Managing Risk

Transcript

STEVE HENDERSHOT

Those moments where we realize that perhaps we aren’t as prepared to deal with uncertainties as maybe we thought—and yes, this is one of those moments—those are the times when risk management really shines.

MOHAMAD ELHELALY

The COVID-19 specifically will change the world in at least near future, if not the far future. Risk management will be a huge part of it because some companies are realizing that they haven’t done the proper risk management, and now they are dealing with the consequences and the impact.

NARRATOR

The world is changing fast. And every day, project professionals are turning ideas into reality—delivering value to their organizations and society as a whole. On Projectified®, we’ll help you stay on top of the trends and see what’s ahead for The Project Economy—and your career.

STEVE HENDERSHOT

This is Projectified®. I’m Steve Hendershot.

If your project or organization was caught flat-footed by COVID-19, you’re hardly alone. But that’s not to say you couldn’t have prepared or couldn’t have anticipated this crisis. The World Economic Forum released its annual top 10 list of global risks in mid-January, and infectious diseases made the list of highest-impact threats. The report came out just a day after the World Health Organization noted in a press conference that a strange new virus in Wuhan, China had outbreak potential. In fact, pandemics or infectious disease have appeared on the WEF top 10 impact list four times in the last five years.

So this moment was possible to anticipate, but it was also very difficult to mitigate with advance planning, and few organizations did so. It’s a testament to the importance of solid risk management, which project leaders know is always a central skill and a critical practice, but which is rarely on display in such stark terms.

Today we speak to two masters of the art and science of risk management, beginning with David Hillson, PhD, founder of The Risk Doctor Partnership based in Petersfield, England. David, a PMI Fellow and author of 11 books on risk, advises organizations on how to approach risk.

MUSICAL TRANSITION
STEVE HENDERSHOT

Much of the world right now feels unfamiliar and difficult to predict—thinking not only of pandemic viruses but also emerging technologies such as 5G. How might one approach risk identification and analysis for things where there’s no playbook?

DAVID HILLSON

That’s a very interesting question because a lot of risk identification is based on things that have happened before. So we learn a lesson from previous experience, and then that helps us to reduce the risk next time around in terms of reducing our exposure to threats, to bad things, but also increasing our exposure to opportunities, to potential good things. And if you’ve got something which is completely innovative and revolutionary, then we don’t have any track record of things previously.

It’s actually quite unusual to have something which is completely novel and has absolutely no precedent of any sort. I think probably we could ask the sort of “what-if” questions, the scenario analysis, the kind of ways of thinking about the future of things that could develop based on what we know of similar systems in the past. But really the question I think is one to do with curiosity and inquisitiveness, appreciative inquiry, some of those other techniques which we can use just to explore the parameters of our uncertainty.

So we need to know where are the boundaries of what we know and what we don’t know. And then the risk identification just looks over the fence, over the boundary into those areas, which are a bit misty at the moment but which could actually crystallize into something significant later on.

STEVE HENDERSHOT

You mentioned earlier positive risk, and these seem like tech developments where there’s a lot of uncertainty for sure, which is risk of one kind or another. But part of that will manifest in the form of opportunity. So how might I develop a framework to capture that as much as possible?

DAVID HILLSON

Oh, that’s easy. I start with the definition of risk as uncertainty that matters. So risks are uncertain. They haven’t happened yet, and they may never happen, but there are uncertainties that we don’t care about. You know, is it going to rain in Kazakhstan next week? I don’t know. And I don’t care. It’s uncertain, but it doesn’t matter. And so, in order to be a risk, we have to have something which is, yes, uncertain but which also matters. And things matter because they affect our objectives. And different people have different objectives, which means that something which is a risk for one individual or one organization is not necessarily a risk for another individual or organization because they have different objectives.

So we ask the question, “What am I trying to achieve, and what might affect me?” All risks are defined in relation to objectives. Now, if we start with that idea of uncertainty that matters, things can matter for a number of different reasons. One is that it might matter because it stops us achieving our objectives or makes it harder. But something would also matter if it’s uncertain, but if it happened, it helped us to achieve our objectives or made it easier. The idea of an uncertainty that matters embraces both downside risks, which could stop us or make it harder for us to achieve our objectives, and upside risks, which could encourage us or help us or make it easier for us to achieve those objectives.

And we call those threats and opportunities. Threats and opportunities are both types of risk. So then when you say, “How could we actually manage those upside opportunities?” The answer is exactly the same. As we would manage threats, we ask the same questions. So what am I trying to achieve, and then what could affect me achieving those objectives? For an upside, I want to know what could help me achieve my objectives? What would increase the probability? What could increase the benefit? And then they’re not all equally important. So we say: Which are the most important? Which are the best opportunities?

And then we have: Don’t just hope and pray they happen. We have planned responses. What can we do to grab those opportunities and make them happen? We do that. Did it work? And what’s changed?

STEVE HENDERSHOT

You’ve spoken before about the concept of a black swan, a risk that is truly impossible to anticipate. With the coronavirus crisis, maybe you’ve got pandemics somewhere on a global risk register, but its breadth and impact seems unique and difficult to prepare for. How should risk managers and project teams respond to risks that they couldn’t have seen coming?

DAVID HILLSON

Well, I’ve been asked about this quite a lot in the last couple of months. The first thing I need to say is that the coronavirus is not a black swan. So a black swan is something which is unpredictable in advance, it’s unknowable, but if it happens, it has an extreme impact. And then it is foreseeable after the event. So after the event we say, “Ah, we should have seen it coming, but we didn’t.” The name “black swan” comes because we knew in Europe in the 16th century that these big white birds that lived on the water with long necks and big, big wings and were white were swans.

And then we discovered Australia and New Zealand in the 17th century, and we found these birds that were big, and long necks, and big wings, and lived on the water, and they were black. So they couldn’t be swans because we know that all swans are white. It’s inconceivable that a swan can be any color other than white—until you meet one. And so the idea of a black swan is that it’s something which is inconceivable. You cannot believe that it’s possible until it happens.

STEVE HENDERSHOT

So there’s no hypothetical black swan, because we couldn’t possibly conjure one.

DAVID HILLSON

Exactly. And that’s absolutely not the case for a coronavirus pandemic. So we’ve had Spanish flu in 1918. We’ve had the Asian flu. We’ve had swine flu, we’ve had bird flu, we’ve had multiple occurrences, SARS and MERS most recently. So it’s absolutely not inconceivable that there could be another coronavirus pandemic, which affects the whole world because we’ve seen it before. So it’s not unpredictable or unknowable. It does have a big impact. And it’s something that could have been predicted in advance, but it doesn’t meet the first characteristic of a black swan, which is to be unknowable.

So that matters because we could have been prepared, and we should have been prepared. But it also means that coronavirus is absolutely not even a risk because a risk is an uncertainty that matters. And the coronavirus as we have it now is absolutely not an uncertainty. It’s the very real reality for most of us. So coronavirus is not a risk. It’s a problem. It’s an issue. It’s something which needs to be dealt with right now. It’s a certainty that matters. And so that means that risk management doesn’t apply to the management of coronavirus itself.

But there are uncertainties that matter which fall out of the fact, the issue, the problem, that we have a coronavirus pandemic now. And so what risk people should be doing is leaving the problem managers, the crisis managers, the disaster managers, to deal with the coronavirus pandemic as it is now, and we should be looking over the fence into the future and deciding what could happen next. What are the risks, the uncertainties that matter in the future—both threats and opportunities—that we now have a chance to think about and act toward in order to influence the future?

So the risk management task now is to think six months, two years, five years ahead, and think about the bad things that could happen as a result of our current situation and the good things that might happen as a result of our current situation. And then work out a route to get to where we want to be. So we’re thinking about the restart of society after the lockdown. We’re thinking about how to use this massive virtual communication which has sprung up across the world in order to transform the way do we do business.

We’re thinking about when we restart driving and flying, how can we do that in a way which minimizes our carbon footprint and our impact on the environment? And those are things which are uncertain. They’re in the future. Some of them are really bad, and some of them are really good. And so the risk challenge now is not to deal with the pandemic that’s in front of us. It’s to deal with the things that might be happening in the future, both the immediate future, the short term, and the long term. And then to provide advice to our decision makers now to say, “Well, we have to deal with what’s in front of us, but the decisions you make now change the future.” And so we have to have an eye to the future when we make our present decisions to make sure that we don’t store up more problems further down the track, but we’re actually making our lives easier in advance.

STEVE HENDERSHOT

Once you’re able to climb up on that perch and peer out into the future, what sort of path forward are you looking for?

DAVID HILLSON

The key thing is to know our objectives. So are the objectives to go back to what we had before coronavirus? Actually, no. If we talk about the idea of resilience, resilience is not recovering to your previous state. Resilience is being able to continue to achieve your objectives in a new state. We can’t go back to pre-coronavirus, and we actually don’t want to. Because we’ve discovered some things that are really useful and some things that are really unhelpful in these last three months.

And we will continue to discover in the next three months, maybe six to nine months. And so society has to take note of those things and actually build them into what we do in the future when we come to reverse the lockdown and release society. I think that’s where the risk people can come into their own because we’re thinking about the future now. It’s our habit to be one step, two step, five steps ahead.

STEVE HENDERSHOT

As you do begin to move forward again, is there any way to build in greater resiliency? So that you’re not just anticipating risks better but are also better prepared to take an unexpected punch?

DAVID HILLSON

That’s a very interesting question. And I think flexibility and resilience need to occur in a number of different ways, a number of different levels. Most people think about resilience and flexibility at an organizational level, but I think we also need to think above that and below that. So, above, I think we need to think about societal resilience, because society is the context within which organizations exist. Below organizational resilience, we need to think about project resilience, because projects are conducted in the context of the organization. And then within the project, we need to think about personal resilience, because projects are delivered by people.

And so I think all of these things, they’re concentric circles. If we’re talking about resilience for projects, we have to think about the people in the projects being resilient, about the way we structure the project itself being resilient, about the organization within which the project exists being resilient. And all of that in the looser context of a resilient society or national culture. And that way, I think if the whole thing becomes strongly resilient, then I think we’re going to survive and thrive whatever the future throws at us.

MUSICAL TRANSITION
STEVE HENDERSHOT

It’s interesting to reflect on how risk management can not only help you anticipate and mitigate risks, but also to recover and refocus after a risk has passed through your defenses and thrown you for a loop.

So let’s continue this risk conversation. Projectified®’s Hannah Schmidt spoke with Mohamad ElHelaly, an assistant project manager with a PMI-RMP certification at Orascom Construction in Cairo, Egypt, about lessons learned from his recent projects and what he sees for risk management in the future.

MUSICAL TRANSITION
HANNAH SCHMIDT

As you look back at projects you’ve worked on, like the Cairo Metro Line 3 project, what are some of the top lessons learned

MOHAMAD ELHELALY

It’s all about change. Change is inevitable. Things will change and you have to adapt. You have to be on your feet all the time. You have to take quick decisions. Some of the things, it cannot wait. Some of the things, you cannot do the full proper analysis and study to make the correct decision. You have to rely on your experience, rely on your team, rely on your guts and intuition, and just take the decision and then do the proper analysis, the proper studying, everything to support this decision. And if your decision was wrong, don’t be afraid and don’t be discouraged to say, “I made the wrong decision, and this is the study that proves that the decision was wrong, and we need to adapt and implement quickly.”

Because especially in risk management, it’s either damages at stake or people’s life, God forbid, or even the objectives of the project. So we need to act quickly because all the impacts are not trivial.

HANNAH SCHMIDT

What are the top risks that could impact your organization’s projects currently?

MOHAMAD ELHELALY

Lots of things. The currency exchange, especially the situation in Egypt and the economy in Egypt. In 2016, the Egyptian pound has devaluated overnight to become from one U.S. dollar equals about six or seven EGP to become 18 EGP—and just overnight. With some indications of course for the people who follow the market and everything, but still not that change was foreseeable for lots of people. And of course, for the already done projects and contracts and everything like this, it was impacted extremely and things have changed a lot.

Still this is not as much of the risk as it used to be back then. But over this year alone, the U.S. dollar is changing by one or two pounds every few months. That is a huge number. We’re talking about construction projects in millions and billions of dollars. So imagine one or two pounds per U.S. dollar changing over months. That’s a huge risk that should and have to be taken into consideration with all of the projects going over here. The commodities and the steel and the rebar and the cement and the sand and all of the construction material, it’s not stable due to the economy and the currency change and the import and export process going over there. So this has to be taken into consideration.

HANNAH SCHMIDT

How do you see risk management changing in the future?

MOHAMAD ELHELALY

I’m not sure I can answer this question, but I can definitely say how it should change all over the next years. Because risk management at the moment in most countries, and especially in Egypt and the Middle East, is working in silo, is working separately. It’s working with the risk management department only.

And I believe that’s wrong, and it should be integrated to all the project management processes and fields and areas and everything. It should be integrated into all the decision management and the decision taking part. It should an integral part to the strategic management and the strategic planning. It should be part of every process in all departments in the company and the project.

I like to use the analogy of safety management 20 years ago. It started as someone stopping the work on-site to make sure that everyone is safe. And people were hesitant and changing and resistant to the safety guy. And their perspective is to try to, okay, whenever there’s safety audits, let’s do this. But the other way around, it’s not their concern. Now, everyone’s working on-site and every department, safety first, zero incidents, safety in mind while doing everything. That’s what I’d love to have risk management in the future like. It’s risk in mind in whatever you do, whatever decision, whatever activities, whatever process.

HANNAH SCHMIDT

And how do you think organizations can get to that point, where risk is integral in every project process?

MOHAMAD ELHELALY

It has to start from the top and the bottom at the same time. It has to start from the buy-in from the CEO and the COO and the MD [managing director], the top management over there. For example, each company has their own procedures and processes and manuals and everything. And then there was a separate risk management process and separate risk management manual. That should not be the case. It should be integrated in every process and every structure and every manual and every document in the company. So whenever, if you are a planning guy and you read your planning manual, you can see risk management in it. If you are a procurement guy and you read the procurement procedures, you have to see the risk management integrated in it. Once it starts like this and people from down, from the bottom, reads it and grow into this culture, then they will meet in the middle with all the integrated risk management part of it. However, as long as it’s treated as different sector or different department, it will never happen.

MUSICAL TRANSITION
STEVE HENDERSHOT

This is a unique moment in modern history in which all of us are acutely and especially aware of risks and threats. Done right, risk management not only helps projects roll along, moving steadily forward in spite of all the inevitable bumps in the road, but it also makes those project environments feel steady—because as you get better at anticipating and responding to risks, the world has a way of feeling a little more manageable. Right now, let’s be honest, we could all use a little of that.

NARRATOR

Thanks for listening to Projectified®. If you like what you heard, please subscribe to the show. And leave a rating or review—we’d love your feedback. To hear more episodes of Projectified®, visit Apple Podcasts, Google Play Music, Stitcher, Spotify or Soundcloud. Or head to PMI.org/podcast.