A Stitch in Time -- Risk Management Part 1

In the corporate world, there are projects and there's ops. A project, as you'll recall from my intro, is "a temporary activity designed to product a unique product, service, or result." It's specifically distinct from the routine processes that go into the day to day running of things -- operations.

Practical Magic Project Management is concerned with specific magical workings with a deadline and a goal. However, you have to run your life too, and it's smart to run it in a magical way. It's the difference between doing magic and living as a magician.

Play at your own risk... police officers on duty

The Black Swan theory is really an operational concern. If something unpredictable and major comes your way it's going to impact your whole life, not just whatever magic you are in the midst of. This becomes a question of sustainability. Is your life set up to weather and even benefit from the bumps, shocks, and Black Swans that will inevitably get thrown at it? And if not, what can you do in advance to make your life more sustainable?

In my experience, you never really know how sustainable your life is until something comes along and shakes it up. I speak from personal experience here. Something goes wrong and you suddenly realize that your life has overly complex maintenance, too much management overhead, inflexible tools, and not enough redundancy to cope with chaos. Things seemed to be hanging together when everything was fine, but are now rapidly coming apart at the seams. It's not just the big stuff either. Lots of little related problems coming together can throw everything out of balance.

It makes sense to examine the weaknesses in your systems... and one of the best ways to do that is to think about the things that could go wrong. Because if you know what could go wrong, you can not only avoid those things so they don't happen, but change your life now so that if they do happen, things won't go sideways quite as badly. This is risk management and it applies to both project management and operations. Risk in this context, by the way, is any uncertain event. If something bad is already happening, that's an issue and you go straight to trying to fix it. Dealing with stuff before it hits gives you lots more options.

Just as we discussed in the Black Swan divination post, seemingly good things can still have bad results, and bad things can be turned around or avoided. The whole point of risk mitigation is to increase the chances of good stuff happening and decrease the changes of bad stuff happening. Technically, there are both positive and negative risks. But this post is specifically about the negative ones.

In order to manage risk in your life (or in a specific magical working, but we'll get to that a bit later), you need to do something that people just aren't very good at doing... you have to think about bad things happening and you have to plan what you might do if they did.

First, let's get past the magical elephant in the room: thinking about bad things happening will not make them happen. And thinking about good things won't make them happen either. I know this is completely contradictory to a lot of current pagan and newage thinking, but it's true. Research shows that:
  • Positive visualization can actually make you less likely to reach your goals. This is because it tends to sap the energy for actually doing anything to actually reach them. Read the article... the bit about mental contrasting at the end is particularly relevant.
  • Negative visualization can be highly beneficial (just ask the stoics). Defensive pessimism, acceptance of death, and not getting too tied to outcomes can increase gratitude, reduce anxiety, and improve actual outcomes. Our willingness to acknowledge bad things can help us make changes to avoid them. And our flexibility with regard to goals is helpful in dealing with whatever comes, bad or good. Note, negative visualization is not the same as pessimism (see below). 
  • Self-fulfilling prophecies do exist, but they are based on action, not thought. It's an untrue belief that's made true by acting as if it's true. Not an actual risk that you somehow trigger just by thinking about it.
  • Optimists are healthier, but because of what they do, not what they think:
    "We also know why optimists do better than pessimists. The answer lies in the differences between the coping strategies they use. Optimists are not simply being Pollyannas; they're problem solvers who try to improve the situation. And if it can't be altered, they're also more likely than pessimists to accept that reality and move on. Physically, they're more likely to engage in behaviors that help protect against disease and promote recovery from illness. They're less likely to smoke, drink, and have poor diets, and more likely to exercise, sleep well, and adhere to rehab programs. Pessimists, on the other hand, tend to deny, avoid, and distort the problems they confront, and dwell on their negative feelings."
OK, to sum up so we can get back to our risk management: actions are more important than thoughts, negative visualization can be good for you, and don't be a pessimist, but don't be a Pollyanna either.

Identify your risks
If you're doing a major working, your risks will be about that working. In order to do a whole life or operational risk analysis, you need to go a little broader. Remember the list of major areas of concern from the Black Swan divination? Well, no need to reinvent the wheel, you can reuse them here. Those will be your major risk categories. Now think about possible bad things that could happen in each domain.

For example:

Health
  • Major illness / accident (hospitalization)
  • Moderate illness /accident (out of work / school for a week or more)
  • Chronic illness / accident (ongoing, not as severe as previous two but long lasting)
Career
  • Losing job
  • Job turning to crap (in my experience a much higher probability than losing it outright)
  • Job stagnation
  • Death of your career (all you buggy whip manufacturers take heed)
  • Economic crisis that kills your ability to find any work at all (hello, 2008!)
Environment
  • Localized natural disaster
  • Disruption to water supply
  • Power outage
Pleasant process, huh? It's important not to get bogged down here. For every item you list, take a moment to be grateful that it hasn't happened (or happened yet, or happened again). This is not the time to spiral into a pit of anxiety. So how do you come up with these bundles of joy? Here are some suggestions:
  • Look at your own experience and the experience of people you know. Look particularly at the experience of people who are doing a bit worse than you are.
  • Pinpoint any assumptions you've made about your life (my job is secure, I'm going to get that grant, tuition won't go up, my car should keep on running for another 100k miles) -- risks come from these assumptions.
  • Identify any weaknesses in your life (an illness that requires ongoing medication or a career choice with a high level of uncertainty). These could point to areas of risk.
  • Look closely at your assets. If you've got nothing, you've got nothing to lose (not technically true, but catchy) -- still, stuff implies risk.
Try to stay within the realm of feasibility for you. I don't skydive, so parachute malfunctions aren't really relevant for my list. And if the result is "everyone dies, it's a disaster movie" skip those as well (yes we could get hit by a meteor, but I'm pretty sure that my list of risks won't be very useful in that scenario).
Bet you didn't see that coming
So now you have a list of Really Bad Things. Yay. But of all the bad things you thought of, which ones should you worry about?

Prioritize your risks
Of all the skills that the PM needs, I think prioritizing is one of the most important (communication is the most important, BTW). There's always too much to do and too many options and too much to worry about. Without the ability to prioritize, it's easy to get overwhelmed.


Prioritization allows you to focus on only the things that really matter. And it guides you in determining in what order those things should be handled. This means that not everything can be a number one on your list. And this should come as something of a relief. Deciding that some things aren't worth worrying about means less to worry about -- or at least fewer worries to focus on.

This might be easy if you're dealing with a list of errands or chores. It's not as easy when dealing with a list of bad things that might happen, but might not, but how do you know, and what will happen if they do? It's here that I'm going to diverge from the standard PMP message. If you go look at this site on Risk Matrices you can get an overview of what the PMBOK advises. But this is NOT what I recommend. In addition to the problems listed on that wiki page, there are other issues with using this kind of risk matrix:
  • It assumes that humans are good at deciding how likely something is to happen (but we know from Taleb that this is untrue)
  • It doesn't allow for extremistan-sized Black Swan impacts
  • It completely avoids the emotional impact of risks (whether it keeps you up nights, whether there's some kind of obligation or guilt attached)
  • It doesn't account for dependencies or relationships between risks
I've given this a lot of thought in my professional life and have been working on several strategies. However the most powerful tool you have in order to prioritize your risks is informed intuition. If you've been working in companies for any length of time, you've seen stuff go wrong and can apply that knowledge to your experience now. Fortunately, everyone has a lifetime's worth of living to mine for data in prioritizing risks in their own lives.

Take a look at your list of very bad things. Which ones make the hairs on your arms stand up? Which ones are you instinctively drawn to consider? Which ones do you desperately want to avoid? Which ones have already happened three times before? Your instinct is a tool and you need to use it here. You don't have to rationalize. If you do nothing else, start here. Invoke a trance state and begin a process of defensive pessimism.

Another way to consider the risks in your life is by focusing on those you can do something about. There are going to be things that you can't really fix or avoid. Shit happens. And if you really can't do anything about it, it's probably best to just park it off to the side and focus on the things you can actually affect.

Try to identify risks that have major dependencies. For example, losing your job is the quintessential risk trigger. It can cause risks to your finances, housing, health, and so on. The risk of losing your house is greatly lessened by having a job, right? Risks at the top of the chain need to be prioritized.

Also, try grouping risks that have related attack strategies. Let's say you have the following risks:
  • Losing your job
  • Your job becoming so much worse that it affects your health
  • Being priced out of rentals in your town (San Franciscans can you hear me?)
  • Can't afford to send your kid to a decent school (either by moving or private school tuition)
  • Never getting anywhere in your work / never getting that raise or promotion
  • Being stuck in a dead end situation forever
It's easy to see that a combination of new career and new town will neatly deal with this entire set of risks. One plan (albeit a big one) = hugely reduced risk across the board. Effectively prioritize the solution instead of the individual risks.

Finally, never discount the power of divination and augury... and combine it with a bunch of research. For example, do you read trade publications associated with your job? Do you follow your customers and competitors in the press? Do you track any legislation in your industry? Why the hell not? So what if you aren't an executive... being the little guy makes you more likely to lose your job when shit hits. Here's a little lesson taken directly from personal experience: when you see your company's biggest client on 60 Minutes, it's time to update your resume.

So at this point not only do you have a list of risks, but you have a feel for which ones you should be focusing on. As an alternative to just, you know, worrying yourself sick, the next installment of this risk management lesson will be all about mitigation strategies, both magical and mundane.

Comments

Popular posts from this blog

The Year of Being Agile -- Agile Risk Management, Informed Intuition, the Hard Part

The End of the Summer - and Things to Come

Project Ivy: End Game