The Primacy of Risk Management

The PMI (Project Management Institute), owner of the PMP Certification many project managers secure, is wrong about so many things regarding modern project management, but one of the most glaring is the fundamental nature of Risks and Risk Management in running a project.  There are certainly lots of pages in the PMP curriculum having to do with Risks — identification, ranking, mitigations.  But, where I feel PMI gets it wrong is that Risk Management is considered once the project plan has been created, and is a way to manage the plan, and part of the Execution Phase.  IMO, Risks Identification and Management is fundamental to the creation of the project plan, not subsequent to it.  

Risk Identification and Planning must be integral to the project planning process.  As soon as the Scope is defined (which ultimately, defines the project), then there are two remaining pieces of the plan:

  • Implementation planning:  How do you get the scope developed and delivered?  I would argue that with good Agile processes in place, the part of the project tends to take care of itself.
  • Risk Identification and Planning:  What are the risks associated with the scope (e.g., technical and resource risks) and the Implementation?  And as importantly, what are the required Mitigation, Avoidance, and Contingency Plans (“Risk Plans”) that come from the Risk Assessment process?

It is exactly these Risk plans that often get overlooked (especially in an Agile framework) when they are not integrated into the original planning process.  Too often, if Risk Assessments occur at all, they are done after the so-called project plan is complete, and when execution begins.  (This is actually where PMP suggests it in the scheme of things.)

I suggest that it is actually the primary function of the project manager to manage the Risk Plans (and to continue to re-assess new and changing risks).  As I stated before, generally the Implementation of the Scope tends to take care of itself, especially in an organization with a well-honed Agile development process in place.  While I love the Agile Methodology, most practitioners are overly focused on the scope, and neglect to monitor the risks, and Risk Plans.  This is where a good Project or Product Manager comes in.  Work with the team to identify the major risks, during the planning phase, define Mitigation, Avoidance, and Contingency Plans, and then stay on top of these.  (Note:  There is nothing about Agile that inherently overlooks Risk Plans.  Rather, it is just that most implementations of Agile, as do most project managers, tend to over look risk planning, in favor of scope development.  In fact, a good Agile backlog will absolutely include stories derived from the Risks Plans.)

It is obvious that I think a lot about risks.  I plan to post other blogs on the page in coming weeks and months on this topic.  But feel free to ping me anytime if you want to talk this over — it is one of my favorite subjects!