Risk Management
Explains how risk management is a special form of decision-making and how teams can plan risk responses
Section 1
Risk Management
In This Section
1. What Is Risk Management?
2. What Is a Risk Profile?
3. Do We Really Need This?
4. How Little Can We Do?
What Is Risk?
A risk is a possible occurrence relating to a particular activity. In the case of teams a risk is something that disrupts a team's pro- gress.
While the words “risk” and “disruption” are typically used for negative events; however, risks can be good or bad. When we say someone took a risk we imply that they accepted the possibility of a bad thing to possibly get a good thing.
But keep in mind that the risk of winning the lottery and the risk of being hit by a car are both disruptions with some probability of happening. Minimizing disruption is often the goal, but some teams actively attempt to increase the occurrence of positive risks.
What is Risk Management?
Risk management is the process of deciding on a risk tolerance profile, identifying risks, preparing responses, and managing team activities to stay comfortably within the risk profile.
What Is a Risk Profile?
A risk profile can mean:
• A tolerance or appetite for risk
• A level or pattern of riskiness
In this book we will use the term risk profile to mean a team's defined tolerance or appetite for risk.
Do We Really Need To Do This?
Risk management is common in financial matters and is advisable for major projects, but what about for smaller teams? Do small, informal, agile or highly stable teams need risk management?
The answer is yes, at some level they do.
All teams risk having members call in sick, win the lottery or get hit by cars. Most teams have organizational risks that are out of their control. But some of which are both common and can be planned for. Examples of those range from a network out- age to a snow day.
Risk management does not need to be a big deal for a small team. But essentially all teams manage risk at some level. Teams that are explicit about their risks and responses typically have better results in the event a risk occurs. And being explicit about risk management both relies on and contributes to good team structure.
How Little Can We Do?
Risk management is one of those things where you do as little as possible but you do it well.
In other words, know:
• Your team's tolerance for risk
• The meaningful risks you face
• The reasonable responses to the most meaningful risks, and
• How your day to day activities affect the team's level of risk Then stop.
It may still sound like a lot, but it may not actually be a lot. If there are two meaningful risks, five practical responses, and cur- rent work patterns don't affect the probabilities in a significant way, your risk management job is simple, quick and well done.
Section 2
Risks Are
Decisions
In This Section
1. Risk Management Is Decision-making
2. Risks Are More Highly Structured
Risk Management Is Decision-making Risk management as an activity is a series of risk identification and decision-making. The primary activity for identified risks is first defining possible responses. Second selecting the one or more of them that is most likely to address the risk satisfactorily. If a risk occurs the team makes a final resolution as to which response will be implemented.
All the elements of a structured decision-making process are appropriate to risk management. In some cases, common sense may suggest that the terminology be different, but the activities are essentially the same.
However, unlike decision-making, risk management is a process that has been defined in detail by various standards and professional bodies. A team's industry or standards may deter- mine which elements of structured decision-making should be used, and what the terminology should be in order for communi- cations about risk to be clearly understood.
Risks Are More Highly Structured
Risk management is a highly structured activity. It is often suited to being organized as a sub-team with a different decision-making process, different activities and roles, and so forth.
Standards, as well as common sense, may call for specific tasks for risk identification and implementation. Specific roles and responsibilities may also be needed. Where that is the case, greater separation may be mandated from outside the team. Or the separation may just be at the discretion of the team to keep things simple.
Section 3
Implementation
In This Section
1. Some Suggestions
2. Structure Risk Management
3. View As If It Were a Team
4. Using MetaTeam