Risk Management as an Immune System

While there are indications that many project organisations, including those involved in Large Infrastructure Projects, do not take Risk Management (RM) seriously, a closer look would suggest they would rather relegate it to an ad-hoc, optional extra, or nice-to-have practice. For instance, on a multi-billion Rand capital programme, the executive committee once turned down a seasoned RM practitioner; instead, an individual with no proper training was assigned to learn on the job. It is rare to come across a properly constituted RM team, with Risk Management professionals; if they have not merely appointed a lone ranger practitioner, RM would be neglected altogether.

To many organisations, Risk Management is like a buckler one shall only raise when the situation around the project gets “risky”, not something that should always remain activated. As a result, the entire concept of Risk Management is typically employed either at the project's outset or, more commonly, when setbacks or impending massive cost and schedule overruns threaten the project.

The author contends that Risk Management should serve as the “immune system” for the project, not only when a threat lurks around—not like the near-blind man who only puts on his pair of glasses afterwards, to figure out how to come out of a ditch he could not see and has fallen in it. Is prevention (i.e., an ongoing approach to RM) not better than cure (i.e., a sporadic approach)?  

Risk Management and Project Delivery  

Organisations involved in “risky” initiatives (e.g., projects) should implement risk treatments to reduce residual risks to levels acceptable to stakeholders and ensure efficiency and effectiveness —to protect an organisation from potential losses or threats to its continued operation¹. Both the PMBoK (on Project Management) and ISO 31000 (on Risk Management) concur that the aim of...