A major problem of Risk Management is getting it to work within a company process. In many occasions, a perfect method on paper proves very hard to implement. The implementation is usually top-down. People feel they have to do extra work and boring administration and in the end nothing really changes. So after three months, or when something happens, everybody starts running as before, complain that risk management has not helped and return to his or her old and familiar habits.
What has gone wrong?
To show the liability, the Cynefin Framework from Dave Snowden is of great help.
This framework divides processes and problems in 4 categories: simple, complicated, complex and chaotic. The two categories that matter in this case are the complicated and complex category.
The complicated category can be explained as a large jigsaw puzzle. The beginning and end are clear, and when you fit the right pieces together, the goal is reached. If the right pieces cannot be found, hiring extra experts can solve the problem.
If the complex category would be a jigsaw puzzle, you have a pile of pieces but the only way to solve the puzzle is to start with fitting pieces that seem likely to work. If looking back, you see that you are making progress, expand this part of the puzzle. If not, set it aside and start with other pieces.
It does not help to treat a complex problem as a complicated one, you have to deal with the complexity, and find the solution through experimenting. If facing a problem, it works to get experts from many area’s of expertise and try the next step with the best idea. But again only hindsight will tell if it was in the right direction.
The problem is, that most company processes are regarded as complicated, while in fact they are (very) complex. Factors like human behaviour, shifting goals, unexpected events, culture and variable workloads are impossible to implement in a waterproof equation. Trying to do this anyway will take much effort, strong management and monitoring to make it work.
So can it be done?
When accepting a process as complex, probing is the key. Using Agile methods can help in getting this to work as this focuses on getting quick results and working from there.
The first step to take is getting agreement on Sense of Urgency. What problem are we solving? Why do we need the added value of Risk Management?
The second step is setting an ambitious and long distance goal that is shared by all stakeholders, top-down and bottom-up. When would our problem be solved? When are we satisfied?
Thirdly, find a probe to implement in the organisation. Parts to keep in mind:
• The probe can function in the process
• The key players have a sense of excitement.
• Implementing the probe should not be complex, so keep the scale down by selecting a pilot project or a small part of the company.
An important step is deciding what form of Risk Management would work best. To answer this question, the Cynefin Framework is of use again. When dealing with Simple processes, best practices are often the key to problems. Risk Management can be used to improve existing processes and make efficient decisions.
With complicated projects, the traditional form of implementing Risk Management is usually a good choice. It helps bring structure to risks, align goals of stakeholders and find focus in solutions and risk awareness.
Complex projects are typically on a tactical or strategic level. Risk Management can here be used to improve decision-making and aligning vision of stakeholders. A simple form is usually a good start.
To be complete: In chaotic situations, Risk Management has no value as immediate action is required to try and find grip on the situation.
After running the probe, evaluate
• Did it work as planned?
• What is the added value and is it enough?
• Are we moving towards the end goal?
• Was it fun and worth the effort?
If the probe was a success, take the next step to enlarge it by adding other parts of the company, other parts of the project or other stakeholders. Steer where possible on the parts that did not work as planned.
If the probe was not a success, evaluate. Find the cause and start a different approach.
Using this method will help, find a fit-for-purpose solution that is adaptable. It will be easier to be accepted within the organisation, as people feel more involved and not pressed towards changing their habits by something that was invented elsewhere. Ultimately it will help people getting grip on risks and opportunities and thereby achieving their goals and be successful.
