Explaining Risk

It's not enough to understand risk. Project practitioners also must communicate it to stakeholders.

Imagine a doctor who tells a patient that he's sick, but doesn't identify the illness. Or a mechanic who tells a customer her car is going to break down, but doesn't say when. How about a travel agent who books a family vacation, but doesn't indicate when the flight leaves.

When information isn't fully communicated to those who need it, it can lose its value.

That's especially true on projects, says Prakash Chanthiran, PMI-RMP, project risk manager in the Perth, Australia office of global oil and gas company Cameron. "When projects fail, it's not because the project team doesn't have the right technology, knowledge or skills; it's because of everything else, and a main part of that is poor communication," he says. According to PMI's Pulse of the Profession(TM) In-Depth Report: The Essential Role of Communications, 55 percent of project managers agree that effective communications to all stakeholders is the most critical success factor. For every US$1 billion spent on projects, a startling US$75 million is at risk due to ineffective communications.

In particular, project success hinges on the communication of risk. "Stakeholders who don't know or understand what risks could affect a project are powerless to do anything about it," adds Mr. Chanthiran. "That's why risk management is so important. It helps you identify what could derail a project and what can be done to manage or avoid risks before they occur."

More than half of CEOs say risk management is essential, yet only 44 percent of senior executives say their company is good at communicating risk to stakeholders, according to a 2013 risk management survey from business services firm KPMG International. Likewise, nearly half of senior executives admit they face difficulties in clearly understanding their company's risk exposure.

In the companies she's worked for, "very few" executive stakeholders have understood the importance of risk management, acknowledges Heather Campbell, PMP, a product manager in the Chandler, Arizona, USA, office of Intel Corp. "When I schedule a risk management meeting, it's common that the folks in the room have never had a meeting specifically to document and assess risk before," she says.

Clearly, there's a gap between the risks that threaten project outcomes and the stakeholders whose actions are required to address those risks. To fill it, project practitioners must make risk communication a priority. These tips will help.

Understand Your Stakeholders

Communicating risk requires first understanding how your stakeholders like to communicate. "Early on in a project you have to feel your stakeholders out and understand what types of people they are," says Jim Hanekamp, PMP, president of Ardor Consulting LLC, Streamwood, Illinois, USA. "Different people respond to different types of communication." Some respond best when risks are explained in writing, while others favor verbal communication.

Stakeholder personalities and organizational roles can impact not only how you communicate but also what you communicate.

"For instance, a senior technical person would want to understand how well a new product will function compared to the previous release. When you communicate risk to him, you should emphasize the risk's impact to the product design," says Ananthan Sanggar, PMI-RMP, PMP, regional head of the PMO in the Singapore office of telecommunications operator BT Global Services. "The CFO of the company, on the other hand, will be more concerned about cost and budget, so you must communicate risk to him in monetary values."

Censor Yourself

As a project practitioner, it's your job to identify every risk that threatens your project However, that doesn't mean you should share every risk. "You have to be careful about what risks you communicate," says Mr. Hanekamp, who advises communicating only specific and imminent risks; all other risks are just noisé. "The more noise there is, the less likely stakeholders are to listen."

Risks worth communicating typically are those where the impact is real, large and immediate. "It has to be a risk you can do something aboutand soon," Mr. Hanekamp continues. "If you say, 'There's a rare chance we might have a nuclear war next week,' they're not going to listen to you. Sure, it's possible, but it's not likely."

In advance of a project, Ms. Campbell partners with stakeholders to develop a risk rating system to identify risks most worthy of their limited time and resources. "We estimate the probability of something happening on a scale of one to five, with five being the highest probability, then we take that number and multiply it by the potential impact, which again is rated on a scale of one to five," she explains. "As a team, we agree that we're only going to pay attention to risks that are above a 12, for example, or a nine. This gives stakeholders a way to quickly understand and communicate which risks to pay attention to."

Meet Early

The best communicators connect with stakeholders early and often, according to Ms. Campbell. "You have to communicate risk as fer in advance as you can," she says. "You can wait until you have clear information that a risk will have an impact, but you should bring everybody to the table early so they can discuss a plan of action."

During a project's planning stage, Mr. Sanggar hosts risk management meetings up to three times a week with internal stakeholders. "Once sufficient risks have been identified internally, I would arrange two to three meetings with the customer to obtain their input and feedback on identified risks."

To make sure your emails don't get ignored, train people to expect them. Stakeholders who are primed to receive risk communications in advance of a project typically are more receptive to them during the project. "It's important to set expectations early," continues Mr. Sanggar, who says essential information includes what the risk is, its potential cost, its potential impact, its trigger and its owner. "For example, tell stakeholders, 'I'm going to use this template, and it will be shared weekly.' Tell them clearly what will be communicated and what action they'll be expected to take."

Build Credibility

"Stakeholders have to trust that when you say something's important, it really is," says Mr. Hanekamp. When he was new to an organization and hadn't yet proven his trustworthiness, a portion of one project failed. "We were putting in a system and there was a senior integrator who was recommending that we do things by the book," he says. "I can remember saying, 'If you do it that way, the system's not going to perform.' As much as I communicated, they followed the senior integrator's advice and ultimately ran into a wall."

Although trust must be earned over time, project practitioners can instantly increase their credibility-and the effectiveness of their risk communications-by using colleagues' reputations as currency. "During risk management meetings, I rely on experts to help me explain risks to stakeholders," Ms. Campbell says. "If the risk could impact the billing department or accounts payable, for instance, a representative from those departments can speak to the impact of the risk better than I can."

Make Risks Relevant

Stakeholders typically have one of two reactions to risk: skepticism or remorse, according to Ringo Alagba, PMP, former head of risk management retail operations at telecommunications firm Eircom, Dublin, Ireland. "When most stakeholders look at risk," he says, "it's either, 'Is it real?' or, 'Qh my, it is real.'"

When they ask, "Is it real?" stakeholders are expressing skepticism; if a risk is real, it must be mitigated-and that may require spending capital, which companies are reluctant to do. By the time they exclaim, "Oh my, it is real," on the other hand, it's too late; the risk has already been realized and the damage done. A project practitioner's job, Mr. Alagba says, is convincing stakeholders that risks are, in fact, real while there's still time to do something about them.

There are several ways to do that. One is qualitative. "The easiest way to get stakeholders' attention is with anecdotes," Ms. Campbell says. "We're all human beings; when you tell a story about what could happen, it creates a picture in your mind, and pictures in the head are still the most powerful form of communication for many people."

Quantitative data-the impact of the risk, typically expressed in time or dollars-also can be effective. Mr. Sanggar recalls one risk management meeting where financial data made all the difference. "I started off with a very drastic statement," he recalls. "I said, 'This same project implemented in Company X cost the client this much money because these things took place.' Right away I won stakeholders over. Very rarely in my industry can we tell a client, 'We can make you more money,' but we can tell them, 'If you don't do this, it's going to cost you more money.' And in my opinion, a penny saved is a penny earned."

Ultimately, a mix of qualitative and quantitative communication is most effective. "Risk is difficult to associate without putting tangibility on it," says Mr. Alagba, who suggests mining both your company and others for case studies that illustrate given risks. "It's not enough to say, 'The building will fall.' You need to say, 'People will die if the building falls,' and you need to support your argument with qualitative facts and quantitative data."

Be Clear

In order to be effective, risk communication must be streamlined, according to Mr. Alagba. "Provide only the information that is necessary for critical stakeholders to make a judgment call on what action to take," he says. "There's no point in taking the long road to where you want to be."

Mr. Sanggar suggests two levels of communication: summary, which includes only key facts, and detailed, which allows for a deeper dive. The first might take the form of a PowerPoint with key risks; meanwhile, an in-depth view could be provided as an attached risk register, to be opened at the viewer's discretion. "Most stakeholders have limited time," Mr. Sanggar says.

Ultimately, though, it's not spreadsheets that sway stakeholders. It's self-interest. "The whole goal of risk management is to make stakeholders extremely uncomfortable, whilst stressing the need for positive decision-making to address the imminent risk," Mr. Alagba says. "You have to make them see how the loss affects the business. If they can't see how they explicitly can be affected, risk management will be a very, very tall sell."

of project managers agree that effective communications to all stakeholders is the most critical success factor. For every US$1 billion spent on projects, a startling US$75 million is at risk due to ineffective communications.

Source: Pulse of the Profession1« In-Depth Report: The Essential Role of Communications. PMI, 2013

"When projects fail, it's not because the project team doesn't have the right technology, knowledge or skills; re's because of everything else, and a main part of that is poor communication/'

-Prakash Chanthiran, PMi-RMP, Cameron, Perth, Australia

"You have to communicate risk as far in advance as you can. You can wait until you have clear information that a risk will have an impact, but you should bring everybody to the table early so they can discuss a plan of action."

-Heather Campbell, PMP

"You have to be careful about what risks you communicate. It has to be a risk you can do something about-and soon."

-Jim Hanekamp, PMP, Ardor Consulting LLC, Streamwood, Illinois, USA

"Risk is difficult to associate without putting tangibility on it. It's not enough to sayf The building will fall/ You need to say, 'People will die if the building falls/ and you need to support your argument with qualitative facts and quantitative data."

-Ringo Alagba, PMP, Eircom, Dublin, Ireland