Written by Michael D. Barwise BSc, CEng, CITP, MBCS, MCIIS, LCCP, FRSABusiness Information Risk Management Consulting
Probably the greatest single challenge for any transformation programme is risk management. Every phase of the programme is likely to consist of multiple independently managed projects each of which will be exposed to its own cluster of risks. These can interact in many ways to affect both individual project and overall programme risk. Furthermore, the level, and even the nature, of individual risks may change as the programme proceeds. Continuously maintaining a clear view of risk priorities, although fundamental to good programme management, is consequently a far from simple task.
To manage such complex and dynamic risk environments we need assessment methods that provide robust and realistic representation of individual risks, support reliable aggregation of multiple risks, and reflect the effects of change immediately it occurs. Unfortunately, the scenario-based qualitative risk assessment approach commonly used in managing smaller scale projects does not perform well at transformation scales of complexity. Its representation of risk is not sufficiently accurate, aggregating the multiplicity of independent assessments into a meaningful measure of overall risk exposure is challenging and error prone, and propagating changes in specific risks into overall risk exposure is arduous and uncertain.
If, however, we instead start from consideration of the logical relationships between risk factors, an alternative approach emerges that both facilitates and speeds risk aggregation and improves realism. On this basis we can create a new generation of tools capable of delivering trustworthy dynamically adaptive programme risk assessment that offers significantly greater levels of predictability and reliability to transformation management.