Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
The importance of properly
describing risks
A world in which all projects succeed
APM North West Branch & APM Risk Managem...
Risk descriptions
• Please take a few minutes to write a risk
description on the card provided.
• Write the risk in the fo...
Risk descriptions
• Assuming the risk you have written is a
threat or downside risk, i.e. a risk that if it
happened would...
Background
• In September 2000, David Hillson
published his article “Project Risks –
Identifying Causes, Risks, and Effect...
Background
• Since then most international standards
and reference texts have adopted the use
of this structured way of de...
The PRAM Risk Management Process
PRAM refers to the APM’s
Project RiskAnalysis and
Management (PRAM) Guide
From TheAssocia...
• A risk that is identified is a risk
that can be managed…
• If you fail to identify a risk, it
means you have taken it.
©...
• A risk that is understood is a risk
that can be managed…
• If you fail to understand a risk,
it means you can’t manage i...
• Therefore, in order to make risks
manageable, it is essential that risks are
described in a way that allows them to be
u...
• The ‘metalanguage’ helps to transcend
language barriers.
• It also really helps in the later
assessment of both probabil...
Definition of a risk event
• APM BoK 6 – “An uncertain event, or set of
circumstances that would, if it occurred, have an
...
The bow-tie diagram
Issues
Uncertainties
Uncertain
Event
Prevention
Actions
Recovery
Actions
Risk Event
Rangeofoutcomes
Do...
Structured risk descriptions
• In order to assist in the risk management process it
is essential that risks are properly d...
16 tips on how to describe
your risks properly
© Lucidus Consulting Limited 2016 www.lucidusconsulting.com
The cause must be a fact.
Many causes of risk events are current
issues, which by definition are facts.
Inclusion of one o...
One of the key words ‘may’, ‘might’
or ‘could’ must be used in the risk
event description.
This avoids the inclusion of is...
The effect or consequence of the risk
event must specifically state which of
the project’s objectives are impacted.
Try no...
Do not use any of the key words
‘may’, ‘might’ or ‘could’ when
describing the effect(s) or
consequence(s).
Use words like ...
An opportunity or positive risk event
should have a net beneficial impact
on objectives.
Therefore, phrases like ‘removing...
A risk event has to be something that
might happen and which is different
from the base case.
Therefore, it is vitally imp...
The measurable impact of the effect
or consequence is against the base
case.
Therefore, it is again important to know
what...
The temptation to quantity the risk
should be avoided, so words like
‘high’, ‘major’ or ‘significant’ must
not be included...
Make sure you actually describe the
correct risk event and not the
effect/consequence.
This often happens when long risk e...
Do not include two or more causes in
the source of uncertainty unless they
are definitely linked.
Although a risk event ca...
Do not include two risks in one risk
event description. This is often
evident by the inclusion of two of
the key words ‘ma...
If your risk event contains words like
‘may lead to cost overrun’ or ‘may
reduce the duration’ you probably
have the wrong...
Avoid including responses (actions)
in the effect/consequence – just stick
to what will happen if the risk event
occurs.
I...
Try to make your risk descriptions –
risk strings (cause, risk event and
effect/consequence) – as precise as
possible.
Thi...
Opportunities/upside risks should not
be choices.
A risk event is something that could
logically happen purely by chance. ...
Beware of risk titles – short form
descriptions of the risk.
By shortening the full description it is
possible to remove t...
A structured description of a risk which
separates cause, risk event and effect
“As a result of <existing condition>,
<unc...
• The cause must be a fact.
• The risk event must be written as an
uncertainty using one of the key words
‘may’, ‘might’ o...
• The effect/consequence should include one
of the words ‘will’ or ‘would’.
• It helps to read the whole risk string (caus...
Creating Value by
Shedding Light on Planned
Change
Peter Simon HonFAPM PMP
peter@lucidusconsulting.com
07900 554536
www.lu...
This presentation was delivered
at an APM event
To find out more about
upcoming events please visit our
website www.apm.or...
Upcoming SlideShare
Loading in …5
×

The importance of properly describing risks, presented by Peter Simon, 10th Oct 2016, APM North West branch conference

2,585 views

Published on

The importance of properly describing risks
Presented by Peter Simon
Monday 10th October 2016
APM North West branch and Risk SIG conference
Alderley Park, Macclesfield

Published in: Business
  • I’ve personally never heard of companies who can produce a paper for you until word got around among my college groupmates. My professor asked me to write a research paper based on a field I have no idea about. My research skills are also very poor. So, I thought I’d give it a try. I chose a writer who matched my writing style and fulfilled every requirement I proposed. I turned my paper in and I actually got a good grade. I highly recommend ⇒ www.WritePaper.info ⇐
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • A very good resource can do the writings for HelpWriting.net But use it only if u rly cant write anything down.
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

The importance of properly describing risks, presented by Peter Simon, 10th Oct 2016, APM North West branch conference

  1. 1. The importance of properly describing risks A world in which all projects succeed APM North West Branch & APM Risk Management SIG 10 October 2016 Peter Simon HonFAPM PMP Director – Lucidus Consulting Limited www.lucidusconsulting.com © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  2. 2. Risk descriptions • Please take a few minutes to write a risk description on the card provided. • Write the risk in the format you would see in your own firm’s risk register or database. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  3. 3. Risk descriptions • Assuming the risk you have written is a threat or downside risk, i.e. a risk that if it happened would have a negative effect on one or more of the project objectives... • Now (on the other side of the card) write an opportunity or upside risk, i.e. a risk that if it happened would have a positive effect on one or more of the project objectives. • If it was an opportunity then write a threat. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  4. 4. Background • In September 2000, David Hillson published his article “Project Risks – Identifying Causes, Risks, and Effects” – (PM Network). © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  5. 5. Background • Since then most international standards and reference texts have adopted the use of this structured way of describing risks. • According to “some people” using this approach has had the greatest influence on improving risk management in practice. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  6. 6. The PRAM Risk Management Process PRAM refers to the APM’s Project RiskAnalysis and Management (PRAM) Guide From TheAssociation for Project Management’s Project RiskAnalysis and Management Guide – Second Edition - 2004 INITIATE IDENTIFY ASSESS PLAN RESPONSES IMPLEMENT RESPONSES MANAGEPROCESS INITIATE IDENTIFY ASSESS PLAN RESPONSES IMPLEMENT RESPONSES MANAGEPROCESS
  7. 7. • A risk that is identified is a risk that can be managed… • If you fail to identify a risk, it means you have taken it. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  8. 8. • A risk that is understood is a risk that can be managed… • If you fail to understand a risk, it means you can’t manage it. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  9. 9. • Therefore, in order to make risks manageable, it is essential that risks are described in a way that allows them to be understood by all who read them. • This includes those who have written the risk (perhaps when they are revisited in, say, three months time) and those who have little knowledge of the project. The ‘metalanguage’ helps to do this. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  10. 10. • The ‘metalanguage’ helps to transcend language barriers. • It also really helps in the later assessment of both probability and impact by clearly separating the risk event from the effect/consequence. © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  11. 11. Definition of a risk event • APM BoK 6 – “An uncertain event, or set of circumstances that would, if it occurred, have an effect on the achievement of one or more objectives” • PMI PMBOK© 5 – “An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more of the project objectives such as scope, schedule, cost and quality. A risk may have one or more causes and, if it occurs, it may have one or more impacts.” © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  12. 12. The bow-tie diagram Issues Uncertainties Uncertain Event Prevention Actions Recovery Actions Risk Event Rangeofoutcomes Downside Upside Risk Responses Cause Consequence © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  13. 13. Structured risk descriptions • In order to assist in the risk management process it is essential that risks are properly described using: Cause • Definite events or set of circumstances that exist in the environment and which give rise to uncertainty Risk Event • Uncertain events or set of circumstances that, if they occur, would affect objectives Effect • Unplanned variations from objectives, either positive or negative, which arise as the result of risks occurring As a result of <definite cause>, <uncertain event> may occur, which would lead to <effect on objective(s)> (David Hillson - PMNetwork - September 2000) © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  14. 14. 16 tips on how to describe your risks properly © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  15. 15. The cause must be a fact. Many causes of risk events are current issues, which by definition are facts. Inclusion of one of the key words ‘may’, ‘might’ or ‘could’, or other words like ‘future’ would confirm that a risk event (not a fact) is being described. 1 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  16. 16. One of the key words ‘may’, ‘might’ or ‘could’ must be used in the risk event description. This avoids the inclusion of issues and ensures that what is being described is actually uncertain. It helps not to use alternative words like ‘possible’, ‘potential’ or ‘chance’ – just stick to the key words. 2 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  17. 17. The effect or consequence of the risk event must specifically state which of the project’s objectives are impacted. Try not to be too verbose. It should be easy to recognise which objective or objectives are impacted. The ‘so what?’ question needs to be avoided. 3 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  18. 18. Do not use any of the key words ‘may’, ‘might’ or ‘could’ when describing the effect(s) or consequence(s). Use words like ‘will’ or ‘would’. Assuming the impact will happen makes it is easier to assess. It removes the double uncertainty. 4 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  19. 19. An opportunity or positive risk event should have a net beneficial impact on objectives. Therefore, phrases like ‘removing the chance of delay’ or ‘avoiding cost overruns’ or ‘increasing the probability that schedules will be met’ are not acceptable as they are unquantifiable. 5 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  20. 20. A risk event has to be something that might happen and which is different from the base case. Therefore, it is vitally important to be totally aware of what is already being planned. 6 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  21. 21. The measurable impact of the effect or consequence is against the base case. Therefore, it is again important to know what is currently included in the cost estimate or schedule in order to define a positive or negative impact. 7 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  22. 22. The temptation to quantity the risk should be avoided, so words like ‘high’, ‘major’ or ‘significant’ must not be included in either the risk event or the effect/consequence. Quantification is done in the next phase of assessment. Any earlier quantification will only be the writer’s view and this can easily be biased. It can also change. 8 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  23. 23. Make sure you actually describe the correct risk event and not the effect/consequence. This often happens when long risk event descriptions are included leading to a ‘may’ statement which is actually an effect or consequence. 9 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  24. 24. Do not include two or more causes in the source of uncertainty unless they are definitely linked. Although a risk event can have multiple causes, it is better to keep them separate. The risk string should be one cause > one risk event > multiple effects. 10 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  25. 25. Do not include two risks in one risk event description. This is often evident by the inclusion of two of the key words ‘may’, ‘might’ or ‘could’. Apart from anything else, later assessment of probability will be difficult/impossible, so either they must be separated or one should be converted to a ‘will’ or ‘would’. 11 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  26. 26. If your risk event contains words like ‘may lead to cost overrun’ or ‘may reduce the duration’ you probably have the wrong risk event and you are actually describing the effect or consequence. All impacts on objectives must be in the effect. Remember, it is always better to assume the effect/consequence will occur. 12 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  27. 27. Avoid including responses (actions) in the effect/consequence – just stick to what will happen if the risk event occurs. In addition any response would be only your own opinion and it might be wrong. 13 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  28. 28. Try to make your risk descriptions – risk strings (cause, risk event and effect/consequence) – as precise as possible. This does not mean they need to be short. 14 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  29. 29. Opportunities/upside risks should not be choices. A risk event is something that could logically happen purely by chance. Using the words ‘the project may’ suggests that this is not a chance event but a choice/ decision that the project team or organisation can make. 15 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  30. 30. Beware of risk titles – short form descriptions of the risk. By shortening the full description it is possible to remove the actual sense of the risk. These then get used in discussion and what is behind the risk gets lost. 16 © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  31. 31. A structured description of a risk which separates cause, risk event and effect “As a result of <existing condition>, <uncertain event> may occur, which would lead to <effect on objectives>” Key words : – is, do, has, has not … [present condition] – may, might, could … [uncertain future] – would, will … [consequential future] The risk metalanguage Structured risk descriptions © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  32. 32. • The cause must be a fact. • The risk event must be written as an uncertainty using one of the key words ‘may’, ‘might’ or ‘could’. • The effect/consequence must clearly state which of the project's objectives is impacted. There should be no need to guess or infer what objective is impacted. In summary (1) © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  33. 33. • The effect/consequence should include one of the words ‘will’ or ‘would’. • It helps to read the whole risk string (cause – risk-event – effect) as one sentence – this often points out where there are disconnects e.g. the risk event doesn't link to the cause or the effect doesn't relate to the risk event. In summary (2) © Lucidus Consulting Limited 2016 www.lucidusconsulting.com
  34. 34. Creating Value by Shedding Light on Planned Change Peter Simon HonFAPM PMP peter@lucidusconsulting.com 07900 554536 www.lucidusconsulting.com
  35. 35. This presentation was delivered at an APM event To find out more about upcoming events please visit our website www.apm.org.uk/events

×