Okay, let's have a look at risk management in practice
And what I want to do is to start with some basic concepts
then focus on two difficult areas in the risk process
So, I guess if I asked you to define the word 'risk'
you would have some ideas of what it meant
We might not have a formal definition that we could quote,
but we all have something in our minds when we hear the word 'risk'
This is what we think, and maybe you think of things like this
Maybe you feel like this little guy, facing some big ugly challenge
that you know is just going to squash you flat.
Maybe you feel like this guy.
This is a real job in North Korea,
and his job is to hold the target for other people to shoot at
Sometimes project managers have the target here
We feel like everybody is shooting at us in our job
Or maybe you just know there's something nasty out there, waiting to get you
And maybe that's what you think of when you think of the word 'risk'
Well that's partly true but it's not the whole truth.
Risk is not the same as uncertainty.
Risk is related to uncertainty but they're different.
So all risks are uncertain but not all uncertainties are risks.
If you have a risk register or a risk list,
you don't have a million items in it, or you shouldn't.
You don't even probably have a thousand items in it,
you have a smaller number.
Although there are millions of uncertainties in the world.
So how do we decide which uncertainties we're going to call 'risk'?
And write them down and put them in our risk register
and decide to do something about them.
Clearly 'risk' is a subset of uncertainties, but which subset?
How do you know?
I think it's very simple to separate risk and uncertainty.
And I used 3 English words,
these words here, 'risk is uncertainty that matters."
Because most of the uncertainties in the world don't matter.
We don't care if it's going to rain in London tomorrow afternoon.
It might, it might not, it's irrelevant, it doesn't matter.
We don't care what the exchange rate will be
if it's between the Russian Ruble and the Chinese Yen in 2020.
It doesn't matter to us.
But there are things on our projects,
and things in our families,
and things in our country,
which are uncertain which do matter to us.
If it's an uncertainty that matters, it's a risk.
So here's another question, how do you know what matters?
In your projects, what are the things that matter?
The things that matter in our projects are our objectives.
So we must always connect uncertainty with objectives,
in order to find the risks.
And if we look at some definitions of risk,
this is the ISO standard that I mentioned,
it connects those words very simply.
Risk is the effect of uncertainty on objectives.
And we might look at another definition from the UK,
from our association with project management,
it says the same thing that risk is an uncertain event
or a set of circumstances, which is uncertain,
but it matters because should it occur,
it will have an effect on achievement of objectives.
Uncertainty that matters.
So we should be looking in our risk register for two things.
Is it uncertain? We don't want problems in our risk register.
We don't want issues in the risk register.
We don't want constraints or requirements.
These things are certain, what we want are uncertainties,
something that might happen or might not happen.
But the other important question for our risk register is
does it matter?
Which objective would be effective if this thing happened?
And then when we want to see how big the risk is,
we can ask those two questions:
how uncertain is it,
and how much does it matter?
And that will tell us how big the risk is.
So, this idea of uncertainty that matters
then develops into something which is useful
by linking uncertainty to our objectives.
So, we have two dimensions of ‘risk,’
we have an uncertainty dimension and we
have a dimension that affects our objectives
In projects, we call these probability and impact,
We could call them other things,
there are other English
words we could use, but these
are the ones, most often, we use.