Risk management short course

1Copyright 2017 John Goodpasture All Rights Reserved

A very short course in risk management

What could go wrong?

Produced by

Square Peg Consulting, LLCwww.sqpegconsulting.com

So, what’s a risk?


An event, outcome, activity, or circumstance

about which there is some uncertainty

Always two parameters


What could happen, to wit:

Impact

How likely for “it” to happen, to wit:

Confidence*

* Anti-confidence: if “it” doesn’t happen, then “anything” else might,

with 100% - %confidence

Narrow the scope


Scope (uncertainty):

Nearly everything

You have to choose what to manage:

What you can’t afford

1% Doctrine


No matter how unlikely,

if you can’t afford it,

you have to do something about it

It’s not about tossing dice


Games of chance have rules

Rules govern impact and confidence

Management can’t change the rules

A fair die is always fair*

* Fairness: only in the long run; in the short run, the house

often wins. Losers paid for the Las Vegas strip

Rules for project uncertainty


There are no rules

Uncertainty has no rules

Management can intervene

The client is independent

There are no fair die

Stuff happens!

Risk management


Intervention to affect outcomes

Ignore it It might go away; unmanaged; affordable

Insure it It might happen; unaffordable *

Transfer it Give the problem to someone else

Go around it Advance in a different direction

Change

somethingRetool, retrain, resource, reorganize

Destroy it ** Unaffordable; go on the offense

* Only to you; insurance companies make money on “expected

value”, the risk-weighted loss

** See: 1% doctrine and pre-emptive methods

Risk attitude


More optimistic, top down

More fact-based outlook

Risk is the balancing quality

Client PM

Time changes everything

More time: more optimism

There’s time to fix it

What you don’t know ….

The future has no facts, so

estimate success

Panic in the last mile

Failure is not an option

It’s too tightly coupled


Risk

Risk

Risk

Tight Coupling

Dependencies*

Risk propagation

* See: merge bias at dependent

outcome

Let’s get loose


Risk

Risk

Risk

Tight Coupling

Dependencies*

Risk propagation


outcome

Loose coupling

Buffers and white space

Boundaries and fences

Interfaces and handoffs

Encapsulation

Let’s get loose


Risk

Risk

Risk

Tight Coupling

Dependencies*

Risk propagation


outcome

Loose coupling

Buffers and white space

Absorb the shock

Boundaries and fences

Resist propagation

Interfaces and handoffs

Enforce standards at the

interface

Encapsulation

White box, black box

Top down; bottoms up


White box, black box

White box: I understand the internal details of construction

White box: bottoms up understanding

Black box: I only understand the external characteristics at the

point of delivery (Done)

Black box: top down understanding

The Principle of Encapsulation


Me

You

White space

Boundaries

Cloud

Standard interface

Encapsulate to contain risk

within boundaries

• “Hide the sausage making”

• Make a “white” box

“black”

• “Boxes” connect at the point of

delivery

• Loose coupling of the

“white” box details and

risks

Yikes! Black Swan


Black swan risks

Beyond imagination

It should never happen

Couldn’t see it coming

Consequential impact

Black Swan: Made famous by financial technician Nassim Taleb

Yikes! Black Swan


Black swan risks

Beyond imagination Myopic

It should never happen Off the chart

Couldn’t see it coming Low on the horizon

Consequential impact “Life” threatening

Anti-fragile

If you don’t (or can’t) manage Black Swan risks, what do you

manage?

• System (or personal) fragility

• Ability to absorb shock without catastrophic failure


Anti-fragile: Another conception of Nassim Taleb

Black swan shock absorbers

Anti-fragile Shock absorber

Loose couplingIf one thing blows up, the damage doesn’t

propagate *

RedundancyIndependent, but similar, overlaps and

duplications **

Bend, but don’t break Partial products, “bent and scratch” quality


* Fuses, breakable links

** Backup copies; multiple or distributed sites

Biases = risks

• Everyone has biases

– Which may present behavior and decision risks in some situations

• Even robots have biases

– They’re programmed by us

– They inherit our moral logic and sense of utility*

– Autonomous vehicle: do I save you or the other guy?


• Utility: the gap between value and cost

High utility: value and cost are aligned

Biases that matter to PM

This stuff matters

Anchor bias

A position everyone is afraid to move too far from----

especially if the anchor is set by an expert or

dominate person (supervisor or superior)

Proximity biasReach for the thing that’s closest – typically, inside

the box

Loss aversionYou can’t stand to lose something you have;

fear of change; fear of the unaffordability of the future

Relative utility

$5 matters more to someone who’s hungry and

broke;

aka: Prospect Theory

The value of a prospect is relative to a starting

point. If you’re already rich, a little more doesn’t

matter


Biases that matter to PM

This stuff matters

Number numbness One is a disaster; 1000 is not much more

Optimism bias The future is rosy; there’s always time to fix it

Confirmation bias Readily accept that which confirms your idea

Framing effectConclusions depend on presentation and not the

objectivity of the content


Learning points

Learning Point take away Commentary

Two parameters for riskImpact and confidence; confidence implies

there’s also “something else”

Uncertainty has no rulesThere are no fair die; You can manage it, but

it’s always there unless you “destroy it”

Time changes risk attitude The future is rosy; the present, less so

Get loose! Keep risk contained; don’t let it spread

Black swans Even when you’re surprised, be anti-fragile

Biases = risksBiases have many disparate effects;

maintain awareness


Thought challenge

Biases are a source of risk, but when you say “risk” people ordinarily

think of undesirable outcomes

Thought challenge: In your business, which are the more

problematic: biases or event and circumstance risks?


Technology

Risk management short course