Introduction
Current risk management theory and standards agree that not all risk is bad. Most of these include opportunities alongside threats within the definition of risk, and they expect the risk process to address both opportunities and threats equitably, proactively and effectively. However, current risk management practice still focuses on threats. Managing opportunity through the risk process is often seen either as an optional extra, or as only for advanced practitioners, or as just plain wrong. Why is this?
This paper draws on human motivation theory (Maslow) and the latest ideas in information science (memetics) to explain the discrepancy. It also proposes practical solutions to promote management of opportunity within the risk process.
Maslow's “hierarchy of needs” sought to explain human motivation, and proposed a layered series of motivators ranging from survival to self-actualisation. Applying this framework to risk management reveals why individuals and organisations think first about threats, and why they see opportunities as optional extras to be addressed later, if at all.
Memetics suggests that ideas (or “memes”) can be seen as packets of information that self-replicate like genes. According to this theory, the “risk is bad” meme appears to be better adapted to the current environment than the “risk includes both threat and opportunity” meme.
The paper describes how to motivate project teams and organisations to address opportunity based on Maslow's theory, and how to enhance the competitiveness of the threat-plus-opportunity meme through memetic engineering. Applying these solutions will strengthen the ability to address opportunities through the risk process, bringing practice into line with theory.
Defining “Risk”
Over 10 years ago, a debate arose within the project risk management community concerning the nature of the types of risk to be managed within the scope of the project risk management process (summarised in Hulett, Hillson, & Kohl, 2002). Until then project risk had been seen as exclusively negative, defined in terms of uncertain events that could result in loss, harm, delay, additional cost, and so forth, with “risk” being synonymous with “threat.” This definition reflected the secular definitions found in non-technical dictionaries (for example, Collins, 1979).
From the late 1990s project management professionals began to realise that there were other types of uncertainty that mattered. Sometimes good things might occur on a project that would result in saved time or reduced cost, or that would enhance productivity or performance. Such “opportunities” could be brought under the existing definition of risk by simply expanding the types of impact to include positive as well as negative effects. This resulted in a change in approach by a number of organisations, including the Project Management Institute (PMI®). A Guide to the Project Management Body of Knowledge (PMBOK® Guide, 2000 Edition) defined project risk as “an uncertain event or condition that, if it occurs, has a positive or negative effect on a project objective” (PMI, 2000). This broader definition has been retained in the current PMBOK® Guide and PMI's Combined Standards Glossary (PMI, 2004, 2005). It is also reflected in a number of other leading standards, both in the project management area (for example, Association for Project Management, 2004, 2006) as well as in more general risk standards (Australian/New Zealand Standard, 2004; Institution of Civil Engineers, Faculty of Actuaries, & Institute of Actuaries, 2005; Institute of Risk Management, National Forum for Risk Management in the Public Sector, & Association of Insurance and Risk Managers, 2002; Office of Government Commerce, 2007). The forthcoming ISO risk management standard is also expected to adopt a similar position.
The use of the project risk process to manage both upside and downside risk is not only embodied in a wide range of standards, but it has been described in textbooks as “good practice” (for example, Chapman & Ward, 2003; Hillson, 2004; Cooper, Grey, & Walker, 2004; Hillson & Simon, 2007). There are a number of benefits available to those who include opportunities in the risk process (see Exhibit 1).
Exhibit 1 – Benefits of Including Opportunity in an Integrated Risk Process
All of this creates a clear statement of intent on behalf of the project management profession: Risk includes both threats and opportunities, and the project risk management process should be used to manage both of these types of risk proactively and in an integrated manner.
Despite this, there is a distinct discrepancy between theory and practice. Although the project management profession is unambiguous in its intention to promote a wide application of risk management to both threats and opportunities in projects, current project risk management practice does not match risk management theory and standards. A survey conducted in 2001 (reported in Hillson, 2004) found a variety of organisational approaches to managing risk, as shown in Exhibit 2, and recent experience indicates that the situation has not changed significantly. Many organisations remain stubbornly insistent that their risk process will only address negative risks, with opportunities either being ignored, or managed through a separate process. Some organisations are attempting to adopt the wider approach, with a combined risk process addressing both threats and opportunities, but even here opportunities are usually not treated equally with threats. In many cases, opportunities are an afterthought, betraying an underlying conviction that risk is really only about potential bad things, and this new-fangled upside thinking is an optional extra. Even some of those organisations that seem most committed to the idea of managing upside risk in an integrated process refer to “risk and opportunity management,” demonstrating a mindset that sees the two as distinct and different.
Exhibit 2 – Organisational Approaches to Risk Management (from Hillson, 2004)
Understanding the Discrepancy: Two Explanatory Frameworks
Why does this discrepancy exist? If the case for including opportunity in the risk process is as clear as the professional bodies and standards seem to portray, why do organisations find it difficult to put into practice? It does not appear to be due to lack of implementation guidance, since clear guidelines exist on how to extend the risk process to include opportunities explicitly (Hillson, 2002), with specific tools and techniques for opportunity identification, assessment, and response planning (Hillson, 2004; Hillson & Simon 2007). Maybe there are deeper reasons for this failure. If the problem with implementing management of opportunities within a unified risk process is not due to practical issues, perhaps the answer lies in the softer areas of motivation and psychology. This hypothesis can be examined from a number of different angles. It might be useful to seek insights by viewing the problem from a completely different perspective. Two such approaches are described below, based on the motivational theories of Abraham Maslow and the information transfer theories of Richard Dawkins. By using these two alternative frameworks to explore what might be going on, it could be possible to develop suitable corrective measures to redress the balance and bridge the gap between theory and practice.
Maslow's “Hierarchy of Needs”
The first potential explanatory framework for why organisations might find it hard to address opportunities as part of their risk management process comes from the work of Abraham Maslow on human motivation, as encapsulated in his “hierarchy of needs” (Maslow, 1943, 1987). He postulated that humans are motivated by the drive to satisfy needs, of which there are a variety of different types. However not all needs are equal, and Maslow arranged the various needs in order of their “pre-potence,” or influence over people. This ordering is usually represented as a pyramid, with the “higher needs” at the top and “base needs” at the bottom. There are several alternative versions of Maslow's hierarchy of needs, one of which is shown in Exhibit 3.
Exhibit 3 – An Example of Maslow's “Hierarchy of Needs”
A key feature of Maslow's hierarchy of needs is his contention that people are driven to satisfy lower needs before higher needs exert any influence. So for example, the most basic needs of air, water, sleep, and food must be met first, and are the over-riding concern of each individual, even more important than being safe or feeling self-esteem. Once these are satisfied a person is free to be concerned about other things. As each level of “hunger” is met (with literal physical hunger at the lowest level), higher needs emerge that require satisfying.
Maslow divided his hierarchy of needs into two groups, with “deficiency needs” toward the base, and “growth needs” (or “being needs”) at the top. Deficiency needs are those that must be satisfied, and without which a person might be said to be deficient or “needy.” The individual does not necessarily feel anything positive if these needs are met, but feels anxious if they are not. When these needs are met, they are removed as active drivers of behaviour. Deficiency needs are mostly physical and emotional. Growth needs, by contrast, are those that add to a person, that are not necessarily required for a healthy existence, but that make a person more fully rounded and complete. These needs are psychological and spiritual, and they form more enduring and permanent motivators.
How is this relevant to the question of why individuals and organisations might find it difficult to implement opportunity management as part of an integrated risk process? Assuming that Maslow's hierarchy of needs is as valid for organisational motivation as it is for individuals, this framework would predict a strong preference for actions that satisfy “deficiency needs,” and that these would take precedence over actions that target “growth needs.” Translating this to the risk domain requires an understanding of which risks relate to the different types of needs.
Deficiency needs are about survival, ensuring that the essentials are available to maintain life. In the organisational risk context, this naturally leads to a focus on threats. A threat is any uncertain event or condition that, if it occurs, will have an effect on objectives that is negative, unwelcome, harmful, adverse, and so on. According to Maslow, both individuals and organisations will be motivated to address these risks as the highest priority. For individuals, the concern is to avoid problems, save face, protect one's reputation, and so forth. At the organisational level, this is the realm of business continuity and disaster recovery, which aim to protect the business and ensure corporate survival. Deficiency needs are also addressed by operational risk management and health & safety, since these are also about feeding and protecting the corporate organism. At project and tactical levels, the need to tackle deficiency needs is also likely to be strongly influential, with a focus on dealing with threats achieving project objectives.
By contrast, opportunities would appear in Maslow's hierarchy as growth needs, being those uncertainties that, if they occurred, would have a positive, welcome, helpful effect on achievement of objectives. Such growth needs exist in such areas as marketing and business development, as well as strategic decision-making, and they also exist at the project level in the form of project opportunities. While these are undoubtedly good things, and in themselves they are clearly worth pursuing, Maslow's hierarchy of needs predicts that there is likely to be less motivation to satisfy these higher needs than there is to address more basic deficiencies. In other words, given a limited amount of time, effort or resources (which is the normal situation in most projects), an organisation will be driven to address threats before opportunities. If the environment is perceived as threatening, then the need to remove or minimise threats will always take precedence over the option of exploiting opportunities, since the drive to survive is stronger than the attraction of growth.
Maslow's hierarchy of needs seems to explain why both individuals and organisations are motivated to deal with threats before opportunities, since threats operate at the lower levels of the hierarchy and threaten deficiency needs, whereas opportunities exist at the higher levels and are seen as lower priority.
Memetics
A second useful framework for understanding the current reluctance to adopt an inclusive approach to risk management is the recently-developed hypothesis of memetics (Brodie, 1996; Blackmore, 2000). This was introduced by Richard Dawkins as a development of the “selfish gene” approach to biology (Dawkins, 1989). Dawkins proposed an extension of this idea, applying it to information theory, postulating the existence of a hypothetical “meme” as a self-replicating unit of information, analogous to a gene, that drives human behaviour and culture. From this initial innovation, the ideas of memetics mirror genetics, with such principles as survival of the fittest, competitive adaptation, mutation, replication, propagation, and so forth. Whitty (2005) applied the memetic approach to project management and found it to be a useful paradigm to generate new insights.
A meme is defined as a package of informational content, approximating to an idea or concept, that exists in the human brain or mind, and that seeks to replicate by transfer to other brains or minds. It is the basic unit of cultural transmission, and culture can be seen as the sum total of all memes. Clearly there are very many memes currently in existence, all of which are competing for the limited resources of human attention and absorption into current culture. The most successful memes are those that are best adapted to the environment in which they operate, which leads them to replicate and become dominant. Dawkins argues that dominant memes are not necessarily beneficial to human individuals or society, and that harmful memes can take root in the same way that viruses can cause pandemics. The important feature that determines the persistence of a particular meme is its competitive advantage when compared to the other memes against which it competes.
Having created this hypothetical framework, it is possible to develop an approach called “memetics,” analogous to genetics, to describe how memes operate. The term “memetic engineering” can be used to describe attempts to manipulate memes in order to produce a desired outcome. While the basis for memetics is challenged by many as entirely hypothetical and unproven, the memetic paradigm offers useful insights into many aspects of human behaviour and culture, including management of risk.
Taking the memetic approach, the concept of “risk is bad” could be viewed as one meme, while the idea that “risk includes both threat and opportunity” would be another. Because these two memes address the same basic area, namely the definition of risk, they are naturally in competition with one another. Does memetics help to explain why individuals and organisations seem to find it hard to embrace the idea that risk management should address both threats and opportunities?
Answering this question requires an assessment of the relative competitive fitness of the two memes—in other words, how well each idea meets the needs of the current environment in which it operates. The majority of social commentators would characterise modern Western society as risk-averse, uncomfortable with uncertainty and its effects, and seeking to reduce this wherever possible (for example, Neuberger, 2005; Better Regulation Commission, 2006), though different national cultures exhibit this to different degrees (Hofstede, 1982, 2001). The world of business is also seen to be largely risk-averse, though again there are exceptions and degrees within this. Focusing more closely on the realm of projects and programmes, the archetypal project management professional is also perceived as being risk-averse, including the project manager, project sponsor, or team member.
The memetic question asks which risk definition meme best addresses the challenges and needs of risk-aversion. The obvious answer is the threat meme, since it encourages more appropriate behaviour, including prevention, protection, contingency, mitigation, avoidance, and so forth. To a risk-averse person or organisation, taking the approach that risk includes opportunity seems to increase risk exposure, by suggesting that some risk is good and should be embraced, speaking of exploiting or enhancing risk, and so forth. In a risk-averse culture, the threat meme seems better adapted to survive and replicate, while the threat-plus-opportunity meme is weaker and less competitive.
Although the theoretical basis of memetics is unproven and challenged by many, it does offer additional insights into why threat-based risk management might be more attractive in the current environment than a broader inclusive approach of managing both threats and opportunities through the risk process.
Solutions
The two explanatory frameworks of Maslow and memetics offer helpful insights to understand why individuals and organisations might naturally prefer to deal with threats and view opportunities as optional extras, leading to a discrepancy between risk management theory and practice. The next question is whether these frameworks offer any ways to address the imbalance, to enable an integrated approach to risk management that deals with both negative risks (threats) and positive risks (opportunities).
Solutions from Maslow
Taking Maslow's model first, there are three ways in which an organisation might proceed if it wishes to adopt the broader risk approach of including management of opportunities equally alongside threats.
- Ensure effective threat management. The first is simply to make sure that all the lower-level motivators are fully satisfied all the time, allowing the organisation to move on to the higher levels. In other words, a risk process that deals effectively with threats will result in an organisation that is confident and relaxed, and that feels secure in its ability to handle both foreseen and emergent negative events and circumstances. Once these more basic deficiency needs are met, the organisation will feel free to release energy and resources to address the growth needs represented by opportunities.
- Develop conscious opportunity management. A positive focus within the organisational culture on the benefits available from proactive management of opportunities will create a motivational force to counter that of the lower-level need to deal with threats. If management express a requirement for projects to identify and capture opportunities, and reward such behaviour visibly, then teams will respond appropriately. Making management of opportunities both explicit and required will maximise the chances of this approach being adopted. By emphasising the value of the higher growth needs, their motivational value can be increased, even if the lower-level deficiency needs are not all met.
- Practice emotional literacy. Maslow's hierarchy of needs is not universally accepted, and some researchers and practitioners believe the linear hierarchy oversimplifies human motivation (for example, Wahba & Bridgewell, 1976). The reality of human motivation is likely to be much more complex. Studies of disadvantaged communities where deficiency needs are clearly unmet often find unexpectedly high levels of contentment and fulfilment, indicative of the higher needs being met. For example, the Kingdom of Bhutan is renowned for its high Gross National Happiness (GNH), introduced as a key national measure by King Jigme Singye Wangchuck in 1972 (Kinga, Galay, Rapten, & Pain, 1999), despite its low development status (Choden, Kusago, & Shirai, 2007). The concept of GNH is rooted in the Buddhist notion that the ultimate purpose of life is inner happiness. This philosophy appears to make it possible for Bhutanese society to experience fulfilment of at least some of Maslow's higher growth needs without satisfying all of their deficiency needs. A similar situation appears to have arisen in London during the Blitz in World War II, and may exist in some African countries today. In terms of Maslow's hierarchy, it appears possible to detach the upper growth levels and bring them alongside deficiency needs, allowing a trade-off between the two, as illustrated in Exhibit 4 (this idea was suggested in a different form by Vonk, Vonk, & Piney, 2007). The spiritual dimension then forms a context for physical hardship that makes sense of suffering and deprivation. Such behaviour requires a high degree of emotional literacy, especially the use of intentionality, resilience, self-confidence and optimism. These characteristics can also be developed in a business context (Hillson & Murray-Webster, 2007; Murray-Webster & Hillson, 2008) to support proactive opportunity management in the risk process alongside threats. This requires an ability to see the bigger picture and think strategically, as well as being able to handle apparent conflict and tension, while remaining focused on the objectives to be achieved.
Exhibit 4 – Modifying Maslow's Hierarchy of Needs
Solutions from Memetics
Viewing “risk is bad” and “risk includes both threat and opportunity” as competing memes allows development of three alternative approaches to enhance the relative competitiveness of the threat-plus-opportunity meme. The goal is to achieve domination of the threat-plus-opportunity meme over the threat meme, since it is not possible for the two to coexist in the same organisation or project.
- Modify the threat-plus-opportunity meme. The idea of “memetic engineering” (mirroring genetic engineering) is to modify a meme to increase its survival value by making it more competitive than its rivals (“survival of the fittest”). One way to achieve this is for proponents of the threat-plus-opportunity meme to consider what makes the threat meme strong, and aim to duplicate and improve on those characteristics in the threat-plus-opportunity meme. The aim is for the threat-plus-opportunity meme to achieve a greater level of recognition and acceptance than the current threat meme. One of the main strengths of the threat meme is its apparent alignment with the prevailing social and business climate. This is based on fear of the unknown, the desire for predictability and control, and the view that uncertainty is bad and must be resisted, leading to a culture of risk-aversion. The idea that focusing on threats is the best or only way to express a risk-averse culture should be challenged robustly, with the view that proactive identification and capture of opportunities maximises the chances of success and protects against unforeseen or unexpected downside impacts.
- Actively promote the threat-plus-opportunity meme. This strategy requires demonstrating its value in the current environment, and/or maximising its perceived advantage in the expected future environment. Proponents of the view that risk includes both threats and opportunities need to promote this position more effectively, employing the skills of marketing, advertising, branding, and so forth. Successful case studies where implementation of the broader integrated approach has delivered significant value should be promulgated. Champions of the approach should seek public platforms to maximise awareness of its principles and benefits, including those listed in Exhibit 1 above.
- Demonstrate the limitations of the threat meme. The goal of increasing the competitive advantage of the threat-plus-opportunity meme can also be achieved by reducing the attractiveness of the threat meme. Active steps should be taken to persuade people that a limited focus on just downside risks will result in reduced benefits, lost value, degraded competitiveness, lack of innovation, poor creativity, and so forth. Demonstrating that the threat meme is an inadequate response to the current and future uncertain environment will reduce its ability to compete against the threat-plus-opportunity meme.
Conclusion
There are clear benefits available from adopting an integrated approach to project risk management that seeks to minimise threats and maximise opportunities through a single risk process. Current standards and guidelines recommend this approach, and the theory is well established. However, implementation on the ground is patchy at best, with limited take-up of the broader methodology. Some possible reasons for this reluctance have been identified by applying two frameworks from disciplines outside project management. Maslow's hierarchy of needs explains why people are motivated to deal first with threats, treating opportunities as optional extras. Memetics suggests that the threat meme is more competitive than the threat-plus-opportunity meme since it responds better to the current culture of risk-aversion in society and business.
These two frameworks also suggest strategies for promoting the recommended approach of managing both upside and downside risk through a combined process. From Maslow it is clear that the integrated threat-plus-opportunity approach must demonstrably meet needs and be set in a context of strategic advantage and benefits thinking. Memetics shows that the idea of integrating management of both threats and opportunities in a single risk process must adapt and compete if it is to be taken seriously and achieve wide acceptance in the business environment. Implementing the strategies outlined in this paper will allow businesses and their projects to gain the benefits available from the wider approach to project risk management, and ensure that the gap between theory and practice is closed.