Risk Management - Monitor and Control

| Home | Guidelines | Manage | Organize | Identify | Assess | Root Cause Analysis
| Mitigate | Monitor & Control |

Even though risks are identified, assessed, and mitigation plans developed to control the more significant risks to the implementation of a decision, the risks do not necessarily fade away.   Risk management is not done until the implementation plan (associated with the decision choice) is completed.  The tasks that were devised during the mitigation step still need to be funded and scheduled and finally completed.  All the risk reduction tasks must be integrated with all the normal routine tasks required to implement the decision.   In an ideal world, the decision-maker would start the implementation of the decision only after they completed the risk mitigation planning.  Then, with all all the risks identified and the mitigation tasks integrated into the implementation plan, the execution of the plan now has its best chance of succeeding.  In a passive approach, the risk mitigations either worked or they didn't.   The risk events either happened or they didn't.   But the task of implementation must remain active all throughout the execution of the plan.   

It is common knowledge that no plan remain intact after "first contact with the enemy".  In most cases, the enemy is the unknown.  We can't control what we don't know.  And often, we couldn't control even what we do know.  So, it is important to watch and observe the progress of the implementation plan to ensure that progress is being made according to the master plan/schedule.  Cost and schedule deviations are warning signs that something could be amiss.  At the first sign of deviations - cost, schedule, or performance - the risk agent must investigate to find out why and whether there are new risks at play that need to be controlled.  It is always better to trap problems while they are small and can still be easily solved.  Prevention is usually better than cure. So, there is a continuing role for risk management, even after the risk mitigation plans are in place, to make sure they stay that way.  Early warning signs that implementation milestones are not being met should trigger an immediate investigation and then followed by active intervention if warranted.  

The degree of intervention depend on the severity of the deviation between the results achieved and the plan.  The intervention should be scoped to fit the size of the deviation.  Preferably, most interventions will only require re-planning options 1 and 2 shown in Figure 9 below.  The first line of defense is to alter what and how work already scheduled gets done.  More work or tasks may need to be added to the plan.  If that does not remedy the problem, then more drastic actions are needed.  The margins of safety in cost and schedule are the first to be adjusted.  Lower level technical margins may have to yield.   If events get worse, then the requirements of the decision may have to be adjusted to more realistic levels, or at worst, the objectives of the decision (investment) may need to be de-scoped.   But in any of the above cases, something has to be done and done as early as possible.  Interventions that could have been resolved with remedy options 1 and 2, if not done early enough, will require more drastic measures if delayed.  The more drastic the measures required to restore the deviation, the greater the final expected outcome will drift away from its original targets.  The new prospective outcome, once the decision is implemented, will drift downward to lower levels of rewards.    It means that the original risks materialized and caused an outcome with less need satisfaction than anticipated.   Such is the real world, we decision-makers sometimes get less than what we expect, but sometimes we get more.