Unmanaged risks

On any project there are going to be dozens, perhaps hundreds, of unmanaged risks (I doubt this is news to anyone):

• Weaknesses that are Low-Low on the risk register's probability-impact matrix, maybe even all the way to High-Low (p-I)
• Threat events or their effects that are off baseline, not in the project plan, and range from Low-Low to High-Low, perhaps even Low-High also (p-I) 

So, you've not put the unmanaged event or its effects in the project plan, but you have identified the risk and put it below the line of those risks that you will actively manage. Among the four big strategies--accept, avoid, mitigate, and transfer--which one is being used in this management scenario?

If you picked "accept", you get the risk manager's prize for this posting. Indeed, this is 'acceptance' of risks that are below the line and not being managed.

Frankly, for many, the idea that we're going to sit back and accept risk is an uncomfortable position to take. But it happens all the time. When my risk management students lament that their organization has no risk management process or strategy and just deals with risk as they come along, I respond:

"No strategy" is a strategy of sorts in the sense that you've embraced "accept" as your risk response plan. In that event, the need to actually do a lot of work up front to identify risks is really not too productive. If the organization is risk-seeking in attitude, this may be just fine. After all, you're just going to accept whatever comes along and deal with it.

Now, assume one of the unmanaged risk events occurs, and there's some effect to the baseline; now the risk is an issue (issues being in the present, and risks being in the future). Now, you manage the effects of the issue. Is there anything you should have done in the plan, anticipating that your strategy is more about issues and less about risk?

Actually, yes: if your target is issue management and not risk management you can still take a page out of the RM manual to prepare:

• Maintain a vigilant 360 awareness to give you some runway on issues
• Keep your powder dry by holding back some unallocated reserves
• Buffer the schedule in the areas you predict are key to project success
• Keep conjunctive events at a minium (planning strategy)
• Have a good idea in mind of a conflict resolution process that you can bring to bear during issue debate and resolution

Does all this mean that unmanaged risks are actually part of the plan and you're just deferring the inevitable? No, unmanaged risks are just as uncertain as anything being managed. Some will happen; many will not. But letting them become issues rather than managing them as risk, you've limited your options in two ways

1. The runway is shorter than it need be
2. Risks that could have been avoided may not avoidable

Seems a little short-sighted, but no risk strategy is a strategy

Bookmark this on Delicious

Are you on LinkedIn?    Share this article with your network by clicking on the link.