Search This Blog

Sunday, June 17, 2012

Everything I Need To Know About Risk Management I Learned From My Pocket Umbrella

[Also available as a podcast] [YouTube]

January 6, 1991: Standing on top of Ayers Rock (Uluru), Northern Territory, Australia. 
45C/113F and a cloudless, brilliant sunny sky. Humidity? near zero.

One of the driest, hottest places on earth.

So why am I carrying my pocket umbrella in my backpack?

And what does this have to do with Risk Management?

Interesting question!

To answer that we need to go back a few years earlier - and to a much wetter climate.

A Basic Lesson in Risk Management

Vancouver, BC, Canada - the "Wet Coast". 
Growing up in Vancouver you get used to rain. Lots of it - or at least long periods of drizzle especially in winter. (In Vancouver they can take a good NZ afternoon downpour and spread that out over three weeks of solid gray sky and liquid sunshine. One joke goes like this: "If you can see Mount Baker, it is going to rain. If you can't, it is already raining."  And another one - "They don't tan in Vancouver - they rust.")

Exaggerating a bit of course, but you get the idea. Wet. And not only that - you expect it, and plan for it.

Everyone has an umbrella (or three or four) and a rain jacket. One umbrella for the car, one for the office, one or two for home, and some spares for guests that might come by. Why? Well for the rain, of course - or at least the very high likelihood of rain, especially in the cooler months.

From the time I was in High School and taking the bus (or walking on a fine day), I carried a small umbrella in the bottom of my backpack.

It did not rain every day, of course - but I always carried the umbrella with me. It was perhaps my first practical exposure to Risk Management Planning. Knowing the region and the climate, there was a decent likelihood that on any given day I would need to keep my head - and especially my textbooks - dry from all that liquid sunshine. 

Remember the book "All I Really Need to Know I Learned in Kindergarten" by Robert Fulghum?  

My parallel to this might be called "Everything I Need To Know About Risk Management I Learned From My Pocket Umbrella."

Silliness, you say. How can you learn anything from an umbrella?

Essential Components of Risk

Risk - especially in the context of a project, is sometimes misunderstood, sometimes feared, and sometimes given no more than a sideways glance as everyone just wants to "get on with it" and start working on the project and produce the deliverables everyone is expecting. On the other end of the scale, Risk Management may become an all-consuming task that sucks the life out of your project as everyone is consumed by the worry of what might happen.

So what is a Risk - vs an Issue?

An Issue is a definite item that will pose some challenges or problems for your project. You are going to have to address it, or choose to ignore it - but it is not a "maybe" - the item is there, in your face- either right now, or at a known stage of your project.

Risk relates to an event that might happen at some time on your project. This Risk can be broken down into the following components:

- What may happen (the Risk Event)
- When is it likely to happen (timeframe: during a specific stage of the project, or at any time)
- What is the likelihood (probability) of it happening (High/Medium/Low)
- What is likely to be the outcome (the Impact) of the Risk Event should it occur (High/Medium/Low)
- What factors might precipitate or contribute to the event

These are just the basic concepts - in your Risk Management Planning you will indeed include all of the above, as well as what you might be able to do about it - to try to prevent it happening (Risk Avoidance/Pre-Event Risk Mitigation), or if it does happen, what you can do to lessen any negative impacts (Post-Event Risk Mitigation/Risk Response).

The trick with Risk Management is doing a thorough enough job to make sure that you are aware of what might happen to impact your project - and to have plans in place to monitor the potential risk conditions and respond in the event it occurs. You don't want to take the "hope and pray" approach, hoping risk will pass you by - but you don't want all of your resources tied up in an exhaustive Risk Management approach that takes on a life of its own and detracts from your project. 

You need to take a practical approach to Risk Management. Look at what is "out there", and do a realistic assessment of what may happen, probabilities and impacts, and then devise an action plan to respond to any events, and look at what practical preventative measures you can afford to take, without going overboard.

When you have your list of Risk Items, you need to categorize them as outlined above, and map them out. You can do a simple 2x2-square grid (High-Low) or 3x3 (High/Medium/Low) if it is helpful to your project, but in my experience, simpler is better. For now let's discuss a simple 2x2 model.

In this model, we want to pay particular attention (and concentrate most of our efforts) on the High Impact/High Probability quadrant items. These could be show-stoppers. Proactive risk mitigation actions might also be advisable for several of these items.

High Impact/Low Probability items need to be monitored and prepared for - but you should not spent a huge amount of effort on prevention - but do have a good post-event mitigation plan.

Low Impact/High Probability items need to noted - but you should not spend a huge amount of effort on prevention or the mitigation plan.

Low Impact/Low Probability items can in many cases be simply noted and little time should be spent on them. Don't lose them though - it might be that their profile will change if conditions on the project change.

Pre-and-Post Event Mitigation

When you develop your Risk Management Plan, you will likely come up with a "what to do IF it happens" set of plans (Post-Event Mitigation) - write them down, and keep them in a drawer somewhere, just in case you might need them later. Update them as necessary.

However, the proactive (Pre-Event Mitigation) side of Risk Management includes taking preventative measures on an active or semi-active basis.

For example, if there is a risk that you might be attacked while staying in a war-torn foreign country, it might be wise to actively station armed security outside your complex. (The best Pre-Event Risk Mitigation strategy is simply not to go there in the first place, but if you are already there...)

But in our example (fortunately) all we have to worry about is rain. Specifically, preventing it from soaking your bag or briefcase.

Preventative Risk Mitigation

 If we took a fully active approach, you might walk around all the time with an umbrella open over your head. Aside from the lack of Vitamin D from sunlight, you would look pretty silly after a while and people will begin to talk about your odd behaviour.

So a semi-active approach might be a bit better. In this scenario, we would be prepared for rain- or at least rain of an average volume. So let's just take an umbrella with us - all the time. (If you only take an umbrella when you know it will very very likely rain - i.e. the weatherman warned you it is going to rain, that is just being prudent. No bonus points for you!)

Which umbrella to choose? (aka Effort)

Those big golf umbrellas provide great coverage, but they are bulky - and just like the guy walking with the open umbrella on a sunny day, walking around with one of those all the time will get people talking. Not ideal. Plus you are quite likely to poke people with it on the bus.

I prefer a more pragmatic semi-active approach - be prepared, but not necessarily for a monsoon. Prepare for a typical or middle of the range event - in this case, a typical Vancouver rain. So I packed a pocket umbrella in my bag. (Not the tiny ones, the ones about 33cm/1 foot long when closed). Suitable for most conditions, but small enough and light enough to carry everywhere, and not be too visible. People will commend you when you bring it out in the rain, but not look at you oddly on sunny days, because they can't see it.

And most of the time - as a Pre-Event Risk Mitigation Plan it was sufficient. Until last year, that is...

Change the Environment, change the Risk

As with everything in your project, things change over time. And sometimes, your Risk profile can change. You need to be aware of the changing conditions and re-assess your risks based on new data. You just might need to update your mitigation planning (post-event and pre-event).

Sometimes what worked before simply won't be enough!

August 30, 2011, Annapolis, MD, USA. 7:45am - I am due to start the training class at 8:00am. I am waiting in my car, outside in the parking lot, along with dozens of other people in their cars. Waiting - because it is not raining. It is drowning outside. Heavy rain bombs hitting the window, and over 1.5cm/half an inch of water pooled everywhere in the flooded parking lot, deeper in many places.

I have my pocket umbrella. Wheelie computer bag is in the trunk. Waiting.

7:59am. Still pounding down outside. I am going to be late for class!

Risk assessment: I have my umbrella. If I grab the bag and pull it, running fast I might be ok. 30 seconds to the front door, give or take. How bad could it be?

8:00 Inside the foyer, absolutely soaked except my head.

8:01 In the classroom, opening my computer bag. Everything is wet.

8:02 My laptop will not turn on.

8:02:01 Risk Event: Computer will not turn on! !@#&*!&#*(&!@#(*&!@*(#& 
Oh dear... I definitely did not make the right call on this one!

8:04 Risk mitigation (post-event): USB thumb drive with the training materials I made as a backup copy seems to be dry. Let's give it a shot, or I will not be earning money today!

8:10 Class starts, up and running with a borrowed laptop and my USB stick - while I completely empty my bag and disassemble the components of my laptop to try to dry them out with the hot air from the LCD projector.

11:55am Wrapping up for lunch. Things seem dry- I reassemble the laptop and power it up. Crossing fingers! 

11:59 Laptop boots up normally. Lucky. Very lucky I don't have to go buy a new laptop.

Lesson #1: Sometimes having a backup to your backup plan is a good thing to have!

Lesson #2: Don't let the heat of the moment let you make bad judgement calls when you have a Risk mitigation plan in place that is likely inadequate. As it turns out, at 8:05am the rain stopped. Haste makes waste, all those sayings...very true. Patience is a virtue...

Lesson #3: Pre-Event Risk Mitigation Plan adjustment: Buy a plastic bag to line the inside of the laptop bag in case of heavy rain.

Back to the Australian Desert

Down from Ayers Rock (Uluru), back in the Land Cruiser and on the way back up to Alice Springs.

Still very hot, and dry. No cloud at all.

Feeling a little bit foolish about dragging that little pocket umbrella into the middle of the arid Australian desert. But then - I could not exactly leave it anywhere either - so here it is with me, in the bottom of my bag.

January 10, 1991: Took the train from Alice springs towards Canberra, stopped in Broken Hill NSW. 44C/111F. Dry. Hot. (Note: Home of Silverton Pub, the pub in the original Mad Max movie. If you go there, take "the challenge" and you will get a free beer. Really! I did.

January 11, 1991: Broken Hill, New South Wales, Australia. One of the few rainstorms per year hits the town, dumping several inches of rain in the afternoon.

** Guess who has an umbrella? ** :-)

Ironically, as there is so little rain, there are no storm drains in Broken Hill. They just have the street curbs, and some walkways the put out from the curb to the middle of the street so people can walk over the water until it flows back out into the desert. However as the rain was quite heavy, the little bridges only went halfway through the flowing water. 

So - umbrella held high and barefoot I went, walking down the street holding my shoes in my hand.

You can't plan for everything!


Risk Management is a matter of awareness and balance - and updating your Risk Profiles as time goes by - some risks disappear, new ones may be added, and some may change.

I have continued the habit of carrying a pocket umbrella in my bag - or, I did until my teenage son needed it more than me this year - now that it is his turn for taking the bus to High School. 

Time to buy another umbrella!

Good luck with your projects, and try to stay dry!


  1. Great blog post, Gary! Risk management is really quite simple when you break down the terminology to everyday language (and use a great example)!

  2. But the aspects that we consider to assume the risks may vary according to several circumstances.