Critical Success Factors for Effective Risk Management
Critical Success Factors for Effective Risk Management
Critical Success Factors for Effective Risk Management
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Critical</strong> <strong>Success</strong> <strong>Factors</strong><strong>for</strong><strong>Effective</strong> <strong>Risk</strong> <strong>Management</strong>Presented byDr David Hillson PMP FAPM FIRMDirector <strong>Risk</strong> Doctor & Partnersdavid@risk-doctor.comwww.risk-doctor.com© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/1
<strong>Risk</strong> management …… THE key driver <strong>for</strong> project & business successWhy?Projects & businesses are risky – must be managedEmphasis on objectivesProactive not reactiveCreates space to manageEnsures consensus & focusHow?© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/2
How to make it work?The three T’s :Techniques ?Yes, we need to know what to doTools ?Yes, techniques need supportingTraining ?Yes, we need to know how to do itAre these enough ?No – necessary but not sufficientNeed to implement “best practice”Need to understand <strong>Critical</strong> <strong>Success</strong> <strong>Factors</strong>© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/3
What is “best practice ” ?“Routine activities that lead to excellence ”Not “what everyone does ”……but “what everyone should do ”Accepted by leading professionalsImplemented by leading practitionersWidely accessibleScaleable, easily tailored or modified© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/4
Various approachesVision StrategyProgrammeCorporate governance/ICAEWRAMP (ICE) 1998/2002BS6079-3:2000IRM:2002ProjectTasksAS/NZS 4360:1999/2004PRAM (APM) 1997/2004PMBoK (PMI) 2000/2004MoR (OGC) 2002© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/5
How to make it work?<strong>Effective</strong> risk management =3 T’s + BP + CSFs<strong>Critical</strong> <strong>Success</strong> <strong>Factors</strong> include :Clear definitionsSimple scaleable processAppropriate infrastructureSupportive culture© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/7
CSF1 : <strong>Risk</strong> definitionFirst principles<strong>Risk</strong> ≠=UncertaintyTrue or False ?<strong>Risk</strong> = Uncertainty that matters(i.e. can affect objectives)© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/8
What is a risk?“An uncertain event or set of circumstancesthat, should it occur, will have an effect onachievement of project objectives”(APM PRAM Guide)<strong>Risk</strong> connects uncertainty with objectives“The combination of the probability of anevent and its consequences”(IRM/AIRMIC/ALARM RM Standard)© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/9
Two-dimensional riskUncertainty estimated as “probability”“Impact” assessed against objectivesBut what kind of impact?Could be either positive or negativeUncertainty that helps as well as uncertaintythat harmsOpportunities as well as threats© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/10
Definition debateCurrent debate :<strong>Risk</strong> is neutral, with undefined impact<strong>Risk</strong> only has negative impacts, i.e. same as threats<strong>Risk</strong> can include both threats and opportunitiesRISK? ? ? ? ? ? ? ? ? ? ? ? ? ? ?RISKUNCERTAINTYTHREATOPPORTUNITYRISK = “threat”OPPORTUNITY© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/11
© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/12
Implications of broad definitionIf risk includes opportunity …Need to change thinkingNeed to change languageNeed to modify process© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/13
New thinkingNot only“What could go wrong?”“How bad could it be?”“Things can only get worse”But also“How could we do better?”“What would we do if we got lucky?”“Can we make our own luck?”© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/14
New languageNot onlyAvoidTransferReduceMitigateBut alsoExploitShareMaximiseEnhanceNot“<strong>Risk</strong> is a potentialproblem, to beminimised or avoided”But rather“<strong>Risk</strong> is the effect ofuncertainty onobjectives, to bemanaged appropriately”© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/15
New processExtend existing riskprocess to deal withopportunities explicitlySimple developmentfrom what is familiarImproved techniques <strong>for</strong><strong>Risk</strong> identification<strong>Risk</strong> assessment<strong>Risk</strong> response planning© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/16
CSF2 : Simple scaleable process<strong>Risk</strong> managementplanningFeedback, updatesand reviews<strong>Risk</strong>identification<strong>Risk</strong> monitoring& control<strong>Risk</strong> assessment(qualitative and/or quantitative)<strong>Risk</strong> responseplanning© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/17
CSF3 : Appropriate infrastructureSelect level of implementationAppropriate & af<strong>for</strong>dableDepends on project type/size/phaseFrom “Slippers & Pipe ” to “The FullMonty ”Provide appropriate infrastructureTools & techniquesResourcesTrainingProceduresTemplatesExternal support© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/18
CSF4 : Supportive culturePeople are THE critical success factor ! identifying risks assessing probability & impacts proposing responses supplying estimates implementing agreed actionsPeople can make or break a project a source of risk exposure a resource <strong>for</strong> risk management<strong>Risk</strong> attitudes need to be managedTRM© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/19
<strong>Risk</strong> attitudesRange :<strong>Risk</strong>-averse<strong>Risk</strong>-neutral<strong>Risk</strong>-tolerant<strong>Risk</strong>-seekingWhy does it matter?Attitudes create heuristicsHeuristics influence judgementNeed to identify & manage risk attitudesPersonal and corporate© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/20
ConclusionIf we have : Clear definitions“risk = uncertainty that affects objectives ”, includingboth threats and opportunities Simple scaleable processdefine, identify, assess, plan, manage, update Appropriate infrastructurenot “one-size-fits-all” Supportive culturemanaging attitudes & taking responsibilityWe will get : focus on delivery of objectives proactive management of threats & opportunities more successful projects & business© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/21
<strong>Effective</strong>risk managementdelivers successfulprojects & businessThank you – any questions?Dr David Hillson PMP FAPM FIRMdavid@risk-doctor.comwww.risk-doctor.com© 2004 David Hillson/<strong>Risk</strong> Doctor LimitedRD/APM-IRM/5Feb04/22
Change language