All projects, including those involving innovation and entrepreneurship, face a multitude of risks. It is critical to identify all of the risks, assess their probability and impact, and develop contingency plans. It is also critical to establish a process for reviewing these plans as well as reexamining potential risks, as they are not static.
Creating awareness through the development of a thorough list of the potential risks, even the most obscure or unlikely, is the most important step. Four general sets of methods and
tools can be employed to generate an extensive list of risks: Various brainstorming techniques, based on the project goals and plans, are the most commonly employed by individuals and teams. If checklists or templates were developed from previous projects, these too can be used to as a foundation or to supplement a growing list. A large number of tools and models can be employed to force some structure/categorization, thus focusing the thought processes and ensuring areas are not overlooked. For innovations, my “Six Tenets” has proved to be a valuable tool here, as it matches the major components of a business plan. Finally, consulting internal or external experts can provide a wealth of knowledge as to potential risks, however they are best engaged once a strong foundation is established.
The most common way to assess risks is to assign to each one a probability of occurring and an impact. If a simple High, Medium, Low-type system is used for both of these factors, a 3x3 matrix is generated and each risk can be plotted. The plot or risk register automatically generates a prioritized list of the risks that need to be addressed. At a minimum, those that fall within the three obvious, serious/unacceptable risk sections need to be addressed, however I would also recommend that the very low probability, but high impact risks also be addressed. As Nassim Nicholas Taleb points out in his excellent 2007 book entitled “The Black Swan: The Impact of the Highly Improbable,” very rare and high impact events often elude foresight but can play a disproportionate role in hindsight.
The third step, once a prioritized list of risks has been created, is to eliminate or at least take steps to minimize (and hence re-categorize) the probability and impact of each risk if possible. Purchasing excess supplies, starting or ordering early, over-engineering, building in redundancies, and including buffer time and funds are examples of implementing such proactive contingencies. Those remaining serious risks each require the development of a detailed, reactive contingency plan. These are the the most difficult tasks as each one is a project in itself that requires strategy and research. Identifying second source suppliers, renting additional space, hiring contract workers, and subcontracting are reactive examples. In many cases, more than one contingency plan will be required as these plans contain their own risks that need to be assessed and managed in a similar manner. Once developed, these contingency plans need to be broadly shared/communicated. In addition, not all serious risks can be adequately mitigated through planning. Basic research breakthroughs, hitting sales targets, and competitive activities frequently fall into this category. For these, establishing deadlines and identifying the trigger points when strategic decisions will be required is the best that can be done.
If identifying potential risks is the most important step towards managing them, then periodic review and updating of the potential risks as well as the adequacy of the contingency plans, ensures that your risk assessment remains relevant, as things develop, change and more information becomes available. Frequently project teams that have made a great one time effort to identify, assess and plan for potential risks, run into trouble later on when their plans become outdated, or new or unseen risks materialize as they tend to do. The reexamination process should be comprised of two components: The informal component is ongoing. When individuals identify new potential risks they should be noted and assessed, with the high impact ones being managed immediately. The formal component involves a complete bottom-up re-identification of all the potential risks, followed by a reassessment and the contingency planning steps discussed above. The frequency of this formal process should vary with the rate of change of potential risks, which can in part be gleaned from the informal process, and the overall length of the project.
Taking steps to raise your risk awareness and develop appropriate contingency plans, will greatly improve a project’s probability of success from a time, cost and quality perspective which in turn increases its overall value to the stakeholders including senior management and investors.