How to build a risk focused culture (Part 1)

Originally published at www.cytalytic.com in July 2020.

For start-ups and even established product development companies it can be struggle to handle risk well even though it is often critical for success. For small companies with limited resources, it is common to see an attempt at proactive risk management in the early stages of development that inevitably ends up in a loop of reactively responding to risks once they have already become issues. Fortunately, there is a better way and some companies have discovered that integrating a risk culture into their daily activities allows them to significantly increase their chances of success.

At my previous company I once asked the manufacturing team how they were progressing with their process risk management activities. They told me that things were in hand and proceeded to send me a spreadsheet containing their risk list on a standard process FMEA (PFMEA) template. It has been diligently filled out and to an untrained eye it looked like everything was under control. However, on closer inspection it was clear that this PFMEA was not what it appeared to be. There was only a summary pass of possible failure modes (only the high-level process steps had been considered), there were no links from the process steps to their impacts on critical design features and only some items actually had actions (which had not been addressed). The most telling aspect, however, was the “last updated” date on the spreadsheet indicating that had not been updated for 4 months. It was typical of many company’s approaches to risk management – fill out a spreadsheet, save it to a folder somewhere and then forget about it until at some later point when the risks come to fruition. It seemed that our manufacturing team had made this classic mistake and I now realized why we were seeing unexplained failures of our pilot product in the field.

Cranking the Handle and Agile Risk Management

Traditional product risk management approaches born out of the automotive and aerospace industries often result in the same experience I had with this team. They required product teams to fill out large convoluted spreadsheets and spend many days going down rabbit holes for little reward, typically requiring a risk expert to intervene and recover some value from the process. Teams would become demotivated by the experience and view it as an onerous “crank the handle” exercise instead of an engaging innovation process (which it can be when done well). Unfortunately, these very same approaches have been picked up by “newer” safety focused industries like med-tech and pharma. Again, they have been applied with mixed success.

These days start-ups often bypass the above experience completely as proactive risk management techniques are not even taught in most start-up accelerators or incubators. Start-up teams usually don’t consider putting a risk register together and instead look to Agile approaches to try and replace traditional risk management approaches. This is based on the Lean Startup theory that incremental development approach allows the team to change direction or pivot if things go wrong. Unfortunately, this doesn’t work for hardware (as previously discussed in my post on Lean/Agile development) and actually can also provide mixed results for software. The key reason is that incremental change is focused at the detail level and does not take into account the big picture considerations such as the product vision, the market the product is going into and the business strategy. Many software start-ups have been surprised when they have applied Agile and/or Lean Startup but still found themselves in trouble.

New Approaches

Fortunately, there are new approaches being applied that reinstate an innovation approach and address the false promise of Agile risk management without abandoning Agile itself. These techniques approach risk management in a number of different ways and can be summarized as follows:

1. Knowledge first development
2. Rolling wave / multi-level planning
3. Risk culture

When combined together they create a powerful new way to manage risk that works for complex hardware, software or mixed developments.

Knowledge First

By definition, a risk in the product development context is an uncertain event that may create an undesirable outcome for the business – the more undesirable the outcome, the higher the criticality of the risk. The interesting thing with risks is that they exist because of the element of uncertainty. If everything was certain then it would be straightforward for the team to address every risk of concern. Unfortunately, no team has a crystal ball to foresee what will cause them trouble down the road, but all teams have the ability to do the next best thing – focus on removing any uncertainty by ruthlessly uncovering unknowns and making them known. This is called a knowledge-first risk management.

I have mentioned knowledge first risk management previously and experimented with various approaches to this over the years, but the best framework I have used for this is a Lean-Agile approach called Rapid Learning Cycles. Rapid Learning Cycles (RLC) has been developed over a number of years by Katherine Radeka and is now used by many well known and very successful product companies that develop tangible products typically involving a combination of hardware, firmware and software.

One of RLC’s core strength is that it focuses all the team’s upfront activities on risk reduction but in a way that is highly motivating, promotes innovation and aligns with familiar Agile methods. Instead of leaning on an inscrutable Risk Register, RLC focuses on the key decisions that the team needs to make to deliver product success. These decisions may be technical, commercial or market related and will typically be cross-functional, encouraging collaboration between all teams that touch the product realisation process. Each key decision is, by definition, critical because it has high uncertainty and high cost if the wrong decision is made. The knowledge-first element in RLC comes in with respect to reducing the uncertainty of decision making.

Knowledge is a critical component of successful risk management. I often share this YouTube clip of a very skilled back-hoe operator who is able to use his back-hoe’s articulated digging arm to brace the digger as it inches its way down an impossibly steep incline. To anyone not skilled in back-hoe operation this seems like an incredibly risky operation likely to result in a roll-over and death of the operator. However, the actual risk is really quite low because the operator, through his knowledge and skill, has significantly reduced the probability of an accident.

The same principle applies to general risk management. If you can build knowledge and skill that reduces the likelihood or impact of the undesirable product outcome in question, then the product risk is reduced. RLC specifically focuses on this activity by aggressively identifying and resolving gaps in knowledge and skill. Every knowledge gap (as they are called) that the team closes not only increases the confidence of the team, it encourages a learning culture and a proactive risk management culture (without labeling it as such).

Planning and Culture

In the next installment of this post we’ll have a look at how knowledge-first development can be incorporated into a lean planning methodology tuned to start-up development and natural risk management. Following that we will see how some other changes can then build and sustained culture of risk management in the company.