Project Manager.com has a series of videos on project management. This one caught my eye. These types of presentations provide useful information in a very accessible format. Much better than our traditional Power Point slides with lots of bullets.
But there are of course problems from the very beginning with the content:
Open Risk Management Process
It is suggested that risks are gathered as a group, everyone in the same room. This is a series flaw. When capturing risk those providing the risk need anonymity. In a room full of people, it is unlikely they all share the same notion of risk. It is also unlikely they are of equal "rank" and influence on the project.
Because of this, there is reluctance on the part of everyone to actually share their actual views of risk. We see this all the time when senior management attends these risk elicitation sessions. It is well documented at NASA that collecting risks requires a sense of "safety." The classic example is Challenger, where the engineers at Morton-Thiokol were stating there is a problem with the "O-Rings" below freezing. The managers stated on the phone with the pre-launch coordinator "you've got to stop acting like engineers and start acting like business people. We don't get paid unless this thing (the solid rocket boosters) get launched."
This is the worst case example of how not to do risk management.
Segregating the "classes of risk," is the basis of risk elicitation. No junior person is going to stand up against a senior manager who has a political or business agenda.
With the capture of all the risks in the Risk Register, then a combining process can start.
Risk Ranking
The assignment of High, Medium, and Low assignment of risk and impact, is an "OK" approach. But care is needed to understand these are "Ordinal" ranking - a relative ranking. What is needed is the "Cardinal" ranking. Here's an example. The probability of occurance is defined and the impacts - in this case to budget - as well.
Embedded Risk in the Project Rhythm
Visiting the risk register weekly is fine, but the risk register, it's impact, and the mitigation processes must be embedded in the Master Schedule and used to actually manage the project. Connections between the risk retirement or mitigation processes, the work needed to retire or mitigate and the actual reduction in risk are embedded in the project performance management processes.
Otherwise, just visiting the risk register weekly is nice, but doesn't really tell you much about how the risks are being reduced as time goes on.
