A mentor of mine once said, “The biggest challenge in managing projects is managing risk.”
And so when I got involved in the project management field one of the first things I did was to go find out how experts in other fields manage risk. Insurance was one of the first areas I looked at. Risk is their business for sure, so just the fact that they are in business and profitable means they must be doing something right.
Understanding some of the strategies and techniques they use to manage risk gave me a lot of insight into better ways of managing project risk. But let me focus on two of the biggest things I took from what the insurance guys do and how you can apply the concepts to better manage risk on projects.
If you want to get valuable info like this weekly, sign up now and we’ll send it to you once a week.
I am a big fan of learning from the experts. If someone has already faced and solved a problem that I have, then I would be a fool not to at least study what they did before trying to figure it all out on my own. We call it “standing on the shoulders of giants”, and it’s a great way to do something really well quickly. Dealing with project risk is a big enough challenge, leaning on other experts is a great advantage.
With so many unexpected problems, challenges, changes, delays and the like (risks) causing projects to miss their due dates, go over budget, or fail to the original scope, coping with project risk is vital. Looking at the strategies insurers used to successfully (and profitably) manage risk, two things jumped out at me. Two things that were very different from how project risk is typically managed. Here’s what the experts do:
Pooling Risk 
Insurers often use a fancier term “aggregate” when they talk about this strategy. But essentially what insurers are doing is pooling their resources (money in this case) so that they can provide protection to people against unexpected problems (risks).
Things like totaling your car, or having your basement flood (to name a couple of things that actually happened in my family recently) happen, and when they do they are expensive. And so people are willing to pay a little bit of money each month to protect them from a very big expense in the event something does happen.
The insurance companies know that while some people will have wrecks or floods, the chances that everyone will have a wreck or a flood is very, very small. The insurance company takes the premiums it collects from all its policy holders each month and uses it to pay out those few who had a wreck or a flood or some other unfortunate event that is covered by their policy.
The Crystal Ball method for project risk
Yes, “but what does this have to do with managing risk on projects?”, you want to know?
Well, the first insight I got was that this is very different from how we plan and manage projects.
Let’s take time for example. Time is one of the most critical issues in a successful project—in most cases it’s very important for us to deliver our project on time. The duration of projects, and the individual tasks within the project, is subject to a high degree of uncertainty (risk). The nature of projects is that we really don’t know how long any given task will take. We can make some estimates for sure, but for most tasks there are so many unpredictable things that we cannot predict exactly how long, or how quickly a task will take to get done.
It’s exactly the same situation the insurers are in. They know there will be a car wreck, but they do not know which of their customers will be involved, when it will happen, or how much damage there will be. And rather than trying to take the crystal ball approach and guess, they pool monies so that they always have enough to pay claims and still be profitable.
From my experience, projects plans are usually created using the “crystal ball” approach. We try to define in advance all the tasks that need to be done, in what sequence, by which resources, and exactly how long they are going to take. And then we manage as if our plan is how reality will happen.
But it never goes that way because no matter how much experience we have we can’t see everything that will happen in the future. And people know this so when they plan for how long a task will take, they put in some safety time “just in case” something goes amiss.
The problem is that people will almost always take all of the time that is available for a task—check it on your projects, how often do your tasks finish early, and by how much? So even if a task could have finished earlier, it rarely does. And other tasks will run into larger than expected problems, and run over their planned time making the project late, and often over-budget too.
Project Risk Lesson 1: Plan projects with time buffers
So the first great insight from the risk experts in the insurance industry is pool time to allow for unexpected delays. In other words take a significant chunk of the time available for the project and put it into a pool—we call it a buffer—at the end of the project. Then divide the remaining time available for the project among the various tasks based on your best estimates. Creating the pool of time at the end of the project in this doesn’t extend the length of the project, but it does provide protection against the inevitable risks that something will go wrong.
But if we take a page out the insurance guys book we’ll aggregate (combine) a little bit of time from each task and put it into a buffer at the end of the project. Taking time out of each task means that people will try to work to shorter task dates—a good thing—and they may achieve them. But if they don’t the time is still there in the buffer waiting for them to absorb the delay.
We don’t have to have a crystal ball or decades of experience to try to guess precisely how long each task will take and where and when we will hit problems. Besides we’re kidding ourselves if we think we can do this in the first place. Pooling time in the buffer at the end gives us the protection we need against whatever delays happen—and as long as the pool is large enough, and we don’t waste it, the project is far more likely to finish on time. (for more on this read Why Critical Chain Works)
Project Risk Lesson 2: Don’t sweat the small stuff
The other lesson I learned from the insurance guys about risk was not to sweat the little things. Insurance companies fully expect to use money from the pool they set aside for paying claims. After all if nothing bad ever happened, there would be no need for insurance in the first place. So they are really managing the pool as a whole, as long as they are not having to pay out more money than they are setting aside in the pool, things are great.
But on projects the focus is almost always on the small stuff—the tasks and when they will be finished. If you finish in the time we “guessed” in the plan you’re ok, if not you did a poor job. With the buffer we fully expect to use time out of it—after all that’s what it’s there for, to absorb the unexpected delays. As long as we don’t consume the time in the buffer too fast the project will finish on-time.
So if risks and uncertainties are jeopardizing your ability to deliver your projects on-time and on-budget, take a page out of insurance industry’s book—
Pool time in buffers at the end of your project plans, and
Stop worrying about every task and focus on how fast you’re using up your time buffer.
Now I have a question for you. What do you do to manage project risk? Have you ever taken a page out of someone else’s book to improve how you manage risk? I’d love to know what you did and how it worked.