ask,

213
00:11:42,184 --> 00:11:45,604
and keep on asking about our project.

214
00:11:46,337 --> 00:11:49,897
In fact, you can use these questions for
anything.

215
00:11:50,106 --> 00:11:54,076
You could use these questions for your
next career move.

216
00:11:54,524 --> 00:11:58,914
You could use these questions for deciding
about your pension.

217
00:11:59,141 --> 00:12:03,691
You could use these questions to decide
how to bring up your children

218
00:12:04,323 --> 00:12:09,183
or to decide on how to invest the nation's
wealth.

219
00:12:09,996 --> 00:12:11,759
These are the questions:

220
00:12:11,799 --> 00:12:15,409
"What are we trying to achieve?"
That's setting objectives.

221
00:12:15,979 --> 00:12:18,439
Then, "what could affect
us in achieving that?"

222
00:12:18,534 --> 00:12:20,574
That's identifying risks.

223
00:12:20,915 --> 00:12:24,455
Then, "when we have a list of risks,
which are the most important ones?"

224
00:12:24,742 --> 00:12:27,392
That's prioritizing, that
assessing the risks.

225
00:12:27,674 --> 00:12:29,814
Then, "what could we do about it?"

226
00:12:30,242 --> 00:12:34,402
Planning our responses and doing it,
implementing the responses.

227
00:12:34,846 --> 00:12:39,166
And then, "did it work and what's changed"
Reviewing the risk.

228
00:12:39,306 --> 00:12:43,766
So if we look at a risk management
process, we could link each step in the

229
00:12:43,800 --> 00:12:46,930
process to one of these questions.

230
00:12:47,093 --> 00:12:49,773
And this is why risk
management is so easy,

231
00:12:49,876 --> 00:12:56,116
because all we're doing is asking and
answering obvious questions.

232
00:12:56,297 --> 00:13:01,117
Anybody who's doing anything important
will ask these questions:

233
00:13:01,320 --> 00:13:03,820
"What am I trying to do?"
"What could affect me?"

234
00:13:03,896 --> 00:13:06,462
"Which are the big ones?"
"What shall I do about it?"

235
00:13:06,473 --> 00:13:08,983
"Did that work?"
"Now what?"

236
00:13:09,703 --> 00:13:14,383
And you could ask those questions every
Monday morning when you drove to work,

237
00:13:14,402 --> 00:13:16,032
or every Saturday morning.

238
00:13:16,032 --> 00:13:17,786
You can ask the question, say

239
00:13:17,791 --> 00:13:20,831
"What am I trying to achieve today?"
"This week?"

240
00:13:21,286 --> 00:13:23,636
"What could affect me and
which are the big ones?"

241
00:13:23,743 --> 00:13:24,835
"What shall I do?"

242
00:13:24,871 --> 00:13:30,351
We can manage risk on a very simple basis,
or we can use this as the structure for

243
00:13:30,394 --> 00:13:35,114
a risk process which is much more complex,
which involves lots of meetings,

244
00:13:35,139 --> 00:13:39,079
and lots of stakeholder groups and
lots of analysis and statistics.

245
00:13:39,098 --> 00:13:41,188
It's the same questions.

246
00:13:41,909 --> 00:13:45,306
So I would like you to remember
two important things.

247
00:13:45,319 --> 00:13:49,229
One is, risk is uncertainty that matters.

248
00:13:49,554 --> 00:13:53,854
And secondly, these questions,
these six questions.

249
00:13:54,535 --> 00:13:58,235
Because that's the heart,
that's the basis of managing risk,

250
00:13:58,245 --> 00:14:00,761
and it really is very, very easy.

251
00:14:01,402 --> 00:14:06,197
Now, in the time that we have, I want to
focus on just two parts of this process,

252
00:14:06,351 --> 00:14:10,591
and then give us the opportunity
to try out some of these things.

253
00:14:10,618 --> 00:14:14,308
The identification step, clearly
very, very important

254
00:14:14,344 --> 00:14:18,494
because if we don't identify the risks,
we can't manage them.

255
00:14:18,977 --> 00:14:21,617
And then planning responses.

256
00:14:21,880 --> 00:14:26,310
Understanding how we can deal with
the uncertainties that we've identified.

257
00:14:26,590 --> 00:14:30,190
So, let's think about these things:
identifying risks.

258
00:14:30,363 --> 00:14:32,493
How do we find all of the risks?

259
00:14:33,496 --> 00:14:35,016
Well, you can't.

260
00:14:35,016 --> 00:14:38,782
You can't find all of the risks because
there are risks that arrive

261
00:14:38,803 --> 00:14:40,563
that we hadn't seen before.

262
00:14:40,563 --> 00:14:44,386
There are emergent risks,
new risks, different risks

263
00:14:44,607 --> 00:14:48,907
and I'll be talking about those
later this afternoon in my speech.

264
00:14:49,088 --> 00:14:54,848
What we want to find are the knowable
risks: the risks that we could find.

265
00:14:55,249 --> 00:14:58,609
We don't want somebody
on our project team who knows a risk

266
00:14:58,609 --> 00:15:00,192
and they're not telling anybody.

267
00:15:00,235 --> 00:15:04,525
So this process is about exposing the
uncertainties that matter,

268
00:15:04,533 --> 00:15:06,773
finding them so we can
do something about them.

269
00:15:06,888 --> 00:15:08,708
And there are lots of techniques,

270
00:15:08,708 --> 00:15:11,724
brainstorming, workshops, check lists,

271
00:15:11,724 --> 00:15:15,144
testing our assumptions and so on.

272
00:15:15,398 --> 00:15:18,028
But I would like to answer a 
bigger question

273
00:15:18,262 --> 00:15:20,439
A different question from techniques

274
00:15:21,479 --> 00:15:24,173
And it's the question, "are we 
finding the real risks?"

275
00:15:25,393 --> 00:15:29,787
When you go to a risk workshop and you
write things in your risk register,

276
00:15:30,007 --> 00:15:33,724
are they really the uncertainties that 
matter for your project?

277
00:15:34,434 --> 00:15:39,874
Are these really the things that could 
drive you off track or really help you?

278
00:15:40,559 --> 00:15:42,856
Or are they just the obvious things?

279
00:15:42,896 --> 00:15:45,954
Where all projects have problems with 
requirements,

280
00:15:46,734 --> 00:15:49,541
with resources, with testing. 
These are things that

281
00:15:49,793 --> 00:15:52,625
always come up, and we have processes 
to deal with them.

282
00:15:53,733 --> 00:15:55,754
But are they the real risks?

283
00:15:56,034 --> 00:15:59,304
I would like to suggest to you that often
in our risk registers

284
00:15:59,664 --> 00:16:02,018
we confuse real risks with other things.

285
00:16:03,021 --> 00:16:07,725
Often, we confuse risks with their causes,
where does the risk come from?

286
00:16:08,555 --> 00:16:13,125
Or we confuse risk with their effects,
what do they do if they happen?

287
00:16:14,005 --> 00:16:16,525
But risks are uncertainties that matter.

288
00:16:17,565 --> 00:16:20,405
They are not causes or effects.

289
00:16:20,470 --> 00:16:25,357
So, causes are things that are true.
This is true that the project is difficult

290
00:16:26,547 --> 00:16:29,370
it is true that we do not have enough
people on the project.

291
00:16:29,730 --> 00:16:33,233
it is true that the customer hasn't 
signed the contract yet.

292
00:16:33,553 --> 00:16:36,631
These are not risks, they are facts.

293
00:16:36,786 --> 00:16:38,426
They might be issues.

294
00:16:38,426 --> 00:16:42,254
They might be problems, but they are 
not risks because they are not uncertain.

295
00:16:42,997 --> 00:16:45,807
And a lot of people write these
things in our risk register.

296
00:16:45,807 --> 00:16:47,949
"We don't have enough time 
for this project."

297
00:16:47,949 --> 00:16:48,819
"It’s a risk!"

298
00:16:48,819 --> 00:16:51,360
No, it’s a problem.

299
00:16:52,236 --> 00:16:55,164
Sometimes we confuse risks
with their effects.

300
00:16:55,335 --> 00:16:58,635
There could be an accident,
we could be late.

301
00:16:58,835 --> 00:17:02,204
those are not risks either,
they are the effects of risks,

302
00:17:02,204 --> 00:17:06,941
how do you manage, we could be late?
If your late, it’s too late.

303
00:17:07,264 --> 00:17:10,547
What we want to know is,
why might you be late?

304
00:17:10,867 --> 00:17:15,230
what unplanned thing could happen
that would result in, you being late.

305
00:17:15,542 --> 00:17:19,439
So, risks sit between causes and effects.

306
00:17:19,939 --> 00:17:23,673
We can’t manage causes because 
they're here now, they are facts.

307
00:17:24,193 --> 00:17:27,339
We don't want to manage effects
because they may never happen.

308
00:17:27,799 --> 00:17:30,857
What we can manage is risks
that sit in the middle

309
00:17:30,857 --> 00:17:33,322
because they haven't happened yet.

310
00:17:34,282 --> 00:17:38,288
So, risk management has 
to separate risks from

311
00:17:38,288 --> 00:17:41,258
their causes and risks from
their effects.

312
00:17:42,108 --> 00:17:46,090
And I find looking at hundreds of
risk registers all around the world.

313
00:17:46,920 --> 00:17:51,758
I've worked in 48 different
countries, every continent, every culture.

314
00:17:52,108 --> 00:17:56,480
Uh, not the Antarctic, it’s too cold.
Um but nearly every continent.

315
00:17:56,670 --> 00:18:02,360
And over half of the stuff in risk
registers are causes or effects.

316
00:18:02,690 --> 00:18:03,707
Over half.

317
00:18:04,233 --> 00:18:07,063
So the things we are trying to
manage in the risk register

318
00:18:07,103 --> 00:18:10,486
are not risks and then 
people are surprised that it doesn't work.

319
00:18:11,506 --> 00:18:16,153
So how do we separate cause, risk, and
effect here is a little test.

320
00:18:17,293 --> 00:18:19,838
And these statements are
written in your notes.

321
00:18:20,028 --> 00:18:22,299
Or you can just think as we go.

322
00:18:22,359 --> 00:18:26,080
Each of these statements and they are
all very simple is one of these things.

323
00:18:26,120 --> 00:18:28,436
A cause is something that is true today.

324
00:18:28,996 --> 00:18:31,730
A risk is an uncertainty that might,
or might not happen.

325
00:18:32,220 --> 00:18:35,120
The effect is why it matters
to our objective.

326
00:18:36,167 --> 00:18:38,557
Okay? So you have to
think what these are.

327
00:18:38,987 --> 00:18:41,806
The project is based in a 
third-world country.

328
00:18:41,906 --> 00:18:44,055
Cause? Risk? Or effect? 
What do you think?

329
00:18:44,695 --> 00:18:46,139
Cause! Very good.

330
00:18:46,309 --> 00:18:50,130
So, this is a fact, there might be 
uncertainties that come out of this fact.

331
00:18:50,340 --> 00:18:54,924
So we may not get the resources we need,
there may be security concerns.

332
00:18:55,364 --> 00:18:59,907
We may not get paid. These are 
uncertainties that come from this fact.

333
00:19:01,107 --> 00:19:03,516
Interest rates might go down.

334
00:19:03,816 --> 00:19:04,816
It's a risk.

335
00:19:04,826 --> 00:19:07,094
Or they could stay the same or
they could go up.

336
00:19:07,094 --> 00:19:09,692
And we could go over budget.

337
00:19:10,013 --> 00:19:11,302
It's an effect.

338
00:19:11,332 --> 00:19:13,622
So, a million things could
take you over budget,

339
00:19:13,622 --> 00:19:15,393
maybe interest rates is one of them.

340
00:19:15,393 --> 00:19:17,200
Okay? They were easy. 
How about this?

341
00:19:17,200 --> 00:19:19,796
The weather might be better than usual.

342
00:19:20,056 --> 00:19:21,756
So risk could be the same or worse.

343
00:19:22,806 --> 00:19:26,270
It would be a bad thing if you
were selling umbrellas.

344
00:19:27,250 --> 00:19:30,290
It would be a good thing if you
were selling ice cream.

345
00:19:31,220 --> 00:19:32,987
It depends what your project is.

346
00:19:34,007 --> 00:19:36,454
Um, I'm allergic to prawns.

347
00:19:38,234 --> 00:19:39,920
It's a cause, it's a fact.

348
00:19:39,920 --> 00:19:44,353
What is the risk that comes from
this fact, this cause?

349
00:19:47,818 --> 00:19:49,846
You think maybe I could be sick?

350
00:19:50,236 --> 00:19:53,180
I could have a reaction. 
I could be very ill. I could die.

351
00:19:54,640 --> 00:19:57,948
All of those things are effects. 
Aren’t they?

352
00:19:58,578 --> 00:20:00,864
But if something happens 
that I didn't plan,

353
00:20:00,864 --> 00:20:03,911
because I am allergic something might
happen that makes me sick.

354
00:20:04,621 --> 00:20:06,532
What's the something?

355
00:20:07,342 --> 00:20:09,264
I might eat prawns without knowing.

356
00:20:09,614 --> 00:20:14,421
So then I check, are there prawns in this?
You know, I avoid things with prawns in them

357
00:20:14,741 --> 00:20:18,247
I manage the risk and not the effect.
And not the cause.