It’s time for more effective and honest risk management

Peter Simon on the single most influential factor in project success and why it must be done better

Peter Simon HonFAPM is Chair of APM’s Risk SIG.

Risk management has always been an integral part of project management, either based on gut feeling and instinct or, more recently, a formal approach. The first edition of the PMI’s PMBOK Guide (1987) included it as one of its eight functions, and APM’s own Body of Knowledge followed in 1992 with the inclusion of risk management as one of the 13 processes and procedures competencies. Today, it would be difficult to find any textbook or methodology that did not include risk management as a key ingredient of project management. Despite the belief that risk management has been around forever, its importance has not always been recognised.

In 2002, Dr Terry Cooke Davies published empirical research findings that showed risk management as the single most influential factor in project success. The same research also found that risk management attracted the lowest score of all project management techniques in terms of effective deployment and use. Twenty years on, have things improved? Is risk management now effectively deployed on all projects? The answer appears to be not, even though many government and corporate bodies insist on it being carried out. To assist in its implementation, international standards have been developed (e.g. ISO 31000), corporate procedures have been created or enhanced and many helpful books have been written. But projects still run late, go over budget and/or fail to deliver the promised benefits.

Why is this? The failing appears to be not in the theory but in the application. Carrying out risk management too late in the life cycle, unwillingness to accept the results of quantitative risk analysis, focusing purely on threats rather than threats and opportunities, and inappropriate allocation of risk in contracts are things we frequently observe, and all of which reduce the effectiveness of risk management. Couple these with optimism bias and strategic misrepresentation of estimates, and all the theory goes out of the window.

There is no empirical evidence to support the ability of risk management to reduce timescales or budgets, or to increase benefits. What it can do is make the achievement of objectives more likely – but only if those objectives are realistic in the first place. A schedule, cost estimate or benefits plan that does not take into account risk should be given little credibility. All of these failings contribute to making many promised objectives impossible to achieve right from the day they are made public.

Let us assume that risk management is carried out appropriately and truly achievable objectives are agreed. In this case, risk management will also help to protect the objectives. The end result will be more (note we do not say ‘all’) projects delivered on time, within budget and, perhaps most importantly, achieving the promised benefits.

So why does this matter now? Ignoring the impact of COVID-19, which could have been predicted, there is one compelling reason why we need to improve the initial planning and estimating on projects, as well as their delivery. The 2021 COP26 Climate Change Conference set the goal to ‘secure global net zero by mid-century and keep 1.5 degrees within reach’. The date of 2050 has been set as a target with an expected annual budget of $100bn. But what will happen if the projects that are initiated to achieve this goal suffer from poor risk management, unfounded optimism, government mishandling or misrepresentation on the part of key stakeholders intent on preserving their reputation? Simply, projects will not be delivered on time, the money will run out and the goal will not be achieved with potentially disastrous consequences.

The time for effective, honest project risk management has never been more pressing. We know the theory, we know how to implement the tools and techniques needed, and we have the required skills. Project professionals must now ensure that all projects – specifically those relating to climate change – consider the risks to which they might be exposed (both threats and opportunities) so that promised schedules, cost estimates and benefits reflect the risks. At the same time, we should resist pushback from sponsoring entities to adjust, ignore or misrepresent any of these measures to satisfy external vanity.