This article was originally published in Project Manager Today in April 2008.
We all know that mountaineers take extreme risks but perhaps it’s not as simple as it seems. Good mountaineers are certainly superb risk managers but the nature of the terrain, conditions and competency all play very significant roles that can change the risk exposure from extreme down to highly manageable. In this article we look at how mountaineers cope with the extreme end of this continuum – on new mountain routes, at the highest altitudes and in conditions that can and do kill – and we contrast this with a programme/project manager facing the risks of an ambitious new project; doing something that has never been done before or at a scale that has never been attempted before. In particular, we look at how traditional approaches to risk management can break-down under extreme risk and what approaches have been proven to work in these circumstances.
The Mountaineer’s perspective
I fancy myself as a bit of a mountaineer. I have climbed all the “trophy” mountains in the Alps – including the Eiger, Matterhorn and Mont Blanc and have climbed in the Himalaya, Andes and many other places in the World. But some years ago, I was humbled to be in the presence of one of the truly great mountaineers, Sir Chris Bonnington. Grabbing my opportunity to speak with him I told him that “Everest – the Hard Way” was one of my favourite books of all time – in both mountaineering and project management! He smiled as he has always stressed the project management aspect of planning and leading a large scale expedition. The annexes to his book contains the detailed plans for the expedition and expose the incredible thought that went into the enterprise and show ultimately how accurate the plans were.
Everest – the Hard Way details the 1975 expedition to climb the South West Face of Everest. By the mid 1970s all the “easy” routes up Everest had been climbed and the leading mountaineers of the time were focusing on more difficult potential routes. I say “potential” as no one really knows if a route is physically possible until it is attempted. The SW face had been attempted once before in 1972. All this achieved was to prove that the SW face was very difficult, if not the most difficult, route up to the roof of the World.
So back to my meeting with Sir Chris – given my risk management background, I just had to ask him “So when you are planning an expedition, how do you identify the risks?” His response surprised me somewhat – “I try not to think about the risks” he said! Now this was either a macho show of bravado or there was something else going on – as he was one of my heroes, I assumed it was the latter. “What do you mean?” I asked. He expanded, “When you are climbing a new route on a mountain like Everest, if you spend too much time thinking about the risks, you would never get out of the tent at Base Camp! You have to stay focused on your objectives and plans and stay positive. Risks are only relevant in their context and need to be kept specific and in perspective”.
All too soon our short time together was over but, before we parted, I did manage to understand the significance of what he was saying and to realise that it was very similar to my own philosophy regarding the risk management of large and complex “extreme risk” programmes.
In 1992 I was part of a team that was asked to look at why programme and project risk management wasn’t as effective as it should be – and, if possible, fix it! In particular we were looking at why “large” scale, programmes have more problems with making risk management work, relative to “smaller” projects.
We looked at lots of risk management processes and tools and a number of common problems emerged i.e.:
- There was a tendency to focus on today’s issues rather than tomorrows risks i.e. they were not really risk management processes!
- They tended to use generic risk statements that communicated very little in terms of the real underlying risk
- They often used distracting quantitative analysis that used “poor-quality” or unsubstantiated data
- Alternatively they used inadequate qualitative analysis using misleading HML (High, Medium, Low) type scales
- Prioritisation was often poor and misleading so that valuable time and resources were spent on the “wrong” risks
- There was a general inability to motivate anyone to actually do anything about the risks so there was a degree of “Risk Assessment” but very little “Risk Management”.
In addressing these problems we effectively came up with a new methodology – the ABCD risk management process. Since those early pioneering days, ABCD has been used effectively to manage some of the biggest and most complex programmes in the world and has become the standard for many businesses and Government departments. The advantages we believe ABCD has over traditional risk management approaches are that it:
Naturally forces people to look to the future (i.e. their assumptions – what needs to happen for people to meet their objectives) and therefore ensures an emphasis on proactive risk management rather than reactive issue or problem management
- Captures the specific root-causes of risks (i.e. the assumptions) that gives pin-point fixes
- Uses meaningful analysis that provides true insight and accurate prioritisation
- Provides clear prioritisation and escalation from projects through programmes to enterprise levels
- Ensures follow-through on actions via simple but effective roles and governance structures
At the most basic level ABCD works because it is an intuitive process that takes a positive rather than negative view of the challenges to the enterprise (i.e. what do you need to achieve your objectives – your assumptions, rather than what might go wrong – your risks). This reflects the approach described by Chris where he focuses on ensuring that the key elements of the plans (i.e. the assumptions) hold true to get safely to the summit.
Stay positive
I have always had a problem with the “negativity” of risk management. And so do many other people it seems – the whole idea of planning out a venture and then spending valuable time identifying what might go wrong can be, at the very least, demoralising as most people are fundamentally “positive” thinkers. Psychologically, people want to concentrate on what needs to be done – the positives – and to make them think about the risks – the negatives – can put their brains in a spin. Should we be surprised at the resistance we often find when we ask people to identify their “risks”? Most people consider themselves to be competent and want to get on with the project. Many understand that risk management can be a useful exercise but they see it as something to do if they have the time i.e. a “bolt-on” rather than a must-do.
Both mountaineers and project managers need plans to deliver success. All plans contain some facts and lots of assumptions. Perhaps the most effective way to manage and communicate the complexity of the plans is to distill out the key assumptions and assess the risk to these assumptions. This structured, assumption based, approach also ensures that key risks are not missed but stable assumptions are not emphasised as “risks” either.
When Chris Bonnington talks about keeping positive or you “would never get out of the tent” he is echoing this approach. A quick look at the Appendices of Everest the Hard Way shows how he approached the expedition. The plans showing the logistics of moving people and supplies from one camp to the next is classic project management – he breaks the complexity down into manageable chunks and thinks about what needs to happen – the assumptions – not what will go wrong. The risks to these assumptions are considered but are kept specific to the plans and in context with the situation.
As the risk increases this positive focus becomes even more important. People can get tunnel vision – summit fever as mountaineers call it – and there is a tendency for risk assessment to go out of the window as the pressure increases. People fall-back into managing problems as they arise but if these are “show-stoppers” then this will not work – and may kill you if you are high up on a mountain. You need to keep your head-up and look ahead, stay positive and understand what assumptions you are making about the terrain ahead and you need to objectively assess these assumptions. This could be the difference between success and failure or life and death – perhaps literally.
Prioritise appropriately
When you try and negotiate your way through a large and complex programme there are going to be risky assumptions – lots of them. Getting these prioritised accurately is the only way that you be able “to see the wood for the trees”. Too many times I have seen programmes so swamped by the number of risks raised and escalated that they effectively give up on the risk process.
On a big mountain like Everest the number of risks will overwhelm you if you let them. As Bonnington describes in his book, it’s very important to keep things in context. If it’s just snowed, then avalanche danger rises. If the ambient temperature increases, then rock-fall becomes more of a risk. If the Sherpa carries of supplies to higher camps have gone to plan, then running out of oxygen is not a risk. The Everest team was encouraged to think about what needed to be done and where the main challenges would be (and to communicate them, but more about that later) but not to escalate things inappropriately.
In ABCD the assumptions are prioritised on a 4×4 scale – not a three-point scale as “medium” allows people to sit on the fence and therefore doesn’t really tell you anything about their perspective. Captured assumptions that are both sensitive and unstable are treated as “risks” and action plans prepared. All other assumptions are monitored but no action is planned. In this way all the key assumptions that underpin the plans are assessed, but only the assumptions that need it are actioned. On a large project or programme, the risky assumptions are subsequently re-prioritised top-down and together this ensures a level playing field and avoids inappropriate escalation.
Be specific
When you are planning a route up a big and potentially deadly mountain, there is no point in just “brainstorming” the risks. What you might get if you did is something like…….
- Unexpected bad weather
- Significant avalanche
- Rock-fall
- Frost-bite
- Broken ropes
- Loss of team member
- and so on….
“Risks are only relevant in their context” Chris said. For example, the threat of avalanche is minimal if your route is primarily up a rock-spur – any avalanches will just go around you. Frost-bite is only a problem if you expose skin in poor conditions – on most days, sun-burn will be more of a problem. So the list above is not specific enough to be useful and will probably be prioritised incorrectly because the context and causes are not captured.
Focusing on the assumptions means that you stay focused on the plans. That does not mean that you don’t consider external factors that are not explicit in the plan but it does mean that you consider such factors within the context of the plan.
Also, being specific is not just about getting more detail. Identifying the root-cause of a risk is a much better way of being specific. For example, rock-fall is always a risk on large mountains but if we have multiple teams on the same line at the same time, there is a much greater chance that the higher team will dislodge something that may impact the lower team – the root cause is in the plan to have multiple teams on the same line simultaneously.
In ABCD, the root-cause of any risk is in the underlying assumption. For example, in a project, there may be a risk that insufficient resources are available for testing. The assumption might be expressed as “10 resources with XXX specific skills will be available for YYY testing”. When rated using the grid above, the next logical step is to understand why the assumption has been rated in that way. So if the Stability has been rated as a “C” (which corresponds to “Uncomfortable”), the “why” might reveal that the root-cause of the potential lack of testing resources is due to a clash of schedules with another project. It is the “why” that reveals the root-cause and it is the root-cause that should be targeted by the risk action plans.
Communication under pressure
Bonnington preaches communication as the most important leadership skill. His book contains many examples where situations are described first-hand by different members of the team. These show good communication, where risks were avoided, and sometimes break-downs of communication where opportunities were missed. Mountaineers on big mountains tend to have lots of experience. As with any major project, the art is to harness that experience so that the relevant risks are identified and managed. Bonnington’s expeditions were notable for their team meetings – he forced the communications whether the team wanted to discuss things or not. He used the best radio communication systems that were available at the time and today’s expeditions on big peaks normally allocate a radio to all team members. Consequently, expeditions today lose far fewer people than they used to.
We therefore developed ABCD as more of a “communication enhancement” technique than just another risk management process. The premise is that most risks will be foreseen by some member of the team or the associated stakeholder group. If you can efficiently capture the combined knowledge in the form of the key assumptions that they are making and their priorities in the form of their ratings, you can get a complete and consistent risk profile.
Further, capturing, rating and sharing assumptions can lead to the identification of risks that would never have been identified by a traditional risk management approach. In recent years we have developed and used the “Assure” web-based tool to force cross-communication of assumptions even more effectively.
There are several good examples of assumption cross-communication in the book. On one occasion, the Everest team were discussing the push from Camp 3 to Camp 4. The consensus is to use a direct line with theassumption that this would to be protected from avalanches on both sides by rocks. This is pretty much agreed when Doug Scott returns from reconnoitring a site for Camp 5. When Doug is brought up to speed on the plans and assumptions regarding the direct line, he points out that on the 1972 expedition, he saw a big avalanche come down that way that was deflected onto the direct line by the angle of the cliffs higher up on the face. The plan was immediately changed and the decision probably saved lives – two days later a big avalanche came through the original planned route!
Accept that you are pushing the limit – Contingency Planning
On 24thSeptember 1975, Doug Scott and Dougal Haston emerged from the South West face and onto the South ridge. They had climbed terrain that had never been climbed before but now they were on “familiar” ground. The problem was that night was fast approaching and they now had no chance of getting back to camp – their assumptions regarding timing had proved incorrect and now their lives, or at least their limbs, were at severe risk. At sunset they stood on the summit and euphoria quickly turned to desperation as the seriousness of their predicament sunk-in. However, they had a contingency plan. On the way-up, they had realised that they were not going to get back to the top camp that night and they had quickly scratched a basic snow-hole for a possible bivouac. They got back to the South summit in the half-light and dug-in for the night. The only problem was that no-one had ever survived a bivouac at that altitude and without bottled oxygen – Doug and Dougal were confident enough to assume that they could, based on their extensive experiences on other Himalayan peaks. And they did, and, against the odds, managed to keep all their fingers and toes.
Extreme Conclusions
So what is different when the risk goes from “normal” to “extreme”?
You need to:
- Keep positive – negativity turns people off, particularly when they are being pushed to the limit. Assumptions are natural and people relate to them. Risks are not and can demoralise.
- Prioritise effectively – you must make sure that you can “see the wood for the trees” or you will be swamped by risks as the pressure increases.
- Be specific – generalities are unhelpful at the best of times. When the risk is high, you must be specific so that you can fix risks at root-cause with minimal effort
- Communication breaks down when people are put under pressure. They withdraw into themselves, forget the bigger picture and do their own job as well as they can. Therefore you have to structure and force communications of the bare essentials to ensure that the team stay on the same page, are aware of each others key assumptions and consequently their perceptions of risk.
There is clearly a big difference between climbing a 1000m Scottish “Munro” and an 8000m Himalayan giant in the way you would view and manage risk. Similarly, simple and relatively informal approaches to risk management tend to work well on small projects but then fall-apart as the projects get bigger and become multi-project programmes. Perhaps the answer is not just more complex processes and software tools to capture loads of unusable data, but to take a fresher, more “positive” view of the challenges and focus on the identification and cross-communication of the assumptions to ensure success and “bag the summit” – safely.
Things that you probably didn’t know about Everest…………………
- Statistically, for every 10 people who successfully climb Everest, one will die (up to 1970 this was 1:1 and by 1990 this was still 1 in 3)
- There are over 100 visible corpses on Everest that no-one has tried to recover – its too risky
- The South West Face was first climbed in 1975 and a repeated accent has never been attempted
- Everest was first climbed in 1953 by Sir Edmund Hillary and Tensing Norgay. The first Briton to climb Everest was Doug Scott on the 1975 South West Face Expedition
- A place on a commercial Everest expedition costs around $50,000
- In recent years there has been lots of talk about “crowding” on Everest. This is obviously because there are more expeditions but it is mainly due to there only being an average of 5 “good weather window” days a year to attempt the summit
- On “summit day”, climbers normally leave the top camp before midnight and climb through the night. If they don’t reach the summit before 2pm, they should turn around or risk being stranded overnight in the “Death-zone” above 8000m
- Most of the people who die do so on the way down!
“Getting to the summit is optional, getting down is mandatory”
– Ed Viesturs, 5 times Everest summiteer
Hi keith – very interesting but I find it difficult to believe that mountaineers woud be so calculated in their approach. Surely they must take things as they find them and work their way arround difficulties? I hae done quite a bit of hill-walking and I don’t thnk this way.
Peter – its the scale thats the point. You may not formally plan a route etc for a bit of hill-walking but if you are going to climb an alpine/hymalayan peak then you will need to plan. So a small, simple project does not need a “formal” risk management process but a large, complex programme really does need it.
Bonnington was famous for his degree of project planning on his expeditions and he was probably the most successful expedition leader ever – not a coincidence I believe.
Hi Keith, Very good article. Also like the concept of an assumptions based risk methodology. When my new site http://purpleprojects.com goes live in the next few months I would like to feature some of your posts on this subject. The problem with risk management is that the truth is difficult for line managers to handle politically and the conversion or handling of important risks as assumptions can only be a good thing in desensitizing matters.
The lack of good risk management is the main cause of the current banking crisis. I read in the Sunday Times today that a government White Paper has just been issued on the causes of the banking crash. At the top of the list was the claim that board directors had no visibility of the risks being undertaken by lower ranking banking executives.
Good risk management would have resolved much of this. However, whatever approach you use if a culture of spin rather than transparency http://bit.ly/8cYjGI exists in an organisation effective risk management is doomed before it starts.
Thanks Kevin. Very true. All ABCD is really trying to do is to formalise the transparency by “forcing” the communication between stakeholders. I like the spin post – have tweeted it to my followers.
Hi Keith,
Great article – I really like the emphasis on being positive and not negative in risk management. The idea of looking for the root cause of assumptions is also very helpful to focus attention on the real potential for problems.
Keith – really good blog. Where is the photo taken of the ridge – no caption.
Hi Don – thanks. This is the ridge leading up to the South Summit on Everest. The Hillary step can be seen just beyond.
[…] Recent post “Extreme Risk Management
Excellent article, Keith! (Love the pix!) It is sometimes difficult to stay within “the context of the plan” when brainstorming a list of risks and opportunities. I’ve found that asking the question “What could cause…” is helpful for drilling down to specific risks. In my experience, 5 levels will usually suffice – sometimes less, sometimes more. Just keep asking the question until you get to a factor beyond your control.
Example (abbreviated):
Assumption – we will hit budgeted sales
1) What could cause missing budgeting sales – loss of customers
2) What could cause loss of customers – lower priced alternative available
3) What could cause lower priced alternative – lack of perceived value in our product
4) What could cause lack of perceived value – poor packaging
5) What could cause poor packaging – lack of design training (or taste)
Obviously each level may have multiple answers that will lead to other potential risks for a single assumption. Graphically, the end result looks like a tree structure.
I’m in the process of writing a post about the “5 Coulds” technique, but you beat me to it!
Tom – thanks and good insights. I look forward to your “5 coulds” technique post – its a big world out there and the more ways of addressing risks that we can get out there, the better.
Hi Keith. Great article. I couldn’t help thinking about NLP language paterns and how the brain processes out negatives. Any thoughts?
Julie – good point. There is actually a lot of NLP in ABCD – both by accident and design. One of the key reasons that assumptions work better than risks is that you can express things positively. As you quite rightly say, the human brain filters out the negatives in a sentance so risk statements really do mess with the logic.
In extreme situations this is even more important as telling people who are stressed to “not” do something is actually processed as “do” it – with potentially disasterous circumstances. As Bonnington said “stay positive”.
[…] Extreme Risk Management