This is the fourth article of our series on Project Risk Management.
Over the last few years SUKAD has conducted numerous risk management courses, some of them were about organizational risk management and others specific to project risk management. This article summarizes some of the comments from the participants of these classes; edited by SUKAD consultants. We raise these points to highlight gaps in the practice of project risk management.
These observations came as a result of this question: “what are some of the issues that you face today in relation to project risk management”. The importance of this question is that it is open-ended and applicable whether the organization has good project risk management practices in place or none at all.
People “Practices” Gaps
- Inconsistency among practitioners in the same organization; some participants seems to be doing more than others in practicing/applying project risk management … and some have better understanding of the project risk management processes than others.
- Some do a good job in utilizing project risk management on larger projects but do not do it (or properly perform project risk management activities) on smaller projects.
- Not sure if “all” recognize the value of project risk management and if they do – are they willing to put the necessary effort that is appropriate to the value? In other words, do we have a gap between what we say and what we do?
- Workload does not allow the project managers enough time to perform proper risk assessments and management.
- It is difficult to gather all stakeholders for risk management activities. Further, technical stakeholders do not give proper value to project risk management.
Training & Development Gaps
- Some feel that they are practicing project and risk management in an “Ad Hoc” or accidental way and they were not properly trained for project management or project risk management (Accidental Project Manager syndrome).
- “We have an excellent tool in place”; but some could not answer specific questions about the tool and there is seems to be differences of opinion here.
- Need to incorporate project risk management and other project management activities into the overall planning effort (time and other considerations).
- Some say “we have good planning” but others says there is a gap, “not fully following all processes”.
Risk Identification Gaps
- It is common that team members limit risk identification to obvious project risks and they conduct the identification exercise in a brainstorming mode staying on the high level. They are not including other tools and techniques, including drilling down into a work breakdown structure (WBS).
- “Usually we identify a few risks on a project but sometime we could have a large number of risks.”
- It is important to have the right balance between quantity and quality of risks identified. The objective is not to identify hundreds of meaningless risks, rather to identify as many risks as possible in order to effectively manage the project and its risks.
- Lack of proper follow-up during execution … “We do a good job in planning but when we go into execution …”
- There is no real enforcement for the project managers to do risk management and follow-up … so most projects still do the risk assessment but not the full “management” or follow-up.
Organizational System Gaps
- It is important to have a knowledge management system in place that includes lessons learned.
- The knowledge management system should be user-friendly and allows retrieving lessons learned readily.
- It also appears that there is no “standard” way for scoring risks; basically how to assign a 1, 2, or 3 to the risk probability or impact. Therefore, risk ranking is left to each team preferences.
- Availability (lack of) lessons learned on previous projects (especially for new type of projects). In addition to lack of experience on new type of projects (new services).
- There are differences between contingency reserve and management reserve but this is not clear within many of the organizations we work with and/or the concept is not fully utilized.
- It is not easy to reach a common view among stakeholders; no alignment. This may seem a people issue but the root cause is system issue and related to lack of standard way for scoring risks.
- Fighting fires, which might be a symptom of not doing enough risk identification and proactive management …
- In a client organization, project managers are quantifying even the medium and low priority risks, which might be acceptable but this is not a “preferred practice” and is an extra effort that might not be justified by the benefit.
- There should be a project classification system (typically 2, 3, or 4 project classes). If such a classification system exists it should be used for all project management functions; including risk management.
- In some cases, “we start early without contract”; this practice is leading to ambiguity of scope, which increase uncertainty, and obviously increasing risk.
- There are difficulties related to cultural and governmental issues in other countries or even in remote, rural areas.
We welcome your contribution in adding to the above factors.
If you are reading this article through LinkedIn or other medium, we ask you to please visit the blog itself and put your comments there; this way your comments and suggestions are visible to all and others can respond or build on your response.