February 27, 2019 at 11:01Fire management as part of the leader’s work
This article is about risk management, not the hard work of a firefighter, as the name might suggest. Nevertheless, this image seems close to me when I talk about risk management, because the consequences of improper control can be, at times, no less dramatic.
Now, during information over-availability, if you wish, you can find hundreds of articles on this topic, however, in the management sphere there are still people who turn a blind eye to obvious things and continue to waste time, money and their own forces. This article is my attempt to convey the “what and how” in a clear language.
How often do you have situations that you are doing some kind of capacious task, have devoted a lot of time to it, and then, as you approach the finish, do you feel growing insecurity? For example, prepare a site for the customer. Implement a new, unproven solution. Or migrate from two data centers to a third. And more and more often phrases come to mind: “with a shield or on a shield”, “pan or disappeared”, “was not”. When the moment of truth comes, say “it has passed” and feel relieved. Or, on the contrary, you beat your table with annoyance with your fist, accompanying this action with words that are completely optional here.
It happens? Each time this serves as an indicator that you have insufficient control over the result of your work. Somewhere they waved a hand, somewhere they did not pay attention, and somewhere they hoped for a Russian chance. However, a problem can arise no matter how much you believe in your luck.
Each one has a small wise gibberish in his head, who painstakingly writes down all your mistakes and omissions, and the closer the deadline is, the more facts accumulate in his black notebook. And you look at how this little book is getting fat, and anxiety begins to grow steadily.
The fact is that, in fact, starting any work, you are ALREADY at the epicenter of a “fire”. True, you still do not know about it. Let's try to figure out what can be done with this.
There is a good parable about the elephant and blind sages. It tells about how several sages decided to feel the elephant and each studied only the part of the animal accessible to him. One said that the elephant looks like a snake, holding it by the trunk. The other held his leg and insisted that he looked like a tree. The third held by the tail and so on. In the end, the sages could not agree and understand what kind of beast such is - an elephant.
An interesting fact is that each of them is right in his own way, he just saw the situation only on his part, refusing to accept information from his colleague. If they added up their observations, they would most likely be able to compile complete information. Now imagine that one sighted person joined the team of blind sages, who saw everything as it is and told them what was really happening. I believe that in this case no one would have thought of calling this situation a parable and drawing a lesson from it.
So it is in risk management. Different people when looking at the same situation may have a completely different point of view, but it will help to see more details and make a better decision.
Gather people in a team, pick up people with different life experiences. The real "sighted" in the team may not be, but collective "vision" will help with a greater probability to determine what kind of elephant is in front of you and how to feed it.
We will talk a little further about the same tools that can be used to properly manage risks.
In practice, I most often have to use a registry and a risk map.
Risk register
The registry is an ordinary tablet, in which there can be from three to four columns to several tens - depending on what degree of elaboration of risks is necessary. For example, you can maintain it in Excel, create a page on a SharePoint portal in your organization, or even take advantage of Project Server features, if any. In practice, any form is suitable - if only this tool really worked and was used.
A small example (cut from a real and already closed project) below:
For convenience, you can also add columns indicating the date of identification of those responsible for the work, add a comment and risk response strategy (accept, avoid, etc.), type of risk (threat / possibility), category, possible cost of influence, and many others attributes that you want to control.
In project management, a risk register needs to be created from the very beginning. By the way, even in the business case, which is used for a high-level presentation of the project with a description of the expected benefits of the project, key risks already known at this stage should also be indicated.
Example risks at the planning stage
Once the start of the project has been agreed, the planning phase begins. Here, a good project manager starts the most intensive work: you need to assemble a project team, identify a list of activities, correctly determine the connections between them (first draw, then typeset), determine how to manage the project, prepare a work schedule.
At this stage, a significant number of project management artifacts can be created, during the preparation of which many risks are identified and, as you want, closed. Examples of such artifacts can be a work schedule, plans (or strategies) for managing risk, communications, quality, a list of project requirements, resource requirements, a description of a project product, and so on.
Let's look at an example of what risks can be identified on the basis of only one time limit. Suppose we have a one-month time limit for the entire project. Arranged activities, tied together, determined who should do what and everything seems to converge.
Nevertheless, it is also worth making sure that the project team members do not have, for example, leave at this time. Because suddenly someone already six months ago bought a ticket to a beach resort and even for an impressive premium does not agree to reschedule his vacation.
And well, if this is your own team - you can find out in advance, agree, provide for a replacement, in the end. And if the risk trigger point is on the customer side? It often happens that the customer feels much less responsibility and, having fallen over with more priority cases, will postpone acceptance several times in a row in the last week. As a result, the project will not be completed on time.
Thus, at least two risks can be highlighted and taken into further work:
Risk 1
Formulation. The risk that the project team members will be on vacation during the implementation of the project. This may affect the timing of the project.
Influence.Due to the fact that the deadline is one month, and leave is usually taken for at least two weeks, any leave of a key participant will have a serious impact on the time frame. I would put a high impact for a start.
Probability. If there is no input, then use at least the subjective opinion of “off season”, for example. And put down a suitable level. Here I would note the probability as low.
Status. We have not done anything yet, we have only identified the risk, so we put “New”.
A comment. Here's a log of risk work. We write "check with the project team members" or "request information from the personnel department."
All, as soon as we have requested information and are waiting for an answer, we change the status to “At Work” and we are waiting for information from colleagues.
Risk 2
Wording. The risk that acceptance will be delayed due to the absence or employment of a customer representative. This may affect the timing of the project.
Influence. If we delay the deadline, then this is certainly bad. However, the delay will be clearly on the initiative of the customer, and we can expect that penalties will not be applied in connection with the delay. I would designate no higher than "Medium" to begin with.
Probability. It is worth considering additional factors, it seems to me. The interest of the customer, the conditions of his work. To begin with, I would designate the “Low” probability of this risk, since the customer turned to us, therefore, he has a need. We can expect some involvement and participation in the project.
Status.New, we just determined it.
A comment. Agree with the customer, of course. Highlight at the initial stage that we look forward to participating in the acceptance on such dates. Obtain consent and, with a clear conscience, continue to work on the rest of the project.
There are more risks, actually. A specialist can get sick, quit. Penalties for late payments may be imposed, and the customer will not go on weakening the deadlines, as it is more profitable for him to delay the time. The supplier may not cope with the delivery time of the equipment, or the equipment may be defective or not at all what was ordered.
It is necessary to provide for all important options, and to work out a strategy for responding to each of them.
Risk map
Sometimes it happens that the risk register is not enough. The number of identified threats has long exceeded several tens or hundreds, and there is sorely not enough time to control everything.
In order to help make the right decision, you can use the risk map - a visual display of all registry entries in the form of a diagram. Thus, by glancing at the picture, we can quickly identify those points that really deserve attention.
Below is an example chart from another project (done in Excel). Impact is located on the abscissa axis , the further to the right, the stronger the influence on the project. On the ordinate axis - the probability (Probability) of the event. R1 ... Rn - these are the risk numbers from the registry, we use it as a signature.
The background is tricolor - green, yellow, red and tuned so that it is clear in which cases we should pay particular attention to specific risks. As we can see, in the current chart, risks R9 and R13 are in the danger zone, so next time these two risks will be given increased attention and control.
I usually build the chart in a separate tab in the same file where I have the risk register.
The first three columns are links to another tab so that the values are automatically substituted. Columns D and E define digital risk values so that the chart is built correctly. In columns G and H, as you can see, I have an intermediate, technical correspondence table so that VLOOKUP (in the Russian version - VLOOKUP) can correctly substitute values.
In the cells D4 and E4, I removed the formula, since the risk has been worked out and closed, it makes no sense to display it on the chart.
Just in case, I am attaching a screenshot of my chart background settings to understand how to make such a gradient fill.
And with this option, I add shortcuts to the points in the diagram. They can be superimposed when the values coincide, so I move it in different directions manually already.
Having built a chart once, you can continue to update it in a couple of minutes and use it for weekly reporting on project status, for example.
Secret fire extinguisher
I consider communication to be the key component that helps ensure safety.
During meetings or calls with project participants, with the customer and other interested parties, I try to draw and focus on factors and events that may affect the project - positive or negative.
Often a person, having expressed some thought out loud, believes that everyone already understands what else to talk about. However, it is possible that others did not even pay attention to his comment, and the phrase does not have the necessary effect. To ensure that valuable comments are not wasted - listen and analyze what you hear.
Let me give you a small example.
Setting up the equipment, until the task is completed one day on a schedule, I once again contact the engineer in the hope of hearing that everything is finished.
I agree with the engineer that I will return to him for news in two to three hours, and if he still does not find a solution, then I fix the risk and analyze the work schedule to determine the margin of time.
Similar moments can arise in any dialogue. Therefore, take notes, stop the conversation, clarify and, if necessary, enter in the registry for further work.
Perhaps it is just such a small comment that will reveal a whole layer of problems that are only waiting for you, having not prepared enough, to begin implementation.
You can schedule separate time for meetings to discuss risks. You can arrange meetings devoted to this issue entirely. You can think for yourself, but, nevertheless, it is better with someone. The discussion of risks is perhaps the only topic that can be part of each of your meetings and at the same time be useful.
By the way, even the ability to manage risks at the level of PMI-RMP (Risk Management Professional) will not be able to protect you 100%.
Anyway, situations will sometimes happen that are simply impossible to control. There will be problems that could have been prevented, but this has not been done, since no one simply foresaw them. And there will also be problems that were envisioned, planned an answer, but everything went completely wrong as planned.
It’s important to understand that risk management is a skill. It too can and should be developed. The theoretical part can be learned from project management standards (for example: PMBOK, PRINCE2) or by taking specialized courses. The practical part, you should do it yourself, every day.
Learn lessons, learn from your own and others' mistakes. And then the number of "fires" will be steadily reduced, and a successful result will become much more achievable. Good luck
Now, during information over-availability, if you wish, you can find hundreds of articles on this topic, however, in the management sphere there are still people who turn a blind eye to obvious things and continue to waste time, money and their own forces. This article is my attempt to convey the “what and how” in a clear language.
Invisible fire
Suddenly flared up forest fire gave orienteering competitions unique dynamics and entertainment.First, introduce myself. Alexey Trishin, project manager at one great IT company. The holder of certificates PMP, PRINCE2, ITIL and several others. Working with risks is one of the key points of my work.
How often do you have situations that you are doing some kind of capacious task, have devoted a lot of time to it, and then, as you approach the finish, do you feel growing insecurity? For example, prepare a site for the customer. Implement a new, unproven solution. Or migrate from two data centers to a third. And more and more often phrases come to mind: “with a shield or on a shield”, “pan or disappeared”, “was not”. When the moment of truth comes, say “it has passed” and feel relieved. Or, on the contrary, you beat your table with annoyance with your fist, accompanying this action with words that are completely optional here.
It happens? Each time this serves as an indicator that you have insufficient control over the result of your work. Somewhere they waved a hand, somewhere they did not pay attention, and somewhere they hoped for a Russian chance. However, a problem can arise no matter how much you believe in your luck.
Each one has a small wise gibberish in his head, who painstakingly writes down all your mistakes and omissions, and the closer the deadline is, the more facts accumulate in his black notebook. And you look at how this little book is getting fat, and anxiety begins to grow steadily.
The fact is that, in fact, starting any work, you are ALREADY at the epicenter of a “fire”. True, you still do not know about it. Let's try to figure out what can be done with this.
Fire brigade
At the Olympics, the team of our alchemists received gold!In fact, it is worth understanding that one person cannot be an expert in everything - that is why they work on projects as a team, and it is much more difficult to achieve a good result alone. Each person has a worldview, a certain life experience and a set of beliefs, through the prism of which he looks at the world. Everyone evaluates the situation from their point of view, which allows you to make a more complete picture and make the right decision.
There is a good parable about the elephant and blind sages. It tells about how several sages decided to feel the elephant and each studied only the part of the animal accessible to him. One said that the elephant looks like a snake, holding it by the trunk. The other held his leg and insisted that he looked like a tree. The third held by the tail and so on. In the end, the sages could not agree and understand what kind of beast such is - an elephant.
An interesting fact is that each of them is right in his own way, he just saw the situation only on his part, refusing to accept information from his colleague. If they added up their observations, they would most likely be able to compile complete information. Now imagine that one sighted person joined the team of blind sages, who saw everything as it is and told them what was really happening. I believe that in this case no one would have thought of calling this situation a parable and drawing a lesson from it.
So it is in risk management. Different people when looking at the same situation may have a completely different point of view, but it will help to see more details and make a better decision.
Gather people in a team, pick up people with different life experiences. The real "sighted" in the team may not be, but collective "vision" will help with a greater probability to determine what kind of elephant is in front of you and how to feed it.
We will talk a little further about the same tools that can be used to properly manage risks.
Crowbar, spade and ax
“Who are we to withstand the forces of nature ?!” Just a speck of dust on the outskirts of the universe.In classic project management, it all starts with a risk management plan / strategy. It is there that it is indicated how risk management will take place in the project. Also, specific methodologies and tools, roles of participants, risk categories and other details that help formalize the risk management approach can be mentioned there. This is a very useful document that can answer many questions during the project, however, it can take a lot of time to prepare it, especially if you have not paid enough attention to this issue before.
- ..., Petrovich! Take a shovel and remove snow!
In practice, I most often have to use a registry and a risk map.
Risk register
The registry is an ordinary tablet, in which there can be from three to four columns to several tens - depending on what degree of elaboration of risks is necessary. For example, you can maintain it in Excel, create a page on a SharePoint portal in your organization, or even take advantage of Project Server features, if any. In practice, any form is suitable - if only this tool really worked and was used.
A small example (cut from a real and already closed project) below:
For convenience, you can also add columns indicating the date of identification of those responsible for the work, add a comment and risk response strategy (accept, avoid, etc.), type of risk (threat / possibility), category, possible cost of influence, and many others attributes that you want to control.
In project management, a risk register needs to be created from the very beginning. By the way, even in the business case, which is used for a high-level presentation of the project with a description of the expected benefits of the project, key risks already known at this stage should also be indicated.
Example risks at the planning stage
Once the start of the project has been agreed, the planning phase begins. Here, a good project manager starts the most intensive work: you need to assemble a project team, identify a list of activities, correctly determine the connections between them (first draw, then typeset), determine how to manage the project, prepare a work schedule.
At this stage, a significant number of project management artifacts can be created, during the preparation of which many risks are identified and, as you want, closed. Examples of such artifacts can be a work schedule, plans (or strategies) for managing risk, communications, quality, a list of project requirements, resource requirements, a description of a project product, and so on.
Let's look at an example of what risks can be identified on the basis of only one time limit. Suppose we have a one-month time limit for the entire project. Arranged activities, tied together, determined who should do what and everything seems to converge.
Nevertheless, it is also worth making sure that the project team members do not have, for example, leave at this time. Because suddenly someone already six months ago bought a ticket to a beach resort and even for an impressive premium does not agree to reschedule his vacation.
And well, if this is your own team - you can find out in advance, agree, provide for a replacement, in the end. And if the risk trigger point is on the customer side? It often happens that the customer feels much less responsibility and, having fallen over with more priority cases, will postpone acceptance several times in a row in the last week. As a result, the project will not be completed on time.
Thus, at least two risks can be highlighted and taken into further work:
Risk 1
Formulation. The risk that the project team members will be on vacation during the implementation of the project. This may affect the timing of the project.
Influence.Due to the fact that the deadline is one month, and leave is usually taken for at least two weeks, any leave of a key participant will have a serious impact on the time frame. I would put a high impact for a start.
Probability. If there is no input, then use at least the subjective opinion of “off season”, for example. And put down a suitable level. Here I would note the probability as low.
Status. We have not done anything yet, we have only identified the risk, so we put “New”.
A comment. Here's a log of risk work. We write "check with the project team members" or "request information from the personnel department."
All, as soon as we have requested information and are waiting for an answer, we change the status to “At Work” and we are waiting for information from colleagues.
Risk 2
Wording. The risk that acceptance will be delayed due to the absence or employment of a customer representative. This may affect the timing of the project.
Influence. If we delay the deadline, then this is certainly bad. However, the delay will be clearly on the initiative of the customer, and we can expect that penalties will not be applied in connection with the delay. I would designate no higher than "Medium" to begin with.
Probability. It is worth considering additional factors, it seems to me. The interest of the customer, the conditions of his work. To begin with, I would designate the “Low” probability of this risk, since the customer turned to us, therefore, he has a need. We can expect some involvement and participation in the project.
Status.New, we just determined it.
A comment. Agree with the customer, of course. Highlight at the initial stage that we look forward to participating in the acceptance on such dates. Obtain consent and, with a clear conscience, continue to work on the rest of the project.
There are more risks, actually. A specialist can get sick, quit. Penalties for late payments may be imposed, and the customer will not go on weakening the deadlines, as it is more profitable for him to delay the time. The supplier may not cope with the delivery time of the equipment, or the equipment may be defective or not at all what was ordered.
It is necessary to provide for all important options, and to work out a strategy for responding to each of them.
Risk map
Sometimes it happens that the risk register is not enough. The number of identified threats has long exceeded several tens or hundreds, and there is sorely not enough time to control everything.
In order to help make the right decision, you can use the risk map - a visual display of all registry entries in the form of a diagram. Thus, by glancing at the picture, we can quickly identify those points that really deserve attention.
Below is an example chart from another project (done in Excel). Impact is located on the abscissa axis , the further to the right, the stronger the influence on the project. On the ordinate axis - the probability (Probability) of the event. R1 ... Rn - these are the risk numbers from the registry, we use it as a signature.
The background is tricolor - green, yellow, red and tuned so that it is clear in which cases we should pay particular attention to specific risks. As we can see, in the current chart, risks R9 and R13 are in the danger zone, so next time these two risks will be given increased attention and control.
I usually build the chart in a separate tab in the same file where I have the risk register.
The first three columns are links to another tab so that the values are automatically substituted. Columns D and E define digital risk values so that the chart is built correctly. In columns G and H, as you can see, I have an intermediate, technical correspondence table so that VLOOKUP (in the Russian version - VLOOKUP) can correctly substitute values.
In the cells D4 and E4, I removed the formula, since the risk has been worked out and closed, it makes no sense to display it on the chart.
Just in case, I am attaching a screenshot of my chart background settings to understand how to make such a gradient fill.
And with this option, I add shortcuts to the points in the diagram. They can be superimposed when the values coincide, so I move it in different directions manually already.
Having built a chart once, you can continue to update it in a couple of minutes and use it for weekly reporting on project status, for example.
Secret fire extinguisher
I consider communication to be the key component that helps ensure safety.
During meetings or calls with project participants, with the customer and other interested parties, I try to draw and focus on factors and events that may affect the project - positive or negative.
Often a person, having expressed some thought out loud, believes that everyone already understands what else to talk about. However, it is possible that others did not even pay attention to his comment, and the phrase does not have the necessary effect. To ensure that valuable comments are not wasted - listen and analyze what you hear.
Let me give you a small example.
Setting up the equipment, until the task is completed one day on a schedule, I once again contact the engineer in the hope of hearing that everything is finished.
- Hello, Kostya, how are you doing with the tuning?Somewhere here in my thoughts a red light starts to light up - I need to start the task with an understanding of how the work will be carried out. For an engineer in this case, some of the settings is incomprehensible - this means that additional research is required, but it can be delayed. I clarify.
- Hi. Fine. Almost done. True, there was one moment left with the setting, which is still not entirely clear how to do it.
- And what kind of setting? Complicated something?Everything, a stoplight. An engineer will spend two or three hours searching for a solution, it is likely that he will not find a solution, and we will be forced to contact the manufacturer. And such treatment can easily drag on for several days.
- Yes there ... * a stream of technical details, which, unfortunately, I do not understand *
- It is clear (no). What do you plan on doing with this?
- Do not know yet. I ’ll look on the Internet what they write on this matter ... The
light bulb is already burning more strongly
... probably it will be necessary to contact the manufacturer and ask them.
I agree with the engineer that I will return to him for news in two to three hours, and if he still does not find a solution, then I fix the risk and analyze the work schedule to determine the margin of time.
Similar moments can arise in any dialogue. Therefore, take notes, stop the conversation, clarify and, if necessary, enter in the registry for further work.
Perhaps it is just such a small comment that will reveal a whole layer of problems that are only waiting for you, having not prepared enough, to begin implementation.
You can schedule separate time for meetings to discuss risks. You can arrange meetings devoted to this issue entirely. You can think for yourself, but, nevertheless, it is better with someone. The discussion of risks is perhaps the only topic that can be part of each of your meetings and at the same time be useful.
Total
By the way, even the ability to manage risks at the level of PMI-RMP (Risk Management Professional) will not be able to protect you 100%.
Anyway, situations will sometimes happen that are simply impossible to control. There will be problems that could have been prevented, but this has not been done, since no one simply foresaw them. And there will also be problems that were envisioned, planned an answer, but everything went completely wrong as planned.
It’s important to understand that risk management is a skill. It too can and should be developed. The theoretical part can be learned from project management standards (for example: PMBOK, PRINCE2) or by taking specialized courses. The practical part, you should do it yourself, every day.
Learn lessons, learn from your own and others' mistakes. And then the number of "fires" will be steadily reduced, and a successful result will become much more achievable. Good luck