Risk Reasoning Ltd

Using risk tools

to support

effective risk communication

Mark Swabey

Managing Director

Risk Reasoning Ltd

Set up communications beforehand!

Risk Reasoning Ltd

Project Communications

Project Manager

Procurement

Supplier

Supplier Supplier

Risk Manager

Team Leader

Team Members

Team Leader

Team Members

Team Leader

Team Members

Customer/s Senior Management

Board of Directors

Other Stakeholders

Public/Press

Risk Communications

Risk Reasoning Ltd

Managed risk communication - Options

Ignore risk communication. Result?

Initial feeling of calm

Until the risks surprise you

Crisis management ensues

Central person (often risk manager). Result?

swamped person,

slow response to risks,

potential for missed information for some recipients.

Organise who sees what and when. Result?

good for recipients, less irrelevant information

difficult to organise unless….

Use collaborative tools that support risk management

Risk Reasoning Ltd

Organising information

A Risk Assessment for each scope of work – a project, sub-project,

a project phase, a business operation, an initiative, a whole division,

a whole business

A hierarchy of assessments (imposing a reporting structure)

Market

Assessment

Business

Assessment

Information

Assessment

Programme

Assessment

Project A

Assessment

Project B

Assessment

Project C

Assessment

Project A

Phase 1

Assessment

Project A

Phase 2

Assessment

Risk Reasoning Ltd

Organising information

Access control for each risk assessment – who can do what and

when

At the start

Once reporting on the assessment

Controlled by each assessment manager, not IT department –

so must be simple and intuitive

Control, but freedom to experiment

Maintaining the baseline

Allowing user to try things out

Authorising modifications

For example: RiskAid scenarios – private copies of the assessment

that can be changed and submitted for approval

Risk Reasoning Ltd

Configuration Control in a risk assessment

Risk

Assessment

Risk

Assessment

Baseline

Assessment manager

starts config. control

User Creates a

“what-if” scenario

Risk

Assessment

Scenario

User submits

“what-if” scenario

for approval

Manager

approves

changes

Yes

No

User deletes

“what-if” scenario

Risk

Assessment

Baseline

updated with

changes

User changes

“what-if” scenario to

to find better solution

Controlled changes to

risk assessments using

“what-if” scenarios

Risk Reasoning Ltd

Information for the board & senior

management

What motivates them? Money, timescales, key performance

indicators (KPI’s)

Talk their language if you want to persuade them – assess risks and

actions (responses) in cost, time and KPI’s

So RAG ratings are not persuasive by themselves

Want report on progress, with brief summaries of changes,

responses, proposals and rationale

Knowing that progress is being made is a key motivator (Harvard

Business Review article entitled “The Power of Small Wins,” May 2011)

Want overview but ability to drill down and investigate

Risk Reasoning Ltd

Risk Reasoning Ltd

Risk Reasoning Ltd

Aggregating the results up the hierarchy

& reporting against budgets

Risk Reasoning Ltd

Information for the

Project Management and Team

Motivation

Seeing the benefits – saving money, time, KPI’s

Seeing the priorities at all time

Just concentrating on my responsibilities (not having to wade

through irrelevant info)

Seeing progress in handling risks

Support

Estimating – uncertainty and alternatives

Handling the bureaucracy

Alert me to changes in risks and actions, and the effects

Displays that guide

Trying things out in private – what if scenarios

Easy comparisons

Risk Reasoning Ltd

Risk Reasoning Ltd

Risk Priority Matrices

Preventative

Actions reduce

the chance

of risk occurring -

pushes risk

to right

Limiting Actions

reduce the impact

of the risk - pushes

risk down

Risk Reasoning Ltd

Displays show the benefits of actions

Preventative

Actions reduce

the chance

of risk occurring -

squashes graph

to right

Limiting Actions

reduce the impact

of the risk - squashes

graph down

Risk Reasoning Ltd

Information for Suppliers

Motivation

Seeing the benefits – saving money, time, kpi’s

Seeing the priorities at all times

Clear risk responsibilities

Clear separation – Theirs, Ours and Shared

Support

Estimating – uncertainty and alternatives

Handling the bureaucracy

Alert me to changes in risks and actions, and the effects

Displays that guide

Trying things out in private – what if scenarios

Easy comparisons

Risk Reasoning Ltd

Information for other stakeholders

Quality Assurance

Maintaining records

Demonstrating risk management in action

Audit & regulatory bodies

Maintaining an audit trail

Demonstrating Governance, Risk and Compliance (GRC)

Customers

Confidence in your predictions, awareness and pro-active

management, anticipating problems and having fallback plans

“Interested bystanders”

Summaries

Comfort - demonstration of “defence in depth”

Lessons learned

Risk Reasoning Ltd

Motivational aspects for tool design Always show the benefits to each user

Easy to use – quickly pick up, use and put down when required

Tool designer – clear displays, minimum clicks to get to any

relevant point, precise changes, immediate effects, hide the

complexity

Fully collaborative – many simultaneous users, not tripping over

each other

Tool designer – design consideration from the start

Use human strengths – judgement, decision-making

Tool designer – tool must not dictate

Use computing strengths – data storage, data comparison,

maintaining records (GRC!), calculations

Key Question – Does the tool help or hinder?

Risk Reasoning Ltd

When it goes wrong

Difficult to use

Can’t see the benefits

A spreadsheet is easier?

Are you sure your risk

calculations are correct?

Compare with last month, or six

months ago

Aggregate the whole business’s

risks from all assessments,

prioritise and summarise them

Who changed what this month?

How did he get hold of that

spreadsheet? I can’t change it

because someone else is!

People will avoid it, risk assessments

will die

People will avoid it, risk assessments

will die

Almost all spreadsheet-based risk

calculations aren’t!

Difficult to show the changes

Substantial effort required

Spreadsheets don’t keep records and

are essentially single user

Risk Reasoning Ltd

When it goes wrong

Wading through irrelevant information

Risk consultants running your risk

assessments for you

People will avoid it, risk assessments

will die

Your staff will not be engaged and

involved

When the consultants leave the

meeting, there is a feeling that risk

management has gone with them

Risk Reasoning Ltd

When it goes right Risk workshops get far further, far quicker – benefits seen immediately

Identify Risks

Allocate initial owners

Assess

owned

risks

Assess

owned

risks

Assess

owned

risks

Assess

owned

risks

Review Assessment

Allocate priority risks

Propose

actions for

owned

risks

Propose

actions for

owned

risks

Propose

actions for

owned

risks

Propose

actions for

owned

risks

Review Actions

Approve, reject or recommend

further work

Workshop Sequence

Brainstorm Session

Individual

Assessments

in parallel

Individual

Proposals

in parallel

Group Review

Group Review

Risk Reasoning Ltd

When it goes right

Risk Reviews

Call for individual reviews by risk and action owners

Reviews returned as scenarios

Approved, rejected or retained for discussion by assessment

manager

Review meeting

–on discussion items only and any new risks

–only relevant people needed

–short, focussed meeting

Risk Reasoning Ltd

Conclusion

Risk tools are most useful if:

They make risk management easier for everyone concerned

They show the benefits of risk management to everyone

concerned

They are used consistently by all concerned

Risk tool designers need to

Take into account:

– the needs of each type of user

– the motivations of each type of user

Avoid:

–complexity for the user