Milk Vs. Meat in Risk Management

In 1 Corinthians St. Paul writes “I fed you with milk, not solid food, for you were not ready for solid food. Even now you are still not ready.” I was reminded of this statement after recently reading an article published in the Harvard Business Review in 2009 titled “The Six Mistakes Executives Makes in Risk Management.” The blunders they mention include the attempt to predict extreme events, using the standard deviation to measure risk, and not appreciating how to frame risk so that others understand it. This is good advice for many projects, especially those that are subject to extreme risk. It is also advice meant for organizations with a sophisticated and mature understanding and appreciation for risk. However, like the recent converts in the ancient Greek city-state of Corinth, most projects can only handle milk, not meat provided by the 2009 article.

For example, most organizations do not conduct quantitative risk analysis. Among private firms, surveys indicate that only 20 percent use quantitative methods for evaluating risk. Among government agencies, some organizations have internal requirements for it, but I know that the cost manuals for some organizations only provide tepid support for it, and the leading group for independent cost estimates within the Department of Defense does not conduct risk analysis at all.

Another issue is that even when risk analysis is conducted, there is a systematic tendency to underestimate risk. Many times the methods used limit the risk ranges. Also, project risk estimates tend to be limited by the project manager’s optimism – the same tendency that leads to underestimation of cost and schedule also leads to underestimation of the true amount of risk.

A better list of six mistakes that would provide the milk that most projects will be able to learn from are these:

1. Projects often do not conduct quantitative risk analysis. It is sometimes measured for cost, and less often for schedule. Rarely are both cost and schedule risk analyzed jointly.
2. Risk analyses often are based on simplistic, naive methods that do not models risk well. These include the use of triangular distributions and not including correlation.
3. Even when organizations conduct risk analysis at the project level, there is no portfolio-level analysis of risk. Even in government agencies where all major projects have quantitative risk analyses of cost, the remaining budgets have no supporting risk analysis.
4. Partly as a result of not understanding portfolio risk, organizations both private and public try to manage too many projects at the same time. This creates a vicious cycle as there as a lack of funds to support all projects leads to schedule delays, which in turn causes cost growth.
5. Quantitative risk analyses typically rely only on the percentiles of the S-curve, which are sometimes called confidence levels. The sole reliance on confidence levels as a risk measure ignores the big risks that lurk in the far right tails of cost and schedule risk.
6. Public organizations do not think strategically. Government organizations should make better use of their market power to achieve better values. The use of incentives in contracts works, and should be widely used.

I write more extensively about these topics in my forthcoming book Solving for Project Risk Management: Understanding the Critical Role of Uncertainty in Project Management, which is now available for pre-order from Amazon and Barnes and Noble. You can also download Chapter 1 for free. The book is written for a general project management audience, but if you want to dig into technical details, you can also read a collection of some of my research on risk on the International Cost Estimating and Analysis Association’s website: https://www.iceaaonline.com/publications/solvingprm/