Managing risk to better manage skilled resources
04/05/2022
Background
Downer Professional Services (DPS) was contracted to help provide the Defence’s Army Project Management Office with a more strategic view of risks and issues across Defensive Cyber Operations in the Deployed Environment.
As part of the Project Management services, Downer provided an experienced Risk Manager to manage the Project’s risks and Issues.
The project had initially focused on Tactical risks which were affecting the ability to conduct day-to-day work rather than considering the impact on the delivery of the Scope of the project.
This meant that each Risk Review Board (RRB) was delving into minute detail of work management which was not the most appropriate use of highly experienced resources across the project.
What did we do?
The Risk Manager looked at the existing Risk Register and the RRB Minutes and held meetings with a number of project stakeholders to gain an understanding of maturity in Risk Management, as well as what was working well or needed refining.
An opportunity to uplift maturity of the use of the customer’s Risk Management Framework through implementing the Critical Controls Approach (CCA) was identified and the uplift to the CCA was first communicated in meetings with project stakeholders and then a presentation to the RRB where approval to implement this new approach was given.
The Project Risks were uplifted to address the three important aspects of Project Management, Time (schedule), Scope (including quality) and Cost.
A Bow Tie was developed for each of these project level risks, and existing controls were identified and further defined through a Control Profile.
The next step was to conduct workshops with stakeholders to understand which controls were designed to impact the causal factors of the risks and those controls which impacted on the consequence. These controls differed from the treatments in that treatments were defined as one off activities with controls being an ongoing effort to reduce the likelihood of the risk occurring or the consequence if it were to be realised.
From these workshops the control profiles were reported to the RRB monthly with each critical control reviewed on a regular basis depending on the significance of the cause or consequence it was mitigating.
Importantly, each control now has one control owner responsible for implementing it.
The project continues to use the Critical Controls Approach to Risk Management.
Results
The new approach allowed for a more strategic view of risks and issues across the project.
Through observations and conversations with the client, the problem of low-level risks being reviewed to a level of detail was identified as a significant impediment to the effective management of project risks.
Adjusting the direction through the implementation of the Critical Controls Approach allowed the project team and importantly the project executive to view risk management form a strategic viewpoint and reduced wasted effort in discussing the detail of low-level risks which are more appropriately managed at the team level.