May 2, 2020
In this APM Project Management Qualification (BoK7) podcast, Paul and John discuss risk and issue management. This podcasts aims to address the following APM PMQ assessment criteria;
- Explain each stage in a risk management process (such as identification, analysis response, and closure)
- Explain proactive and reactive responses to risk (such as avoid, reduce, transfer or accept and exploit, enhance, share and reject)
- Explain the benefits of risk management
- Explain the key aspects of issue management
This podcast is just part of the parallel learning system for the APM Project Management Qualification. This approach includes a wide range of learning resources including a printed study guide, on-line e-learning, a tutor lead study group and a wide range of project management courses
Below is a transcript of this podcast:
Introduction
Welcome to a parallel project training APM project management qualification podcast based on the APM body of knowledge seventh edition. You should be using this in conjunction with our elearning podcasts, and potentially a tutor led course. For more information, please visit www.parallelprojecttraining.com
Paul
Hello, welcome to another Parallel Project Training podcast with John Bolton. Hello, John. Hello and Paul Naybour. Oh, we're doing the PMQ and we're doing risk and issue management today. Deep joy. So we've got quite a big section here. Quite a lot of assessment criteria.
John
This was the longest podcast in the box. So this lasts 47 minutes
Paul
So explain the stage in the risk management process such as identify analyse, plan, response and closure, explain proactive responses to avoid reduced transfer and accept exploiting enhance, share and reject, explain the benefits of exposure and explain the key aspects of issue management and contingency. So as we start with this definition, a risk event is
John
well, yeah, a risk event is an uncertain event or set of circumstances that should occur or they occur would have an effect on the achievement of one or more of the project's objectives. That's the prime guide definition. Okay. There is a slightly different glossary definition. Okay, what's the glossary? Say it doesn't talk about risk events as much it talks about just it says something more generic. The risk is the potential of an action or event to impact on the achievement of objectives,
Paul
potential action or event. Yeah. Okay. So they're all events that might have an impact on achievement.
John
Yeah, I mean, I think people talk about the word event as if it's meaningful, I think it's just just a noun,
Paul
or an adjective, whatever it is, to the key thing that can be opposite. They can be opportunities or threats, right. So you're looking at both, which confuses some people sometimes because generically, we talk about risks being bad things, but we don't tend to write down on opportunities are very rarely academic,
John
which is, but then, you know, interest rates could go up as well as down. I have a blog about that fuel prices forgot as well as down. They want to talk about that or not really. Okay. No, I mean, well, we need to mention it, because it could be part of, but it's not ostensibly part of the syllabus. Yeah. You know, they don't talk about risks. Positive risks in here are explicitly Yeah, although they do talk about the responses as being exploiting heartshare or reject, which in the pram guide on opportunity on so we talk about those as well.
Paul
So risks can have causes background facts, it make them happen. So that's called change or political uncertainty, economic uncertainty, or technology or something. And that cause introduces an uncertain event, which has an impact on time, cost and quality usually, or achievement of the overall objectives for the period.
John
So I mean, how is our problem with going down the cause? root, you know, so you can they might rain tomorrow? Because of global warming? That's a fact. Yeah. But I mean, it could cause a global warming is more likely Pratt was the rain. Warning. Yes, exactly. So what's the cause? So close to this, because I've got diesel,
Paul
diesel, and go back and back and back back, but you just try to identify a manageable root cause? So Ben, well, it's
John
a specificity of, isn't it? It's, it might rain, tomorrow's facts, but it might rain when we've got the roof off the building. Yes, that's a risk.
Paul
Yes.
John
So that's something tangible I could do something about the corner. It's only any use to you if there's actually it's meaningful due to the fact we're working outside in February, a rain
Paul
tomorrow,
John
we might have bad weather while we've got the roof of the building. It's while we've got the roof of the building. That's the key bit. Yes. So we haven't got enough resources. That's fact you know, most people haven't. Yes, yeah. So we haven't we haven't we know, we know. We're short of people. Therefore, there's a risk that I won't have my expert on the for a week in June to review my document of risk, and that's the risk.
Paul
And so that means your project might be delayed. That's why Guess what? A good the benefits of risk management. Well, it's demonstrates professionalism, you got sound process in place, means you can calculate the contingencies properly. You know what you're doing about those risks? And it builds a culture that actually lets you take risk,
John
where things go wrong, they're stone they because you're proactively doing something about it. Yes, but but also So it has the has the effect of labelling people to do things. It's an enabling thing rather than a restrictive thing.
Paul
Yes. So risk isn't necessarily bad.
John
No, because where there's where there's muck, there's brass.
Yeah, exactly where there's opportunity risk you get no
better. Exactly, exactly. So, you know, the only way you avoid all risk is sort of lying in bed in the morning. Wait to die. Yeah. sighs you have to avoid the risk, you avoid the
Paul
risk. Yeah. So the process we're going to follow is slightly simplified, identify what those risks are, assess the significance of race plan, what you do by the wrist and close might actually find most people are understand this now. Mostly, they've done it for health and safety perspective.
John
Yeah. And
Paul
we're, we did talk about health and safety earlier. Here, the difference is that we're looking at the impact of time, cost and quality, rather life and accident. So we're going to identify what those risks are, assess them plan what to do about them, and close out the risks.
John
I think it's a shame that they've sort of diluted the health and safety aspects of this a bit because yes, in my experience, a lot of our customers Health and Safety, Health is very important. So I don't want anyone to run away with the idea that we're dismissing that
Paul
now it's mandated requirement,
John
we are talking about project risk here, not kind of such as life and limb.
Paul
Yeah. And so the difference is, this is discretionary. You don't have to understand what your commercial risks are. If you don't, you'll just lose money and grow our business but you do the Law Society says you need to manage your health and safety risks. It's a mandatory thing everybody has to do. So, working through that process, the first terminators identify understand what those risks are. And we've listed out some techniques brainstorming SWOT assumption analysis, interviews, prompt lists, checklists, are slip swatting, they're by mistake. And we're going to talk through each of these are quite obvious, really well,
John
they are I mean, I think people know what a brainstorming session a capture assumption, I suppose the the assumptions analysis might be a bit trickier. My Way think, and assumptions are risks, really? Because I'm assuming I've got five bricklayers, therefore there's a risk. I haven't. Yeah, that's fine. I'm assuming the customer is going to do that for therefore there's a risk they don't.
Paul
Yes. So assumption that you have any uncertainty about
John
sales guys never using let the bid managers put risks in the proposals. Why? Well, because they used to say, well, the customer might think is risky, they want to buy it. But you know, so as descriptions in AD square that circle, so what assumptions in here you have assumptions, pages and pages of assumptions. But basically, I mean, but sometimes you have to make assumptions as we move forward, Tony? Yeah. So you know, I'm assuming that, you know, with the, you know, the server's gonna be delivered on the right day or something, but, you know, essentially, we used to convert that into
Paul
assuming when the server rise, it will run software that we've written.
John
You know, I used to, yeah, so assumptions, we used to turn them into risks, just tell everybody go through them and put them under risk. Because that way they do get managed. Yeah. brainstorm interviews is like a one to one, isn't it? Probably just a good promise, the pestle, you know, do a pestle analysis a good list? Yeah. And then a checklist is a more definitive version of a problem list is where specific actions are identified. So you see, those were things like display screen assessments in the health and safety space. But also, you know, you see him on procurement has the has the has the supplier potential supplier got a clear, you know, credit history, or they got a record of ccjs have they got this okay? So you go and take and if they take all of those then you're at you're sort of happy doesn't mean they're any good, but you've gone through the checklist.
Paul
So from there, we build our risk log or risk register.
John
Yeah, usually got, you know, like a normal Excel spreadsheet type thing. Identification description. In fact, everybody I know uses Excel.
Paul
Do ya? Some people have databases? Yeah,
John
this was big columns and other big database system.
Paul
So then we've got this long list of risks. The next step is which are key risks and most people are happy with this probability impact grid now we look at how likely the risk is impacts gonna be and
John
very common. high probability high impact risk there's one of these on the news the other night was was was watching one of those Brexit things and also face Laura, what's her name? Coons Berg had a risk recipe I wasn't gonna I can't remember it was exactly but yeah, they one of these. So where were the main risks? So they were they were appearing on this
Paul
site, a set of generic sort of templates for infographics. And it had all these in it. Like you have become a member David Wilson invented this thing with a different waiting Yeah, it was this idea that thing get to know that old Yeah.
John
So the pig the pigs all right is a sort of visual training aid. It's a bit rubbish when it actually use one.
Paul
Well, you just code it into a lookup table on your Excel spreadsheet. Yeah.
John
But you just it becomes illegible after about half a dozen on there.
Paul
No, no, sorry, it calculates the colour. So you can build it into Excel so that when you put the high medium low, it will calculate whether it's red, Amber green. Oh,
John
I know. Yeah. But I mean, all you're doing is just yeah. Yeah, but I mean, this actual grid. Yeah. As good as training. And if you've got a workshop with a bunch of people getting to put risks on posters and stick them on the wall, usually is a column and is really yeah, they you normally have a long tabular thing that you can saw.
Paul
Yeah. So next step is take your most significant risks and come up with responses. That's right. Most people will just talk about mitigation here. So we have to just talk a little bit about that, because mitigation is a simplification of the APM
John
view of the world. Well, mitigation is like a collective noun. Yeah, for all of these things, right. So to mitigate a risk, you can accept it, avoid it, transfer or reduce it. That's right. So mitigation is not a valid thing to be talking about.
Paul
Yeah. So for exam mode, we need to talk about accepting the risk is basically saying, Well, I know what that risk is, I'm just gonna live with it. Yeah, I've done I've done all the reasonable stuff that I can to minimise that risk. So eventually, I think you do you end up accepting everything? Yes.
John
I think a lot of us could accept because by definition,
Paul
yeah. And business.
John
Well, the point is, once you've accepted something, you have to provide a contingency.
Paul
Because because they happen rarely see, that's why
John
irrespective of how remote it might be, or unlikely it might be due
Paul
to what happened. And that's where insurance and PII insurance and all that sort of avoid, avoid my favourite actually changed the scope. So that that risk can no longer happen.
John
We're used to stuff called traco ethylene traco. trike,
Paul
oh trike. Yeah. For cleaning.
John
Yeah, yeah, it gives off equipment and mustard gas when you warm it up.
Use a dip. Copper don't use that anymore
while they stop using it because it was a bit dodgy. And so they kind of avoided any risk of it was quite a global that was that was. Yeah, that's pretty nice. Yeah, that was. And so what they did, they introduced a different degreaser. Yeah. Which of course wasn't quite as good. Yeah. So they've already won risk. But they introduced another one. Yeah, that's an example of a secondary risk. Yeah. But avoiding is where you just change what you're doing change the scope, or change the process or
Paul
Yeah, transfer, give the rest of somebody else who's better able to manage your risk looking at somebody else's? Yeah, usually through insurance, an example of transfer or contracting.
John
I don't know. I think transfer is really hard. Because you transfer you don't insurance only transfers, the impact doesn't matter. The
Paul
probability, you only transfer you can only transfer the impact, he cannot transfer the likelihood, if the risk still happens, is transferred to a subcontractor. But the vistal you transfer I think, like if you transfer the risk to a subcontractor if something goes wrong, it's still you're still your fault. So you just replace a kind of digital delivery delay risk with a reputational risk. Yeah, it works if you give it to someone who's better able to manage it than you.
John
Yeah. But it's still like,
Paul
yeah, it's still like, they might have more skill and competence to manage that risk. They might though. Yeah.
John
So that's why that's, that's why you subcontract? Yes. Because there's a risk we can't do it. Therefore get someone that can.
Paul
Yeah, he's done it before. He's got like last Friday's Yeah. Reduce is the closest to what people mean by mitigate. So he takes some action to reduce the likelihood of doing a survey or pilot study or feasibility study. Or you reduce the impacts more tickets reduce the impact. To reduce, you know, it's gonna rain. So wear a coat. Put us put a cover up or something.
John
Yeah, yeah. So if you got to take the roof off the building in February, you're going to offer time? Yes. So reduce him post likelihood. No impact.
Paul
Yes. The impact, correct. Sorry, I was wrong.
John
Then you got opportunities. And these are in to some degree there. The other? Yeah, the adverse, are they so reject his way? So Trevor, we don't bother with it. Yeah. Quite why we need to write that down is beyond me. But anyway, enhance where you you actually try and enhance the probability or the impact
Paul
separately to reduce
John
by doing something? Yeah. So you actually take action to enhance it? Yeah. exploited is where we don't don't do any action. We just take the take the opportunity to take it when it comes. Okay. So there's no cost involved in in house. Yes, they just had to happens or it doesn't same. exploit,
Paul
exploit.
Okay, exploit is different from enhance.
So that's the same as Except to them what exploit?
John
exploit is the same? Well, hold on, let's start again. accept, accept and reject. They go together. Yeah. Yeah. So accept and reject. They're those. If I enhance and reduce, they're the same. Yeah, share, and transfer, they're the same. So avoid an exploit.
Paul
Okay? So we don't avoid it. We just say, Oh, that's a good rest. Let's just go for it.
John
I don't think they're opposites. Yeah, we've had this conversation before, avoid is where you do something differently to stop it happening. exploit is where you do exactly the same as what you were going to do. And wait for it to happen. Yeah. So they're not always opposites. But three of them are, but yeah, so in, you know, in a, in a practical sense, if, if I'm building a new station, and I decide there's an opportunity to put up, pop up coffee shop on it, and get some rent from it, then I might, might exploit that, and just rent it out and cost me nothing. On the other hand, if that space needed some water, or some power, or drainage or whatever, then I might have to do some more grant more enabling works to make it happen. So I'm doing the same thing, except now I'm doing some work to make it happen, rather than just letting it happen naturally. Good.
Paul
So next step is to response. So actually making this happens a lot, I think. So you caught your plan, you put it in this register, and they goes, Oh, that's a really good recipe. Let's put that in the bottom drawer and forget about it. Yeah. So response means actually going out and buying that insurance policy or subcontracting this workhorse, right.
John
That's the thing that's the mistake people make is they think that doing that is contingency, but it isn't buying PCs part of your budget, isn't it? Yeah, actually spend money. So it's golden is doing a prototype, if I decide if I decide I'm going to put some drainage in for that pop up shop. Yeah, all of a sudden, it said work back into my car, and I'm gonna spend it actually
Paul
committed to doing it. That's right. So it's
John
no longer kind of is no longer optional. And enclosure
Paul
is about keeping all the records up to date as in.
John
Yeah, well, it's just about tied in keeping it keeping your shipshape, really. But if the project the project could the risk unnaturally close? So if, if you've got, if you've had the roof of the building and put it back again, then although there's no risk is that yeah, it's like most construction jobs, all the risks are happen before you get to damp proof course. Okay, because it's all about ground condition winds, it's all about, you know, sort of in a lost civilization or, you know, not having a proper, you know, kind of soil, sort of constituency. So, some risks can naturally just drop off. Yes. Others, you get to the end of a project, and you might find if you've identified others, so, if you've built a new build a new building, you realise there's a risk that the flooding, you might need to tell somebody. Yeah, this used to be called closed it? No, it's called monitor monitor.
Paul
Yeah. So I think what they're trying to get out here is when when a phase is like you're saying, when a phase is finished, you can close out the risks associated with that phase. Yeah. And realise the savings. Of course,
John
the point about a close risk is that if there was any contingency associated with it, it gets relinquished. Yes. That's why closures quite important. Yes.
Paul
Yes. So let's talk about contingency. We mentioned it a few times, like so what's your definition of a contingency? Same as yours?
John
I think I hope go on. Well, you when you do probability impact grades, you work out what the probability is. Yes. And the impact? Yes. And that allows you to come up with a figure. Yes. And that figure in pounds is what your contingency is. So the consequence of that is, if it's not on the risk log, there's no contingency for it. Yes, that doesn't mean something could still go wrong, just because it's not in your log. But I've got a I've got a risk that I've identified, I've worked out what my contingency budget is. Alongside that I need a contingency plan. So I need to know what's going to happen if that risk occurs, no matter how unlikely it might be. So that's why it essentially every every risk on a risk log eventually is accepted. Yes. Because, but but you can't just accept it. Accept that
Paul
you have to have some money in the bank, and you have to know what you're going to do. Because it might be really important to you contingency plan is all your team might win the lottery. That's right. So what's your contingency plan if they do?
John
retire,
Paul
or recruit consultants, so you might have to put some agency staff to backfill, that's your contingency plan. So you work that out in advance? Yeah. Well, how much money would you need to set aside for that much plan? Well, the chances of your team winning the lottery blooding? Low Yeah, so not so much. So you write about we need to take counts both the cost of the contingency action, but also the likelihood of slack contingency actually
John
happening, and it's the way insurance works. That's why car insurance things. People say all the insurance was really cheap. Well, that's probably because they consider it to be a really low risk. What's the chance of me getting well
Paul
continued kidnapped in another class if you continuously plan to Lewis cabins?
John
Yeah, that's right. It's like insurance. You'd never don't need it till you need it. No. But that's contingency. So the the obvious question is, well, what do you do about the risks that you haven't identified? That just okay, just pop up in front of known unknown, although actually they're not risk their issues. So what happens to the issues that occur that you never predicted? Yes, the unknown unknowns, and that's called manage reserve.
Paul
Yes. Okay.
John
I, neither neither the contingency or the management reserve are held by the project manager. I
Paul
don't know. That's different from different organisations. Yeah. organisations give the country a little bit of pm some a little bit.
John
Sometime. Yeah, I have problem with giving the project manager the contingencies, they tend to spend it. They'll spend it on things other than things supply chain. Yeah, the dangers continues to get. So the good practice, go all the suppose a recommendation that the ideal solution, I suppose, is where the sponsor holds the contingency, and gives it to the project manager on the on the risk event occurring. Yeah. But that's a bit overly bureaucratic and limiting for the project manager on the contractual relation here might be bigger. I mean, certainly, if you're a supplier, that might be the case. I know, big con, some big contracts have relied on that. When they were they've said to the supplier don't build any contingency. And if it goes wrong, we'll give you them. We'll give you the money.
Paul
Yeah.
John
But by the way, if it's not on your log, you pay for it.
Paul
Yes. So I'm gonna have a logbook, we had that once, guess how many risks we had in the log gone. 500 500. Just to make sure that everything was on the log, yeah, we spent six weeks creating a generic log of risk is always different. It's always interesting that you put pressure on one point because you think that's going to solve the problem. And you create a disincentive to do something else.
John
I went to do a health check on a project up in London once for the government department to remain nameless, and the project managers out I've got 417 or something risks. And I said, I said I don't think I'm managing the
Paul
contract. They said yes, I say whatever. Why don't blame me for not telling them. Yeah, that's that's not the best plan. Really, that's not the best. Yeah, the best reason for doing it. That's the problem. I will not talk about problems of risk. But that's the problems I've seen the risk is when you build it into a contract, it changes the behaviour. Yeah, does people behave in a commercial way rather than because the project deliver cover their backside? That's what they do. So definition of issues, an issue is something that has a problem that's now or in the near future, that's going to breach our tolerances. tolerances, it's going to exceed our expected budget. Yeah. agreed with the
John
tolerances, your wiggle room, needs to be
Paul
in require support from the sponsor to resolve. So they're no longer than certain. Yeah, almost certainly going to happen. Yeah. But they're not insignificant, they're not. So it says the project manager is responsible for the day to day management of the project. This is not day to day issues. This is stuff that's beyond the data, why
John
the way the syllabus is read, or the way the book implies it is these are the things that they can't deal with. Yes. So it's like something's gone wrong. Our family best but actually to melt, some new legislation comes in. That's right. Or whether or not whether or not I've added on the risk or not is irrelevant. because it'd be sorted out. I've never seen this coming. Yeah.
Paul
You know, if you're a project manager, you're going to keep tabs on all the parliamentary legislation, it's going to be introduced by the government tomorrow. In our like, it's not, it's not your job,
John
like, so. issues, really, I mean, and that's why in here, they talk about issue escalation. So I think the key point here for me is issues. Risk Management is prospective. Yes. So it forces you to think about the future and what might go wrong. issue management is here now it's reanimated? Yes. So the project managers got to be quite tuned into what's going on. Yeah. Because you got to spot these things early enough to be able to do something about them and, and actually deal with them straight away. And and that's why the relationship between the project manager in the sponsor is quite important because sometimes issues bubble up, you know, like, I was doing a job and the contractor went out of business. You know, we turned up on a Monday morning, everything was locked up. padlocked up there's a security guard, Stan. Yeah, yeah. You know, you haven't got time to mess about you've got to get a meeting done quickly sorted. You know? So I suppose there's a low tolerance for a lot of documentation around a lot of issues. It usually happens afterwards. But, you know, issue management's usually done through minutes of meetings or, you know, emergency meetings or
Paul
Yeah, I've actually best place to track issues is on the progress report. Yeah, cuz they're the things you actually want to talk to a sponsor. That's right, your progress. That's why I like raid logs.
John
Yeah, you know, risks, assumptions, issues and decisions. Not so right about the decision bit, but keeping them all in the same place. The good thing about risk logs is risk, because risks are not yet happened. There's a probability associated, that probability is always less than 100%. Okay, issues 100%. Yes. So there's that. Yeah, actually, when you look at a risk log and look at an issue log, they're very similar. You can lock people up to saying the same, but the only difference is issues. 100% probability, yeah.
Paul
Little code that says this issue is
John
yes. Because now an issue. And then you've got you've got traceability that as well. Yeah. Yeah. But anyway, that's a bit sort of
Paul
cool. So we talked about contingency, we did benefits of issue management and escalation, our fitness true benefit is that it enables the sponsor to take the decisions of sponsor should be taking, and the project managers take decisions the project manager should be taking. So it's, it means that you can ask for the support or the sponsor to resolve issues that are beyond your remit. And if I think back in my career, I wish I had known about this when I was a junior PM, because I used to carry everything on my back. I, you know, I felt responsible for the whole pie. And I didn't realise that actually, if someone has said to me, Paul, you need an issue management process that you can escalate issues up the chain, they're beyond your remit. I think I'd been more successful and I've had a better career. Not I was unsuccessful. But I just think it's a really useful mechanism.
John
Well, the trouble is, you see, if you sort of take it on yourself, everyone will just get used to taking as far as they won't away didn't tell me. Yeah. And then you got to get yourself to blame everything. I
Paul
call it monkey management.
Key management's a monkey shoulder.
Yeah. And everybody just wants to dump the monkey on you. Yeah. So you just take everybody's monkeys. And
John
by the same token, no, no, senior persons kind of thank you for waiting outside their door every morning or like, Oh, well, that's why today, you
Paul
know, another thing has gone, you know, it's not day to day. So that's why I like this definition of issues or things that are significant. You can't
John
know. So that's why the boundary is quite important. Because, you know, if you are incompetent, you'll have more issues when you Yes, and that become that's what gets thrown up into stark relief. Yeah, quite quickly. Yeah. Because you're always staying outside to go I've got another problem Mirko deal with it. Yeah.
Paul
That's why I think stick them on your monthly report. That's the place to sit down and talk about the issues, you know, less their companies going out of business or something. Good. And we talked about contingency planning. Excellent. Thank you, john.
John
Good
We hope you enjoyed this podcast and found it informative. To find out about our training courses elearning or tutor led course please go to www.parallelprojecttraining.com