PM Articles > Kimberly Wiefling > The Where, Who, and When of Risk Management

Project Management Dialogues with ATTITUDE!
This Month's Featured Noggin' Floggin':

The Where, Who, and When of Risk Management

by Kimberly M. Wiefling, M.S.

Project risk management had seemed straightforward enough to me when I first became a project manager. But over the last decade I've started to appreciate the nuances of what now seems to me to be more of an art than a science. Since our theme this month is risk, I'm going to muse about some interesting aspects of risk management that are sometimes overlooked.

Documenting Your Demise

Quite a few years ago I attended a talk by Donald G. Reinertsen, author of the fairly famous book Developing Products in Half the Time. He claimed that the biggest mistake people make in managing risk is to identify the risk but do nothing about it. That certainly rang true for my experience. And it makes perfect sense, since there are never enough resources to address all possible risks. In most projects you just can't afford to prepare for every possibility. With that in mind, I consciously put less emphasis on making a comprehensive list of all possible risks, and focus instead on a shorter list (just those at the top of the pile, usually prioritized by calculating likelihood x impact for each risk), and preventing or mitigating the biggest, baddest, and ugliest of the bunch. Long lists of risks you do nothing about are just documenting your demise.

How Risky Does it FEEL?

As I wrote this article I was sitting on the deck of Esalen Institute overlooking the rugged coastline. My ears were buffeted by the sound of the surf intermingled with the four drummers pounding out a soulful rhythm that got a few people dancing and two children twirling endlessly. Amidst such a blissful environment it didn't feel like there's much at risk. And maybe there wasn't, but that's one of the interesting things about risk—you can't use how you feel as a guide to how much risk you're taking. A project manager who thinks nothing of driving all over town for meetings might need a stiff drink to step onto an airplane to go meet the increasingly large part of the team that's located on a different continent. People are notorious for not being able to accurately judge the level of risk accurately for a host of psychological reasons. If that's a blind spot for risk managers, my next beef is about a clear case of risk management tunnel vision.

When, Where, and Who Cares?

When project teams engage in risk management they often focus on "What" could happen to threaten the project goals, the assumption being that the only risks we care about are the risks to the goals. That would be terrific, if those goals represented all stakeholders with an interest in the project (in priority order, of course!). But project goals frequently do a poor job of precisely describing "success." As you may know from personal experience, many projects are plagued by unclear, misunderstood, rapidly shifting, or purposely postponed goals (a.k.a. SCRUM, Agile, Lean, spiral model, whatever you want to call common sense iterative product development these days). And, in spite of much consciousness raising over the past 20 years, measures of project success still routinely ignore metrics associated with employee retention and long-term customer loyalty, to name a few. Even in this age of Corporate Social Responsibility, most projects aren't tracking "reducing our negative impact on the earth" as a high-priority metric of success. Nope, just thinking about risk from the standpoint of What threatens the all-too-often nebulous and ill-defined goals of a project just isn't going to cut it. We need to explore the Who, When and Where of project risk.

Surf's Up!

Let me illustrate with the issue of global warming. Much attention is focused on What is predicted will happen—shrinking glaciers, rising oceans, fleeing populations. (Glaciers are on my mind lately because a friend of mine recently launched a non-profit called Ice911 to re-grow glaciers using a "planetary band-aid" that can be put in place quickly—and removed once it's no longer needed. Check it out!) But the more complex issues regarding the risks associated with global warming revolve around questions like:

  • Who
    • Who will be impacted by the rising oceans?
    • Who will be impacted by measures to address the issue?
    • Who is the cause? (possibly cows, or so I am told)
    • Who is responsible for tackling the issue?
  • When
    • When might the oceans rise—at what rate?
    • When will the water level start to rise noticeably, and when will it peak?
    • When do we need to start taking action in order to prevent them from doing so?
  • Where
    • Where will populated land be flooded?
    • Where will all of these people live?
    • Where will the water level peak, or will we all need to become better swimmers?

You might notice that all four groups in the Who category are potentially different. Suppose, just for the sake of argument, that cows truly are the biggest source of global warming. Well, they certainly can't be counted upon to tackle the issue—that's probably going to be largely in the hands of the wise government leaders of our world. Those impacted by the economics of treaties and regulations are likely to be businesses and consumers in developed nations, while those fleeing to higher ground include anyone within a meter or two of sea level, with a greater burden falling on people without the means to easily re-locate. The mismatch between those impacted by risk prevention activities and those impacted if the risk is not avoided leads to much of the controversy about how to respond to this risk. Without considering the Who, it's going to be pretty tough to decide How to address the What. How is your risk analysis shaped by the stakeholders in your project?

Measuring Success 1000 Years From Now

On the surface, When isn't quite as complicated, but it's fraught with landmines. Human beings are notorious for their inability to connect cause and effect when they are separated by large spans of time or space. Is smoking bad for your health? By now most people agree that it is, but it doesn't usually kill you until years later, so it's tempting to take a puff and think about quitting tomorrow. What is the time horizon we need to be concerned about for a given risk? Do we measure success in averting disaster over the next 10 years, 50 years, 1000 years, or in perpetuity? Can we assume that at some point this issue will become irrelevant, either because of advances in civilization or the complete demise of the planet due to other causes?

Certainly the timeframe over which we wish to avert risk impacts which risks we need to consider and how we address them. A company concerned about this quarter's revenues might ship a product that makes a profit today. Ten years later that product is discovered to result in illness or death, and lawsuits costing shareholders billions of dollars. A team commercializing medical devices only needs to guard against late supplier deliveries during critical regulatory test phases, but their focus needs to switch to guarding against life-threatening quality control issues throughout the entire life of the product. "Success" is a snapshot in time. Many a "successful" marriage at the two-year mark is on the relationship scrap heap after ten years. (Which is why I think perhaps marriages should have an expiration date . . . OK, maybe not! If my mum reads this she's going to faint.) Anyway, we need to carefully consider the timeframe of our risk analysis, When a particular risk might occur, and over what time period that risk is relevant to the success of our project. What is the timeframe over which you are considering risk for your project?

WHERE is the Risk?

Many a swimmer is more afraid of sharks than deer—as well they should be if they're swimming. But if you live in the US you are 300 times more likely to be killed by a deer than a shark. Of course that's more likely to happen to you when you're riding in a car, not swimming in the ocean. As any animal enthusiast can see, risk also depends on Where you are. Just like realtors, risk managers need to consider "location, location, location." One of my clients won't even build a production facility in certain countries because of the risk that the completed plant might later be claimed as government property. These days, project managers need to consider risk as a function of location in the world. Tornadoes happen in Kansas and hurricanes in Florida. What location-dependent risks does your project face?

Life's Not Fair

As project leaders, we need to consider the risks to all parties who may be impacted by our project. In order to do this properly we need to do a thorough stakeholder analysis as part of our risk analysis. Why? Because life's not fair. Consequences rarely align with causes. As leaders we have the responsibility to represent absent stakeholders and make up for the misalignment between cause and effect. Over many years of leading projects I've noticed that the consequences of poor choices in projects often accrue to someone other than the people making those choices. Designers take a shortcut that dooms the customer support team to excess costs throughout the lifecycle of the product. An executive promises an impossible milestone to a key customer, so the whole project suffers while the schedule is pretzeled to accommodate it. Features creep inexorably toward infinity, while the time available for QA testing shrinks as the schedule slips. "Them that done it ain't them that feel the sting!"

Risk Scope Creep

I'm advocating risk management scope creep. Don't just identify risks. Think about the Who, When, and Where:

  1. First, identify the stakeholders who may be impacted by your project, for better or worse.
  2. Explicitly specify a timeframe over which you are considering risk.
  3. Location, location, location.

Alternatively, you and your team could skip risk analysis altogether, hide your head in the sand like a big ol' ostrich, and just come into work every day and "do your best." That's a recipe for the riskiest project of all.

Related Items
Got risk? Get to the root of it with the right conversations and problem-solving techniques, then make a recommendation. Need help from someone further up the chain? Escalate it! Not sure if it's worth it to correct for a risk? Expected Monetary Value calculations can help your team assess the value of a risk as well as the value of any potential solutions. (Or just flip a coin!)

Not all comments are posted. Posted comments are subject to editing for clarity and length.

Thanks for the great article Kimberley! :)

Great article, fits well in with lecture for class, I will share the link with my students.


Thanks for your analysis and insight. Great article, I appreciate it.


The comments to this entry are closed.

©Copyright 2000-2017 Emprend, Inc. All Rights Reserved.
About us   Site Map   View current sponsorship opportunities (PDF)
Contact us for more information or e-mail
Terms of Service and Privacy Policy

Stay Connected
Get our latest content delivered to your inbox, every other week. New case studies, articles, templates, online courses, and more. Check out our Newsletter Archive for past issues. Sign Up Now

Got a Question?
Drop us an email or call us toll free:
7am-5pm Pacific
Monday - Friday
We'd love to talk to you.

Learn more about ProjectConnections and who writes our content. Want to learn more? Compare our membership levels.