The blog
Les Pro. de la Transfo.CIO Revolution by Airsaas

How to be pragmatic in project risk analysis?

Posted by
Jérôme Dard
The
4/5/2022
The AirSaaS Blog

When was the last time you said to your CODIR:”No we're not going, it's too risky! We are at N% risk/On time/On cost/on quality !

In this article we are going to We are interested in risk analysis in project management and what's not written in the PMO manual project...! After a brief review of the fundamental risk models in project management, we will look at Why is a project risk analysis a gas factory and a waste of time if done classically? We will suggest to get out of hypocrisy and subjectivity in order to develop a modern, digitized and pragmatic practice!

Why is it important in project management?

Risk management may never have been more important than it is today

Analyse de risques trop complexe
The main risk of your project risk analysis... is its complexity!

A project is always an investment ; it is better to ensure that it will be possible to conduct it effectively. It is in this stage that we will establish how we plan to achieve the objectives of the project. Here we will try to find out if the project will be viable economically, if it is in fact realizable (technically and within the limits of possible costs and deadlines), and know the consequences of the project on its environment.

Anyone who has ever had to manage a project... or an IS during a pandemic knows that risk analysis is both indispensable AND that she is not enough.

In fact, experience tells us that Nothing ever goes as planned... and that if we are not careful, there is a good chance that we will explode the deadlines, the budgets, and that the expected quality is not there.

These difficulties, for some, will be predictable, and you will be able to anticipating. And it is precisely the role of project analysis to prevent you from finding yourself in this kind of situation. Thanks to her, you will have an arsenal that is both proactive and reactive already ready to use... and especially in the event of an unexpected crisis, thanks to your good management of project you will be able to devote your energy to what was not “predictable”.

La The pandemic reminded everyone that the unexpected always happens : “This unexpected shock reminded us that forecasts are regularly denied. The story is a succession of improbable events that follow one another, clash and intertwine to give birth to a future that was unimaginable a few months ago.” (Yannick Roudaut author of When the improbable arises - Another future comes back in the game! Ed. The Salt Sea Oct. 2020.)

What is a risk in a project?

A risk is a Possible future event, identifiable and that we can quantify in project management.

The risk is inherent to any project. It may come from the nature of the project, of budgets allocated, of the degree of complexity, of the need for Resource, etc.

Capture écran AirSaas - analyse de risques
Think differently about implementing risk management with the help of AirSaaS

A very important nuance: the NFX50-117 standard (Project Management — Risk Management — Project Risk Management) Distinguish between the unexpected, the unexpected, the risk and the problem. 

One of risks of your risk assessment potentials of your project, it is precisely this confusion and the resulting amalgam effect.

Type of “classic” IS project risks and selected examples:

  • Functional : The specific weight in the project is too important...
  • Technique : there is a technological barrier.. do not hesitate to do a POC to remove the risks identified.
  • Organizational : Non-compliance with commitments (planning, charges and costs)
  • Roadmap : Small projects and non-priority projects... revision of the projects' RoadMap causing the project to be delayed or postponed
  • Project management: No positioning of key milestones per planning phase.
  • Internal customer : Weak involvement of the MOA/businesses in the project
  • Supplier relationship: Difficult communication, poor responsiveness of the service provider team, etc.
  • SLA : Misassessment of the service level need such as availability or response times. => Verify suppliers' claims about service level agreements
  • Legal : change in the legal environment, etc... here we sometimes touch on very sensitive and blocking subjects...
  • human : decisions are not taken or we need highly qualified people... in the midst of a war for talent... or even people who are already (over) busy...
  • Cyber Risk : Based on your organization's risk appetite, your cyber risk management program will then determine how to prioritize and respond to these risks.
  • Psychosocial risks: PSR covers stress, harassment, workplace violence, and incivility. A risk to be transferred to HR.
  • Financiers : the minimum ticket is too high for example.
  • Communication and management : too much absence of stakeholders...

etc... This is not an exhaustive list!

For each type of risk we will therefore identify: its type/the key words/a description/the potential impact /and the recommended actions in a register... (see below).

The 4 steps of project risk analysis

The risk management process is divided into 4 steps.

For the PMBOK®: risk management is defined as” The systematic process identification, analysis and response to project risks”.

Procress analyse de risques
Simple, basic!
  • Step 1: identify the risks of a project
  • Step 2: Assess the likelihood and consequences of risks
  • Step 3: propose actions for each risk
  • Step 4: Monitor and report on risk monitoring

Step 1: Identify (and prioritize) project risks in a matrix... legible!

Matrice analyse de risques
Example of a risk register for a DSI quality assurance plan in excel format... that no one wants to read anymore...

The identification of risks and their management must be carried out both as early in the project as possible AND throughout the project life cycle, with particular emphasis during milestones.

If some risks are too great —> Do a project to de-risk and then validate the project or not. (see part 3 below).

Nota bene : When a quality approach is in place in the company... this process will be usefully carried out jointly with the quality manager during management reviews, among others.

Here after having (a bit) filled in the Excel file to do your ranges... get out of the frame!

Be creative, First of all, make your risk analysis legible and above all collaborative. For example, use the “j”The ones who do the work“inspired by the Agile culture.

Do you know The “Pre-Mortem” ? This game was popularized by Dave Gray, James Macanufo, Sunni Brown, the three authors of the best-selling Gamestorming - playing to innovate (ed. diateino in 2014.)

It's aboutanticipate all the reasons that would cause the project, product, service, company... to fail, just so they don't arrive.

“If you want to clean up the gray atmosphere that reigns in your offices, if going in circles does not make you dream and you want your team to make sustainable progress, this fun guide is made for you!”

Jeu agile pre mortem vs analyse de risques
Premortem - Excerpt from the book GameStorming - Ed Diateino

An important point of this collaborative approach: never disregard minority opinions! The majority are not necessarily right when it comes to analyzing risks.

Step 2: Assess the likelihood and consequences of risks

What they tell you at school, during risk management class: do a quantitative profile for project risk especially based on an average of probability, severity and criticality!

Matrice analyse de risques criticité impact probabilité
Welcome to full subjectivity! Each risk is rated... weighted...

What we learn in the field : with these evaluations it is that these matrices are difficult to “maintain”... and that the quantitative assessment gives us enter into full subjectivity!

Beyond all the good practices and beautiful quantitative matrices therefore... Do trust in simplicity, processes, experience and your intuition!

The business resumption plan (PRA) and or business continuity plan (PCA) will not vaccinate you against everything... but they are a”Airbag risk“interesting.

In terms of experience... beyond yours, that of your team, we can rely on the folk wisdom... for example about what the laws of the time taught us... short update:

  • Murphy's law : “nothing is going as planned” -”Anything that can go wrong, will go wrong”.
  • Or the Hofstadter's law which states that,”regardless of the expected duration of a project, it will not be delivered within the time limit.

Lesson to be learned: the project manager and his team must estimate more widely the time required to complete their project.. Assume that he will inevitably fall behind schedule. A CIO used to tell us: “Put mattresses in the schedules” !

Step 3: Suggest actions for each risk

  • Accept : everything is normal... we continue to supervise.
  • Reduce : reduce the probability of occurrence and/or the severity of impacts.
  • Transfer: transfer responsibility for a risk to a third party who would bear the consequences of the problem
  • Avoid : total elimination of uncertainty.

Beyond the basics and the expectation... the most important action in your project management will be to be able to decide. Including to decide not to launch the project. On this point, remember the formula invented by Olivier Bas, Vice President of the Havas Group:

1/2 décision = bordel au carré
Olivier Bas conference source - Title of a chapter from the book “Like your job” published by Dunod.

To achieve this prudent risk management , you will need to have demonstrated that you have “de-risked” your project. Concretely, this may mean having launched a specific project, a kind of prototype, without risk. ‍

Step 4: Monitor and report on risk monitoring

One organizing must be put in place to communicate on risk management. However, it is on this fourth stage that the implementation seems to be the most heterogeneous today...!

In general, the lack of written transparency can lead to serious failures.

Capture écran Airsaas
Think differently about project risk management - screenshot AirSaaS menu flash report

Well used, a Tool of project management permits To align on the value, the DSI And the teams trades, and top manager, in breaking the silos of an organization sometimes too heavy or compartmentalized within each company.

How do you change operational risk management during the project?

You may also be suddenly confronted with new risks or see risks that were once critical lose in intensity. In short: monitor your risk map regularly. Ce process of risk management is iterative. But... going back to the initial map for an update is a big burden. What do you do to avoid spending all of your available bandwidth?

Way to do it:

  • Faire Raise the points of attention in stepless
  • Same for rulings 
  • Update the weather statuses And their operational contexts
Capture écran AirSaas flash report
Example of an AirSaaS flash report consolidating points of attention, decisions, weather status...

Human: the indicators that make risk become a problem...

  • If the Decisions are not made 
  • If too manyabsence Of stakeholders 
  • Defiance In the Milestone outfit 
  • Non-exhaustive list:)

SaaS... new, unfamiliar and often misunderstood risks

  • Trust to the supplier on their resilience capacity and check!
  • Test your resilience plans to make sure they work and that everyone knows how to do it in a crisis.

In short:

  • It's usually the lack of written transparency In business who Leads to failed projects ;
  • Take risks into account and project constraints will allow radical decisions to be made : we launch the project or not, we possibly implement actions that will make it feasible for a team.
  • Risk analysis is Made at the start of the project, at the feasibility study stage, and during greats milestones of the project cycle.

To deepen this last key area, we recommend that you read the article: The project milestone: a technique for sequencing your projects intelligently.

See all posts →