The Challenges of Risk Management in Projects

Good risk management seems to be a challenge in most projects and can affect its delivery. The subject is often taught, analyses, spoken about, and reported within organizations EPMO’s. It then comes as a surprise when projects and programs fall well below their key delivery benchmarks and, more often than not, the reason is an unidentified risk manifesting itself into an issue that impacts adversely on delivery. Considering the number of projects conducted and the documents associated to risk, the effort that goes into quantifying the risks of a project should not be missed, but they still do.
The following are possible reasons why risks are still not always adequately identified, understood and how they can negatively impact projects large and small alike.
Emphasis on regular outcomes
Project teams are hard-wired to deliver, and never more so than in the current delivery environment that heavily favors agile techniques whereby delivery is an on-going cycle. This emphasis upon regular outcomes drives a delivery focused mentality within many teams. This focus can, however, have a negative impact on risk management as it is exercised within the team.
As agile continues to propagate the emphasis on continual delivery can make risk management seem like a handbrake to the speed with which teams are now working at and as such it gets put to one side in the rush to hit delivery deadlines.
Experience
IT Project Management within the business and IT world is relatively new, unlike the construction industry whereby project management has been taught and valued since ancient civilizations. The relatively recent introduction of project management within the white-collar sector has led to the rise of tertiary qualifications. There are also many stand-alone bodies providing varying degrees of project management qualifications and risk management.
The mechanics of managing risk can seem straight forward from the comfort of a textbook or course. The reality of the effective application of risk management can be varied when delivering a project. Possibly for two reasons;
Firstly, good risk management requires the ability to identify potential risks. This requires imagination or experience which is often formed heavily by past experiences of what can happen in certain situations. The lack of imagination or experience can and normally does affect the risk assessment. For example, when laying fiber cable, time should be added when dealing with Government bodies, such as councils or heritage listed environments, all adding time to project delivery.
The second issue and how to avoid potential risk, is the input or buy-in from a wide range of people. Some of whom may be time poor or they may actually be hostile to the project. This is where stakeholder management becomes critical. If a project manager does not have the ability or experience to get all the right people engaged then running through the risk management process per the textbook will not be enough.

Only positive news

Many organizations expect or want only good news, which is valued by the executive over the ‘real’ news. This drives certain sub-optimal behaviors in an organization that will work its way down into project delivery. Calling out risks frequently and possible issues can be seen as antagonistic to an executive who just wants to hear about what is going well.
This dynamic can lead to the less experienced or robust project manager to priorities the good news over the possible bad news and keep the risk and issues toned down or off the agenda altogether. This is a head in the sand mentality that does not promote good risk management practices.
The list above is not exhaustive but is a good indicator of why risks continue to surprise some projects to their detriment. Of course, identifying the risk is just the beginning and does not mean they will manifest themselves into significant issues. If nothing else it provides the team with the ability to have robust mitigation plans for them if they occur.