As CFO, you’re charged with ensuring that your organization is positioned to deal effectively with all kinds of risks — operational, financial, reputational, and strategic. Assessing your organization’s risk profile through the prism of its portfolio of projects and programs can be a good place to start.
Projects are how you implement your strategy; project management is about having a structured approach to driving business results. If you’re not managing your projects, you’re not managing your risks.
In a recent PMI survey, 83% of high-performing organizations reported they “always” or “often” manage risk in conjunction with project management, compared to only 49% of low performers. (We define high performers as organization in which 80% or more of projects meet goals, come in on time and on budget; low performers are those in which 60% or fewer projects meet goals and come in on time and on budget.)
I just don’t understand why more organizations aren’t using risk management as often as they could. Why wouldn’t you double down on mitigating your downside and maximizing your upside?
A key strategic and functional priority for any organization should be to have the capability to see (or look) through the lens of enterprise-wide risk. This integrated perspective, aligning project and risk management, allows you to see patterns and commonalities that you wouldn’t otherwise. You may realize you have a weighting in a particular risk that has the potential to be the single point of failure in the organization.
In a sense, your portfolio of projects and programs is no different from an investment portfolio: You don’t look just at risks related to a specific holding, but rather at those of the portfolio as a whole. You should look at your project/program portfolio the same way.
It’s also important to take advantage of this aggregated view to assess the opportunities in your portfolio. In fact, not defining opportunities and risks is one of the primary causes of project failures, according to PMI’s recently released report, “The High Cost of Low Performance: 2016 Pulse of the Profession.” The portfolio view of risk allows you not only to mitigate the downside but see where you could be investing in capabilities that aren’t in place for longer-term projects.
To manage risk effectively, you need to commit to discipline and process. Two in three organizations reported having a formal risk-management process in place to assess and mitigate risks to the organization, according to a PMI study on organizational agility. But 40% of respondents cited lack of senior management support as one of the primary barriers to effective organizational risk management.
You can play the role of both champion and sponsor of risk management, keeping the dual focus on the downside and the upside. That allows you to be a strong strategic partner not only to fellow C-suite members but to the entire organization. If your organization has an Enterprise Project Management Office (EPMO), it can be a great asset to you. If your organization doesn’t have an EPMO, engage with whatever teams or senior leaders are responsible for strategy implementation.
It’s also important to understand that some risks are about the strategy itself, while others relate to the implementation of the strategy. Both types of risks need to be recognized and managed.
One of the best stories I’ve ever heard about managing both avenues of risk comes from John Furlong, who was CEO of the XXI Olympic Winter Games, held in Vancouver in 2010. Every two years, the Olympics represents one of the biggest portfolios of projects in the world, dependent on excellence in both strategy and execution. (Recall the media bashing the Sochi Winter Olympics took in 2014 for poor planning and execution on a variety of fronts.) The planning for the Olympics, is, as Furlong stated in a 2012 speech “exhausting…. One of the things you spend an enormous amount of time planning for is the weather.”
The Olympic Committee examined some 90 years of data around snowfall and weather patterns on Canada’s Cypress Mountain, a prominent site for many of the planned activities, and everything indicated “there would be more snow than we could possibly imagine.” Just to be safe, they started harvesting snow in November and put it at the top of the mountain.
When no snow had appeared by Jan. 8 — despite constant assurances from Canada’s national weather service that snow was on the way — the Olympic planners started spreading the harvested snow around the mountain. Then an unseasonable Pacific warm front caused the snow to melt. (So much for 90 years of statistics.)
The next step in risk/project management: harvesting snow from other mountains, and buttressing it with bales of hay. Logistics included determining which transplanted snow was “compatible” with the existing snow. A complex project, a seemingly low-risk strategy that nevertheless had enormous downside potential, and agile execution all came together to allow the events to go on as scheduled.
Project management is a powerful weapon in any CFO’s arsenal —when used/leveraged most effectively. Alignment of risk management and project management should be a strategic imperative for an organization. You can have one without the other, but doing so exposes your organization to unnecessary vulnerability.
Mark A. Langley is president and CEO of the Project Management Institute and a former CFO of ChemLogix and Assetrade.com.