Untitled

Risk management is a critical tool that helps companies and projects to see and address potential issues before they occur. It uses a structured approach to identify and examine a potential issue from the perspective of how likely they are to occur (likelihood), how big the problem will be if it does occur (consequence). This information is then used to undertake appropriately scaled actions to minimize the chance it will occur and the damage if it does occur. The bigger the potential problem, the more emphasis placed on avoiding it and/or minimizing its impact if it does occur.

Large companies rely on risk management to provide the framework to analyze a risk and take steps to make it less likely to occur and minimize damage if it does occur. They face so many risks that it is critical they analyze them and focus on the ones with the potential to cause them the biggest issues. They also rely on risk management to develop a corporate culture where staff consider likelihood and consequence for most of the tasks they undertake rather than just blindly doing what believe they were told to do. This approach to work is good for the company – having employees thinking of what can go wrong and how to avoid it reduces problems. This culture is even more important in Small to Medium-sized companies and projects (SMs).

Addressing risks helps SMs increase profit and improve financial stability – which is why risk management is a required practice in ISO 9001 and various other management and contract frameworks. Risk management is critical for SMs since they often to not have the depth and history needed to absorb major cash and reputational losses and in projects, anything that delays completion or increases the cost of the project typically results in exceeding the project budget.

SMS can easily implement risk management. Simply identify past issues and, at a high level, where they occurred. Then look forward and think of other issues that may come up. For example, there may have been issues with suppliers in the past and, for upcoming work, it may be critical that those issues do not recur. A quick risk forecasting meeting prior to reaching out to suppliers for bids and again prior to selecting a supplier may result in minimizing likelihood and consequence of supplier issues (risks). In the meeting, the team looks at what aspects of supply are critical to the company to see where the focus should be. Factors such as supplier on-time delivery, cost, and/or quality may be critical to success. Once critical potential issues are identified, do some mitigation planning to reduce each risk’s likelihood and consequence. The goal of the exercise is to look into the future, see what can go wrong, identify which possible issues would have the biggest impact, and mitigate them. It is a very beneficial bit of time spent.

In a project, start by identifying issues that have come up in similar projects. Key phases in a project such as pre-biding are often subject to a risk assessment to avoid under or over bidding based on possible risks. Supplier and sub-contractor selection is another activity where risk management can stop problems from occurring and reduce their impact if they do occur. Mitigation plans may be as simple as an additional clause in a contract (to reduce the likelihood of the issue occurring) and/or identifying suitable back-up suppliers/subcontractors (to reduce the consequence if it does occur).

SMs look at key operational risks throughout the entire organization or project and often assess their impact from four different perspectives; Health, Safety, and Environment (HSE), Cost, Quality, and Corporate. In many cases, a risk impacts more than one area, so there is some overlap. For example, there may be an environmental incident that impacts an SM in three different areas – SHE impact (contravening an operating environmental permit), cost impact (clean up and fines), and damage to the corporate reputation (news or social media attention). Using risk management, steps are identified and taken to reduce the likelihood of it occurring and to reduce the impact in each of the three areas if it does occur. Failing to mitigate an environmental risk can have a major impact on a company or project.

The biggest issue facing SMs is keeping track of the information, plans, and progress related to each different risk. Larger companies and projects typically have dedicated personnel supported by specialized software or spreadsheets that they use to manage risks. In smaller companies this is not feasible. This is where TRM Advantage comes in – it is the specialized app needed to keep track of information, plans, and progress and it enables smaller organizations to obtain the same benefits from risk management at a fraction of the cost. It operates on desktops, laptops, and is fully mobile friendly so it can be used anywhere there is cellular phone service.

Risk management and quality management are critical parts of successful organizations (companies and projects). Each one supports the other and together they reduce company losses and streamline how the organization does business. With a new app that is available, TRM Advantage, risk management efficiency is significantly improved.

Risk management is all about identifying potential issues (risks), forecasting how likely they are to occur or reoccur, evaluating the potential consequences if they do occur, and taking appropriate steps to reduce their likelihood of occurring and the consequences if they do. Appropriate steps range from ‘do nothing’ for risks that are organizationally acceptable to planning/implementing actions that are taken to reduce the overall risk. Actions that reduce likelihood are designed to make the risk less likely to occur while actions that reduce consequence are intended to minimize problems if the risk does occur. Consequences are evaluated from four different perspectives: Safety, Health and Environment (SHE), Cost, Quality, and Corporate risk. If a risk is minimized from these different perspectives, it is unlikely to present a significant issue to the company or project.

Quality Management focuses on Quality Assurance (QA) and Quality Control (QC) where QA is concerned primarily with the processes used to generate an output and QC is focused on the inspection and testing of the output to verify that it meets customer requirements. QA looks at processes/procedures to make sure they are developed and implemented and is responsible for auditing them to ensure they are being followed. QC develops and implements the plans and checksheets used to verify that outputs from various processes/procedures are as they should be before they are sent to the customer. In quality terms, a customer is anyone that received a process output.

Although risk management is very different from quality management, neither should be implemented without the other. Risk management is used to evaluate the risk posed by a process and it’s output to determine if a written procedure is needed and how detailed it should be. If there is minimal risk, then there is likely no need to develop a formal process/procedure and involve QA/QC. If there is significant risk, even if the process is very straight forward, then a procedure is likely warranted, and QA/QC will be involved in monitoring the process execution and subsequent output. Similarly, if the quality team identifies an issue (non-conformance, etc.), the next question should be ‘Is it a big issue or a minor one’ – the answer being used to guide the response and ensure quality resources remain focused on larger issues that pose bigger threats to the company or project. Determining whether an issue is big or minor is done using the risk matrix and, if possible, a quality history that shows how likely the issue is to reoccur by seeing how often it has occurred in the past.

Another area where quality relies on risk management is a QA evaluation of process risk. In this, the various processes/procedures in use are analyzed to identify which areas of the process pose the largest risk to the output. An example of this would be in the IT system. Processes are checked for areas where there is potential for a hack into the system and then appropriate steps can be taken. It is also relevant in a manufacturing process where certain key steps in a process may be critical to end product quality, overall SHE, or output cost. When these steps are identified, they can be focused on to ensure the procedures properly address the risks and that workers are familiar with them.

Risk management relies on quality management to ensure that identified risks that have been addressed remain under control through the processes that have been put in place. Risk management closes the risk and the ball is passed to the quality team to ensure the processes are developed, relevant, implemented, and being followed. Without the quality team, processes tend to fall apart and people go back to doing what they always did or what seems easier.

The risk and quality teams can work together by setting risks that have been addressed to a special ‘monitor’ classification and following up with quality periodically to ensure that a QA check has been performed or that QC is ongoing. This verifies that the risk remains under control. Scheduling for quality audits should be guided by the level of risk posed. The quality management team can use the risk levels presented by the different processes to help set their audit schedule and forecast staffing and specialized contractor skills that will be needed when setting their budget.

Although risk management is often not seen as viable in small and medium sized companies and projects, implementation is critical. The major hurdle to implementation is managing the information that is part of risk management – especially if it is done in a spreadsheet or similar manner. This is where a sound risk management app changes a major time commitment to a simple yet critically valuable exercise.

Pre-activity risk reviews are a critical part of difficult, complex, or hazardous activities. They are performed by the supervisory team in the activity planning stages and their intent is to identify activity-related issues that could occur before, during, or after the work. There is tremendous value in this, particularly if the activity is one that where new equipment, personnel, or locations are involved. Note that pre-activity risk reviews are not the same as field level safety reviews undertaken by workers before they start a task. The pre-activity risk review is easily done and typically takes slightly more than an hour (time requirements vary with activity complexity). The risks are evaluated in terms of likelihood and consequence, with consequence being assessed from four different perspectives: Health, Safety, and Environment (HSE), Cost, Quality, and Corporate.

The analysis is performed for each of the three activity phases involved – before, during, and after. For the before phase, the activity set-up is analyzed to identify any needed personnel, equipment, training, layout, materials, permits, approvals, and other elements that must be in place and ready prior to starting. Starting the activity when any of these items are missing puts the activity in jeopardy and significantly increases the risk of Health, Safety, and Environment (HSE), Cost, Quality, and/or Corporate issues associated with the activity. For the execution phase, the same approach is taken but the focus is on the activity itself and the issues that can arise while the work is underway. The after-phase analysis looks at how the activity is followed-up and considers new signage, procedures, safety barriers/protocols, and other factors that may be needed to ensure the activity results do not cause issues in ongoing operations.

To perform each analysis, the supervisory team looks at the activity execution plan and forecasts what could go wrong based on experience and knowledge. Each potential issue is assessed using the likelihood categories to see determine its likelihood rating. Next, the consequence is assessed by rating the probable outcome if the issue does occur. Consequence is assessed from each of the four risk perspectives. Likelihood and consequence for each perspective is combined in the risk matrix to determine the level of risk, or criticality, of the risk. If the risk is considered significant, actions are identified to reduce the likelihood, consequence, or both. The actions are assigned to different personnel and tracked to ensure they are completed. The hard part is keeping track of everything, something that is significantly easer to accomplish with a robust software application (App) to support the effort.

The benefits of implementing pre-activity risk management are huge. From a company perspective, if you intend to take on a new area of business, new line of products, or manufacture something new, then spending an hour or two forecasting what can go wrong and how it can be avoided will make for happy customers, happier employees, and a much more profitable venture. If an issue does occur, you are ready with a plan ‘B’ and the impact to your customers, employees, and bottom line is minimized. From a project perspective, if you have a plan and contingencies in place for key risks, the likelihood of having an injury, downtime, or a quality problem with the output is minimized. Get ready, do the work, and get out and on to the next job is the most profitable way to execute projects. Pre-activity risk management reviews go a long way to making this happen.

Most companies that have achieved success and grown have implemented risk management and pre-activity risk reviews. This has kept them from experiencing many of the legal, OSHA, regulatory, quality, and financial issues that can plague smaller companies. And many of the larger companies embed the requirement for a risk management program into their contracts so that only those with an active program can pre-qualify as one of their suppliers. Many larger companies reduce their risk by only dealing with what they determine to be well managed companies. W. Edwards Deming (a 20th century management and quality guru) said that “Management is prediction” and he expected managers to identify and avoid/minimize problems before they occurred. Risk management is the key tool for this.

The amount of money and time wasted solving issues that could and should have been avoided provides a very large return on pre-activity risk management and risk management in general. So-called ‘firefighting’ and always having to troubleshoot and solve problems is completely unproductive and a waste of resources that could be better used elsewhere. Risk management keeps any organization from relying on luck to avoid major catastrophes and improves their short and long-term financial performance. Avoiding even one or two issues a year generates far more savings than the costs associated with risk management implementation.

Schedule is a major risk in any project, turnaround, or business endeavor.  Schedule overruns and missed deadlines can have very large impacts on all measures of success. Customer satisfaction, schedule overrun, lost production, and earned value (in projects) are a few of the measures that can be impacted when things are late.  How to quantify schedule risk in projects, turnarounds, or business operations is a legitimate question that often comes up.

It is not uncommon for project managers and companies to want a distinct risk consequence category for schedule risk.  This is not something I recommend.  In my opinion, any legitimate schedule risk can be quantified as a cost or, in rare cases, one of the other risk categories.

There is a quantifiable value associated with any delay on the critical path of a project or business activity.  The costs include direct and indirect costs related to delaying the start-up or grand opening.  Other costs associated with various delays include crew overtime, demurrage, penalties, late fees, and equipment rentals.  Opportunity costs such as idle workers and lost future sales can also be calculated.  All of these are quantifiable using standard economics and can be used in the risk category of cost.

Other reasons for not having a schedule risk category include confusing overlap between cost and schedule risk and general clutter.  Cost and schedule risk can be confusing when the cost risk is minimal but the schedule risk shows a significant level of risk.  I have seen this on many occasions but, in my opinion, it makes no sense.  If you can delay something without impacting cost, safety, or some other risk category, then it is generally considered schedule ‘float’ and not a risk.  Removing the schedule risk category quickly resolves the issue.  Also, given that there are typically four risk categories being used already (SHE, Cost, Quality, and Corporate), adding others that overlap can create confusion and unnecessary work with no added value.

Risk management is a critical tool that helps companies and projects to see and address potential issues before they occur. It uses a structured approach to identify and examine a potential issue from the perspective of how likely they are to occur (likelihood), how big the problem will be if it does occur (consequence). This information is then used to undertake appropriately scaled actions to minimize the chance it will occur and the damage if it does occur. The bigger the potential problem, the more emphasis placed on avoiding it and/or minimizing its impact if it does occur.

Large companies rely on risk management to provide the framework to analyze a risk and take steps to make it less likely to occur and minimize damage if it does occur. They face so many risks that it is critical they analyze them and focus on the ones with the potential to cause them the biggest issues. They also rely on risk management to develop a corporate culture where staff consider likelihood and consequence for most of the tasks they undertake rather than just blindly doing what believe they were told to do. This approach to work is good for the company – having employees thinking of what can go wrong and how to avoid it reduces problems. This culture is even more important in Small to Medium-sized companies and projects (SMs).

Addressing risks helps SMs increase profit and improve financial stability – which is why risk management is a required practice in ISO 9001 and various other management and contract frameworks. Risk management is critical for SMs since they often to not have the depth and history needed to absorb major cash and reputational losses and in projects, anything that delays completion or increases the cost of the project typically results in exceeding the project budget.

SMS can easily implement risk management. Simply identify past issues and, at a high level, where they occurred. Then look forward and think of other issues that may come up. For example, there may have been issues with suppliers in the past and, for upcoming work, it may be critical that those issues do not recur. A quick risk forecasting meeting prior to reaching out to suppliers for bids and again prior to selecting a supplier may result in minimizing likelihood and consequence of supplier issues (risks). In the meeting, the team looks at what aspects of supply are critical to the company to see where the focus should be. Factors such as supplier on-time delivery, cost, and/or quality may be critical to success. Once critical potential issues are identified, do some mitigation planning to reduce each risk’s likelihood and consequence. The goal of the exercise is to look into the future, see what can go wrong, identify which possible issues would have the biggest impact, and mitigate them. It is a very beneficial bit of time spent.

In a project, start by identifying issues that have come up in similar projects. Key phases in a project such as pre-biding are often subject to a risk assessment to avoid under or over bidding based on possible risks. Supplier and sub-contractor selection is another activity where risk management can stop problems from occurring and reduce their impact if they do occur. Mitigation plans may be as simple as an additional clause in a contract (to reduce the likelihood of the issue occurring) and/or identifying suitable back-up suppliers/subcontractors (to reduce the consequence if it does occur).

SMs look at key operational risks throughout the entire organization or project and often assess their impact from four different perspectives; Health, Safety, and Environment (HSE), Cost, Quality, and Corporate. In many cases, a risk impacts more than one area, so there is some overlap. For example, there may be an environmental incident that impacts an SM in three different areas – SHE impact (contravening an operating environmental permit), cost impact (clean up and fines), and damage to the corporate reputation (news or social media attention). Using risk management, steps are identified and taken to reduce the likelihood of it occurring and to reduce the impact in each of the three areas if it does occur. Failing to mitigate an environmental risk can have a major impact on a company or project.

The biggest issue facing SMs is keeping track of the information, plans, and progress related to each different risk. Larger companies and projects typically have dedicated personnel supported by specialized software or spreadsheets that they use to manage risks. In smaller companies this is not feasible. This is where TRM Advantage comes in – it is the specialized app needed to keep track of information, plans, and progress and it enables smaller organizations to obtain the same benefits from risk management at a fraction of the cost. It operates on desktops, laptops, and is fully mobile friendly so it can be used anywhere there is cellular phone service.