Risk Management and the Three Bears

Everyone is familiar with the story of Goldilocks and the Three Bears. Goldilocks is out for a stroll and happens upon a house. She knocks on the door, and since no-one answer, she walks right in. She then goes through the kitchen, the living room, and the bedrooms to find just the right breakfast to eat, chair to sit in, and bed to in which to sleep. She was in pursuit of perfection. The porridge, chair, and bed had to be “just right”. Not too hot, not too cold, not too big, not too hard, and not too soft.

Risk Management and the Three Bears

Risk Management and the Three Bears

You may wonder what this has to do with risk management.  When it comes to risk identification, reporting, and escalating risks on a project it has everything to do with it. A seasoned project manager will quickly let you know that terrible thing can happen if you escalate either too early or too late on a project. You have to learn how to escalate “just right”.

What Risk Management Process?

Let’s discuss the spirit of risk management. Risk management is the art and science of identifying, communicating, and mitigating potential risks that could be associated with a project. This is where a risk management assessment and risk management plan will prove essential project management tools.

For example, a risk that may present itself to a project is that certain resources necessary to work on the project may not be available if another project comes in before the one you are working on. It’s not certain that this could happen, but there is a definite possibility that this could occur.

It is your job as a project manager to identify and articulate the impact this risk may have to your project. Risk management software can help assess the probability of risks occurring and identify which risks will convert to project issues. What impact will this risk have on the project? Will it bring the project to a grinding halt? Or, will the project be able to quickly swerve and avoid this issue altogether as if the risk were never there?

Once you have the answers to these questions, you now need to determine who needs to know this information. This is where the “art” of Risk Management comes into play.

The Problem With Escalating Too Early

This is where the porridge is too cold. There may be a risk you have identified on the project that a certain deliverable may not be delivered on time by one of the teams on the project. The probability of this event happening is about 50% and would have a medium impact on the project. So, there’s a 50/50 chance that this deliverable may be late and have a pretty serious negative impact on the project. The team responsible for delivering this part of the project has assured you that they are doing everything they can to make up any lost ground and keep the schedule on track.

You now have a tough decision-making process to go through.  You reflect on this particular team’s track record in the past and feel relatively comfortable with their assurance that they can keep things on track.  However, you also know there have been times with they have completely missed the mark despite their assurances. Plus, the impact that missing this date is pretty substantial on the project.

You make the decision that it is a big enough issue to bring up at the next Project Status update with the executive sponsor in attendance.  The representative from that particular department now takes offense at the fact that you didn’t have enough faith in them to get things back on track and felt the need to get others involved. This makes their life harder with more scrutiny and additional checkpoints, requirements, and interference from the higher ups. “How could you do this to us?” they ask.

This is a reasonable question considering the circumstances. And, if you don’t have a good answer to this question you may find that your working relationship with this team begins to quickly degrade. They will not be as forthcoming with information, nor as inclusive with you as they have been in the past feeling that you have “betrayed” them.

This could end up in a pretty serious problem that takes months or even years to work through. The solution? Make sure you have your facts straight. You need to deeply understand the risk and the associated impact it could have on the project. You need to clearly understand that what the team’s mitigation strategy is in order to feel confident (or as this case may be, not confident) in their plan.

You also need to communicate with them on a regular basis as to your motivation for escalating on a potential risk. The last thing you want to do is throw someone under the bus, however, for the sake of the project, this is something that needs to be done. Also, help them understand what happens if this risk is realized and you didn’t say anything.  You are then faced with an entirely different set of questions and interrogatories as to who knew about what and when did they know about it.

This is an extremely tough spot to be in. If you escalate too early, there is really not a good way to prove whether a problem would have occurred if you had not said anything as you can’t prove a negative.  That’s why this area would be considered the “art” of project management. The right answer is based upon years of experience, previous mistakes, and a high level of trust that you have established with those that work on your project.

The Problem With Escalating Too Late

This is where the porridge is too hot. A risk has now been realized and there has been no indication that it has ever been brought up before. Now begins the onslaught of questions from managers and executives scrambling to figure out what went wrong. The unfortunate part of this inquisition is that you are right in the middle of it. “Didn’t you realize this was going to happen? Why is this the first time I’m hearing about this? Do you realize we could have resolved this issue if we had known about it earlier? Now it’s too late and there is nothing that can be done…” are all a typical line of questioning and conversations that will ensue once everyone realizes a risk has turned into a full-blown issue.

Unfortunately, this is where even those who may have felt “betrayed” because you escalated on them too early in the first scenario may begin to recall things differently than you do. “Don’t you remember I told you about this being a potential risk about two months ago?” may be something that comes out at a project status meeting much to your chagrin.

What to do? You have to intimately and deeply understand the downside of not reporting a risk that may happen. You may feel as if you are helping a colleague or teammate by not saying something, but ultimately that approach can blow up in both of your faces. The fire drill that results in bringing things back on track after it blows up is time-consuming, exhausting, and many times unnecessary for everybody involved.

Fortunately, there is a happier ending to Risk Management and The Three Bears than what happened to poor Goldilocks (waking up with bears looking at her, screaming “Help” and running into the forest never to be seen again). But, you will have to experience for yourself both the hot and the cold that results from not accurately ascertaining the probability and impact of a risk. That’s OK. It’s not the end of the world, just mark it up to experience on your way to getting it “just right.”

Leave a Reply