A Risk Management Solution

We have multiple teams that delivers features to business projects. Each team and project need to manage their risks. Additionally we are in need of managing "the big risk picture".

Every team and project create their risk matrix and risk management plan. When a new project starts one often see they experience the same risks as other projects.

Every team and project communicate their risk matrix, typically powerpoint/excel templates are used. Arenas are meetings in the steering committee, the project, and in various management meetings.

Given you have 10 teams plus and 5 projects, you have 15 risk matrixes, one challenge is if you want to see the overall picture, you will need to merge them manually.

You might experience that teams and projects are better at identifying risks than performing the other process steps of a risk process, if they have a common process at all. So, there could be a need of process governance as well.

When it comes to risk mitigation one can identify patterns of how a risk can be mitigated. Given one have patterns, could it be an idea to "reuse mitigation plans", e.g. create checklists?

The mitigation plan contains plan items, and we wanted to allocate one responsible person per plan item, and a deadline.

We decided to make a lean "Risk Advisor" application in Genus Apps (www.genus.no). We decided to implement a risk process. In this process risks are first identified, then analyzed, a plan is made, it's tracked and monitored. Communication around the risks are done all the way. The risk owner is responsible for "moving the risk along this process".

So, every single risk follows this flow.

We designed an information model that contained all our needed entities; e.g. the risk itself and its attributes. Attributes such as description, consequence and probability etc. Examples of other entities are the mitigation plan, risk source and risk type.

Having all the information elements wired together in a Genus Apps model it's easy to create different views and reports. E.g. what are the risks of project x, and what risks exist for team a. 

Furthermore a consolidated risk matrix (probability and consequence) that contains all risks for all teams and all projects was created, of course one can filter that can be set for teams and projects. Risks without a plan, risks with both consequence and probability set to high, are highlighted.

After having worked with some risks one discover patterns across the mitigation plans - learning - which then can be consolidated to a generic checklist for that kind of risk. So, we decided to include checklist as part of the solution - shared learning.

The application gives us one place to go to get the risk overview. It produces reports to office-tools if one have to see the matrix in e.g. Microsoft Word. We have also created integrated reports leveraging the Genus Discovery solution (clickable charts/analysis, drill-down/up).

An average risk index shows the overall total risk for our teams and projects.

To begin with I personally was a little bit skeptical regarding what value we could get out of the effort of creating this solution. The effort was fairly low, and to be honest that of having a full overview in one place is of great value for all.

New projects now have a register to look at, as a source for identifying risks, very often we meet the same ones. One can then copy the existing risk, and make necessary adjustments to its information attributes. Furthermore add mitigation checklists, or even reuse and adjust the previous mitigation plan.

We are still piloting the solution, so far we see value of a central register.

For more information please send me a message.