Risk Management Fundamentals

0:00Welcome to skill number two of the PMI RNP risk management professional course. I'm Bob. Thank you for joining me. And I know I dropped a ton of stuff on you in that first skill. Well, I'm only going to keep doing it. There's a ton of stuff you have to learn , piles and piles. We have to move you out of reality into the land of unicorns, what I call a PMI land. So let's do that in skill number two. Let's take a look at the outline. Oh, and if you didn't notice, I have a different hat. I have my do-good work hat on by Anthony and Arino, great sales trainer, great guy. That's his motto. Just do some good work.

0:41That's what we're going to try and do here. So let's take a look at the skill outline. First thing we have to understand is this is foundational stuff. This is why I have a pyramid. This is what we're going to look at. I have to lay the groundwork that we're going to build upon through the next 28, 29, 30 skills. If we mess this up right here, there's going to be plenty of confusion down the road. So let's not do that. Foundational. We're going to define a bunch of words you probably think you know, but you actually might be wrong. So that's the first thing we're going to do right out of the gate. We're going to talk about the risk management principles.

1:19Pretty easy stuff there. We're also going to talk about risk attitudes across the entire spectrum. There's risk aversion all the way through risk seeking and it's not just your attitude. It's your company's attitude across projects and programs, the portfolio. What about your investors? What about your customers? What about your end users? There's a huge spectrum here which many project managers fail to really appreciate. We're going to talk about the sources and categories of risk and they are almost endless, but there's a way to approach them in a reasonable manner so you aren't overwhelmed. We're also going to talk about some foundational relationships across projects, programs and portfolios and how one builds across another. And the last thing we're going to talk about in this particular skill is the alignment across the standards. Remember, you have Pembox 7 in play which has a risk chapter. Then you have the practice guide for risk and then you have the standard for risk management across projects, programs and portfolios. So there's a lot of documentation at play here. I'm going to weave it all together and oh by the way,

2:35don't forget about the exam content outline which I'm going to touch across several different domains there as well.

0:00Okay, welcome back. Let's get right into it. Let's start with some definitions. And here you go. Here's where we're going to start. We're going to keep it nice and simple, and then we're going to accelerate a little bit later on. So the first one is ambiguity. What is ambiguity? It's really just a lack of understanding. It's a lack of clarity. It's how much you think you do or do not know. And think about any particular project. When do you have the most confusion or lack of understanding? At the beginning, as you begin to learn more, as you identify risk, you have less ambiguity. And projects with low ambiguity, meaning you know a lot, are pretty simple. So there's ambiguity. But what about an individual risk? An individual risk is an uncertain event or condition. It's uncertain.

0:56But if it happens, it might have a positive or a negative impact on one or more of your project objectives. It can be good. It can be bad. It's uncertain. Well, what about overall project risk? It's the total effect, the sum of all of those individual risks. And how does it affect your project, or your program, or your portfolio, or your overall company's strategic objectives and vision?

1:27It's the sum. Add it all up. And you get the overall project risk. Now, opportunities confuse people because they know about them, but they don't think about them. An opportunity is an uncertain event. And if it happens, it might result in a game. And here's an easy example. Think about a time you got a coupon in the mail and you thought, wow, if I go get my oil changed over here at the Valvoline Express place, I get 50% off. That's an opportunity.

2:00But it's not a gain until you actually drive your vehicle over there and save 50%. So there's a life cycle here to realize that game. Think of it that way. Now, threats are easy. Threats are bad things. If something happens, it might result in a negative impact. Let's say you're worried about driving down the road and your tires kind of bald and you think, man, if I hit even the tiniest rock, I might have a flat tire. Well, that would be bad. That's a threat. Now, issues are different.

2:35They're on the other side of the coin from threats and opportunities. Threats and opportunities are uncertain. They haven't happened. Well, issues have happened. You have realized them. An issue is a realized threat. Go back to my previous example. You're driving down the road, you hit a nail, boom, you got a flat tire. It is no longer uncertain. Now, you have to deal with it. You have to pull over. You have to get the spare out. Hopefully, you have one and not one of those little donuts and you have to actually change it. An issue is something you have to deal with.

3:14You have to take action. Realized opportunities are called benefits. Go back to my previous example about that Valvoline Express oil change discount. You realize the benefit by taking that coupon and your vehicle there and letting them change your oil. I recently did that, which is why I have this example. It was pretty awesome. I'm quite happy with it. Now, an assumption is a belief you hold to be true or false and the absence of proof. I believe the sun will not come up tomorrow. Well, if it turns out to be the opposite, it could result in a risk to your project. Now, obviously, if the sun didn't come up, that would be very bad. But let's switch the flip there for a minute. I assume, based on historical information, that the sun is actually going to rise tomorrow.

4:09That's my belief. But if it doesn't actually come up, it will result in a risk. Actually, it's going to be a pretty significant issue. So think about that for a moment. I assume we'll get paid and funded all the way through the life cycle of this project. And if you get funded all the way through it, no problem. But if you lose funding at a certain point, that does result in a risk, something that you may actually have to deal with that will become an issue. That's an easy example. A constraint is a condition that limits you. We are constrained by time. We are constrained by a particular quality standard. Here's an easy example. We are constrained by the hours of work. We can only do work on this project during the maintenance window between 11 PM and 4 AM in any particular time zone. Why? Let's say data traffic is really high during the day.

5:06And we can only work on this project, which may be to swap out some sort of server for increased capacity at night. Well, why are we doing it at night? Because that's when data traffic is lowest. That's the only time we can do it. Now we're constrained by time and the maintenance window. We may be constrained by using internal resources only. We may be constrained by a quality standard that's six sigma. We may be constrained by a certain amount of money. I don't know. But a constraint is something that limits you. And usually when you're limited, it may result in a risk event. I think that's going to do it for now. Let's stop right here and take a breather.

0:00Okay, in this section, we're going to talk about the principles of risk management, and there are seven principles in the practice guide for risk management, as well as the standard for risk management, and they're pretty well in line with one another. We're going to go through each of them pretty quick, and I'm going to give you some examples and ideas to kind of lock it down. I think you'll figure it out pretty quick. Here's the first one. Strive to achieve excellence in the practice of risk management. Wow, sounds a lot easier than it is, but let's take a look at some of the things you might do.

0:32Continuous improvement in your processes and your tools. Do your processes work ? Are you using the appropriate tools? For example, if your probability and impact matrix doesn't work for everyone, so half of them use it and half of them don't, that 's a pretty lousy tool. Do you have gaps in your process? If you do, then you probably can work on that as well. Increase professional competencies. Get some training. Get a certification.

1:02Attend a class. Have some lunch and learns. Have a senior risk manager. Provide some sort of lesson to everyone else to bring them up to the latest and greatest skills. There's always something you can do to be better. Promote a risk awareness culture. If you've ever been on the Metro, they like to say if you see something, say something. This is in WDC of the Washington District of Columbia area, northern Virginia. You know what I'm talking about. What they're basically saying is this job doesn't belong to any one person. It belongs to all of us. If you have an opportunity to bring awareness to the rest of us, then do that. Don't ignore it and say, well, that's someone else's job because that's a really poor attitude. Provide ethical and transparent communications. If you see something is wrong, don't ignore it.

1:55Bring it up. Be transparent. Don't wait two or three days to see if it gets better. Talk about it now. There 's an ethical issue here. If you wait because you're worried about getting in trouble or getting someone else in trouble and it blows up in everyone's face, there's an honesty issue there. You may or may not feel that way, but it's true. Both of those last two go together. If you see something, say something. Let's talk about the next one. Align your risk management of the organizational strategy and governance practices. This needs to be an alignment from the strategic level to the tactical level and there should be no disconnect. Your strategy and responses should support the big picture. The company has a vision. There's the present state and the future state and that vision and the actions you take between now and then should take you there. Well, risk governance from the top should be an alignment all the way to the bottom. So your responses at the bottom should not interfere or negatively impact your direction at the top.

3:08Everything has to be integrated from the high level to the bottom level or you're going to have a problem. Have appropriate oversight levels and accountability. If you're trying to standard ize your risk management across the entire organization, then you can't have risk governance in each individual silo. You need to take it to the enterprise level and make sure you have it there. And that's just one example. It depends on what you're trying to do and then have accountability.

3:40You can have responsibility without accountability. And I think you know what I'm talking about. Integrate risk across your people, your processes and your domains. Risk management is not a standalone part of your project. It is integrated into scope and schedule and quality and people. It is integrated across engineering and IT and operations and sales and marketing. It should be seamless and interwoven across all of them. Otherwise, you're going to have disconnects. You 're going to have gaps that will result in problems. Have performance feedback loops. Now in agile, they do this very well. There's a daily stand up where the developers can talk about what they worked on yesterday and what they might work on today and anything that got in the way of what they were working on.

4:32Agile does this very well. And often, there's also a sprint review where they get feedback from their stakeholders, clients, customers and users. On the predictive side of the house, we are terrible at integrating a feedback loop with something more than once a month or once a quarter. It should be much more often. And then if you add a hybrid project to it where you got two frameworks running at the same time and lots of different connection points, you absolutely need a feedback loop because what if hardware is waiting for software and neither side knows what the other is doing. This is harder than it sounds like, but it's worth it. Let's move on to the next one. Focus on the most impactful risks. What are we talking about? In one example, impact is greater than probability. I don't care if you have an 80% probability of a risk occurring with a small to minimal impact. It's the impact that matters. Now compare that to a risk that has a 10% probability of occurrence and a catastrophic impact. You can clearly see that one of them

5:50is far worse than the other. And that's what you should be paying attention to. Those that have the greatest impact. Encourage a balanced risk view to capture opportunities. What it means is don't just look for threats. Losses. Bad stuff. Make sure you are also looking for opportunities, benefits, gains, have a balanced approach. Quantify the impact when needed to rank the value. You can qualify your risk as saying it's low, medium, or high. But that doesn't tell people the whole story.

6:28If you quantify it and say, well, it has an impact of 10,000, 50,000, 100,000, or a $1 million legal fine, that's how you can rank the value of those impacts. Dollars and cents always get noticed. And the last one here, align attention to risk appetite and reevaluate those risks often. If your risk averse, meaning you don't like risk, your head should be on a sw ivel looking for risk events left and right. If your risk neutral, you will be paying less attention.

7:07If you are risk seeking, you may just let them come at you left and right like mosquitoes near a swamp. I don't know. But you need to align your appetite, your client's appetite, your company 's appetite, to their awareness of what's going on around them. Because if they are risk a verse, they need to reevaluate those risks far more often than if they are risk seeking.

0:00Okay, welcome back. Let's jump right into the next principle, balance realization of value against the overall risk. What does it mean? It means think of the cost benefits analysis. Is the benefit of this project? Is the benefit of this outcome greater than the cost to pursue it? For example, let's say you want to invest $5,000 and you have two options. Investing $5,000 over here might yield the benefit of an additional $500. So your total outcome might be $5,500. Total investment and outcome. In another example, you might invest that same $5,000 and realize $10,000 in benefits. Okay, that's substantially different. $510,000 or $5,000 if you just doubled it. I don't know. Then you have to look at the probability of actually achieving it as a benefit and possibly the loss. So the benefits of value should outweigh the overall risk because sometimes if the risk is so great, you shouldn't even pursue this anymore. And that's

1:17just one idea. And let me drop some other ones on you. Select responses that maximize the net benefit too. If you can avoid a threat versus accepting a threat and your monetary loss is less by avoiding versus acceptance, then you should probably do that. If you transfer the impact to someone else versus mitigating it yourself because the net benefit is greater, then you should probably do that.

1:49Here's another easy example. Do you want to pay for your own car repairs if you 're in an accident or do you want to keep paying that monthly insurance premium and transfer that impact to them? That's what we're talking about here. Select the responses that are going to work best. Prioritize opportunity enablement or pursuit. If there are opportunities, benefits gain, benefits or gains, excuse me, they have a greater priority than avoiding low impact risk. You should absolutely be pursuing those opportunities if the benefits are worth it.

2:26Balance the cost with risk reduction. I talked about that. If it's going to cost me $100,000 to reduce the impact of a $50,000 impact, I'm probably not going to do that. But if I can invest $500 in insurance perhaps to reduce or remove the impact of a $100,000 threat, then I will do that. There 's a balance there and you should be able to figure that out pretty quickly. Optimize with lessons learned. I'm blown away by how many companies have great lessons learned that they don't share.

2:59And I'm also blown away by how many risk managers have access to it and they reinvent the same threats every single project and they miss the same opportunities every single project. Historical information is your greatest source of risk information on any project. Never forget that and you should be leveraging it. Foster a culture that embraces risk management. So at the top, leadership is going to model and promote risk awareness behavior all across the organization. If they're walking the walk, then everyone else will walk the walk. But if they're only talking a good game and they're not doing it, that's what everyone else is going to do as well. They say that leadership starts at the top and it's the exact same thing for risk management. Your daily routine should include risk conversations. What are the daily risks today? If for example, we have a construction project, oh, we have a train we're moving. Excuse me. I started to say cold train, but I 'm not sure where that came from. Oh, these are the weekly risk we have to look forward to. These are the monthly's we have to look forward to. And these are the ones we can actually close out.

4:15Risk management should be the first thing you talk about in every single meeting on a project at an appropriate time, especially when you hit execution and beyond, because that's when the majority of your risk events are going to occur. Man, I'm stumbling over my words because I'm super excited to talk about this. I said it before. I'll say it again. I am a risk nerd. I love this stuff. Recognize and reward transparency. A lot of people don't point out something that's wrong with the risk methodology because they don't want to air their dirty laundry. They don't want to get someone else in trouble.

4:49But if I walk into a switch and I see someone working on some kind of electr ified equipment and it ain't locked out and tagged out so they can't get knocked out, I'm going to say something about it. And I'm going to do it without concern for my own career or theirs because it's the right thing to do. Now there's a balance there, but in the cases of life, limb, and eyesight, in a very extreme example, it's super important. And promote psychological safety and cross-functional collaboration. People shouldn't have to worry about speaking up and getting crushed by their manager because they said something that may have made their manager look a little silly.

5:29Don't do that. If they see something, they should be able to say something without getting smashed by the process. A risk is a risk is a risk. Say something. Let's move on. Principle six, navigate complexity using risk management to enable successful outcomes. Man, that's a lot. Use systems thinking in risk analysis. The risk you're thinking about may not just affect IT. It may affect engineering in sales. It may affect operations. It may affect sales enablement or sales outreach or whatever it is. Do not view risk in a silo. It usually affects far more than you think. Scenario planning enables strategic agility. You may have multiple responses for any particular risk and then play them out. Well, if we do this, this is the likely outcome.

6:23If we do that, this is the likely outcome and the secondary risk. If we do this , that might happen. Play these out so you aren't surprised and that will make you more agile, especially at the strategic level. Integrate qualitative and quantitative thinking. Qualitative, low, medium or high. Real risk, yes or no. Quantitative, impact in dollars and/or days. The combination of the two will make people pay attention. They will have a clear understanding of what you're talking about and use adaptive risk governance.

6:57There is no one size fits all. Do you need an enterprise level risk oversight board for a single project or should you simply have a risk manager in charge at the PMO responsible for all the projects and programs in a $50 billion company and the answer to both of those is no. You need an appropriate level of risk oversight based on your industry, the cost, the experience level of the team, and so many other factors. I can't even outline them all, but there is no one size fits all.

7:32And the last principle, continuous improvement. Get better within your risk competencies. Institutionalize your lessons learned. Elevate them all to the strategic, to the enterprise level, so everyone can share, everyone can see, and everyone can benefit from them. Audit and mature your risk framework. An audit is all about the process. Are we following it, yes or no, and does it work, yes or no? If the answer to either one of those is no, then something has to change and that's the only way you can get better across your organization.

8:13Leverage technology and data analytics. Do not make risk decisions based on your gut instinct. Let the data drive your decisions. Let AI help you identify risk and quantify it, and aggregate piles and piles of information so you can see what historically has happened so you don't have to do it again. There are a ton of tech tools out there. Use them. And last but certainly not least, encourage a growth mindset around uncertainty . Uncertainty, the unknown. Welcome it, look forward to it, embrace it. That's a growth mindset. Avoiding it, transferring it into someone else's wheelhouse, that's not my problem, that's close-minded.

9:04And when you have those kinds of ideas and thoughts, you're going to have a gap that's going to come back and bite you in the enterprise, but you know what I'm talking about.

0:00In this section, we're going to talk about risk attitudes, not a tood, and why it matters. A chosen or inherent disposition towards uncertainty that influences a person's or an organization's behavior when responding to a risk is actually called, well, now that I'm writing it out, your risk attitude, there's yours, and there's your companies. That's why there are two levels, the individual level and then the organizational level. And many times there's a huge disconnect right here. I might think I'm able to do X, Y, and Z or not able to do it.

0:40My company may have a completely different idea and that misalignment can lead to more threats and missed opportunities or both. So let's take a look at the risk attitude spectrum. If you're on the left side, you are risk averse. You do not like uncertainty, you prefer predict ability. You want to know as much as you can know about all there is to know before you make a decision. I get that, there's nothing wrong with that. And there are some industries where that is the only way things get done. Think engineering, making bridges, putting up buildings. It's really nice when they don't fall down. So they are certainly risk averse. Within you have risk neutral. You're comfortable with the wins and the losses balanced trade-offs. No problem there. Then if you go to the far side, you are risk seeking. Think venture capitalism. Think any of the companies right now that are scrambling to get AI driven anything out. Those people are trying to be the first to market with their AI driven process, their product, their result, whatever it is. And they 're dropping huge money on these massive data centers to pull it off. So that's the risk attitude

1:55spectrum. Now let's talk about the components within the attitude. There's a degree of uncertainty. A person or a company is willing to accept. And that's called your risk appetite. How much are you willing to eat? And it goes all the way back to the spectrum. Averse, very little. Neutral, some more. Seeking lots. Within you have the acceptable variation from that degree of uncertainty. And that is your risk tolerance. And I have a graphic to explain this very well in just a moment . So hang on.

2:31But then there's a specific moment or a point where the exposure becomes intolerable and it needs to be escalated. That's actually called the risk threshold. Easy enough. Every one of us has an appetite with a tolerance and a threshold. And it changes throughout our career, throughout our life from project to project, depending upon a bunch of factors that we're going to get into in a moment. But let me explain these three components here in this example. If you look at the grain, there's your appetite. If these are my threats, I like to stay right here. But I'm willing to put up with a little bit of variation, which is my yellow zone, my tolerance zone.

3:18I'll put up with that. Let's say I'm driving the speed limit. My appetite is 65 miles an hour. But my tolerance is up to 75, depending upon whether or not I'm on a highway or I'm on an interstate. So that's my tolerance. But my threshold is 76. I do not like to go faster than that faster than 75, really. And if traffic is consistently moving faster than that, then I need to escalate and let my house spouse drive or I simply need to pull over, find a restaurant and take a break.

3:51And yes, this is old man talk. This is how I feel about it. But let's go the other way. Those are threats. Let's say you are in pursuit of opportunities and you're looking for a discount . Think of that red area out there at the bottom where it says monitor. I'm monitoring a 10% discount for this kind of material, but I need it to be more. So now it moves into the yellow area and it 's 20 to 25%. Now I can do something about it if I want to. But then it moves into that green area and it's 30% off. Now I will absolutely capture that opportunity. And this is why it's important to understand your appetite, the deviation you are willing to put up with, and the point where you will absolutely go no further or you will escalate. And there are a lot of things that influence this.

4:43Think about the organizational culture. Whatever leadership is doing, the rest of the company is largely going to follow because leaders lead. They set the tone. And then what about the history of success and failure? Well, we tried this before 15 times and it didn 't work any time. So we're not going to do that. Or we tried it a lot and 8 out of 10 times we were able to capture those opportunities. So based on your successes and failures, you will continue to follow that pattern. But what about your external environment? What about the market volatility, stocks, bonds, municipal things, Bitcoin, Ethereum, Doge, whatever it is? What about regulations? What about stakeholder expectations for returns and losses? And I'm just musing out loud here for financial stuff. The external environment really matters. But what about the project itself? How complex is it? How visible is it? Where is the innovation level? Is this something we've done many times before?

5:50Or is it brand new? What about our resource constraints? Do we have lots or do we have none? Think about SpaceX. I am fascinated how quickly we went from just firing rockets into space, watching them fall into the ocean and maybe we collect them and maybe we don't. And suddenly, they're making them fall exactly where they want them, want them to, excuse me. And suddenly, they're catching the small rockets and a couple of them blew up and they went, so what? We got more rockets. And suddenly, they're landing them on floating platforms and it's perfect. And suddenly, they're landing them two at a time. And then, not long ago, they caught a huge heavy rocket booster. It was perfect. I'm fascinated by the tech.

6:38So if you have lots of money to throw in something, the resource constraints really don't matter at that point. But what about your stakeholder personalities? Are they optimists? Are they pessimists? What about their past experiences? How literate are they as it relates to risk? Do they have a preconceived idea about what a risk is or a response is? Or do you need to help them understand it? And the answer is, I don't know, but everyone has a different perception. And then you have your available information. How confident are you in the data you're being fed to make a decision? What about the data model? What about the knowns? What about the known unknowns? It really does depend. And this alignment between the top level and the bottom level really matters. Because if there's a misalignment or it is ignored, you 're going to have inconsistent responses at various levels of the company. You actually make yourself legally responsible for some of these decisions and you get your company on the hook form as well. If you're overly cautious, you're going to miss opportunities that your bosses would have preferred that you captured.

7:48Or if you go the other way, you might escalate two later too often, resulting in a greater level of threats occurring than there should be. But if you have it dialed in, you may actually have coherent risk decisions. Yes, we sampled the data, we compiled it, we analyzed it, we captured that opportunity, we trusted data. Or we looked at the data, the numbers weren 't on our side, and we passed on that opportunity. But the company that did take the opportunity, they're now bankrupt.

8:20Your reward to risk ratio is going to be optimized too. You are winning more than you are losing. You are avoiding threats. You are capturing opportunities. There's an optimism. There are more positive project outcomes. Your responses match the governance. You're not exposing your company to liability or yourself. You're not getting fired. You're not getting dragged into court. And the culture embraces fact based dialogue. This is what we said would happen . This is what actually happened. This is the data that supported that. No one's trusting their guts. No one's looking to see if the moon or Mars is in retrograde. They are making fact based data driven decisions and they can talk about it. The bottom line is this, proper alignment with risk attitude from the top to the bottom between the individual and the organization is no longer seen as a compliance exercise. It's a competitive advantage. And that's why it's really important to know what you're talking about and who you're talking to from the tactical level to the enterprise level.

0:00"Welcome back and welcome to sources and categories of risk." I want you to think of it time, if you've ever done this, where you went to a project meeting and they said, "Okay, we're going to start ID risk." It's identification day, give it to me. What do you got? And people just randomly say things or they write down random stuff or they put them on random post-it notes and stick them on a board with no rhyme or reason. You have scope and you have quality and you have weather events and you have risk events and you have operational, organizational, human resources.

0:36And there's no rhyme or reason. It just becomes chaotic. There's a reason you can't do that. You need a well-structured view of risk sources because if you don't have that, you're going to have a ton of problems later on. They might not manifest right now, but they will certainly pop up. And remember, we're not just talking about project risk anymore. We're talking about program level risk, portfolio level risk, strategic level, all encompassing company level risks.

1:12So you need a well-structured way to manage that. Excuse me, I think I eat a bug. If you have a well-structured view, you're certainly going to identify more risk. It's a fact. I've done it a hundred times. And whenever we start with a list, we get it right. And here's an easy example. Think about a time you didn't take a grocery list to the store. Did you really get all the stuff you wanted to or you were supposed to or did you get home and go [garbled]?

1:43I forgot X, Y, and Z and now I gotta go back. Or you know what, I forgot it. So now I'm just going to eat something else. By having a list, you're going to avoid blind spots. You're also going to reduce exposure with consistent groupings. You will miss entire categories unless you have a well-thought-out list. And we're gonna get to one rather several in just a moment. But more importantly, you're going to begin to identify opportunities.

2:15Threats aren't the only thing out there. Opportunities, gains, benefits, they exist as well. So let's get straight to a PMI definition. Any element alone or in combination that has the potential to give rise to uncertainty and achieving objectives. This is called, wait for it, a source of risk. Ha, that's it. And here's the key idea behind them.

2:46Sources describe where those risks might come from. The problem is they don't go far enough and actually identify the what specifically that risk is. So if you tell me, well, here's a great source, weather events, really? Atmospheric conditions is your source. Well, what specifically are we talking about? Are we talking about hurricanes, tornadoes, tsunamis, tidal waves, Arctic conditions, heat-related injuries?

3:21What specifically are we talking about? Torrential rain, I have no idea. So here are some common categories. External, those are things outside the company's control. Internal, those are things usually within the company's control. Technical, that's easy. Political, strategic, and then you have projects specific stuff like scope, schedule, cost, communications, human resources, whatever it is.

3:53And these are just a couple of categories. There are a bajillion more. But here's another key concept. Sources reveal root causes. There's something called Pareto's law. You've probably heard of it. It is the law of the common few. Well, as it relates to risk management, there's the 2080 rule or the 8020 rule, whichever way you wanna say it. 20% of your root causes result in 80% of your risk events.

4:24And if you can identify what those root causes are, you can usually avoid or transfer a whole bunch of risk events. But if you never identify those root causes, you will always deal with the effects. They will happen over and over and over, which is why Pareto's law is always in effect. This will bring us to the RBS. The risk breakdown structure is a higher arch goal.

4:55That's a real word. Decomposition of identified risk sources organized in a comprehensive way to promote risk identification and consistent analysis. And it's broken down across three levels. Level one is major categories. Level two is subcategories all the way down to specific sources and triggers. And if you're thinking, wait a minute, the risk breakdown structure, where have I heard that before?

5:26Because it sounds suspiciously like the work breakdown structure and the organizational breakdown structure. If you made those connections, you're on point. It is a graphical, numerical, higher archical or a higher archy. It's a way of breaking it down. And the reason you're doing it here one more time is so you can have consistent risk identification and analysis. Well, let me give you an example.

5:57And there's a lot here. So I'm just gonna come off screen for a moment and I'm gonna show you where we're starting. Let's start over here at this IT project. That is your major category. Within you have your subcategories and you can go down to as many categories and sub levels as you need to. Let's worry about technical risk. Well, underneath technical risk, we have requirements and design. And one risk might be incomplete or changing requirements.

6:29And yes, I'm now noticing I misspelled it. So please hold your laughter to a minimum. But what about poorly defined user stories in the agile space or misinterpreted system needs? This is a way to systematically break it down into smaller and smaller, lower pieces. Just like the work breakdown structure. Why are we doing that? So we can chase down the root cause. And let's say there's only one root cause for all of those in requirements and design.

7:03Wouldn't it be great if we could identify them and deal with that root cause? Because if we did, theoretically, we could wipe out all of those potential risk events. But let's do one more and then stop this nugget because I don't wanna get too deep and make it too long. Let's jump over here to a construction project and talk about some project management level risk. Well, what happens if we have inaccurate estimates? Or we sequence our activities in a lousy way?

7:34Or we don't do enough due diligence to get approvals or permitting. What's the impact? If we can figure out what the root cause is of say, this one and this one and this one, and maybe it's connected to that one and that one, maybe we can wipe them all out before they materialize into actual issues. This is why you need a risk breakdown structure. A clear structured way to identify your sources and then dig deeper into them to chase those root causes.

0:00So the risk breakdown structure, right? Wow, but it doesn't just end there. Remember, we're not only talking about the project level now, we're talking about all levels across the organization. So think about the portfolio level. Strategic level risks, do you have an RBS for that? You might be talking about investment choices or major resource allocations. Think about the COVID-19 years, 2020 and through 2022, major supply chain shortages.

0:33Shoot, you couldn't get toilet paper for a while. Think about how some of those resources, not really toilet paper, might impact the company's portfolio at that level. But then you have the program level, where you have the interdependencies, the linkages across multiple projects. And then you have the project level itself, those tactical risks tied to deliverables. But here's some key takeaways here. The higher the level, the more interdependent the risk.

1:04Basically, the higher the level, the greater the reach, the greater the impact that risk is going to have. Because portfolio level risks influence business priorities. Project level risks influences execution and delivery. So we're running all the way up and down the stairs now. Tactical level, project level, operational level, program level, multiple program levels, portfolio level, initiative level, company level.

1:39This is bonkers. So a well-structured plan, a well-structured list, and appropriate risk breakdown structure is the only way you're going to survive this moving forward to actually maximize value delivery within your company, your portfolio, your program, and your project. But why does it really matter? Let me just lay this out one more time. If you don't have categories, your lists are going to be repetitive and random.

2:10And that randomness is going to keep those root causes hidden. You're not going to find them. It's also going to be really hard to assign risk owners. The risk owner is the person designated, they either volunteer or they're volunteered, to actually ensure the risk response happened. Well, then you have a risk action owner. And we're going to get to both of these later on. The action owner is the person that actually does this stuff. Let's say you are a project manager for a construction company, and you have heavy equipment.

2:44Well, the yard foreman is going to be the risk owner. If something happens with the bucket loader, he's going to make sure that the bucket loader driver does what he or she is supposed to do for that particular issue. So you have the risk owner, the action owner. And if you never get to the root causes, you're going to have a really tough time making sure that the right person is assigned to those roles. And because it's all willy-nilly crazy, it's going to be random.

3:14And that's going to overwhelm your stakeholders when you report it. They're not going to see a rhyme or a reason or a pattern. They're going to see chaos. And this is your fault as a project manager. If you have a risk, if you have appropriate categories, you're going to have a logical grouping for analysis and reporting. Sorry, I had to pull my face off of there. And those risk clusters will expose your root causes. And they almost always pop up really quickly.

3:46When you have three or four risk events and they're all tied together, it doesn't take long to drill into the root cause. And once you have order within the chaos, it's not going to be hard to assign the appropriate owner. If someone says, well, there's an engineering risk, do I just randomly assign it to the engineering director and let him assign it to a risk manager? But if I have a well-drilled down risk, I might potentially be able to assign it to the specific engineer working that shift and that particular piece of equipment, because that's what you want.

4:22Who should be assigned? The people most closely associated with that work. And so that's why you want those risk owners very clearly identified and not volatile. Because you can actually create another risk by assigning someone who's not qualified to deal with it. And we're going to talk about this many more times throughout this training. You're also going to have better decision making. Because again, at a minimum, you have three levels of reporting and decisions to make.

4:52Project, program, portfolio. And at a minimum, you might have three kinds of projects, predictive, hybrid, agile. There's a lot to this. So RBS-based categories are going to make your risk register scalable, auditable, easier to communicate. Because at some point, you're going to have to justify your methodology. I used an RBS. This is the one I used. These are my categories, subcategories, and specific risks.

5:26We went down four or five levels. And I can go down as many levels as appropriate for my project, my experience level, my team, geographical location, technology involved, and the list goes on and on. So let me give you some common examples for RBSs. Well, there's PESL, political, economic, social, technological, legal, external. That's just one. There's also T-COP.

5:57I always say T-COP, but I know it's T-COP. Technical, environmental, cost, operational, political. It can be whatever you want it to be. And you can customize it based on your industry, which is what I always recommend. But do not forget the danger associated with hybrid. And there is one. You should strive to create a specific hybrid model for your hybrid projects. And that's it. The structure behind risk breakdown structures as it relates to risk identification.

6:32Because if you can't identify them, you can't analyze them. If you can't analyze them, you can't figure out how to respond. And if you have no response, acceptance is the only thing you can do. And I promise you, things will go from bad to worse.