Houston, we have a Risk!

Do you remember the famous movie Apollo 13 released in 1995, in which the famous quote (itself borrowing the words of Jack SWIGERT in 1970) ‘Houston, we have a problem’ is uttered by Tom HANKS. Indeed, even before the issue was identified, wouldn’t it have been essential to be able to identify the risks related to the environment or from material/equipment failures? Going further, could this have been avoided? This is a question that remains ever-present within every company nowadays. Do the actors involved in corporate projects share specific insights and concerns about risk management? How can one make the “pill of project risk management” more palatable to employees with varying levels of interest? How can one spread a risk culture and encourage peers to engage with this topic, despite its uncertain and almost intangible nature?

In many organizations, risk management is often the “weak link” or the “fifth wheel” in relation to project scheduling and cost management. In such environments, the role of the project risk manager or the risk focal point becomes extremely complicated. Numerous arguments are made to avoid addressing the risk portfolio. Some stakeholders feel disconnected from the topic, others claim they lack some time, some are on vacation during risk reviews and therefore do not prepare them, and others argue that the tool used to manage risks and opportunities is ineffective. The list of grievances is virtually endless.

We often observe a disconnect between the ideal: a risk management process integrated at all levels of the company, and the reality: a lack of enthusiasm for managing risk and uncertainty. This raises the following question: What are the levers of involvement to reduce this antagonism?

The goal of this article is to share, through a representative but fictitious case study, common sources of dysfunction in managing risks and opportunities (R&O) within organizations, as well as general principles to apply to fully embed risk management into project teams.

A Necessary State of Affairs

The realization of risks that the existing process failed to anticipate or mitigate can serve as a basis for auditing the R&O culture within an organization. It is essential to examine the relevance of the current process and assess how it has been implemented by stakeholders. A firm commitment from management is essential to the success of such an evaluation of the risk management process.

The gaps identified during the diagnostic assessment with various stakeholder groups (PMO, project managers, contract managers, etc.) within the department highlight the following issues:

• Some significant risks are ignored and left unaddressed.
• Basic risk management principles are not being applied.
• The official risk management tool is bypassed, skewing the overall consolidation.
• Response and mitigation plans are poorly followed.
• Reporting to management is neglected.
• Roles and responsibilities are poorly understood and scarcely implemented.

How to Analyze These Dysfunctions?

One primary cause of dysfunction often lies in the deployment of a process primarily designed to meet the needs of top management, without first considering the operational needs of the projects and the teams involved. This can lead to a form of passive “rebellion,” resulting in disinterest and a minimization of personal investment.

Other root causes can be identified, such as poorly communicated strategies from central bodies on the risk management approach at the project portfolio or company-wide level. The lack of basic knowledge and understanding of the specific jargon used in the risk management process (qualitative and quantitative assessments, risk matrices, etc.), especially in the identification and monitoring stages, is also a key factor in poor management.

The complexity of the processes, unclear roles and responsibilities, and the cumbersome nature of risk management tools can also be raised during discussions with concerned stakeholders. A chronic issue in large organizations is the lack of harmonization of practices and routines between different projects or departments.

From Diagnosis to Action: Moving Forward

Here are some improvement strategies for PMOs or risk managers looking to enhance risk management within their organizations.

Build Shared Competence

All key stakeholders must be equipped with the necessary knowledge and skills to identify emerging risks, assess their likelihood and impact, and implement appropriate control measures. To achieve this, raising awareness among staff must be a priority. This can include thematic information sessions (e.g., ensuring data integrity, identifying and evaluating cross-cutting risks, understanding the risk rating scale) tailored to each level of responsibility, such as PMOs and project managers. Weekly support should also be provided to operational teams to help implement the risk management process and effectively use the management tools. A great deal of patience is required, depending on whether these sessions are mandatory or not!

Identify the “Locomotives”

It is important to identify the “locomotives,” the key individuals who will motivate their colleagues to actively manage their risk portfolios. These individuals will be the champions of change, driving the shift towards risk-based project management.

Eventually, the momentum of initially reluctant individuals will begin to show. The more adaptable, empathetic, and persistent you are, the more you will lead by example. Paying attention to others is crucial, as you will need to identify any hesitations, weak signals, and obstacles, and come up with practical solutions to address them.

(Re)integrate Cost, Schedule, and Risk Management

Integrating cost, risk, and schedule management is a cornerstone of project management that should be reminded periodically. Defining risk responses as project tasks, with duration, cost, resources, and a responsible party, and incorporating them into the project schedule is an interesting approach. Initially, we recommend setting key milestones for the risk treatment plan, with predecessors and successors in the schedule, and then extending this principle to achieve the desired level of control: the ability to track risks in the project schedule, alongside all other tasks. This represents a real challenge, undoubtedly requiring a phase of support during implementation.

Clarify, Support, and Assert Expectations

Continuous engagement from management is key to any process implementation. This becomes even more critical when it is necessary to rebuild trust and secure buy-in for the process. How can leadership demonstrate this sponsorship?

• By allowing everyone to speak openly about their project weaknesses and share concerns without fear of judgment.
• By instituting regular risk reviews and requiring project managers to report on their key risks in steering committees.
• By making decision-making processes and arbitration procedures more transparent. Sometimes, access to the management reserve at the program or portfolio level is shrouded in opacity, making it difficult for project managers to understand and accept.
• By more carefully scrutinizing requests to use the management reserve, as it is not intended to be spent freely. Easy access to this reserve does not encourage effective risk and opportunity management.
• By fostering constructive criticism of the R&O management process.

Facilitate the Use of Centralized Tools

How long can a specialized risk management tool, which requires some training, withstand the lure of the trusty Excel spreadsheet? For some project managers, pressed by operational urgencies, the answer is often minutes, if not seconds. Let us be clear: the time savings promised by bypassing the official solution is a false economy.

Despite a higher learning curve, specialized tools offer unparalleled structuring and consolidation features. They ensure, through their configuration, the natural application of company processes. Therefore, it is essential to guide employees toward adopting these tools and integrating them into their project routines. Initial training, followed by regular “refresher” sessions, will be necessary to maintain data quality over time.

Work on Routines

To enable project stakeholders to take ownership of risk management, they must be given the means to detect and report risks during regular routines, and they must be proactive and committed to their actions and decisions. To achieve this, performance evaluations such as mock audits or recognition programs (e.g., for the employee who mitigated the most risks) can be implemented.

Break the Routine!

To break down silos, encourage collective intelligence, and open up dialogue, we recommend using simple, playful methods:

• Depersonalize risk meetings with original icebreakers such as “introduce your superpowers,” “spit out your worries,” or “photolanguage” (share your current mood in a photo).
• Use case studies to illustrate how to assess a risk.
• Hold a “deep dive” session with project managers to analyze why certain risks materialized or were mitigated.
• Use interactive digital boards like Jamboard or Klaxoon for brainstorming and visualization sessions.
• Use quizzes and games, such as the “Six Thinking Hats” method or the Bowtie method, to identify and analyze R&O.

We also recommend the RDMM (Risk Driven Mind Mapping) method, developed by setec eocen – expertise gestion de projet, which enables the early and shared identification of risks through mind maps, leveraging the expertise of project stakeholders. This facilitation workshop, tested and adopted by several of our clients, helps project teams focus on the root causes of risks and their effects using intuitive, visual elements and simple, natural language. This method fosters team dynamics, and certain insights emerge during these workshops.

Leverage Lessons Learned

Perfection cannot always be achieved in organizations: keeping processes up-to-date, ensuring that people are trained and involved, and embedding a risk culture throughout the company. However, leveraging lessons learned (REX/ROE) is an essential complement to R&O management. Unfortunately, we often observe that this practice is either nonexistent or poorly implemented in many organizations. Tools do exist to create and feed back into this loop of reflection and continuous improvement, such as ReXplore, a solution developed by setec eocen – expertise gestion de projet. By capitalizing on micro-REX and providing intelligent, continuous access to project knowledge, it constitutes a promising pathway for organizations that adopt it.

And How Does the Story End?

Presenting the results of an improvement plan deployed on a fictitious case study is undoubtedly challenging. However, we offer some representative testimonials from risk managers involved in a progress-driven approach. Though not fully achieved yet, they are clearly on the right track:

“The action plan defined after the diagnosis of risk management within the engineering department has been successfully implemented. From being the ‘fifth wheel’ of the project, the risk management team has now become a fully integrated vehicle, determined to stay the course on the highway of projects.”

“Along the way, we learned to understand the company culture, implement innovative tools, and methodologies that gradually engaged the key collaborators in project risk management.”

“Daily management now benefits from a gradual but real change in culture, and this is the most important outcome. We hear people talking about risks in the hallways; they’re complaining less, and R&O is now on the agenda of team meetings – and that’s already a victory!”

We hope this article provides you with useful insights to accelerate your risk and opportunity management processes and, as a result, help your projects reach the finish line more smoothly while fostering widespread adoption of the risk culture.