The need to view project risk management as a necessary proportional response to project complexity

The need to view project risk management as a necessary proportional response to project complexity

The need to view project risk management as a necessary proportional response to project complexity

This thought piece is the fourth in a series of submissions I am developing as part of my QUT advanced research on the topic of "Establishing risk intelligence in major project environments”.  In papers 1 and 3 of the series it was demonstrated that as much as 70% of major-complex projects fail to meet their owner sanctioned objectives. That is, to come in on time and within budget, whilst delivering the expected benefits.  This high failure rate was observed to be common in both private and public sector projects, as well as both technology and infrastructure projects and had in fact remained consistent over the past 70 years (Flyvbjerg, Merrow et al).
Such a lack of improvement in project success is particularly concerning for those of us invested in the art of project risk management as it implies any advancement in project risk management definition and standardisation achieved over the years has been insignificant in the context of effectiveness (i.e. actually improving the failure rate).  Although a broad range of reasons have been documented for these high failure rates, three particular symptoms appear to be mentioned most frequently;
  • Poor upfront planning; including design and estimations (see The Planning Fallacy);     
  • Poor governance throughout the project lifecycle (see optimism bias, the hidden hand etc.) and;     
  • A general inability to effectively control the uncertainty (risks) associated with such complex project environments (see wicked risks, complex risk theory, black swans, etc.) 
Download Also:
Points (i) and (ii) appear to be driven primarily by behavioural issues at both the individual and organisational levels, whereas point (iii) appears to be driven primarily by gaps, flaws and limitations in the globally accepted project risk management literature, understanding and practices.  In particular, there appears to be a growing academic argument that suggests most traditional risk management methodologies and practices are too simplistic and/or isolated to control the material threats which are prevalent in complex-uncertain project environments

Gaps, flaws and limitations - the current state of global project risk management

Consider that the fundamental premise offered by most globally accepted, “brand name” project risk management methodologies (e.g. ISO 31000, PMBoK, Prince2, PRAM, RAMP etc.) is that by effectively establishing and practicing a set of process based steps, (in accordance with the relevant guide notes) one can manage program-wide risk. Although this particular premise may have some potential in simple-rational environments, it has proven problematic in complex-uncertain environments. This is evident by both the lack of improvement in complex project failure rates as well as the noticeable amount of academic criticism documented as to the perceived ineffectiveness of such process driven approaches in complex environments (Keynes, Atkinson, Johnson, Williams, Chapman & Ward, Rittel & Webber, Smith & Irwin, et al).
A common view shared by these critics is that complex environments tend to breed risks which are far too random and dynamic to systematically forecast, quantify and control, thus deeming such process driven techniques ineffective, especially when operating as the primary means of risk control. Nassim Taleb (The Black Swan) and John Maynard Keynes (Nobel Economist) suggest that risk forecasting systems are often developed as a biased, coping mechanism for addressing only the “known” risks, and ignore the additional controls and rigour required to address the “unknown” risks which may emerge. Taleb suggests that risk forecasting systems are underpinned by the flawed assumption that "we know all” whereas Keynes suggests that risk forecasting systems fail to acknowledge uncertainty as the primary driver of risk. 

Furthermore, the proponents of complex risk theory (Taleb, Rittel & Webber, Cooke-Davies, Smith & Irwin et al) suggest that an entities’ ability to absorb or mitigate complex-unknown risks is dependent on the overall rigour and resilience of such broader criteria as strategy, planning, opportunity management, executive decision making and organisational responsiveness.   Although these proponents don’t necessarily all agree on the full suite of risk management enablers required to address complex-unknown risks they do advocate that total risk management is significantly more holistic, multi-dimensional and enterprise-wide than merely adopting a risk forecasting system. Thus, any risk methodology advocating a process based approach to risk management (alone) is attempting to control entity-wide risks through limited means.

It is therefore implied (by the academic community) that the fundamental flaw of the traditional, process driven risk management methodologies is that they assume that all risks of consequence, are predictable, linear and rational enough to be controlled through a step-by-step process. In reality though, complex risks in uncertain environments are more likely to be dynamic, deviant and irrational and therefore require a significantly broader, deeper and more integrated approach to risk management than merely facilitating forecastable risks through a systematic process.  
Of particular contention, is the observation that there are a number of significantly momentous project risk methodologies in play which are being marketed as “industry accepted better practice”, or as in one case; “the global risk standard”, yet these “global better practices” do not appear to be supported by the known academic community. Most of these risk methodologies lack empirical evidence demonstrating they are indeed effective and they conflict with the peer reviewed observations of the recognised academics in the field.

That is; there is almost 100 years of complex economic risk theory (Keynes), 40 years of complex project risk theory (Rittel & Webber) and 15 years of Black Swan theory (Taleb) demonstrating that systematic/process driven risk forecasting techniques are ineffective in complex-uncertain environments. Yet despite this, most brand name project risk methodologies continue to advocate for process based risk systems as their primary means to control risks.

Eureka?  A fundamental “Eureka” appears to be missing from the current project risk community’s understanding as to what constitutes effective risk management in complex-uncertain project environments and that is; The ability of a complex project environment to effectively absorb (or control) material risks is dependent less on its’ ability to systematically forecast and process such risks, and more on it's ability to secure an overall and program-wide rigour, resilience and responsiveness.
It is implied by the proponents of complex risk theory, that the goal of risk management in complex project environments should not be to establish systems that can pro-actively forecast, quantify and control risks (i.e. the traditional project risk management approach) but rather to secure a program-wide rigour, resilience, and responsiveness which may offer a proportional response to the increased levels of complexity.
Once we project risk practitioners are able to understand and recognise this potential “Eureka”, it is only then that we are truly able to recognise both the limitations of the existing project risk management methodologies as well as the need to move beyond these methodologies towards a fully integrated and program-wide risk management approach.

Our research

Although our own research is still in its early stages, the early literature review into both project failure research and project risk management better practice appears to yield six primary project risk themes underpinning the relevant industry literature, academic focus and existing methodologies.

These six primary academic principles of project risk effectiveness include;      
  • The need to establish an effective decision making framework to provide oversight of all matters of project-wide performance & risk (governance)     
  • The need to manage a project within clearly defined and owner approved tolerances (appetite)      
  • The need to proactively mitigate known and forecastable risks through  robust upfront planning; including estimations and design        
  • The need to enable effective project systems to proactively identify, quantify & control  emerging risks        
  • The need to independently test and validate critical project controls, performance indicators, forecasts, estimations and data (assurance)     
  • The need to embed a positive and project-wide culture which promotes both greater accountability and awareness for risk
It is our early conceptual view that when combined, these six areas of academic research potentially provide an underlying platform upon which to enable a principle based and framework driven approach to securing effective project-wide risk management.  That's not to say that these six principles offer an absolute risk solution, but rather that if risk management is to add demonstrable value to complex project environments, then at some level all six of these principles will need to be effectively woven into the project's delivery fabric.

Furthermore, these six principles (as a minimum) may offer the basis of the integrated and proportional response required to control risk in project environments of increasing complexity.  That is; as project complexity increases so too should the rigour, resilience and responsiveness of these six principles as an integrated risk management framework.  Our research thus seeks to understand and define the specific collaboration that needs to be achieved between these six principles in order to enable risk intelligence in such complex environments.

Hopefully this research will give project practitioners greater understanding as to the specific dependencies in play when attempting to effectively manage risk in major (complex) project environments. Ultimately our vision for this research is to help project practitioners become more effective in the manner in which they use risk management techniques to successfully delivery major projects.
Related Topics:
                                       Warren Black
I am an Engineer, Risk Professional and Complex Systems’ Thinker who has particular interest in understanding how the complexity sciences may offer a better means to controlling emergent risks within highly complex, operating environments.  I currently consult on how to improve organisational Governance, Risk & Assurance practices so that they may reflect not only the degree of investment at risk, but also the specific environmental complexities in play. I believe that over the past decade in particular,
I have accrued deep expertise in my chosen subject matter as evidenced by the fact that I was the head of Program-wide Risk for BG QCLNG and have held Senior Project Risk & Business Advisory roles at both Deloitte and Marsh & McLennan Risk Advisory Practices. I am also arguably one of only a handful a Risk Professionals who has built a full end-to-end risk management & reporting framework for an organisation of over $25 billion (BG QCLNG). At its peak this was the 8th largest project in the world and is hence a significant indicator of my capability.  
As a practising complexity & risk specialist, I have worked within two of the world’s largest mining project hubs (BHPB and Rio Tinto), three of the Queensland mega LNG projects (GLNG, APLNG, QCLNG), Australia's largest construction company (Leighton’s/CIMIC), The State of NSW's largest Infrastructure PMO (I&P PMO), Victoria's Largest Rail PMO (VicTrack), Brisbane's largest city Rail Project (Cross River Rail) and the largest publicly funded civil & infrastructure PMO in Queensland (Brisbane City Infrastructure).  Also, as a demonstration of my commitment to my art; I am currently engaged in a PHD by Research whereby I am "Investigating a Complex Systems Approach to Complex Project Risk Management". I believe that the complexity sciences provide a new generation lens upon which to help risk management transition into a future world of complex working relationships and perpetual disruption.

Post a Comment

Previous Post Next Post