Lessons Learned Building a

Risk Management Process

In a Teaming Environment

Lessons Learned Building a

Risk Management Process

In a Teaming Environment

James ToddF/A-22 Team Risk Manager

James ToddF/A-22 Team Risk Manager

Purpose Purpose

This briefing is not meant as a primer for basic risk management principles.

This briefing focuses upon key elements and processes necessary to build an effective risk management system within a team environment.

This briefing does not include all activities that the risk management team may be required to employ, but rather seeks to discuss a few key lessons-learned in building an effective risk management process among a number of team partners.

ContentsContents

• Lesson: Assess Your Environment• Lesson: Challenge Your Assumptions• Lesson: Pillars of Effectiveness• Lesson: If You Can’t Map It, You Don’t Know It• Lesson: Murphy’s Law – Plan for It• Lesson: Commit to Continuous Training • Lesson: Build Upon Your Strengths • Lesson: It’s About Culture, Not Technology • Lesson: Increased Communications Will Minimize Problems • Lesson: Ensure Clear Communication At All Levels• Lesson: Stabilize a Process Before You Improve It • Lesson: Permanent Change Requires Commitment at All Levels • Lesson: Value-Added Risk Roles • Lesson: Touch RM Data Once • Lesson: Essentials of an Effective SW Risk Tool• Lesson: If You Don’t Control Your Processes, Someone

Else Will• Lesson: No Substitute for a Good Risk Process• Lesson: What Will Your RM Process Be When It Grows Up?

Lesson: Assess Your EnvironmentLesson: Assess Your Environment

• Establish a Baseline Understanding– People– Processes– Policies– Infrastructure– Environment

• Key questions– Who are my customers?– Do we have the support of the program leadership?– What is the maturity level of participants in the risk process?– Has the risk management process been mapped?

• Is it understood at all levels within the program?

– What level and type of training is needed/reasonable?– What labor hours and funding are necessary to effect desired change in

the risk process?– Is the risk process accurately documented?– What is the current level of information infrastructure?– Where are the weak points in our communication capabilities?– Is the intent of the risk process to proactively “search and mitigate” or as

a reporting activity?– Does the current environment empower people?– Does the leadership view RM as a high priority?

• People

• Process

• Technology

• People

• Process

• Technology

Lesson: Challenge Your AssumptionsLesson: Challenge Your Assumptions

• Assumptions are necessary• Assumptions define work• Assumptions can limit solutions• Assumptions are not always visible

• People

• Process

• Technology

• People

• Process

• Technology

People Process Technology

Risk Management

System

Think out of the box

Lesson: Pillars of EffectivenessLesson: Pillars of Effectiveness

• People

• Process

• Technology

• People

• Process

• Technology

PPEEOOPPLLEE

PPRROOCCEESSSS

TTEECCHH

Risk Management SystemRisk Management System

An Effective Team Risk Management System Optimizes Three Key ElementsAn Effective Team Risk Management System Optimizes Three Key Elements

Lesson: Pillars of Effectiveness (cont.)Lesson: Pillars of Effectiveness (cont.)

• Complexity

• Understanding

• Commonality

• Synergy

• Complexity

• Understanding

• Commonality

• Synergy

Org 1Org 1

Org 2Org 2

Org 3Org 3

TeamTeam

It takes a team to build a team process

Lesson: If You Can’t Map It, You Don’t Know ItLesson: If You Can’t Map It, You Don’t Know It

• Steps– Map the RM process, as-is– Identify waste and inefficiencies – Rebuild the RM process, minus the waste

• Recommendation– Never build a team RM process map, alone

• Gather a team, composed of team partners and customer representatives

– Once improved, ensure that the new process is communicated & understood by management

– Ensure that the new process is documented in the appropriate policies and directives

– Benefits to this approach• Fosters teambuilding

• Promotes ownership across the team

• Increases understanding in the process

• Map the Process

• Identify Waste

• Remove Waste

• Re-Map It

• Map the Process

• Identify Waste

• Remove Waste

• Re-Map It

Lesson: Murphy’s Law – Plan for ItLesson: Murphy’s Law – Plan for It

• Identify weak points in the risk process • Predict what elements are likely to fail • Develop strategies to counter failures • Typical RM weak points

– Communication flow• Up, down & in the middle

– Ill-defined risk process• No feedback loops

• Too complicated

– Understanding the risk process at all levels– Changing directions, mid-stream– Ill-defined training– Poor documentation– Poor coordination of effort– Poor application of software tools

Lesson: Commit to Continuous TrainingLesson: Commit to Continuous Training

• Design RM training around the maturity

level of your personnel

– Motivation

– Working knowledge & skill

• Effective training requires an investment

– Dollars

– Labor hours

• Plan for it

• Budget for it

• Document it

• Get management commitment, upfront

Lesson: Commit to Continuous Training (cont.)Lesson: Commit to Continuous Training (cont.)

• Types of Training

– One-to-one

• By phone

• By email

• Netmeeting

• In-person

– One-to-many

• By phone

• By email

• Netmeeting

• In-person

– Prepared modules

• Tutorials (e.g. PowerPoint briefings)

Match Modes of

Training With the

Individual’s

Motivation &

Skill Level

Lesson: Build Upon Your StrengthsLesson: Build Upon Your Strengths

• Each team partner has something to

contribute to a “team” risk management

solution

• Pull the best from each organization

• Empower each team partner to help

develop & maintain a team risk process

• Through empowerment, each team partner

gains a sense of ownership in the team

risk management process

N.I.HN.I.H

Lesson: Build Upon Your Strengths (cont.)Lesson: Build Upon Your Strengths (cont.)

• It takes teamwork to build a team solution

• Avoid the pitfalls of NIH practices

• Learn to empower RM people

• Empower other team partners

• Realize that every individual has a unique

contribution to make to the RM process (it

is your job to find it and use it)

When You’re Green,

You Grow…

…When You’re Ripe,

You’re Rotten

When You’re Green,

You Grow…

…When You’re Ripe,

You’re Rotten

Lesson: It’s About Culture, Not Technology Lesson: It’s About Culture, Not Technology

• In a struggle between Culture vs. Technology… Culture Usually Wins

• When you strip away the computers and the information technology, organizations are mostly about people following a commonly understood process

• Permanent change occurs when people change. The law of inertial

• Change is often slower than planned• Even positive change is stressful• Stay the course• Keep reselling the risk process• Keep training your personnel• Technology is not a panacea for RM

Lesson: Increased Communications Will Minimize Problems

Lesson: Increased Communications Will Minimize Problems

• Even in the most technical areas of

business, the biggest mistakes are often

the result of a breakdown in the

communications process

• Ensure that your risk process identifies the

communication flow and links

• Email is not the best form of

communication (but it’s necessary)

• An effective communication system can

make your risk process forgiving

Lesson: Ensure Clear Communication At All Levels, Among All Partners

Lesson: Ensure Clear Communication At All Levels, Among All Partners

• Effective communication relies upon trust

– Keep your word

– Do what you say

– Keep others accountable

• Don’t alienate

• Recognize others - Share the credit

• Praise in public, criticize in private

• Be consistent with your plans & meetings

• Be responsive

• Don’t be afraid to ask questions

Lesson: Stabilize a Process Before You Improve ItLesson: Stabilize a Process Before You Improve It

• Develop a team plan for improvement

• Execute it – track It

• Stay focused

• Avoid distractions

• Continue selling

• Continue training

• Avoid making improvements until the risk

process has stabilized

Lesson: Permanent Change Requires Commitment at All Levels

Lesson: Permanent Change Requires Commitment at All Levels

• Without sufficient understanding & support within the program, failure is all but guaranteed– Top-level– Mid-Level– Lower-Level

• Complete an accurate assessment of current process shortcomings

• Promote agreement that change is necessary

• Implement a joint risk management team to plot a better course

• Integrate risk management process into key, recurring program meetings

• Continue to train your people• Keep personnel abreast of RM progress

Lesson: Value-Added Risk RolesLesson: Value-Added Risk Roles

• IPT risk integrator– Ensures that each new risk item is coordinated

& reviewed among all lower-tier IPTs

– Ensures that each new risk item is coordinated

among other team partners

• Joint Risk Team– Responsible for mapping risk process

– Initiate improvements & implementations

– Address team concerns

– Composed of team members and customer

• IPT Risk Integrator

• Joint Risk Team

Lesson: Touch RM Data OnceLesson: Touch RM Data Once

• Use processes & tools that minimize the

frequency that data is either transferred or

copied

• Minimizes opportunities for errors

• Reduces manpower to maintain risk

management system

• Heightens timeliness of data

• Increase accuracy

DBDB

Site 1Site 1Site 2Site 2

Site 3Site 3Site 4Site 4

Essentials of an Effective SW Risk ToolEssentials of an Effective SW Risk Tool

• Capture associated information in one record• Builds risk handling plans, automatically• Builds action plans, with risk burn-down metric• Applies probabilities of cost and occurrence• Builds basis of estimate• Allows supporting data files to be attached• Generates traditional risk assessment matrix for probability

of occurrence vs. severity of impact– Technical– Cost– Schedule– Support

• Capability to identify and assess items associated with major risk groupings

• Operate risk tool in shared environment– Check the speed of your network

• Flexibility to adjust to the unique requirements of a specific program

Lesson: No Substitute for a Good Risk ProcessLesson: No Substitute for a Good Risk Process

• Software risk management tools are great…

…but no substitute for a well-developed risk

management process

• Beware of buzz words

• A well-developed, well-understood risk

management process is the best predictor of

success

Lesson: Decide What Your RM Process Will Be When It Grows Up

Lesson: Decide What Your RM Process Will Be When It Grows Up

• Clarify the purpose of your risk process

– Two approaches

• To become a reporting activity that identifies &

absorbs risk, or…

• To become a proactive tool to avoid or mitigate

risk

• Ensure that your process supports the

intent of your risk management system

– Ensure that the recurring RM metrics support

the purpose of your risk system

Lessons Learned Building a

Risk Management Process

In a Teaming Environment

Lessons Learned Building a

Risk Management Process

In a Teaming Environment

James ToddF/A-22 Team Risk Manager

James ToddF/A-22 Team Risk Manager