Suppose that you are having surgery; there is a risk that you’ll have trouble with anesthesia. It is possible that you could develop a clot, infection, or post-op pneumonia. Your surgeon has to prepare for these risks. But what if you should suffer a stroke during surgery (which is relatively rare)? Or your liver function is impaired (which is also uncommon)? Your doctor also has to be aware of these risks and have a plan to combat them in the operating room. Your organization needs to be an expertly trained surgeon, identifying both obvious and the less obvious risks and developing strategies to deal with them.

The problem is that, often, businesses see only the very obvious risks, such as technology. It’s easy to blame technology! Does it work? Is anything new going to be able to be part of the existing infrastructure? Can we integrate it? Yes, those are all important points to consider, but you cannot stop there.

What about people risks, for instance?

• Do we have enough business subject matter experts?
• Can we take people away from day-to-day operations to include them in the project?
• Do we have sufficient room in the budget to implement the change and train people in the new processes or programs?
• Are we prepared for change management strategies?
• Do we have the subject matter expertise and buy-in that we need?
• Have our people completed a project of this magnitude (dollar size, complexity and timelines) before?

Another problem that we see is that companies do perform very comprehensive risk analyses but they do so with a tick box mentality. Risk #1: check, risk #2: check. We put risks on a list without really prioritizing them, considering how they would impact our business or how we can mitigate them.

With my last client, the team had worked on a project for eight months. When a project is longer-term like this, there is a big risk that people will get sick, tired, and just plain burned out. There is a risk to their health and to morale that needs assessed in the initial risk analysis. You can’t just say: “Our people may get tired or sick. Ok, good to know. Next risk?” You have to talk about the implications of each risk and how you can work to mitigate or accept it.

With this client, who bumped up against this risk, we looked at things like: are we going to allow the team members to take vacations? How? When? Can we do rolling vacations? Can we set the project back a few months rather than keeping the pressure on? What are the consequences of each course of action, and are we prepared for that? Luckily, management with this company was very understanding and progressive in that they recognized the value of vacation! They decided that it was worth it to take a hit so their people could take some time off.

Whether risk identification and action plan assessment is shallow and obvious or done in a tick box method, the results will be very much the same: a project that is in danger.