3.0 BASIC REQUIREMENTS FOR
EFFECTIVE RISK MANAGEMENT
As previously mentioned, the International Space Station
Program was only implementing a risk management system
on paper. Actual use by program management of risk
management processes was minimal and intermittent.
However after many internal and external management
audits of the program, program management gave the
approval to implement a more comprehensive integrated
system and began to use and stress the elements of risk
management to all levels of program personnel – this was a key milestone for risk management within the program
office. The first and foremost requirement to ensure
successful implementation of risk management is the need
for management “buy-in” and their communication and
insistence to the program. As program personnel directly
and indirectly observed program leadership stressing and
using risk management and when they begin sensing
evidence of a cultural change within their organization,
improvements to risk management will finally take root.
The ISS program team began to see first hand the benefits –
both as a reporting mechanism and a structured technique
for managing their own risks.
As management demonstrates a commitment for risk
management, the risk manager should develop a
comprehensive Risk Management Plan for the
program/project. It should contain common definitions (risk, success criteria, acceptable risk, …), the qualitative
measures used to score, rank and prioritize risks, the
detailed implementation plan on how risk management
elements will be institutionalized within the program
management structure, and finally how risk management
interfaces with other elements of program control, systems
engineering and safety, reliability/maintainability and
quality assurance functions.The basic elements of the plan should describe a continuous
process for identification, assessment, mitigation planning,
tracking and control. The process should be proactive, there
should be defined and utilized methods for ferreting out
new risks from all aspects and corners of the program.
Once identified there should be a formalized approach to
begin the evaluation and integration process. Integrating
risks also assists the decision maker in understanding how a
risk’s decision can affect other risks (better understand the
cross-coupling effects and the entire risk landscape of the
program).
It is important in the implementation of risk management
that the processes are integrated using existing control
mechanism (embed in existing board process and becomes
part of the existing management infrastructure). This will
limit the “cost of” risk management to the program andensures that emphasis and commitment by program
personnel remains. As such, risk management should be
part of everyone’s job description. There should not be a
separate set of risk practitioners that are responsible for
identifying and mitigating risks. The risk office should be
fairly small, with only the responsibility to help develop the
processes, assist in facilitation and integration of risk, and
finally monitor and control the effectiveness of theprocesses. Part of the measure of effectiveness is whether
there is an efficient flow of risk data from the individual
that identifies the risk to the appropriate decision maker.
Ideally, risks should be managed at the lowest appropriate
level with issues being elevated to higher levels of
management. Therefore, risks should be elevated only, if
additional resources are required to mitigate, if integration
with other organizations will be necessary or if general
visibility by the next level is needed including the need for
programmatic risk decisions. By elevating risks to higher
levels of management, cross-functional and cross-program
implications of risk decision-making can be better handled.
The risk system should capture every program team
member’s concerns and have a formalized method for
evaluation and disposition. Rationale for closure should be
documented for those risks that are deemed unfounded.
More mature risk processes should include multiple paths
for reporting issues from project personnel to avoid
premature closure. There also should be a mechanism to
document dissenting opinions based on the coarse of action
seletced.