If you don’t manage project risk, it will manage you!

Too few contractors discuss risk in their proposals even though this can be the most powerful discriminator, especially for incumbents. And, having participated in over a hundred reviews of government projects of all sizes and complexity, I can sadly report that only a handful had implemented a satisfactory degree of risk management and control. Most industry and government project managers (PM) didn’t even give it lip-service even though they probably learned about it in PMI training! And few RFPs required it. I was heartened quite a few years ago when I was hired to implement the acquisition risk management process at GSA FEDSIM. Unfortunately, their farsightedness was the exception and not the rule.

In a nutshell (by the way, why would anything but the nut be in there?), project risk management is the systematic process of identifying, analyzing, and responding to project risk before it becomes an issue.?An effective risk process will:

• Serve as a basis for identifying alternatives to achieve cost, schedule and performance goals
• Improve service and product quality
• Assist in making decisions on budget and funding priorities
• Provide risk information for progress reviews or milestone decisions
• Allow monitoring the health of the project as it proceeds through the lifecycle

The five key elements of risk management are:

• Risk management planning
• Risk identification
• Risk analysis (qualitative and quantitative)
• Risk response planning
• Risk monitoring and control

The process isn’t a?one-time-and-then-forget-it?process. After all, the risk dynamics of any type of project, including simple labor contracts, change throughout the project. You must continue to periodically identify, assess and mitigate risk to stay on top of changes. And, unless you have a complicated technology intensive project, this doesn’t have to be a laborious undertaking. In fact, it’s much easier than explaining why your project failed and the ensuing job search.

A simple risk matrix that estimates the probability and impact severity of each potential issue is a simple tool that takes a considerable amount of the distracting emotions out of the equation by diverting everyone’s attention to the decision process instead of their inherent biases. Even doing it on the back of a napkin is better than nothing!

The four common basic risk mitigation strategies are:

• Avoidance. This is using an alternate approach that doesn’t have the risk. This mode isn’t always an option, but this is the most effective risk management technique if it can be applied.
• Control: The Risk Management Guide from the Defense Systems Management College (part of the Defense Acquisition College --?dau.edu) defines this mode as "the development of a risk reduction plan and then tracking to the plan." The key aspect is the planning by experienced persons. But the plan itself may involve parallel development programs.
• ?Assumption: This is simply accepting that the probability of the risk and its impact don’t justify any mitigation planning. I supposed ignoring risk might fit in this category!
• Risk Transfer. This is attempting to pass the risk to another program element. This could entail assigning the risk onto a subcontractor, customer, or other entity outside your organization. My worst experiences with this are when PMs passes poor performing staff members to a different department in the organization instead of dealing directly with their performance issues.

Finally, let’s face it…if senior management doesn’t require regular reporting of risk status, most PMs won’t do it. They’re just too busy fighting the fires that that could have perhaps been avoided. This implies a serious culture change that is beyond the scope of this article.

Also, remember that a sound description of how you will manage project risk can be a strong proposal discriminator.

So, I’m begging you…manage the risk before it manages you!

Summarized from:??The Essential Guide to Managing a Government Project, by the author (2021).