Tackling risk depression
DAVID HILLSON, PHD, PMP, PMI FELLOW
The Risk Doctor Partnership
Risk depression occurs when we see risk only in negative terms: All risk is bad, risk must be avoided or minimised at all costs, and we need to protect ourselves from risk and make sure that it doesn't happen. To the risk-depressed, all risks are threats.
Although this view is very common, it is wrong! A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition (PMI, 2013) tells us that not all risks are bad. Risks include both threats and opportunities, and both need to be managed proactively.
But risk-depressed people and projects are so focused on threats that they don't recognise opportunities. This inhibits innovation and creativity as we take a defensive position, playing it safe just in case something goes horribly wrong.
This paper describes the diagnostic symptoms of risk depression and explains how it can affect projects. The paper presents proven treatment options, ensuring a more accurate perception of risk reality. The paper closes with explaining how to remain risk-healthy, once risk depression is cured.
Keywords: risk, threat, opportunity
INTRODUCING RISK DEPRESSION
Depression affects a high proportion of people at some point in their lives. It saps energy, takes the enjoyment out of life, and makes it hard to concentrate or focus, so that everything becomes more difficult. The World Health Organization defines clinical depression as “a common mental disorder, characterised by sadness, loss of interest or pleasure, feelings of guilt or low self-worth, disturbed sleep or appetite, feelings of tiredness, and poor concentration” (World Health Organization, 2016).
Most of these characteristics have parallels in the risk ailment known as risk depression (Hillson, 2014), particularly its description as a common disorder. But what is risk depression?
Risk depression occurs when individuals or groups see risk only in negative terms: All risk is bad, risk must be avoided or minimised at all costs, and we need to protect ourselves from risk and make sure that it doesn't happen. The only risks that matter are negative risks—risks that could cause delay, increase cost, cause accidents, or damage reputation. To the risk-depressed, all risks are threats. Faced with a risky future, pessimism seems to be the natural response.
Although this view is common, it is a mistake to believe that all risks are bad. All risks are uncertain, and all risks would affect achievement of objectives if they happened. But some uncertainties might actually be helpful if they occurred. Most international risk management standards and guidelines include definitions of risk with both downside and upside, including the following:
- ISO 31000:2009: “Effect of uncertainty on objectives. Note: Effect can be positive and/or negative.” (International Organization for Standardization, 2009, p. 1)
- PMI's A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Fifth Edition: “An uncertain event or condition that if it occurs has a positive or negative effect on a project's objectives.” (PMI, 2013, p. 310)
- RAMP: Risk Analysis and Management for Projects: “A possible occurrence which could affect (positively or negatively) the achievement of the objectives for the investment.” (Institution of Civil Engineers & Institute and Faculty of Actuaries, 2014, p. 5)
Risks with negative effects on objectives (e.g., delay, additional cost, reduced performance, damaged reputation) are also known as threats, and risks with positive effects (e.g., reduced time or cost, enhanced performance or reputation, increased value) are opportunities.
Despite the consensus among standards that risk management should address both good and bad risks, preferably in an integrated process, many organisations ignore upside opportunity risks and focus exclusively on downside threat risks. This negative monomania is the underlying cause of risk depression.
DIAGNOSIS: SYMPTOMS OF RISK DEPRESSION
A number of specific diagnostic symptoms indicate the presence of risk depression in individuals, projects, and organisations.
THREAT-ONLY RISK REGISTERS
The primary way to diagnose risk depression is to look at the risk register and the underlying risk process. If the risk register includes only negative risks or threats, the concept of risk as opportunity is probably absent. If the risk process has no tools, techniques, or language to address upside risk, then it will not be possible to capture and address positive risk in a structured way.
RISK AS BAD NEWS
When people attend a risk workshop, they often come with a feeling of doom, believing that risk can only mean trouble. “We already have enough to worry about and we're far too busy; now we have to spend time thinking about all the things that might go wrong, most of which will never happen. What a waste of time.” Similarly, when senior management receives risk reports or sees the topic of risk on a review meeting agenda, the reaction frequently is “Why are we focusing on the downside? Don't bring me problems; bring me solutions!” The risk practitioner is regarded as a troublemaker or bearer of bad news, frightening people with potential disasters.
“PREVENT AND PROTECT” MINDSET
The limited view that all risks are negative can lead to a protectionist attitude that inhibits creativity and innovation. When the environment is believed to be hostile, management and project teams adopt a defensive posture, taking the safe option “just in case something goes wrong.” This mindset can sap energy and commitment from team members, who can become demotivated and anxious, losing confidence in their ability to achieve challenging goals.
HIGH LEVELS OF CONTINGENCY
Atypically high levels of contingency are indicative of underlying risk depression. While contingency planning is an appropriate response to unmanageable and unknown risks, it is not a panacea for all risks. Project teams should be able to estimate the level of “normal” contingency for a particular type of project based on previous experience or industry norms. Risk depression can lead to contingency levels well above what might reasonably be needed.
PROGNOSIS: EFFECTS OF RISK DEPRESSION
Serious consequences can arise if risk depression is left untreated, particularly a prevailing attitude of pessimism and a virtually guaranteed failure to achieve objectives.
LOSS OF INTEREST
Those suffering from risk depression can lose interest in their project, believing that it is doomed to failure. Risk depression produces a focus on failure, robbing the project team of the pleasure they should rightly feel in being engaged in a creative or productive enterprise. Feelings of guilt or low self-worth can arise if the risk-depressed believe they should have been able to foresee or avoid significant threats, or if preventable problems occur that were missed by the risk process. Seeing only potential bad possibilities can also reduce commitment and energy levels, engendering feelings of pointlessness and futility.
A process that is self-limited to finding and addressing threats while ignoring opportunities generates a one-way street that leads to missed targets, inadequate performance, and ultimate failure (except in the simplest of cases where all threats are manageable).
It is nearly always impossible to avoid all threats fully, and some residual risk will remain after planned responses have been implemented. That residual risk is likely to result in some degree of performance shortfall against the original objective. In other words, focusing only on threats is bound to lead to some extent of failure; the question is, by how much we will fall short of the objective?
CASE STUDIES: RISK DEPRESSION IN ACTION
Because risk depression is so common, there are many examples of major projects that demonstrate its effects. The most obvious of these are in the public sector, where projects are large, complex, and visible, and where public scrutiny by regulatory bodies makes information freely available. At least one underlying factor is the inability or unwillingness to consider opportunities proactively through the risk process. This in turn is largely due to the underlying definition of risk used within the organisation. The U.S. Department of Defense (DoD) and NASA provide two prominent examples.
U.S. DEPARTMENT OF DEFENSE
The U.S. Department of Defense has adopted a definition of risk that differs from the industry view. In every respect, DoD regards risk negatively, as confirmed in Risk Management Guide for DoD Acquisition, which states: “Risk addresses the potential variation in the planned approach and its expected outcome. While such variation could include positive as well as negative effects, this guide will only address negative future effects since programmes have typically experienced difficulty in this area during the acquisition process” (U.S. Department of Defense, 2006, p. 1).
This underlying concept of risk as threat is in line with the defensive mindset of “prevent and protect,” and is likely to be influential in the failure of the majority of defence projects to deliver on time or within budget.
Another example of a risk approach that explicitly excluded upside risk or opportunity is the Exploration Technology Development Program (ETDP) of the National Aeronautics and Space Administration (NASA). Clearly, the level of technical risk for ETDP projects is enormous, and a highly rigorous risk management process was in place. However, this approach was failing to deliver the required level of technical breakthrough, so the ETDP programme office tried a different approach.
The existing ETDP risk process was based largely on DoD's traditional threat-based process. The ETDP programme office decided to explore the possibility of including opportunities in its risk process, using the Constellation programme as a live case study. A simple opportunity identification workshop produced important new insights for the programme, identifying eight strategic opportunities that ETDP could pursue to overcome a current bottleneck. As a result, modifications to the NASA standard Agency Risk Management Procedural Requirements (NASA, 2008) have been proposed that would formally incorporate proactive management of opportunities in the routine risk process, although these have not yet been formally adopted.
TREATMENT OPTIONS: ADDRESSING RISK DEPRESSION
Since risk depression is a disorder, it should not be “normal” or acceptable for individuals, project teams, or organisations to restrict their view of risk to negative threats. Instead, the risk-depressed should seek to broaden their perspective to include opportunities alongside threats. The following treatment options are recommended as part of an overall plan.
EXTEND THE RISK PROCESS TO INCLUDE OPPORTUNITIES
Because opportunities, like threats, are just another type of risk, they can be managed using the same process (Hillson, 2002, 2004, 2009). Fortunately, only a few modifications are required to enable the standard risk management process to handle opportunities as well as threats. The most significant modifications are needed in the risk identification step (using techniques that explicitly expose opportunities), qualitative risk assessment (defining upside impact thresholds), risk response planning (developing specific opportunity response strategies), and risk communication (including opportunities in risk registers and risk reports). The other steps in the risk process can be followed with no major changes, allowing both opportunities and threats to be managed in an integrated and combined way.
Leading examples of risk management processes that explicitly address both threats and opportunities include guidance from PMI (PMI, 2009, 2013) and proprietary methodologies (e.g., Hillson & Simon, 2012).
DEVELOP SPECIFIC OPPORTUNITY IDENTIFICATION TECHNIQUES
While it is possible to find opportunities through the use of standard risk identification techniques (such as brainstorming, workshops, assumptions testing, root-cause analysis, risk interviews, and checklists), it may be preferable to use methods that are targeted specifically to opportunities. These include the following:
- Opportunity checklist. This simply requires recording over time those opportunities that have been previously identified, preferably holding them in an accessible database with a logical structure, and using the list in future analogous situations to ensure that the possibility of similar opportunities is not missed or overlooked. The best place to capture such previously identified opportunities is the lessons-learned review.
- SWOT analysis. This is commonly used to support strategic decision-making. Its use as a risk-identification technique requires a different focus, allowing opportunities to be derived from strengths and finding threats arising from weaknesses. When used in this way, SWOT analysis starts with a facilitated brainstorming process to consider strengths and weaknesses, and then identifies related opportunities and threats that might affect achievement of the objectives.
- Benefits tree analysis. This adapts the well-known method of fault tree analysis (FTA) to find opportunities. The starting point is to identify a range of positive end conditions, such as saving time, reducing cost, improving performance, or enhancing reputation. Each of these conditions is considered in turn, asking how and why it might arise. What helpful uncertainties might lead to this good result? What might occur that produces faster, smarter, or cheaper results?
FOCUS ON THE BENEFITS OF INCLUDING OPPORTUNITIES
A final element of the treatment plan for risk depression is to celebrate success, making others aware of why an integrated approach to managing both threats and opportunities is worthwhile. This can be implemented only once the other treatment steps are complete and both thinking and practice are aligned with the more inclusive, broader view of risk. When individuals and teams acknowledge the importance of managing both upside and downside risks proactively, and when the risk process is extended to address both equally (incorporating specific techniques where required), the organisation should start to see benefits. Ensuring that these benefits are widely known and recognised will reinforce the view that risk depression is not normal and that there is a better way to think and act.
Benefits include the ability to:
- Exploit more opportunities. Including opportunities explicitly in the risk process means that more of them will be identified in advance and managed proactively, and some that might otherwise have been missed will be identified and captured.
- Permit trade-offs. Finding and capturing opportunities and turning them into benefits or savings can mitigate some of the adverse effects of threats.
- Increase chance of success. A process that proactively seeks upside will inevitably deliver more successful outcomes.
- Support innovation and creativity. The process of identifying opportunities requires a positive mindset that seeks improved ways to deliver value. More innovative and creative thinking will maximise results.
- Increase efficiency. Using a combined process to manage both threats and opportunities delivers synergies and efficiencies.
- Motivate teams. A focus on upside risk, offering potential for positive improvements in performance, will increase motivation and job satisfaction.
- Demonstrate professionalism. Addressing potential upsides in a structured way demonstrates a professional approach to colleagues, clients, and competitors.
Risk depression occurs frequently, but effective treatments are available to enable sufferers to recover to a place where they are symptom-free.
Being free of the symptoms is not enough, however. Positive well-being is not gained simply by ensuring the absence of illness or ailments. This was recognised as long ago as 1946 in the preamble to the constitution of the World Health Organization, which defines health as “a state of complete physical, mental and social wellbeing and not merely the absence of disease or infirmity” (World Health Organization, 1946).
This is also true in the area of projects and risk. It is not enough simply to diagnose and treat any shortcomings in the way we manage risk in our projects. We also need to actively promote health and well-being in risk management.
Risk health is more than the absence of risk ailments. It is a positive state of well-being in which risk management capability and competence are effective, robust, well-established, and growing. There are five strategies that can help a project-based organisation to gain risk health and stay healthy (Hillson, 2014):
- Develop a mature organisational risk culture
- Demonstrate clear risk leadership
- Regularly enhance risk management capability
- Ensure intentional learning
- Maintain momentum
No single strategy will ensure the risk health of a particular project, but together these five offer a powerful way of keeping the risk management approach strong and healthy. This is especially true if they are built into the overall “risk lifestyle,” becoming part of everyday practice in the way risk is approached in projects (Hillson, 2009).
Risk management is one of the most important things we can do. It is too important to leave to chance, and we need to do it better. By diagnosing and treating any unhealthy aspects of our approach to risk management, and by discovering new habits that we can build into our risk lifestyle, we can all stay risk-healthy and thrive.
Metaphors can be helpful to explain difficult issues, using a familiar situation to shed light on something that might otherwise be hard to understand. The use of clinical depression as a metaphor in this paper is intended to be illustrative only, and is in no way meant to deny the reality of the genuine condition or to belittle or undermine the challenges faced by those who suffer from it. The medical imagery and language are merely intended to serve as a useful entry point for discussing approaches to effective risk management.
ABOUT THE AUTHOR
Known globally as The Risk Doctor, David Hillson is a thought-leader and expert practitioner who consults, speaks, and writes widely on risk management. David is recognised as a risk thought-leader within PMI, and he has received multiple awards, including the PMI Fellow Award. He is currently Vice Chair for the PMBOK® Guide – Sixth Edition update project.
CONNECT WITH ME!
Hillson, D. A. (2002). Extending the risk process to include opportunities. International Journal of Project Management, 20(3), 235–240.
Hillson, D. A. (2004). Effective opportunity management for projects: Exploiting positive risk. Boca Raton, FL: Taylor & Francis.
Hillson, D. A. (2009). Managing risk in projects. Farnham, UK: Gower.
Hillson, D. A. (2014). The risk doctor's cures for common risk ailments. Vienna, VA: Management Concepts.
Hillson, D. A., & Simon, P. W. (2012). Practical project risk management: The ATOM methodology (2nd ed.). Vienna, VA: Management Concepts.
Institution of Civil Engineers, Institute and Faculty of Actuaries. (2014). RAMP: Risk analysis and management for projects (3rd ed.). London, UK: Thomas Telford.
International Organization for Standardization. (2009). ISO 31000:2009. Risk management: Principles and guidelines. Geneva, Switzerland: International Organization for Standardization.
National Aeronautics and Space Administration. (2008). NASA Procedural Requirements 8000.4A. Agency risk management procedural requirements (revalidated January 2014). Retrieved from http://nodis3.gsfc.nasa.gov/displayDir.cfm?Internal_ID=N_PR_8000_004A_
Project Management Institute. (2009). Practice standard for project risk management. Newtown Square, PA: Author.
Project Management Institute. (2013). A guide to the project management body of knowledge (PMBOK® guide) – Fifth edition. Newtown Square, PA: Author.
U.S. Department of Defense. (2006). Risk management guide for DoD acquisition (6th ed.). Retrieved from http://www.acq.osd.mil/damir/documents/DAES_2006_RISK_GUIDE.pdf
World Health Organization. (1946). Constitution of the World Health Organization. Official Records of the World Health Organization, 2, 100.
World Health Organization. (2016). Depression. Retrieved from http://www.who.int/topics/depression/en
© 2016, David Hillson/The Risk Doctor Partnership
Originally published as part of the 2016 PMI® Global Congress Proceedings – Barcelona, Spain