Lack of  RISK mitigations

• Problems that was foreseen

• A risk management process that is perceived as having no value

• A growing  list of risks, that appears to be exhausting

• “Risk acceptance” as the prevailing mitigation strategy

When risks are not appropriately mitigated, there are two major reasons.

1. Lack of risk mindset

2. Lack of “energy”

Please note that lack of skills or tools is not on the list!

​

Risk mindset: The ability to handle risks comes primarily from a mindset that is focused on avoiding problems. My best example is looking at parents with small children. One of the parents is often mitigating more risks than the other. That focus comes from a risk mindset, not from an ISO standard or a risk management tool. Nothing will happen if you don’t have that mindset as a true way of prioritizing your actions. If, on the other hand, you have the “risk mindset”, the standards, processes, and tools will be very useful to support and facilitate risk management in a complex project.

​

Energy: An overloaded project that is only measured on the short-term delivery of functionality will not prioritize risk mitigation over functionality delivery. They may possess the risk mindset and want to mitigate risks, but since risk mitigation has a longer ROI than delivering functionality, it simply does not happen.

Hold on to the leadership aspect of overview and strategic planning.

The time horizons of the sponsor and the steering group are longer than the project's.

Risk management in projects is, by nature, supporting the longer-term goals and not short-term functionality delivery and needs a higher focus from the sponsor and steering group.

​

Coaching the “risk mindset” is the first leading principle that ensures that the project management is using the knowledge that only they can see to invest in the appropriate risk mitigations that support the sponsor and steering group's long-term goals.

The sponsor and steering group also establish pressure on the project, and too much pressure excludes risk mitigations. So, the second principle is to balance the pressure with the need to achieve long-term goals.

Mitigations – not plans!

​

A simple question about risk handling will reveal a lot.

Suppose the answer is based on the presentation of a process, a risk register, and a point on the agenda of the steering group meetings. In that case, your project is doing risk management motivated by compliance, not performance, and hence wasting time.

You are happy if the answer goes straight to the value of mitigated risks: “We did this and avoided this cost”.

​

KPI: The number of successful mitigations where the avoided cost justifies the mitigation investment. The accuracy is not important; it is the risk mindset and the project’s motivation and ability to mitigate that is important.

​

Bonus: The story of successful mitigations is a great source of organizational learning. Look for mitigations that inspire other projects and reward the sharing.