The title of this post is adapted from a comment made by the CRO of Fidelity Investments, who wrote:
“Corporate leaders recognise that over the long term, the only alternative to risk management is crisis management. And crisis management is much more expensive, time-consuming, and painful.”
Summarised from : Kloman, Felix. “A short history of risk management: 1900-2002”. Risk Management Reports, 2002
Risk management is the idea that a logical, disciplined approach to the uncertainties of the future is possible and necessary in order to live with these uncertainties productively and efficiently. Prior to the advent of risk management, faith and luck were the two pillars for managing the future. Events have causes. Believing in luck obscures the causes.
The great conflicts (e.g., World War 2), the great disasters, (e.g., Chernobyl) all affected and contributed to the development of risk management. But the most significant milestones are from personal events:
1900: The Galveston Texas flooding changes the nature of weather prediction worldwide.
1905-1912: Workers’ compensation laws introduced in the US from inception in Germany, introduces pension and shifts personal responsibility to business and government.
1920: BP forms Tanker Insurance Company, Ltd, which becomes one of the first captive insurance companies. Today there are 5000 such companies with $214 billion investable assets. (Captive insurance companies are companies formed to finance the risks of their parent companies)
1921: John Maynard Keynes publishes ‘A Treatise on Probability’ which emphasises the importance of relative perception (over numbers?) and judgment when determining probabilities.
1926: Von Neumann begins publishing papers on games strategy showing that a goal of not losing is superior to a strategy focused on winning.
1933: The US Congress passes the Glass-Steagall Act, which slowed the development of financial institutions and fragmented risk management. Also caused the split between financial and insurance risks. Revoked in 1999.
1952: Markowitz’s paper ‘Portfolio Selection’ published, which explores return and variance, which led to many of the sophisticated measures of financial risk in current use.
1956: Russell Gallagher’s paper ‘Risk Management: A New Phase of Cost Control’ published. Philadelphia becomes focal point of new ‘risk management’ thinking. Snider argues that the ‘professional insurance manager should be a risk manager’. Herbert Denenberg picks up writings of Henri Fayol, using them to explore risk management.
1962: Massey Ferguson develops the idea of ‘cost-of-risk’, comparing sums of self-funded losses, insurance premiums, loss control costs, and administration costs to revenues, assets and equity. Moves insurance risk management thinking away from insurance, but fails to cover all forms of financial and political risk. Rachel Carson’s ‘Silent Spring’ is published, leading to the formation of the EPA and Green movement.
1965: Ralph Nader’s ‘Unsafe at Any Speed’ is published which gives rise to the consumer movement. Caveat emptor changes to caveat vendor, leading to stiff product and work safety regulations. Rise of punitive damages in American courts.
1966: Insurance Institute of America issues the first examination for ‘Associate in Risk Management’
1972: Kenneth Arrow Nobel Prize winner imagines a perfect world where every uncertainty is insurable. Concludes our knowledge is always incomplete. We are best prepared for risk by accepting its potential as stimulant and penalty.
1973: Geneva Association is formed. Two years later begins linking risk management, insurance and economics. The association provides intellectual stimulus for the developing discipline. Scholes and Black publish paper on option valuation, opening up the field of derivatives.
1974: Gustav Hamilton creates a ‘risk management circle’ which graphically describes the interaction of all elements of the process, from assessment and control to financing and communications.
1975: American Society of Insurance Management changes name to Risk & Insurance Management Society (RIMS), signalling shift towards risk management and by end of the century has 3500 corporate members.
1976: Fortune magazine publishes ‘The Risk Management Revolution”, suggesting coordination of risk management functions within an organisation, and also suggesting board responsibility for organisational policy and oversight.
1980: Society for Risk Analysis formed in Washington. Its journal Risk Analysis published. Makes terms ‘risk assessment’ and ‘risk management’ well known in legislatures on both sides of Atlantic.
1983: William Ruckelshaus’s speech on ‘Science, Risk and Public Policy” brings risk management to the national political agenda.
1986: The Institute of Risk Management (IRM) begins in London. A few years later begins education program looking at all facets of risk management, issuing the designation “Fellow of the Institute of Risk Management”. US Congress passes Risk Retention Act. Risk retention groups begin.
1987: Black Monday. Vernon Grose publishes ‘Managing Risk’, one of the best ever primers on risk assessment and management.
1990: UN starts IDNDR, International Decade for Natural Disaster Reduction. Efforts end with publication of Natural Disaster Magazine, presenting a synopsis on nature of hazards and challenges for the 21st century.
1992: Cadbury Committee in UK issues report suggesting that governing boards are responsible for setting and accepting oversight for risk management policy. Successor committees in the UK (Hempel, and Turnbull) and in other countries establish a new and broader mandate for organisational risk management.
British Petroleum turns insurance world topsy-turvy with decision not to insure operations in excess of $10 million. Decision was based on academic study by Neil Doherty of the University of Pennsylvania and Clifford Smith of University of Rochester.
1995: AS/NZS 4360:1995 standard first published. First Risk Management Standard. Nick Leeson in Singapore topples Barings. Revives interest in operational risk management.
1996: Global Association of Risk Professionals start. Operating through the internet, it becomes the largest RM association in the world. Focused on financial risk.
Risk management popularised and becomes a bestseller through Peter Bernstein’s ‘Against the Gods’.
2000: Y2K bug fails to materialise, mainly because of massive fix effort. A big success for risk management.
2001: Sept 11. Collapse of Enron reinvigorates risk management.
Summary of “Facts and Fears: Understanding Perceived Risk”, a study of risk perception conducted by Slovic, Fischhoff, and Lichtenstein.
Perception of risk refers to the acceptance that there is in fact a risk. Acceptability of risk refers to how much the risk can be tolerated; to what level it should be controlled.
INVOLUNTARINESS
New research suggests that the accepted views on catastrophic loss may need to be revised. A current, popular view, based on a hypothesis forwarded by Starr (1969), says that people tend to demand stricter standards against hazards brought on by involuntary risks (involuntary risks are risks one does not take by choice). This hypothesis says that risks that are involuntary are perceived to be less tolerable.
Slovic, et. al's study did not intentionally seek to address Starr's hypothesis, but the findings provided an interesting test of it. Their new study seems to suggest that in addition to voluntariness, a host of other factors such as knowledge, controllability, etc. need to be factored into risk standards.
Their study further tends to the notion that it may not be involuntariness per se that drive the call for stricter results, but other conditions closely associated with involuntariness, such as catastrophic results. Involuntary hazards tend to include large-scale catastrophic events such as nuclear power, terrorism, bio-chemical threats.
Levels of acceptability of risk correlates positively with perceived benefits of the risk, in fact more strongly than voluntariness.
CATASTROPHIC POTENTIAL
The study suggests that it is the (perceived) potential for massive loss, rather than involuntariness, that could be the driving force to risk perception and acceptability.
CONCLUSIONS
Further conclusions. The authors conclude that the public can make gross mistakes in perceptions of risk, but then so do experts, so public opinion ought not to be excluded from risk decisions. It is much better to involve the public in risk matters for the purpose of increasing their knowledge in the longer term and also because their cooperation is needed for risk management undertakings to succeed.
...but not quite.
Web projects are Information Systems projects with a few distinguishing features. Like any project, principles of sound project management apply.
It is important to be aware of web projects' distinguishing features in order to manage them successfully. It is critically important to understand that web projects are not simply technology projects but undertakings involving people, systems, and organisations.
Reference: Managing Web Projects, Turner
As a project manager who does not produce the product being delivered, we often need to reflect. What value am I providing my client? How are they better off with me around?
It helps to be both personal and impersonal.
How does it help them to have a project manager for this project? What value does this position provide?
How does it help them that I am the project manager for this project?
According to Shoji Shiba, knowledge has several levels. The first level is simply Exposure. You've heard of Linux, you know what it is, you've had the chance to do some basic stuff with it, like listing the files on the system. It is plain that such a level of knowledge is of very little use.
The second level is Skill. At this level, one's knowledge has reached some usefulness. You know how to ride a bike, and you can use the bike to get you from A to B without much falling down. At this level, your productivity is very basic and inefficient. Workers who are at this level are not very effective. They can do the job but need much supervision to ensure their work is satisfactory.
The third level is Understanding. You have reached the level where you know what you are doing and can make effective decisions.
The fourth, and final level is Mastery. You know how to use the skill at the highest levels and the highest effectiveness that the skill is able to deliver. This is where you are most productive.
It takes time to develop Mastery. It is worth taking the time to study the best ways to shorten the knowledge cycle from Exposure to Mastery.
After the project has been broken down into analysable components, we identify the source of the risk -- why is there uncertainty? What is causing this uncertainty or variability?
By addressing the causes or sources of the variability we will be better able to respond to the causes in addition to the effects.
Suppose we have identified a risk in the completion of the functional specification documents of a software development project. What we mean is that we have identified an uncertainty in the completion of these documents. They may take more or less time than expected. What might be the causes of this risk?
The specifications may take longer because the requirements may change as the project progresses. The specifications will change in proportion to the change in requirements.
The specifications may take longer because it may be realised later that the specifications do not cover its areas on the proper depth and scope.
These are two possible causes. Notice that responses required to mitigate the uncertainty could be very different. In the first cause, we need to look further at the requirements documents from which the specifications are being developed. In the second cause, we need to look at how we can identify gaps in the specifications documents. Of course it is possible that both causes occur.
Once we have identified the possible causes of the risks, we can proceed to identifying responses to address the causes, the risk, and the risk events.
* * *
References: Simister & Turner
A risk is an area of uncertainty. This uncertainty can turn into risk events that may prove unfavourable to a project. Risk events are not always necessarily unfavourable.
Whether is will rain or not, for example, is a risk for someone planning to go on a picnic. The risk events could be that it will rain heavily, or it will rain lightly, or it will not rain. The area of uncertainty, that is, the risk, is the possibility of rain.
Managing project risks is about analysing the risks (uncertainties) that a project is facing, identifying the risk events that may come out of that risk, planning responses to these events, monitoring the chances of these events, and executing responses to the risk events.
The SCERT approach to managing risk begins with breaking down the project into manageable components. Because nothing is certain, every single task in a project has some risk (uncertainty) Much of that however, is handled in the scheduling process which (must have) used a probabilistic approach (for example a 3-point estimation in PERT).
We only look at the major uncertainties.
Break the project into components. SCERT recommends no more than 20 components for large projects, and no less than 5 components for small projects.
If the concern is for risks affecting the schedule, breakdown the components by activities. If the concern is risks affecting the cost of the project, breakdown the components by cost components, highlighting their expected costs.
Once the project has been broken down into manageable components, the process of identifying the sources of risk (again, uncertainty) can be identified.
* * *
The famous line: "what we have here is a failure to communicate" elicits chuckles. People recognise the experience these words describe. The words resonates with many people because the experience is very common.
We've all had experiences of miscommunication. You may recall colleagues who never let you finish a question -- they answer the question even before you have even gotten midway through your question. Of course the answer you receive has no relation to the question you were intending to ask.
For a project manager, miscommunication is a professional tragedy. A project manager's job is constantly about communication. He doesn't do the actual work. He organises, orchestrates, informs, and instructs. He uses communication to do these. A project where the manager instructs the team to do something, and the team comes back with something else can be heading for trouble. Miscommunication consumes time, energy, money, increases tension, and decreases motivation in the workplace.
Dowling & Sayles says that for communication that instructs to be effective, it must meet a few criteria.
First, the message itself must be understood. Understanding is hard, it is easier to misunderstand. To understand something is to get exactly what is meant. To misunderstand is to get something wrong, even a very little something.
One of the problems is words. Words are never very precise. Someone said that words are cups that people fill with the meaning they want. Think of the words you often use in your projects: maximise, prioritise, quality, improve. Do they mean the same thing to everyone? These could all be understood in different ways. When you come across communication that uses words that come loaded with meaning, make sure to explain in more detail what you mean by the word.
Managers should practice getting feedback about what they are communicating. How do you know that what you said is what was heard? One way to get feedback is to ask the other party to restate what you just said. This works for some people. You can ask your staff to repeat what you said. You can also practice it yourself, repeating what other people say to you, to help them ensure that you understood them correctly. It is not as easy to ask your superiors or clients or some people to repeat back what you said.
Another way to check if they understood you is to ask questions about what you said, trying to get a hint of what they think you meant.
Once your communication has been understood you have crossed one barrier. There are two more to cross.
The next question is, yes they understood what you said, but did they believe you?
Depending on which management writer was asked, the visitors from space would be directed to different people. These writers seem to have different definitions of leadership and thus leaders. Some simplify it to 'leadership is about dong the right things, while management is about doing things right."
Leadership is about doing the right things. Not really,
Leadership is about having a vision. Not really, everyone has visions and dreams.
Leadership is about a charismatic and powerful personality. Not really, there are charismatic and powerful personalities who are not leaders (almost every movie celebrity)
Leadership is a process, influencing others to perform something. Like selling or marketing or mugging?
Leadership is about authority and power. There are many people in positions of authority who cannot command.
My current view is that leadership is about having followers. Without any followers, you are not a leader. That is all it is. To take the lead means to be the leader. Without followers there is not lead to take.