The risk everyone knew about

For years I was the project manager sent in when a project had already gone wrong.

The trouble often started with something everyone knew about but nobody had properly planned for. It was usually on the risk register. It wasn’t in the schedule, and the cost of dealing with it wasn’t in the budget.

A register isn’t management

The projects had risk registers. They were treated as lists.

Risks were identified, described and recorded, but that was often where the process stopped. Effective risk management requires the next decision: which risks can be accepted and monitored, and which require action?

When a risk requires treatment, that treatment has to become part of the project: activities in the plan, tasks in the schedule, an owner, a date and the resources to do it.

And resources mean money.

That was another gap I kept finding. The risk was sitting in the register, but the cost of treating it wasn’t sitting in the project budget. The project could therefore be approved with a known risk but without the money required to manage it.

By the time I arrived to rescue the project, the risk had usually materialised. It was now an issue, the remedy cost money, and that money wasn’t in the budget.

The rescue can repeat the failure

Once the risk has materialised, the first job is to turn the issue into something that can actually be managed.

The remedy has to go into the project plan, with activities and tasks in the schedule, ownership, dates and costs.

But identifying the remedy doesn’t fund it.

Unless senior management accept the cost and approve a new project budget, the rescue plan has exactly the same weakness as the plan it replaced. The solution exists on paper, but the project still doesn’t have the resources to deliver it.

You can repeat the original failure inside the rescue.

Where the money stops

This is where risk management becomes a test of senior management culture.

Putting a risk on a register is easy. Funding its treatment is harder. It can increase the project budget, weaken the business case or force a decision about whether the project should proceed at all.

A strong senior management team makes that decision while the risk is still a risk. Fund the treatment, change the scope, accept the exposure knowingly, or stop the project.

A dysfunctional team can do something much easier: approve the project and leave the cost of the risk outside the budget.

When the risk eventually materialises, the problem comes back, only now it is more expensive. The rescue manager can identify the remedy and put it into a new plan, but somebody still has to fund it.

That can require senior management to acknowledge that the project they approved never had enough money to manage a risk they already knew about.

And it isn’t always one person. Where funding follows influence rather than agreed priorities, the loudest executive can protect their projects while a project with a quieter sponsor carries an unfunded problem.

In the projects I was brought in to rescue, the business case told me what had been approved, the risk register told me what they knew, and the project plan told me what they had actually done about it.

The money often told me why.

What holds the line

Strong portfolio management discipline helps: funding decided across the whole portfolio, against criteria agreed in advance.

It works only if senior management back it, including when the discipline constrains their own projects, and accept the overhead of running it.

That overhead should scale. Project and program methods are scaled to the needs of each project and program of work. The portfolio office should be scaled to the organisation in the same way.

The point is to make the decisions about risk, treatment and money before the project makes them for you.

Before you sign off

If you review plans for a living, put the risk register beside the schedule and the budget.

For every material risk, ask what decision has been made about it.

If it has been accepted, who accepted it and what will trigger another look?

If it requires treatment, where is that treatment in the plan, who owns it, when does it happen and where is the money to pay for it?

If those answers aren’t there, the risk has only been recorded.

If you’re a founder, your plan has the same gap. Take the risk you already know about and decide what you’re going to do with it. If it needs treatment, put that treatment into this month’s tasks, and put the cost into your numbers.