When they set off the first hydrogen bomb there were a number of things that could have gone wrong. One worthy of mention is that it could have set off a chain reaction in the atmosphere and effectively frying the planet. It was a slim probability and of course if it happened there’d be no one left to answer to, so as a mitigation plan they kept their fingers crossed.
Although this is pretty much an extract from ”What they didn’t tell you about project management in class’ my approach to risk mitigation planning is not radical, but it is simple and effective. The gist of the book is that as project manager you are all about keeping people accountable. If you are to keep the decision makers accountable for their decisions then they must be informed decisions. If you’ve kept information from them then ownership of the failure is yours. The risk mitigation plan is an important communication device. There are a number of ways you can present it. Below is the table I use. The trick is in knowing what should (and what shouldn’t) go in it. Think carefully about things that could rain on your parade, document them and present them to your sponsors. For example:
Event
|
Probability
|
Impact
|
exposure
|
mit. plan
|
New Bird flu affects team members
|
High
Project activity requires interaction with international students
|
Low
There may be delays in data gathering, which is not on the critical path
|
Medium
|
Issue flu shots to all team members. Encourage remote submission of data
|
Earthquake renders Corporate Office unusable
|
Low
Tremors have been reported in the news but geologists do not expect after shocks
|
High
Project could be delayed indefinitely
|
Low
|
Nothing
|
About the columns:
Event is the thing that can go wrong. Remember that it has to be relevant to the sponsor’s decision to proceed. Avoid inclusion of operational issues/risks that can be managed within the scope of the project. Consider the sentence, “Boss this is something you need to consider before we start the project”. If it doesn’t apply to the event you’re thinking about then you should probably leave it out.
Probability is the likelihood of the event happening. Use ‘low’, ‘medium’ or ‘high’. Avoid using percentages or fractions as they imply a degree of accuracy which cannot be supported by data. Include a few words of explanation as to why the risk event has become a probability worthy of executive attention.
Impact is the extent to which the event will impact the elements of the triple constraint, ie time, cost or deliverables. Again, use low/medium/high rather than a percentage. Include a brief description of the impact, eg ‘will take longer’, ‘cost more…’ etc.
Exposure is the combination of probability and impact ie how exposed is the project to this risk event? Probability and impact are not enough because you can have an extreme impact event like ‘earthquake’ but with a probability so low that you’re not really worried. On the other hand you can have a relatively low impact issue like the emergence of a new flu virus but it is quite likely to affect your protect. ‘Exposure’ is the column in which you summarise for your sponsors the severity of the risk. Again use ‘low/medium/high’ and sort the table so the biggest concerns are at the top. Use one word only in this column to make it stand out. The details are in the other columns.
Mitigation plan is where you state the action the project team will take to minimise the probability of the event occurring and/or to minimise the impact of the event on the project should it happen. It’s OK to put ‘none’. If you’ve listed a possible event because it’s been in the news and the boss might be worried, but you’re not and you don’t plan to do anything about it, then say so. It will give you the opportunity to discuss the risk with the boss and it will give the boss the opportunity to overrule you which is their right. It may be that there are political implications less obvious to your level of operation. If the boss sees ‘none’ and decides some action is warranted then that decision will come with the required budget, resources and timeline adjustment.
Hopefully you can appreciate that the risk mitigation plan is important, and not particularly difficult to do, but do you have to do one each time? You are expecting the boss to make a decision. Part of that decision is knowing what could go wrong. Perhaps there is nothing, in which case you could leave it out or leave it blank, but don’t pad it out with issues which don’t belong for the sake of ticking the ‘risk mitigation plan’ box.
In the table I’ve used earthquake and influenza as risk event examples to demonstrate relationship between columns of the table. I do this in class too but as they’re walking out the door I threaten them with grievous bodily harm if they include swine flue and earthquake in any real risk mitigation plan. Include only events that the sponsors need to take into consideration when deciding whether to proceed with the project or not. A blank risk mitigation table will provoke thought. “What about…?” and your boss is now doing your job for you which might be a bit embarrassing but it is productive. Padding with events not specifically relevant to the decision to proceed are likely to cause the reader to start skimming, reducing the quality of the communication that you have with the reader.
Your risk mitigation plan is all about communicating what could go wrong and what you are going to do to minimise the probability of it happening and/or the impact of it happening if it does. One possible outcome is that the sponsors decide not to proceed with the project, which is their right, but no matter what happens the risk mitigation plan (done well) will ensure that you, your team and your sponsors stay friends through the rough patches. This is not only good for your stress levels but also gives the greatest probability of a successful outcome. .