6. The Onus of Uncertainty
,Corporate culture—whatever that means—poses serious challenges to the would-be risk manager. The most important of these is an attitude toward uncertainty that can thwart even the best-intended effort. The attitude is summed up as follows:
It’s okay to be wrong, but not okay to be uncertain.
If that rule describes your company, you’re sunk.
The rule says you may miss your promised delivery date—even miss it by a mile—but in the months and days leading up to that date, you’re not allowed to express any doubt that you will indeed deliver on time. Failure is tolerated as long as you don’t commit the capital crime of admitting beforehand that you might fail. Another expression of the rule is that you can ask for forgiveness for being late (afterward), but you can’t ask for permission (beforehand).
If your corporate culture won’t allow you to admit uncertainty, you can’t do risk management. It’s as simple as that. You can learn how it ought to be done, but you can’t actually manage your risks. It’s as if we had shown you how to play an octave on the keyboard with one hand, but your own hand just isn’t large enough to reach.
This constraint may leave you prone to an infectious disorder called selective myopia. Projects that are stricken with this condition can only see small problems. Large problems may loom directly ahead—problems that would be in the center of any healthy project’s field of vision—but they go completely unseen by the victims of selective myopia.
“Oh, you mean that oncoming train”
The symptoms are straightforward. People take elaborate care not to trip over the railroad ties, but nobody can see the oncoming train. Risks are identified, a risk list is published, risks are reported on status reports, and mitigation strategies are approved. Risks are monitored and tracked. If one only reviews the risk lists and records, it appears that the project is low-risk. All the risks enumerated are at the inconvenience or nuisance level. The risk tracking proceeds without variance until the project is suddenly canceled, often followed by a furious bone-picking of the corpse by litigation. Here are a few examples:
• Patient 1. A contractor is building a turnkey system for a client. Everything seems to be under control. Issues are out there, but they are noted on the risk list and nothing hints at failure. Then the final system is delivered to the client for acceptance and is rejected outright. The contract called for a mutually approved specification for the new system. No spec was ever accepted. At no time in the project history did anyone add the risk, “We haven’t formally agreed on what we’re building.”
• Patient 2. A contractor is building a replacement system for a client that recently merged with another company. The contractor has proposed using a set of software modules from a solutions vendor, along with some customization, as the new system for the merged organization. Packages are purchased, and new hardware is installed. Risks are listed, status meetings are held. From the dawn of the project, the client has repeatedly proclaimed that since the peak of its business is from Labor Day to Christmas, either the new system or some temporary solution must be in place by then. The various client participants on the project repeat this like a mantra. At no time, as the months tick by, does the risk, “We might not have the new system in place by September,” appear on any risk list or any project status report. It’s just too awful to consider. Labor Day blows by as though it were Arbor Day. There goes Thanksgiving, then Christmas. In January, the CEO of the client company cancels the project, tosses out all contractor personnel, and files a lawsuit.
Variation on the Theme
TDM: I was working on a litigation effort, looking back over the remains of a project that had gone badly down the tubes. Many things had gone wrong, but the one that actually proved fatal was that a Title-8 subcontractor had been completely overwhelmed by the commitments it had accepted. Eventually, the contractor simply walked. The little company folded and never was heard from again.
Interestingly, the project had a risk list. When we went back over the successive versions of the list that had been published from day one right up to cancellation, we found an amazing thing: The risk that the Title-8 subcontractor might fold up its tent had been articulated early in the project, but was then pointedly removed from the list, never to appear again.
This is the same kind of selective myopia we referred to earlier, but practiced after the fact. Management looked aghast at a potentially fatal risk that made it onto the list. As long as it was there, the big boss glared accusingly at everyone. Some poor bastard was instructed to “manage that risk and make damn sure it’s sufficiently managed so we can remove it from the list by this time next week.”
Fortunately, There’s a Vaccine
What is the cause of this can’t-see-the-oncoming-train disease? We haven’t isolated the virus, but suspicions abound. Maybe these organizations do not have the voluntary muscle structure to utter the word “catastrophe.” They persuade themselves they are dealing with all their risks—potential problems—but they are only dealing with a subclass of these: potential problems for which they have remedies.
There may be no cure for those already infected, but there is a vaccine that has shown promising results for keeping the uninfected clean. The vaccine must be administered at the very beginning of any risk management attempt. At the first go-round of what would normally be risk identification, vaccinate everyone by naming all the catastrophic outcomes you can imagine. Ask for more catastrophes from the group. Don’t do any risk management—yet. Speak the words “failure,” “rejection,” and “cancellation.” (If you try to say these words and they won’t come out, you are already infected and should seek professional help.) If you can say these words, see whether you can get others to speak them publicly as well. Now, work backward from your catastrophe list, asking for scenarios that could lead to each of the catastrophes. Take each scenario in turn and try to describe the risk(s) that could bring it about. Now you have the beginnings of a risk list that might reflect future reality.
We will return to this risk-discovery technique in Chapter 14, laying out its procedures and some tricks for making it work. Just for now, though, the essence of the technique is this: Attack your nightmares, not your petty worries; to discover the risks that really matter to your project, trace backward from effect to cause. Watch for oncoming trains.