I was recently asked to design and facilitate a workshop about technology project risk management for an insurance company. When we started to discuss the desired outcome of the workshop it became apparent that what my client really wanted to know about was how to manage an unforeseen crisis.
This wasn’t the first time that a client of mine had merged the concept of a crisis into the concept of risk, so it led me to write this article.
Consider the following circular definition of risk:
A risk is a problem that has yet to occur, and a problem is a risk that has already materialized.
Before it happens, a risk is just an abstraction. It’s something that may affect your project, but it also may not. There is a possibility that ignoring it will not come back to bite your ass.
As a logical consequence risk management is then the process of thinking out corrective actions before a problem occurs, while it’s still an abstraction. Or as Timothy Lister words it; “Risk management is project management for adults”.
The opposite of risk management is crisis management—in other words, trying to figure out what to do about a problem after it happens.
So a crisis is the result of one or more events that have already happened. It is usually something that is unforeseen, public in nature, and has the potential to cause great harm to a project and an organization in terms of finances, revenues, reputation, market positioning, and service delivery.
Here are some examples of project crises I have personally experienced:
> The sudden departure of the only person that could explain how that ancient legacy system works.
> The main supplier going suddenly bust because of a lost litigation case.
> The main supplier being bought by our biggest competitor.
> Discovering that your supplier oversold big time; the key system functionality that drives your business case does not exist, and will never exist.
> Your whole external consultant team being poached by another competitor.
> Performance problems shortly after going live, so bad that complete teams were walking out of the building because they could not access their documents anymore.
The manner in which a project team, an organization, its executive team, and its board responds to and handles a project crisis will often determine the overall impact the crisis has.
Being on the front foot with a crisis management plan and scenario planning, acknowledging what has happened (and expressing authentic empathy towards people who have been affected), accepting responsibility, offering assurances and following through quickly will ensure the best possible outcome.
Conversely, being slow off the mark, deflecting responsibility and doing little else is likely to exacerbate the situation and lead to greater negative consequences.
Managed well, a crisis situation shows the organization that the project is resilient and well run.
Effective risk management and crisis management starts with the project manager. Regular updates of your RAID lists that analyze these critical risks, their monitoring and responses provide the steering committee with strategic information regarding the key drivers of the project.
The steering committee’s role in monitoring these risks is not to ensure they don’t occur, but to help you with seeing the bigger picture, because the project manager does not have all the information.
One of my upcoming articles will be about what project managers can learn from crisis management.