BMT: 6 Key Lessons in Risk Management from the Coronavirus outbreak

by BMT

The Coronavirus outbreak has had a profound and tragic impact across the globe, impacting millions of lives and causing huge economic disruption. As we all work to ensure we are more resilient for the future, the outbreak will shape risk management in a way that few other events have. Whilst its full impact is still unknown, there are already lessons to be learned for project practitioners. In April, a Sunday Times investigation reported numerous actions, or lack of, which precipitated the outbreak. This provides a suitable case study for managing existential risks, as well as 6 key lessons we can learn:

1. Action, as well as identify
2. Have faith in plans
3. Address the long and short term
4. Follow through on lessons learned
5. Be imaginative
6. Recognise your limitations

1. Action, as well as identify
The investigation noted how “a possible pandemic had long been listed as the number one threat to the nation for many years”[1], but when the reality of one loomed, the required mitigations were unclear. This will be familiar to those who have taken part in workshops to identify risks, only for them to be catalogued and neglected. A risk log needs to be a living document which reflects changes as they happen. It needs to be solution focused. Identification, without mitigation, is of little use to anyone. Much emphasis is often placed on ensuring that language around risks is accessible and meaningful, but it is even more important that the actions to mitigate risks are coherent, comprehensible, and actionable. The more precise the better. ‘What could we do?’ is the wrong question; ‘What will we do? Who will do it? When will they do it? How will they do it? What will they do if this does not work? What will it achieve? Is it enough in terms of cost vs benefit? Is it enough in terms of reduction of risk?’ are the right questions.

2. Have faith in plans
The Sunday Times article quotes one source as saying “almost every plan we had was not activated in February.”[2] This reflects another common problem in project management: if sponsors and key stakeholders do not have sufficient confidence in the process or outputs from risk management, they will likely undermine pre-existing strategies when risks become issues. The subsequent risks of deviating from pre-existing plans are confusion and unintended consequences. Articulating and agreeing a risk management strategy in the foundational stage of an enterprise is vital for underpinning confidence and ensuring organisational commitment once mitigations need to be triggered. Once in delivery, risk management plans need to be frequently and robustly tested to ensure they are relevant and will not be circumnavigated by reactive or inactive responses when an actual crisis emerges.

3. Address the long and short term
The investigation reports how much of the focus from Government risk planners was on preventing a no deal Brexit in early 2020. Hindsight provides a perceptive lens few had in January. It does, however, reflect on a common challenge with managing risk – balancing immediate risks with longer term ones. The short-term risks may instigate a sense of urgency, but the longer-term often seem distant to the point of being negligible. This is problematic because ‘distant’ risks can all too suddenly become immediate, and often have a much greater impact. As Michael Lewis describes in his book, The Fifth Risk, ‘bombs with very long fuses’ may take longer to detonate, but the explosion can be just as large when they do.[3] From a project controls perspective, presenting these risks to stakeholders who are primarily focused on daily fire-fighting can be challenging. Visualising timelines and impacts of risks are useful assets for encouraging stakeholders to think more conceptually about long term risk management.

4. Follow through on lessons learned
In 2016 the Government ran a rehearsal for a pandemic, which reportedly led to many recommendations. However, according to the Sunday Times investigation, these were not widely implemented. Again, a project practitioner may well be familiar with this situation. Positive steps to unearth potential problems like pilots, user testing and peer reviews are a constructive part of a project’s risk strategy; they will, however, only be fruitful when run as part of an end-to-end risk strategy which has an inbuilt feedback loop, and can rectify the problems it identifies. Where organisations have effective frameworks for embedding organisational learning, they will find a considerably more holistic approach to learning from experience.

5. Be imaginative
Risk management is often derided as a dull endeavour, reserved for the cautious and the unadventurous. For large organisations, the Sunday Times investigation demonstrates the need for imaginative and bold thinking when it comes to risk. Breaking a preventative optimism bias, or an “it can’t possibly be that bad” mindset, needs to penetrate the top of organisations. This kind of thinking will be required across all industries, as planners turn their gaze to the next risk on the horizon.

Speaking in The Fifth Risk, Former Associate Deputy Secretary of the Department for Energy in the US states:
“Managing risks is an act of imagination. And the human imagination is a poor tool for judging risk. People are really good at responding to the crisis that just happened, as they naturally imagine that whatever just happened is most likely to happen again. They are less good at imagining a crisis before it happens – taking action to prevent it.”[4]

Put more succinctly, as former US Defense Secretary Donald Rumsfeld famously stated, it is “the unknown-unknowns: the things we don’t know we don’t know” that can pose the greatest existential risk. With the plurality of threats that will unravel throughout the 21st century, this kind of conceptual thinking will become vital for large organisations.

6. Recognise your limitations
There are, however, clear limitations for the kinds of activity smaller enterprises can undertake. Many organisations will rightly be reflecting on what they could have done differently. In many cases though, planning for an event which seemed so unlikely might not have been the highest priority, in the same way that planning for a nuclear disaster now might seem unnecessary. Projects with limited budgets and scopes can only plan for so much.

So how do projects mitigate risks on an existential scale, if they have limited time and powers? Firstly, in-built flexibility to P3M designs will help provide resilience. Portfolios, Programmes and Projects which can accelerate/decelerate, scale up/down, shift resources or pause activity as needed, will be more adaptable and responsive in terms of unknown challenges. We are already seeing numerous organisations moving to a more agile way of working (both capital-A Agile methodology, and taking inspiration from lower-case agile principles) with strong results. In-built agile responses to risk will provide an enhanced suppleness to dealing with challenges in a ‘VUCA’ environment.[5] Secondly, a systems-thinking approach allows a more interconnected way to manage risk; it is increasingly prevalent in project management, and this ability to see patterns of change, rather than static snapshots, is going to be fundamental for smaller enterprises managing existential risks[6].

The Coronavirus outbreak has highlighted the importance of good risk management; not just the need for robust pre-existing strategies and mechanisms, but for innovative approaches going forward. Whilst a risk-free world is an impossibility, and arguably undesirable, there are numerous steps businesses can take in order to adapt to challenges and reap the rewards of good risk management strategy. Indeed, at the time of writing, the threat of Covid-19 appears to be abating; nonetheless, the threat of future waves of a pandemic is considerable. It is the organisations proactively analysing, renewing and renovating their risk management strategies now who will build the kind of resilience required to sustain the next existential risk, whenever, and whatever, that may be.

BMT provides independent technical expertise and consultancy. We help businesses with complex programme delivery, working with them as they evolve through the lifecycle of change. From Organisational Design and providing Change Management, to Portfolio, Programme & Project Management and Control, Decision Support and Assurance – we work with customers to set the right strategy and direction. Our risk management specialists have specific expertise in: Delivering risk planning services to projects, programmes and portfolios and providing transformational strategic risk advisory services.

Our consultants are qualified and experienced in helping enterprises of all sizes to optimise their risk strategies to appropriately mitigate, or capitalise on risks and/or opportunities. If you would like to learn more about BMT, or our services, please contact enquiries@bmtglobal.com.

Notes

[1] Sunday Times, 19 April 2020, p.7
[2] Sunday Times, 19 April 2020, p.7
[3] Michael Lewis, 2018. ‘The Fifth Risk’. Penguin Books, p.75
[4] Michael Lewis, 2018. ‘The Fifth Risk’. Penguin Books, p.67
[5] A term coined by the US army, referring to environments which are: volatile, uncertain, complex, and ambiguous.
[6] Michael Emes & William Griffiths, 2018. ‘Systems thinking: How is it used in project management?’. APM