The pursuit of courage, judgment, and luck: a rogue risk management rant.

  He who will not risk cannot win.
  John Paul Jones, 1791

Program management is risky stuff, in part because it relies so much on programmatic forecasts (a notoriously dodgy business, this fortunetelling). Accordingly, smart program managers institute risk management plans to deal with the potential of cost increases, budget cuts, schedule slips, performance failures, and the like.

[ILLUSTRATION OMITTED]

However, the traditional approach to risk management is seriously flawed. It overlooks several key elements of successful program management. When PMs think about risk at all, they typically pay prodigious attention to the mechanisms and methods of risk management, while the human side is frequently ignored. This often leads PMs to do the wrong things for the wrong reasons, producing the wrong results--and ultimately short-changing the warfighter.

In spite of, or perhaps because of, the volumes of officially sanctioned risk management guidance and training, all too many PMs think a good risk management process simply identifies and mitigates the bad things that can happen. Conventional risk management wisdom states that a closed risk is a good risk. Many PMs are apparently driven by the fear that their project could go down the tubes and take them with it.

Those beliefs are wrong in so many ways.

For starters, risk management is not supposed to be about preventing bad things from happening. Some readers may want to take a moment to let that statement sink in. Risk management is also not supposed to be about counting, tracking, and closing risk items. It's definitely not supposed to be about protecting the PM's backside. And yet, in case after case, that's what PMs make of it.

Real risk management involves accepting the fact that bad things happen, being as aware of those bad things as possible, and doing our best to make sure the bad things don't impact our customers' ability to accomplish their mission. Everything else is ... well ... something else.

Risk management--real risk management--is ultimately all about customer success. The point is to make sure we deliver a needed capability to the customer or die trying. Risk management should be as focused on taking the right risks as we are on avoiding the stupid ones. Further, it should involve PMs' accepting risks, rather than forcing our customers to accept them. It's simply a question of whose interests come first. Which brings us to ...

Customers First

What have our risk management activities done for us? Ah, but that's the wrong question. We should be asking what our risk management program has done for our customers. When the customer's success is our focus, risk management becomes a romantic, even spiritual activity, full of opportunities for love and self-sacrifice. It becomes something worth doing.

On the other hand, if we "successfully" deliver something (on time, on budget), but it doesn't actually help our customers accomplish their missions, then we have failed to accurately deal with the program's most important risk--the risk of irrelevance. No doubt such a PM will get rewarded for an on-time, on-budget delivery, despite this failure. And that's just plain wrong.

Oversights and Flawed Assumptions

The official guidance about risk management, in both the Department of Defense and industry, usually describes a paradigm in which PMs seek to establish and execute disciplined risk planning, identification, assessment, and risk response project phasing. Got all that? The primary objective is apparently to ensure the PM and his or her organization don't get in trouble. Very seldom is the customer even mentioned. The end result is PMs who take the safe-for-me route, embracing the risk of mediocrity while studiously avoiding any possibility of game-changing excellence.

Another fundamental (and flawed) assumption in this equation is that risk is bad. The brutally messy and scary news is this: If you care about your customer's success, risk is good, folks. A program with minimal risk is a program that isn't going to make much difference in the world. PMs need to get over the fear, abandon the reflexive CYAing, and get down to the real work of meeting the customer's needs.

Don't misunderstand. Rigorous thinking about risk is a vitally important aspect of program management. Discipline, integrity, skill, experience, attention to detail--all of these are good things and have a role to play in our risk management activities. Many of the analytical activities and thoughtful planning exercises have a great deal of merit. The well-established risk management methodologies are, generally speaking, useful tools. But ... once we've executed the proscribed plan-identify-assess-respond-etc., process, we are left with the need to decide and the need to act. That's where the real risk handling happens. When the analysis is done, the hard decisions have to be made, and sometimes you just have to grab the scissors and run with them.

Courage and Judgment

PMs can't allow risk management simply to be about checklists and procedures. We can't allow risk management to be a bloodless, rationalistic exercise in careful planning. It is rightly a human, subjective activity. When you get right down to it, risk management is basically an exercise in personal courage and professional judgment.

Lest we be accused of making stuff up, in the name of due diligence, we searched the Risk Management Guide For DoD Acquisition, Sixth Edition (Version 1.0 Aug 2006) for the words "courage" and "judgment." Neither word turned up. That's a shame, because if you aren't talking about courage and judgment, you're not really talking about risk. The DoD shouldn't feel too bad--we searched the online archives of a commercial journal, Risk Management Magazine, and got the same results.

Trust and Luck

It bears repeating that risk management is a human endeavor. We contend the best risk management strategy can be summed up in a single, terrifying word: trust. Trust your team. Trust your contractors. Trust your customers. Trust your boss. It takes courage and judgment to trust, but failure to trust is an unacceptably risky strategy. [The authors explained the importance of trust in "The PM's Dilemma," Defense AT & L, May-June 2004.]

Of course, risk management is more than just implementing approved methodologies with courage, judgment, and trust. Luck is a pretty important piece of the puzzle as well. What does luck have to do with risk management, you might ask? Just about everything. Fortunately, uber-guru Tom Peters' book Liberation Management lays out a list of 50 actions designed to help in "the pursuit of luck." While following his advice doesn't guarantee success, doing the opposite of what he recommends pretty much guarantees failure. A quick Google search of the words "tom peters luck" will provide the actual list, for curious readers.

Those of a more scientific mindset may prefer to refer to University of Hertfordshire professor Richard Wiseman's research. The aptly named Wiseman executed a 10-year study of luck. He published his findings in a book titled The Luck Factor: The Scientific Study of the Lucky Mind (2003) in which he observes that luck perception and luck production are both related to personality factors such as optimism, extroversion, openness, and low levels of anxiety.

Wiseman's research showed that while people who describe themselves as lucky are not more likely to win the lottery, they are more likely to experience positive outcomes in other, less random activities. For example, a person's extroversion creates a large social network, which can lead to "fortuitous" connections with people and resources. Openness to new experiences leads to action, as John Nash said in A Beautiful Mind, "The probability of my success increases with every attempt." Turns out, he was really on to something. The bottom line: Luck is real, and you probably want an optimistic, open, extroverted, lucky person leading your risk management team.

Of course, there are those who scoff at luck and optimism. They might even sniff, "Hope is not a strategy." However, a significant body of research seems to indicate that optimism might indeed be, if not a strategy, at least an important and reliable strategic element. In fact, in addition to contributing to luck, optimism is itself a powerful and direct component of achievement, as Dr. Martin Seligman demonstrated in his book Learned Optimism. Pessimistic risk managers will tend to have more negative outcomes than optimistic people (call it bad luck). Fortunately, as alert readers may have guessed. Seligman's book claims optimism can be learned, which is why we brought it up in the first place. Pessimists might want to peruse Seligman's book. There are worse ways to spend a little time.

It Comes Down to This

PMs have to do risk management because the world is uncertain. Everything is not under control (and if it is, it shouldn't be). No matter how smart, educated, optimistic, or lucky you are, things will sometimes go wrong. No amount of risk management will ever change that. But as we said, risk management is not really about preventing bad things from happening anyway.

Yes, there are always ways to avoid or mitigate the risks involved with program management and technology development. However, when we mitigate away all the risks, we virtually guarantee mediocrity. Six Sigma, for example, has been described as "a way to measure the probability that a product being developed will have almost no risk." If that's true, it sounds like a pretty good way to identify products and procedures the research and development community should run, not walk, away from.

PMs must engage in risk management activities, but those activities require courage and judgment, not simply checklists and database entries. Trust, hope, optimism, and luck are all, to a certain degree, in your grasp; and they will go a long way towards ensuring meaningful risk management, leading to customer success. And that's what it's all about.

Only those who dare to fail greatly can ever achieve greatly.

Robert F. Kennedy

The authors welcome comments and questions. Contact them at [e-mail] and [e-mail].

Maj. Dan Ward, USAF * Maj. Chris Quaid, USAF

Ward holds degrees in electrical engineering and engineering management. He is Level III certified in SPRDE, Level I in PM, T & E, and IT. He is currently assigned to the Air Force Research Laboratory in Rome, N. Y. Quaid is currently deployed to Afghanistan, where he is doing field research on risk management with the Army.