Facilitating risk management


Many organizations have spent small fortunes on setting up risk processes and supporting tools, which then fail to deliver the expected value. This is because self-evidently correct process doesn't necessarily work well when trying to get collections of human beings to agree on how to manage potential future events. This applies to projects and programs of change as well as to organizations as a whole.

This paper introduces the concept of risk facilitation as part of the role of the project manager and looks at where this can add the most value. The paper explores some of the pitfalls that project managers face when facilitating risk management on projects.

Finally, the paper will cover the top 10 tips for risk facilitators from the authors’ book A Short Guide to Facilitating Risk Management (Pullan & Murray Webster, 2011). These will help project managers to avoid the pitfalls and, more importantly, to be more effective at managing risk on their projects.

What Are the Pitfalls of Risk Management on Projects?

Project and program managers deal with uncertainty throughout their work. It's an inevitable part of change. As such, managing risk, or “uncertainty that matters” (Hillson, 2009, p. 10) is part of A Guide to the Project Management Body of Knowledge (PMBOK® Guide)—Fourth Edition (Project Management Institute [PMI], 2008) as well as other standards, such as the Project Risk Analysis and Management PRAM Guide (Association for Project Management [APM], 2004) and Management of Risk - Guidance for Practitioners (M_o_R) (Office of Government Commerce & Murray Webster, 2010), and has been for many years.

Potential pitfalls abound for the unwary project manager as risk facilitator!

Exhibit 1: Potential pitfalls abound for the unwary project manager as risk facilitator!

Despite standards in place, many risk processes for projects and programs don't work very well in practice. During the preparation for their book in 2010, the authors met several hundred project managers and gathered some of the problems that they face. The following are typical examples of what came up, arranged into three categories.

1. Pitfalls around applying risk management processes:

  • People believe that if we have a risk register, however out of date, that we are managing risk.
  • People don't understand the risk process.
  • Stakeholders are unclear on what risk is.
  • People focus on issues rather than risks.
  • We only focus on negative threats, and ignore positive opportunities.
  • The project team is too woolly when describing risks.
  • Stakeholders don't take ownership of risk, but expect the project manager to do so.
  • Identifying risks is fine but then people run out of steam.
  • Risk actions often don't get done.

2. Pitfalls around facilitating risk meetings and workshops:

  • Our project managers get far too involved when facilitating risk workshops.
  • The purpose and objectives of our risk workshops are not clear at the start.
  • The project team tends to get overwhelmed with detail in risk workshops and don't get very far.
  • Project risk meetings involve a huge range of hierarchies and this tends to get in the way of people talking openly.
  • It's very difficult to engage people for more than one workshop as their enthusiasm fades as time goes on.
  • Project risk workshops are boring.

3. Pitfalls to do with project and company culture around risk management:

  • Project managers are so busy managing their project issues that risk management tends to get squeezed out.
  • Senior managers label project managers as “difficult” or “negative” if they talk about threats to delivery.
  • Reactive ‘heroes’ not proactive risk managers are rewarded – this drives the wrong behaviors.
  • No one can see the pain we are avoiding; we're not noticing the value we create.

In total, the authors gathered more than 60 different pitfalls faced by project managers associated with facilitating risk management on their projects. It seems clear that project managers need help with making risk management work in their projects and their organizations to make risk management as easy as it can be.

What Is a Risk Facilitator and Why Might I Need To Be One?

Project managers plan and run risk processes for their projects. They plan and run meetings or workshops where risks are discussed. A project manager works through other people to manage risks on their projects. Anyone who carries out such tasks is facilitating risk management and, as such, is adopting the role of the risk facilitator, even if only part-time.

The risk facilitator is there to make risk management as easy as possible

Exhibit 2: The risk facilitator is there to make risk management as easy as possible

So what does a risk facilitator do? The word facilitator has a Latin root, meaning, “to make easy.” Risk facilitators make risk management as easy as possible for project stakeholders. That often means bringing life and energy to what can be a dull and pedantic, albeit thoroughly logical, process. It means getting project stakeholders to take risks seriously and to take action as a result, usually without line management authority. As such, risk facilitators need to be able to work with diverse groups, manage the energy levels in these groups, deal with conflict, sustain participation, and be able to guide groups to outcomes. They'll need to navigate group dynamics carefully and use a range of appropriate tools and techniques. In addition, the risk facilitator needs to have a good understanding of risk management so that they can challenge groups to come up with good descriptions of risks, to counteract any skewed perspectives and to ensure issues are dealt with separately from risks.

Project managers can make very good facilitators. They are used to working across organizations with diverse stakeholders and getting things done without line management authority. Many have facilitation skills for working effectively with groups, even when they are dispersed around the world.

There is a problem though; many project managers find that they are too close to the details of their project and find it difficult to step back out of the content. Their facilitation of a risk workshop or other session may be counter-productive, stifling discussion and masking perceptions different to their own. To overcome this, in many organizations, project managers offer to facilitate risk workshops for their colleagues and vice versa.

The hamburger analogy for risk facilitation

Exhibit 3: The hamburger analogy for risk facilitation

The role of the risk facilitator during a session is more than just group process. The risk facilitator is also the professional custodian of the risk process and, as such, needs to ensure the quality of descriptions of risks identified, or the value of actions chosen in terms of their ability to increase certainty. The authors find it useful to explain this using a picture of a hamburger. The three different parts of the hamburger represent three different elements of a risk session (as shown in Exhibit 3):

  • The bread bun, representing the facilitation process, neutral of content. This aims to make the session run easily and smoothly for all.
  • The beef burger, representing the content of the work, the details of the project.
  • The salad layer (usually lettuce and tomatoes), representing the risk process and knowledge of risk.

Using the hamburger analogy, the facilitator must stay vegetarian, i.e., stay out of the details of the work content or project. The authors argue that the risk facilitator is not entirely neutral, as in a process facilitator, but must also include the salad layer. This means that the risk facilitator must be able to challenge details of the risk process. This could include challenging objectives that are not clear or ensuring that risks are described clearly enough to be assessed effectively.

So, to facilitate risk management effectively on their projects, project managers should consider whether they are able to stay vegetarian or whether it would be better to bring in another person who is less involved in the day to day details of the project.

Top Ten Tips for the Project Manager Who Wants to Facilitate Risk Management Well

Tip #1: Careful planning helps you avoid the many pitfalls of risk management

Remember that preparation is key to success. Ensure that there is a clear purpose for each part of the risk process. Think through the possible issues, conflicts, and politics that might get in the way. Think about the best way to breakdown the risk process into workshops, small meetings, one -to-one sessions, and individual work. What are you trying to achieve at each stage? What makes the most sense in terms of timing? Who needs to be involved and when? How will it flow?

Tip #2: Risk management can be difficult, but the point of risk facilitation is to “make it easy'

One of the most important roles for a risk facilitator is to make sure that everyone has a clear understanding about the steps in the risk process, their own role in it, and the chance to ask questions if they want to. Once this is in place, the risk facilitator should design the risk work to make it easy for people to play their part. This means bringing risk meetings to life and engendering ownership of risk.

Tip #3: Risk facilitators need a range of personal qualities

Some of the personal qualities required by a risk facilitator

Exhibit 4: Some of the personal qualities required by a risk facilitator

Risk is about perception and each individual in a project team is likely to have a different perception from all the other team members of how risky their project is. Murray Webster's work with David Hillson (Hillson & Murray Webster, 2007; Murray Webster & Hillson, 2008) explained that there are three main groupings of factors which influence how people perceive risk:

  • Have I seen this before?
  • What is my automatic reaction?
  • How do I feel about it?

Project managers with the personal qualities shown in Exhibit 4, namely, balance, intuition, hearing what's happening, seeing what's happening and strong personal radar (picking up what's happening around them) are most likely to be able to work with these factors and to test that risk responses are appropriate.

Tip #4: Risk facilitators need to stay out of the detailed content of the work

This can be the hardest part for project managers! While in many ways, project managers can make excellent risk facilitators, as they are already used to engaging diverse stakeholders without line management authority, they often find it almost impossible to stay out of the detailed content of the project work. When this is the case, project managers should facilitate detailed risk workshops for projects other than their own, where they will be able to facilitate and challenge without risk of bias.

Tip #5: Risk facilitators need to engage the right people

Risk facilitators need to identify the appropriate people to be involved in risk management and engage them throughout the process.

Tip #6: Keep groups energized and engaged

Keeping people energized

Exhibit 5: Keeping people energized

Risk workshops and the whole risk management process are often considered tedious, dry, and detailed. It doesn't need to be like this because project situations change all the time. Risk management needs to keep pace and be dynamic, responding to changes. To achieve this, ideally, the whole team from the project sponsor down need to live the risk process, making it part of daily work. When this happens, discussions about risk become day-to-day conversations and part of governance and decision making. Workshops need to be designed to be effective and fun for the participants. Project managers who facilitate risk need to work on maintaining their own level of energy, as well as that of the group.

Tip #7: Need to challenge

A key role of the risk facilitator is to challenge groups to provide the best risk outputs. This requires skill as well as credibility with the group. Project managers, though, need to be very careful not to challenge details of the content of their projects, but to ensure they only challenge the risks.

Tip #8: Careful preparation is the key to successful risk workshops

Project managers need to be clear on their role when facilitating risk. First, they should assess whether they will be able to stay “vegetarian” out of details of their project, as they run detailed risk workshops. If not, they should invite another project manager or risk facilitator to run their workshops, and take part as a participant.

A workshop

Exhibit 6: A workshop

Tip #8 reinforces Tip #1: planning and preparation is key, especially with risk workshops. Too often, they are run without enough preparation, especially those that run virtually. Think through the purpose of the session, the objectives, the time plan; who should be there and what roles each will play (timekeeper, scribe, facilitator). What ground rules will the group agree to work to? It is invaluable to agree upfront how the group will work to anticipate and pre-empt problems that may come up later. How will actions be recorded, distributed, and followed up afterwards? What resources are needed in the room and what technology, especially for virtual sessions? What politics might get in the way? Think through how the session could be effective and fun rather than tedious.

Tip #9: Things will go wrong!

Things will go wrong

Exhibit 7: Things will go wrong

With a range of different perspectives, conflict is natural. Keep calm and carry on. Help the group to find a way through. As before, careful preparation will help here, especially understanding the different perspectives that people bring to the risk management process. Remember that it is possible and often helpful to call a break should things go wrong!

Tip #10: Keep at it and do it well!

What happens if you don't facilitate risk management

Exhibit 8: What happens if you don't facilitate risk management

When asked for examples of poor risk management, project managers described “tick-box” compliance, where risk registers are only completed or updated just before an audit or when a customer asks to see it. This behavior devalues what should be a useful process. All too often, this leads to low energy and cynicism. There is little point in such behavior, as this just consumes resources without managing risks.

In contrast, by applying the tips in this paper, the project manager who chooses to excel as a risk facilitator can add much value to their projects and indeed to their organization in three ways:

  1. Less waste (by anticipating problems before they happen, avoiding rework, delay and hassle);
  2. More confidence (in project plans and relationships, because there are fewer surprises); and
  3. Better decision making (with decisions made on the basis of the best information available).

Put the time, thought, and preparation in to doing risk facilitation well and you'll engage others and never again have a risk register metaphorically “covered in cobwebs”!


Risk management is very important if organizations are to make good decisions in risky and important situations. Projects involve a huge amount of uncertainty and change, and need good decision-making. Facilitating risk management is a key role for project managers and can make the difference between success and failure. By facilitating risk management, project managers can add real value by making the process easy for their colleagues, so they can be creative, productive, and have fun while reducing waste, increasing confidence, and making better decisions.

Association for Project Management. (2004). Project risk analysis and management PRAM guide. Princes Risborough, UK: Association for Project Management.

Hillson, D. A. (2009). Managing risk in projects. Aldershot, UK: Gower.

Hillson, D. A., & Murray Webster, R. (2007). Understanding and managing risk attitude. Aldershot, UK: Gower.

Murray Webster, R., & Hillson, D. A. (2008). Managing group risk attitude. Aldershot, UK: Gower.

Office of Government Commerce, & Murray Webster, R. (2010). Management of risk - guidance for practitioners Norwich, UK: The Stationery Office.

Project Management Institute. (2008). A guide to the project management body of knowledge (PMBOK® Guide) (4th ed.). Newtown Square, PA: Project Management Institute.

Pullan, P., & Murray Webster, R. (2011). A short guide to facilitating risk management: Engaging people to identify, own and manage risk. Aldershot, UK: Gower.

© 2012 Penny Pullan and Ruth Murray Webster
Originally published as a part of 2012 PMI Global Congress Proceedings – Marseille, France



Related Content

  • Project Management Journal

    Narratives of Project Risk Management member content locked

    By Green, Stuart D. | Dikmen, Irem The dominant narrative of project risk management pays homage to scientific rationality while conceptualizing risk as objective fact.

  • Project Management Journal

    Identifying Subjective Perspectives on Managing Underground Risks at Schiphol Airport member content locked

    By Biersteker, Erwin | van Marrewijk, Alfons | Koppenjan, Joop Drawing on Renn’s model and following a Q methodology, we identify four risk management approaches among asset managers and project managers working at the Dutch Schiphol Airport.

  • Project Management Journal

    Collective Mindfulness member content locked

    By Wang, Linzhuo | Müller, Ralf | Zhu, Fangwei | Yang, Xiaotian We investigated the mechanisms of collective mindfulness for megaproject organizational resilience prior to, during, and after recovery from crises.

  • PMI Case Study

    Saudi Aramco member content open

    This in-depth case study outlines a project to increase productivity with Saudi Arabian public petroleum and natural gas company, Saudi Aramco.

  • PM Network

    A certeza da incerteza member content open

    By Fewell, Jesse Por mais que ansiamos por um retorno pré-pandêmico, é ingênuo pensar que as velhas formas de trabalho um dia voltarão - mesmo para o ágil.