How do you overcome resistance during a risk management review?

Embrace the laws of physics: if you aren’t working in a vacuum, resistance will exist. We know that when we meet resistance, we’re not just dealing in something hypothetical, which is good because it means we aren’t wasting our time. Remember, resistance has qualities that can be measured. So, be prepared to capture as much data as possible about the directions and magnitude of pushback. Units of measure could be conflicting corporate or personal values. Get excited when you encounter resistance, because it will allow you to test model assumptions and better price your risk management options.

In my experience, the primary resistance in risk management reviews is the thought that outcomes from the process will stifle growth. In actuality, proper risk management reviews and controls facilitate better growth rather than reckless growth that may need to be fixed later. A connection to the personal impact on individuals and not just the organization is critical. The second part which can be more difficult to overcome, is the complexity of the issues involved. Not all stakeholders will have a good understanding or the desire to learn why something is being done and may be dismissive. This can cause friction and potentially confrontation. It is critical here to present the facts in an ordered way, seek agreement and document outcomes.

The best way I've found of communicating the value of risk management is to tie it back to operational reality. Without risk management an organisation will run around trying to either treat everything at once, or be blissfully unaware of potentially severe problems around the corner which then turn into crises. Explain that risk management allows the business to tackle what really matters, in a calm and measured way. This reduces workload for teams as they're not constantly changing priorities and firefighting. This in-turn improves the overall efficiency of the organization so it can meet its goals quicker.

While the organization's vision, mission and goals are critical, personalizing the WHY at the individual level can be ore impactful. People are always concerned about their goals, their compensation, their staff and their reputation. In the communication, failure can generate feelings of fear. My recommendation here would be to instill the sense of safety and sharing that risk management can provide.

I agree with Mark. Typically, a staff member's first interaction with risk management is after something goes wrong. Clear communication of the purpose and scope of an investigation by the risk management department to the involved individuals at the outset of the process, will ease most fear and apprehension associated with the process and will go long way towards a successful outcome. Otherwise, the natural reaction by the staff is that he/she is being blamed for the problem rather than being part of the solution thereby leading to fear, resistance and lack of cooperation.

People will bear almost any HOW if they understand the WHY. The best way to get there through this process is asking as many questions as possible from stakeholders to make sure concerns are addressed. Use their responses specifically to show how they were addressed.

i) Give reference of the Lessons Learned document from previous projects ii) Share the data related to risks, issues and defects from previous projects iii) Change the Risk Evaluation Axis from 'Probability' Vs 'Severity' to 'Criticality to Customer' Vs 'Competency to Deliver' iv) Buy their opinion (agree with them) by giving up your side in lieu of a sound Plan-B and their assurance to fix v) Ask about the solution roadmap in case the risk materializes, and keep that in notes vi) Have backup documents ready which are relevant to the risk mitigation controls / plan