Lessons Learned Building a
Risk Management Process
In a Teaming Environment
Lessons Learned Building a
Risk Management Process
In a Teaming Environment
James ToddF/A-22 Team Risk Manager
James ToddF/A-22 Team Risk Manager
Purpose Purpose
This briefing is not meant as a primer for basic risk management principles.
This briefing focuses upon key elements and processes necessary to build an effective risk management system within a team environment.
This briefing does not include all activities that the risk management team may be required to employ, but rather seeks to discuss a few key lessons-learned in building an effective risk management process among a number of team partners.
ContentsContents
• Lesson: Assess Your Environment• Lesson: Challenge Your Assumptions• Lesson: Pillars of Effectiveness• Lesson: If You Can’t Map It, You Don’t Know It• Lesson: Murphy’s Law – Plan for It• Lesson: Commit to Continuous Training • Lesson: Build Upon Your Strengths • Lesson: It’s About Culture, Not Technology • Lesson: Increased Communications Will Minimize Problems • Lesson: Ensure Clear Communication At All Levels• Lesson: Stabilize a Process Before You Improve It • Lesson: Permanent Change Requires Commitment at All Levels • Lesson: Value-Added Risk Roles • Lesson: Touch RM Data Once • Lesson: Essentials of an Effective SW Risk Tool• Lesson: If You Don’t Control Your Processes, Someone
Else Will• Lesson: No Substitute for a Good Risk Process• Lesson: What Will Your RM Process Be When It Grows Up?
Lesson: Assess Your EnvironmentLesson: Assess Your Environment
• Establish a Baseline Understanding– People– Processes– Policies– Infrastructure– Environment
• Key questions– Who are my customers?– Do we have the support of the program leadership?– What is the maturity level of participants in the risk process?– Has the risk management process been mapped?
• Is it understood at all levels within the program?
– What level and type of training is needed/reasonable?– What labor hours and funding are necessary to effect desired change in
the risk process?– Is the risk process accurately documented?– What is the current level of information infrastructure?– Where are the weak points in our communication capabilities?– Is the intent of the risk process to proactively “search and mitigate” or as
a reporting activity?– Does the current environment empower people?– Does the leadership view RM as a high priority?
• People
• Process
• Technology
• People
• Process
• Technology
Lesson: Challenge Your AssumptionsLesson: Challenge Your Assumptions
• Assumptions are necessary• Assumptions define work• Assumptions can limit solutions• Assumptions are not always visible
• People
• Process
• Technology
• People
• Process
• Technology
People Process Technology
Risk Management
System
Think out of the box
Lesson: Pillars of EffectivenessLesson: Pillars of Effectiveness
• People
• Process
• Technology
• People
• Process
• Technology
PPEEOOPPLLEE
PPRROOCCEESSSS
TTEECCHH
Risk Management SystemRisk Management System
An Effective Team Risk Management System Optimizes Three Key ElementsAn Effective Team Risk Management System Optimizes Three Key Elements
Lesson: Pillars of Effectiveness (cont.)Lesson: Pillars of Effectiveness (cont.)
• Complexity
• Understanding
• Commonality
• Synergy
• Complexity
• Understanding
• Commonality
• Synergy
Org 1Org 1
Org 2Org 2
Org 3Org 3
TeamTeam
It takes a team to build a team process
Lesson: If You Can’t Map It, You Don’t Know ItLesson: If You Can’t Map It, You Don’t Know It
• Steps– Map the RM process, as-is– Identify waste and inefficiencies – Rebuild the RM process, minus the waste
• Recommendation– Never build a team RM process map, alone
• Gather a team, composed of team partners and customer representatives
– Once improved, ensure that the new process is communicated & understood by management
– Ensure that the new process is documented in the appropriate policies and directives
– Benefits to this approach• Fosters teambuilding
• Promotes ownership across the team
• Increases understanding in the process
• Map the Process
• Identify Waste
• Remove Waste
• Re-Map It
• Map the Process
• Identify Waste
• Remove Waste
• Re-Map It
Lesson: Murphy’s Law – Plan for ItLesson: Murphy’s Law – Plan for It
• Identify weak points in the risk process • Predict what elements are likely to fail • Develop strategies to counter failures • Typical RM weak points
– Communication flow• Up, down & in the middle
– Ill-defined risk process• No feedback loops
• Too complicated
– Understanding the risk process at all levels– Changing directions, mid-stream– Ill-defined training– Poor documentation– Poor coordination of effort– Poor application of software tools
Lesson: Commit to Continuous TrainingLesson: Commit to Continuous Training
• Design RM training around the maturity
level of your personnel
– Motivation
– Working knowledge & skill
• Effective training requires an investment
– Dollars
– Labor hours
• Plan for it
• Budget for it
• Document it
• Get management commitment, upfront
Lesson: Commit to Continuous Training (cont.)Lesson: Commit to Continuous Training (cont.)
• Types of Training
– One-to-one
• By phone
• By email
• Netmeeting
• In-person
– One-to-many
• By phone
• By email
• Netmeeting
• In-person
– Prepared modules
• Tutorials (e.g. PowerPoint briefings)
Match Modes of
Training With the
Individual’s
Motivation &
Skill Level
Lesson: Build Upon Your StrengthsLesson: Build Upon Your Strengths
• Each team partner has something to
contribute to a “team” risk management
solution
• Pull the best from each organization
• Empower each team partner to help
develop & maintain a team risk process
• Through empowerment, each team partner
gains a sense of ownership in the team
risk management process
N.I.HN.I.H
Lesson: Build Upon Your Strengths (cont.)Lesson: Build Upon Your Strengths (cont.)
• It takes teamwork to build a team solution
• Avoid the pitfalls of NIH practices
• Learn to empower RM people
• Empower other team partners
• Realize that every individual has a unique
contribution to make to the RM process (it
is your job to find it and use it)
When You’re Green,
You Grow…
…When You’re Ripe,
You’re Rotten
When You’re Green,
You Grow…
…When You’re Ripe,
You’re Rotten
Lesson: It’s About Culture, Not Technology Lesson: It’s About Culture, Not Technology
• In a struggle between Culture vs. Technology… Culture Usually Wins
• When you strip away the computers and the information technology, organizations are mostly about people following a commonly understood process
• Permanent change occurs when people change. The law of inertial
• Change is often slower than planned• Even positive change is stressful• Stay the course• Keep reselling the risk process• Keep training your personnel• Technology is not a panacea for RM
Lesson: Increased Communications Will Minimize Problems
Lesson: Increased Communications Will Minimize Problems
• Even in the most technical areas of
business, the biggest mistakes are often
the result of a breakdown in the
communications process
• Ensure that your risk process identifies the
communication flow and links
• Email is not the best form of
communication (but it’s necessary)
• An effective communication system can
make your risk process forgiving
Lesson: Ensure Clear Communication At All Levels, Among All Partners
Lesson: Ensure Clear Communication At All Levels, Among All Partners
• Effective communication relies upon trust
– Keep your word
– Do what you say
– Keep others accountable
• Don’t alienate
• Recognize others - Share the credit
• Praise in public, criticize in private
• Be consistent with your plans & meetings
• Be responsive
• Don’t be afraid to ask questions
Lesson: Stabilize a Process Before You Improve ItLesson: Stabilize a Process Before You Improve It
• Develop a team plan for improvement
• Execute it – track It
• Stay focused
• Avoid distractions
• Continue selling
• Continue training
• Avoid making improvements until the risk
process has stabilized
Lesson: Permanent Change Requires Commitment at All Levels
Lesson: Permanent Change Requires Commitment at All Levels
• Without sufficient understanding & support within the program, failure is all but guaranteed– Top-level– Mid-Level– Lower-Level
• Complete an accurate assessment of current process shortcomings
• Promote agreement that change is necessary
• Implement a joint risk management team to plot a better course
• Integrate risk management process into key, recurring program meetings
• Continue to train your people• Keep personnel abreast of RM progress
Lesson: Value-Added Risk RolesLesson: Value-Added Risk Roles
• IPT risk integrator– Ensures that each new risk item is coordinated
& reviewed among all lower-tier IPTs
– Ensures that each new risk item is coordinated
among other team partners
• Joint Risk Team– Responsible for mapping risk process
– Initiate improvements & implementations
– Address team concerns
– Composed of team members and customer
• IPT Risk Integrator
• Joint Risk Team
Lesson: Touch RM Data OnceLesson: Touch RM Data Once
• Use processes & tools that minimize the
frequency that data is either transferred or
copied
• Minimizes opportunities for errors
• Reduces manpower to maintain risk
management system
• Heightens timeliness of data
• Increase accuracy
DBDB
Site 1Site 1Site 2Site 2
Site 3Site 3Site 4Site 4
Essentials of an Effective SW Risk ToolEssentials of an Effective SW Risk Tool
• Capture associated information in one record• Builds risk handling plans, automatically• Builds action plans, with risk burn-down metric• Applies probabilities of cost and occurrence• Builds basis of estimate• Allows supporting data files to be attached• Generates traditional risk assessment matrix for probability
of occurrence vs. severity of impact– Technical– Cost– Schedule– Support
• Capability to identify and assess items associated with major risk groupings
• Operate risk tool in shared environment– Check the speed of your network
• Flexibility to adjust to the unique requirements of a specific program
Lesson: No Substitute for a Good Risk ProcessLesson: No Substitute for a Good Risk Process
• Software risk management tools are great…
…but no substitute for a well-developed risk
management process
• Beware of buzz words
• A well-developed, well-understood risk
management process is the best predictor of
success
Lesson: Decide What Your RM Process Will Be When It Grows Up
Lesson: Decide What Your RM Process Will Be When It Grows Up
• Clarify the purpose of your risk process
– Two approaches
• To become a reporting activity that identifies &
absorbs risk, or…
• To become a proactive tool to avoid or mitigate
risk
• Ensure that your process supports the
intent of your risk management system
– Ensure that the recurring RM metrics support
the purpose of your risk system