The basics

by Matthew Leitch, 18 March 2003

Common sense good management

Have you noticed that things rarely turn out as expected? The most likely outcome is rarely what happens. Usually it is something else - one of the innumerable alternatives, each less likely than the expected outcome, but collectively more likely than the favourite.

Modern society and systems are so large, complex, and fast moving that we face an unprecedented problem of uncertainty, and it's getting tougher. Companies, charities, and governments are under intense pressure to handle uncertainty better and are trying various methods and programmes to do so. Specialists are emerging and preaching good risk management.

When I say this most people have the same reaction: "Dealing with risk and uncertainty is everyone's job! It's just good management. I do it all the time." Quite right. The daily decisions and actions of people throughout organisations are where most of the risk management action is. Special corporate programmes with workshops and risk registers are comparatively low in importance.

It should be obvious that the risk management skills of individual managers are important to an organisation and that recognising the contribution of everyday risk management decisions should be an important part of any organisation's formal risk programme.

The scope for improvement

What is less obvious is that most of us are not as good at risk management as we think. There are three reasons for this:

• Natural reasoning flaws: Psychologists have discovered many persistent flaws in the way we think about likelihood. Even Professors of statistics make big errors when they rely on their judgment. Typically, we have an overly narrow view of what might happen in the future. Finding ways to counter these subtle but important errors has been so difficult many have concluded that they are an innate and inevitable.

• Pressure from other people: The impact of our innate mental limitations is nothing compared to the effect of pressure from colleagues at work. Almost daily we are pressured to appear more certain than we really are and to fix our minds on one future outcome only. The result is that we suppress uncertainty. We don't talk about it, think about it, or manage it as much as we could and should.

• Lack of knowledge: Finally, we get little education or training in effective risk and uncertainty management techniques. Things are changing but there's still a long way to go. In my education more time was spent trying to teach me Latin than risk. Most people don't even know what they don't know.

Thanks to these issues risk is frequently overlooked or mis-managed by individuals and large organisations alike, with a variety of consequences from the stress you feel at the end of the day to the collapse of the telecoms industry.

If this still seems like it's going to be obvious common sense, bear with me. You will be surprised.

Basic terms and concepts

The first thing that may surprise you is how chaotic the jargon of risk and uncertainty is. The experts do not agree on the meaning of "risk", "uncertainty", or even that mathematical word "probability". I use the phrase "risk and uncertainty" because it encompasses the general area of interest (almost) regardless of which definitions you happen to prefer.

It's probably easiest to stay with the normal meanings and associations most people have to these words as far as possible. However, there are some important finer points. Here's a fairly natural way of defining risk management and associated terms and gives you just about all the theory you need in three minutes of reading.

• Alternative outcomes / events: When we think about the future we can imagine alternative outcomes (a.k.a events) at various points, and there are still more outcomes we don't think of.

• Risk management / uncertainty management: Risk management is an activity where we think about outcomes other than some benchmark outcome and try to manage those outcomes, for example by doing things to make them more or less likely or to modify the impact if they should occur. For much of its history risk management has concerned itself only with bad things that might happen, but increasingly people are bringing in all alternative outcomes. One way to help people stop focusing exclusively on the negative is to say "uncertainty management" instead of risk management.

• The benchmark outcome: Often, though not always, one future outcome is special to us. This might be the most likely outcome, or the outcome we are planning, or some other outcome that seems to us proper for some reason. This is what I call the benchmark outcome, and we have a choice about what it is. For example, if a bank lends some money to someone the proper outcome is that the money will be paid back, with interest. People naturally take this as the benchmark level.

• Upside and downside risks: Outcomes more favourable to us than the benchmark level are seen as upside risks, while outcomes less favourable than the benchmark are seen as downside risks. If you just say "risk" most people assume this refers to a downside risk. We have a choice about what we take as the benchmark level and this affects what we classify as upside and downside. For example, if you launch a new product, plan for one particular level of sales, set a budget for another level, and forecast yet another you have at least three obvious alternatives for your benchmark.

• Risk factor / driver: Things which are true now or expected to be, and which we see as creating risks in future are often called risk factors, or risk drivers. For example, smoking is a risk factor for heart disease because a person who smokes now is more likely to get heart disease later.

• Set of risks / area of uncertainty: Often it is impossible, inconvenient, or unnecessary to think about every alternative outcome and we prefer to group risks together into sets. More often, these are called areas of uncertainty. It is common to call these "risks" as well, which leads to some confusion and mistakes.

• Issue: An issue is something bad about the current situation. It is not a risk.

• Opportunity: An opportunity is something good about our current or future situation that makes it possible for us to do something we find attractive. If you ask people to think of opportunities they will usually list many opportunities inherent in the current situation.

• Future opportunity: If you want people to think about opportunities that might arise in future you need to make that clear, so I suggest talking about "future opportunities".

• Probability / likelihood: There are two philosophies on this. The Frequentist view is that probabilities are a natural phenomenon based on relative frequencies of occurrence. For example, the probability of a person getting heart disease is something we can find from the proportion of people who get heart disease. The Bayesian view is that probabilities represent our degree of certainty about the truth of propositions (i.e. statements that can be true or false). Most risk management effectively assumes a Bayesian view of probability.

• Expected value vs expected outcome: "Expected value" is a mathematical concept and different from the expected outcome. It is the probability weighted average outcome. For example, if you play a game where you roll a die and receive £10 for any number between 2 and 6, but lose £50 for throwing 1, the expected value of each throw is 10 * 5/6 - 50 * 1/6 = zero. However, we would normally think of winning £10 as the expected outcome with a risk of losing £50.

• Internal controls: This phrase refers to anything that is done to try to make sure something happens as intended. For example, if the task is to raise invoices, then internal controls might include things like checking invoices before they are issued, testing of the computer software that creates the invoice, and training for the person who uses the software. Internal control experts tend to have a much broader idea of internal controls than non-specialists. In the example just given, most people would not see the training as an internal control, but control specialists usually do.

Think more effectively about risk and uncertainty

Baffling papers and deeply researched books have been written by Harvard Professors and leading consultants, covering sophisticated methods like "scenario planning", "game theory", "real options analysis", and "probability distribution elicitation" but this web page, like everything else on Managed Luck, is for busy people.

It describes simple methods that can be used daily on problems large and small, by people thinking alone or with colleagues, without a corporate programme. These are the methods that help us make sense of any situation and deal with it, occasionally by going on to apply a more sophisticated technique, but usually without that kind of effort.

The right techniques for thinking about risks and uncertainties can dramatically improve our ability to make sense of situations and influence outcomes in a helpful way. This is because they accomplish two things:

1. Open our minds to future alternatives: We tend to have an overly narrow view of the future, so we benefit from techniques that open our minds to the full range of future alternatives. These techniques need to help us overcome our innate limitations and pressure from others.

2. Simplify action planning: Another reason we don't normally notice the full range of potential future outcomes is that there are lots of them. We instinctively fear the explosion of complexity and feel we can't think through it all. Fortunately, there are several techniques to cut through this complexity and dramatically accelerate action planning.

Applied singly, or in combinations, the key techniques described below open your mind and close down the problem of action planning. They are deceptively natural and convenient, yet they overcome some big barriers.

Seven techniques for busy people

The techniques of most value are those that allow us to make powerful inferences about the actions we should take, quickly and easily, from limited and poor quality information. They should help us pick out the relevant information from a confused situation, quickly and reliably, and allow us to make the main decisions about future action with ease.

With the ability to get close to good answers quickly, it only remains to add more sophisticated refinements where necessary for precision in big decisions.

Here are 7 key methods for everyday risk management. The first four are often used together.

1. Identify uncertainties

Whether you are planning your day sitting alone on a train, or planning the strategy of a global company in a conference room meeting, the starting point for managing risk and uncertainty is to identify your areas of uncertainty. Make a list. There's no one right answer. (Later I'll show an example of a table format that puts several of the basic techniques on one page.)

Simple? Common sense? When was the last time you did it? Making a list is very different from having a general awareness that you face a lot of uncertainty.

It is vital to open your mind to the full range of future outcomes, and listing areas of uncertainty will start this process. As you go, more and more will come to mind. Some people like to have a list of headings as prompts, but this is not essential.

Just make simple observations about your circumstances and intentions, and see what they suggest about uncertainty. Some surprisingly penetrating insights can be produced with this simple method.

Example: Easy deductions. Imagine the organisation you work for, which is not a retailer, decides to open its first shop and to locate it in New Bond Street, London. What can you deduce about the areas of uncertainty this involves? Firstly, as this is the first shop the odds are that your employer has little prior experience of retailing to draw on. So that's a fairly suggestive fact straight away. The value of the venture is questionable and so is your competence to make it work. Next, the location. New Bond Street is an area chock full of very expensive shops selling clothes, jewellery, art, and so on. How will shoppers in this area react to your shop? Will they be in the right mood? Are they people you want to have coming into your shop? Easy isn't it! Start with the most important, most distinctive facts ("a shop" and "in New Bond Street" for example) and work from there. You are almost guaranteed to be focused on the right things straight away.

Your objectives are likely to be a good source of ideas about uncertainties. (If an uncertainty does not relate to your objectives in some way it is not important to you.) But beware of turning objectives into risks/uncertainties without thought because this can lead to rather theoretical and unhelpful risks/uncertainties. For example, if you have an objective of launching a product and decide that an uncertainty is whether you succeed or not, that is little help. Try opening it up by asking why you might succeed or fail.

Don't forget that even your objectives may be an area of uncertainty. Even if they have been written down and agreed at the highest level in your organisation there is still the chance that things may change. In fact, they probably will.

Knowing the common reasons for uncertainty can make it easier to spot:

• Novelty - particularly where new conditions are different from conditions that have been unchanging for some time and which you have become accustomed to. It can be difficult to identify and review all the ways in which assumptions about that factor have become embedded in your current behaviour so errors are common.

• Complexity - particularly when the complexity is from numerous, interconnected elements interacting.

• Speed - because if you have less time to gather information and think you will have to guess more.

• Intangibles - especially psychological things. Predicting human behaviour is extremely difficult.

Review your list from time to time, both regularly and when some important event has happened to change things.

This technique has two helpful effects. First, it makes you aware of your uncertainty and begins to open your mind to alternative futures. Second, just as important, it does not involve itemising every possibility. You stay at the level of areas of uncertainty and can make decisions on action without going further.

This first example shows the impact of managing uncertainty in this way. It also illustrates other techniques explained later.

Example: Super-Organised Stuart and Risk-Aware Rob. Imagine two companies are vying with each other to buy a third company. Each of the competitors hires accountants to perform a "due diligence" review in which they will interview senior people and look at documents to try to find out more about the company on offer. They have one week, starting Monday with their reports both due on the following Monday morning. The two teams of accountants both have the same job to do, but the team leaders have very different styles of working.

Super-Organised Stuart quickly establishes a written scope and gets it signed off. He gets hold of an organisation chart for the target company and draws up a plan of interviews, which his secretary starts to arrange. As usual, he starts at the top with the Chief Executive. He plans the work in a series of logical stages. Interviews will be performed and results documented in the file. A report will be drafted starting on Thursday afternoon ready for an initial review on Friday afternoon. He'll have to work over the weekend but he's confident that the schedule has enough slack in it to cope with anything unexpected.

Compared to Stuart, Risk-Aware Rob seems to be a bit of a mess. No schedule of interviews, no timetable, and a scope documented still marked "DRAFT". Rob spent his planning time going through areas of uncertainty for the bid, the scope, and his review. He has already had a telephone interview with the Chief Finance Officer to get information that helped to clear up a lot of his ignorance and requested two meetings as a result of that. The other meetings have still to be decided. Like Stuart, he will start with the CEO on Monday.

Monday morning and both teams get their hour with the CEO. The CEO is impressed by Stuart's confident manner and detailed planning, but also by Rob's realism and intelligent responses. Rob in particular seems to be using information gained to plan the rest of his review. The meeting with Rob ends with identifying the right people to speak to about the issues Rob appears to be interested in. They're not all the same as Stuart's interviewees. Rob ends by saying that he expects to learn a lot and may need to come back for other contacts or explanations. The CEO tells both teams about the importance of the company's treasury operations and their progress since a problem a year ago. Both Stuart and Rob respond that this is outside the scope of their work, but Rob says he intends to check that and asks if it will be ok to ask questions in that area if the scope is changed.

Monday afternoon and Rob decides to cover the risk that his scope may be changed to include the treasury questions. He calls his office to find a treasury expert. After a few minutes talking with the expert Rob decides it probably should be added to the scope. He puts his views to the client who agrees to come back with an answer as soon as possible. Without waiting for a reply Rob calls his own office again and starts a search for a treasury expert who could be available at short notice to do a day of investigation.

That evening Rob and his team are still hard at work long into the evening as they work through the information gained in the first interviews, considering the implications for their review and for the bid. Rob wants to manage down the uncertainties of the review as quickly as possible and does not want to be caught out discovering problems near the deadline. Stuart and his team are at their hotel, having dinner, on schedule.

Wednesday morning, and Stuart's office calls to say they have heard about a nasty treasury issue and could he cover it in his review? "Out of scope" says Stuart but agrees that, if he receives a revised scope he will include it in his review. He calls his office to try to find a treasury expert at short notice. He finds one, but very senior. Stuart had a tight budget, but it's too late to worry about costs, he decides. Rob's treasury expert finishes his review that afternoon.

Also on Wednesday morning Rob starts to draft his final report, starting with the executive summary. It's too early to finalise any words, but Rob knows that attempting a first draft is one of the best ways to identify information needs, reducing that uncertainty and reducing the risk of reaching the weekend without key facts needed to finish the report. By that afternoon he has 40% of his text and has added some items to his team's target issues list.

Thursday morning and Stuart hears from his treasury expert. Apparently, the key people in the treasury department are in a training workshop in Paris for two days but might be contactable by mobile at lunchtime. Stuart is aghast. He spends much of the morning trying to make contact or find alternative approaches to reviewing the treasury area.

By Thursday afternoon Stuart is still not in a position to begin drafting his report. There are key interviews outstanding for treasury, and also it has emerged that the IT director was unable to provide any detailed information and that further interviews are needed with two managers closer to the action. Knowing that time is running out Start starts drafting anyway and instructs his team members to begin drafting their sections as best they can. Most are still doing the file notes, but recognise the need to start drafting the report.

That night Super-Organised Stuart's team work late into the evening, but Rob is at the hotel with his team, unwinding over dinner, having managed down their uncertainties earlier in the week.

Friday, and more problems for Stuart. Nobody in his team has submitted anything completed for the report and on talking to them he discovers why. His original plan committed the team to a particular level of detail, but now it is clear that they don't have time to do as much. Rob was also disappointed at the difficulty of getting good information but always knew it could happen. His goal was to do as much as possible in the time. Another difference is that on Thursday afternoon Rob deliberately produced a first draft with limited detail but a complete structure. From then on, he could not fail to deliver something adequate and further work will just make it better.

Friday afternoon and things are looking up for Stuart. One of the treasury people has taken time out of the Paris training for a telephone conference and the treasury section has been covered. What a relief. If he works over the weekend he should have something by Monday.

That weekend Stuart works on Saturday and Sunday to re-write almost all the report. He gets review comments from his boss on Sunday. It's not comfortable but in this line of work such desperate measures are normal. There are some points where Stuart wishes he had more relevant facts to clear up issues he is only now noticing, but overall he is happy with the result.

Rob relaxes over the weekend, apart from spending some time on Sunday morning reading through his work. He knows it is easy to make mistakes in the pressure of a review and that Friday is bad time for being careful. He corrects some typos and improves the section on IT. His team also review the report that weekend because Rob says there is a risk of his mis-understanding what they have told him or written in their draft sections.

Monday morning and Rob presents his findings to the client while Stuart rearranges his client meeting for the afternoon. Nobody will ever see both reports side by side, but if a comparison was made it would show that Rob's report is far more focused on the big issues, more insightful, and more detailed where it matters. Stuart's report, by contrast, seems like a fairly even coverage of a checklist of standard issues without much flexing.

Just being aware will change your thinking and behaviour, but don't stop at awareness.

2. Consider the impact of your uncertainties

This technique is important for focusing your planning on key areas, but it also increases your awareness of alternative futures.

Having some idea of the significance of your uncertainties is helpful when it comes to deciding what actions to take, but accurate, mathematically sound ratings can be difficult to achieve. Fortunately, for most day to day risk management, they are not needed.

The question to ask about each area of uncertainty is "What difference could it make?" In answering this you may want to eliminate extreme outcomes that you consider very unlikely. Just where you draw the line is your choice.

At this point you will need to give some thought to alternative outcomes. What might happen? It is not necessary to do this in depth. Deeper consideration of alternatives is technique number 5, below.

Often, it is not necessary to arrive at a specific conclusion as to "How much?" If it is clearly a lot of difference and there's not much doubt that some kind of action is required then it may not be necessary to think any further. The risks are major and that's enough. If, later, it emerges that the only actions you can take are expensive or otherwise a problem you may have to come back to the impact of the uncertainty and consider it more fully.

Another shortcut is to put the uncertainties in descending order of impact so you can draw a line to identify the top areas for more intensive work.

It is helpful to write a short explanation of the impact rather than just assign a number or classification.

If quantification is appropriate the technical understanding required to do it correctly is greater. However, even quantifying subjective views is enormously beneficial. Supporting judgments with data makes them more valuable still.

Individual risks (i.e. potential outcomes) can be rated for their probability of occurrence and impact if they did occur. However, this technique cannot be applied to sets of risks, so a different method is needed.

Sets of risks can be rated by estimating the probability distribution of impact. If the number of risks in the set is small the distribution can be what mathematicians call a "discrete" distribution with every risk considered individually. For example, if there are only five outcomes their probability and impact ratings can be combined on one table or graph e.g.

If the number of risks in the set is high or infinite a "continuous probability density function" is more appropriate and easier than it sounds. This can be tabulated or graphed, and various summary statistics can be computed for more compact summaries. For example, estimates might be made of the probability that the impact will fall between a set of ranges:

Many existing company programmes of risk assessment focus exclusively on downside risks, where the benchmark is defined as "our current plans". A popular way to do ratings is to rate each area of risk for its probability of occurrence, and impact if it should occur. This is illogical if the area of risk contains more than one risk but a simple and logical alternative is to give just one rating. This rating is the level of downside impact you are X% sure you won't exceed. For example "For 'health and safety' we are 95% sure the impact won't be worse than £10m." This is a very simplified version of the probability density function idea.

If you want to assess the impact of the uncertainty on forecasts of business performance or project outcomes you need to decide what the benchmark level should be, then decide how much of the impact is on the upside and how much is on the downside.

Risk quantification is a complex area and further discussion is beyond the scope of "The Basics".

3. Consider monitoring and research

This is a technique that follows on from identifying areas of uncertainty and allows you to identify important actions without getting mired in the details of alternative future scenarios.

Uncertainty can often be reduced advantageously by finding out more. Sometimes there are things you can do immediately, which I refer to as "research", but often it is just a case of making a phone call. Usually you have to wait for more information, in which case it may be worthwhile planning to monitor relevant sources of information.

First, think about the nature of each area of uncertainty to see if that tells you about whether the amount of uncertainty can be reduced. Sometimes there is nothing that can be done, such as when predicting the outcome of a toss of a coin. Second, think about what you could do by way of monitoring and research.

Your draft actions actions flow as follows:

• If uncertainty is high for a relevant area and it would be easy to reduce it by research, decide to do the research, though not if that research could influence actual outcomes adversely (e.g. don't ask a competitor if they intend to block your next strategic move; it could prompt them to do so).

• If uncertainty is high for a relevant area and we will probably get useful new information if we monitor and wait for it, decide to monitor. (This decision is independent of the research decision.)

• If uncertainty will remain high whatever we do, choose one of the robust patterns of action (see below) such as multiple-stages, portfolios, reusable blocks, or cheap commitments (though you would probably want to do so anyway). Do not let someone else push risk onto you unless you have to.

If this leads to too many actions or to actions whose cost-benefit is in doubt one can always prioritise the actions and decide which are worthwhile.

4. Consider mitigation and exploitation

Besides finding out more, what are you going to do about your areas of uncertainty? There's little in this technique that helps to cut down the complexity of considering alternative futures, but it keeps your ideas in a structure and, combined with the techniques explained below, it can be surprisingly easy to come up with very effective actions.

Future outcomes tend to have a number of effects/impacts, both favourable and unfavourable for us. By doing things in response we can change the impacts and sometimes, by doing things in advance, we can put ourselves in a better position to control those impacts. In short, preparation can help. Also, by our actions we can influence the likelihood of different events.

To get an initial idea of what you actions should be follow this procedure:

• If you see a way of reducing the negative impact and/or increasing the positive impact of a possible outcome, note it down as it might be useful. (Basic techniques include sharing the impact with someone else, having a contingency plan and any necessary resources in place, having some fallback in place, getting insurance, creating a buffer or insulation, reducing a commitment, weakening the causal links between the outcome and the negative consequences, and giving yourself more than one chance.)

• Having considered ways to modify the impact of outcomes, do you see any ways to make outcomes that are, overall, positive in their impact more likely? Do you see how to make outcomes that are, overall, negative in their impact less likely? If so, note them down. (Basic techniques include weakening/strengthening the causal link between drivers of the outcome and the outcome itself, putting your best people on the most important uncertainties, altering things that are drivers of the probabilities, and avoiding combinations of hazards at the same time by changing the timing of events.)

• Do any of the actions noted down look worthwhile? If so, decide to do them.

Once again, having quickly roughed out some actions it may be worthwhile going into more detail to get precision or a more comprehensive and knowledgeable analysis by using a more sophisticated approach as well.

Example: Running conferences. Imagine you have a job in the Conferences department of a thriving society for people who study lichens. Your role is to gather ideas for conferences, arrange them, sell them, run them, and report on the results obtained. You've been doing the job for a year and it's turned out to be a lot more difficult than you expected. On top of all the stress of getting everything ready for each conference there is the problem of deciding whether to go ahead with a conference idea. It all depends on how many people attend, which is proving very difficult to predict and nobody in your department seems to have more than a vague idea, even though they still seem confident they can predict demand and always act surprised when things turn out differently from their expectation.

One of the most awkward situations is to have to abandon a conference because of poor take up after it has been advertised and some people have signed up. This has happened three times in your first year and it is more costly than you expected because the venue is usually paid for in advance and only a small part of the fee is refundable.

Thinking about the uncertainty you face it is obvious that it is mainly uncertainty about demand. This is generated by the intangible nature of the interests of the scientists who might come, and is worse for conferences that are on unusual topics not previously explored. By contrast, the annual conference on Scandanavian tree lichens has been running for 12 years and attendance is pretty steady.

However, this uncertainty can be reduced by appropriate research. You decide to try a survey using a market research method called "conjoint analysis" at the next big conference and also on the society's web site to find out what the members value in a conference (including rating specific topics), and exactly how much. For example, what is the impact of the venue, the time of the year, the narrowness/breadth of the topic area, the style of the presentations, and the reputation of the main speakers? Using the analysis will give you a much better chance of proposing conferences with a good chance of at least breaking even.

The uncertainty can also be reduced by waiting more time to see how many people actually do sign up. However, the problem of non-refundable venue fees has to be reduced at least. You survey suitable conference venues to find out their cancellation fees and discover that some will refund closer to the date of the conference than others. By favouring these venues for novel conferences, encouraging members to sign up early, and monitoring the growth of committed attendees you can avoid the venue fee problem much more often than in the past.

Here is an illustration of a simple table design that accommodates the techniques described so far for rapid reasoning about uncertainty:

With simple techniques like this it is possible for everyone to practice managing uncertainty better, all the time. Your organisation may have its own designs for different situations.

5. Clarify alternative futures

If you want to go beyond a very quick analysis the next step is usually to think in more detail about what the alternative outcomes might be for each area of uncertainty, or combinations of them. The step of clarifying alternative futures (i.e. thinking of specific risks) is a way to control the level of detail you go to. As usual, the main aim is to get a wider, more realistic view of the full range of alternative outcomes.

Thinking through alternative outcomes is beneficial in a number of ways:

• It tends to expand your appreciation of the uncertainty you face.

• It can help you assess the impact of your uncertainty.

• It can suggest specific actions for monitoring and mitigation/exploitation.

• It can improve your ability to identify the different future scenarios as they start to unfold.

This last benefit is thought to be one of the greatest advantages of "scenario planning", which is based on extensive thinking about alternative future outcomes. If you are going into a situation where you will have little time to think, or if the signs will be subtle and hard to read, this could be a useful mental preparation for yourself and your team.

6. Make risk-aware plans

The quickest and easiest way to make plans that have good risk profiles is to use a form of plan that is inherently risk aware. Having done this there is still a need for some detailed analysis of risks, and action to refine the plan, but the right basic form is the most important step. Here are the main forms of plan with good uncertainty management characteristics. Understand them all and draw from them as your first choice.

• Multiple-stage projects where each stage is valuable in itself, with opt outs: In this pattern there are two helpful things going on. Firstly, each project stage is designed so that it is worthwhile in itself and would be desirable even if it was decided not to go on with further stages. Secondly, there is the option to quit after each stage, and do no more stages. Both contribute to average returns, and improve them provided excessive sacrifices were not made to design the project in that way. In Evolutionary Project Management projects are divided into roughly 50 sub-stages, achieving a dramatic improvement in risk profile.

• Portfolios: The portfolio pattern means putting your eggs in several baskets, instead of just one. This is the normal approach with investing in company shares, but also applies to research projects, new products, new systems, and so on. The idea is often to try lots of things and monitor closely for signs of successes that can then be pushed harder, while failures are pruned away. The benefit of diversification in this way is greatest if the performance of the individual investments is not correlated. Sometimes people standardise something in an organisation for perceived efficiency benefits without allowing for the loss of variety and the implications of having reduced learning by leaving fewer experiments with which to discover success.

• Reusable blocks: Building or achieving something that could be re-used in other projects or to meet other objectives is another useful pattern. Reusable blocks tend to be useful even when conditions and the goalposts have moved. Reuse also has good environmental credentials.

• Cheap commitments to create options: Keeping your options open is nearly always valuable. Generally it is better to make low commitments if you can. Avoid up-front investment wherever possible. Delay commitments. Make your commitments low.

• Pareto value sequencing: Often, you can divide the work and prioritise it so that the items of greatest value can be done first, with less important items left until later. If time or resources run out before the lesser items are done this is less damaging than if an important item is left undone. The project degrades gracefully. For example, it is often safer to create a rough but complete version of a deliverable first, then do a series of refinements, than to do half the deliverable to full refinement, then start working on the second half. Another example would be trying to get everyone in a team to learn Risk Management by Christmas. Not everyone's skill in Risk Management will be equally important, so start where Risk Management is most useful and move out from there.

• Systematic risk reduction through variable costs: Systematic risk is risk that comes from general economic conditions and affects just about all businesses though to different extents. Some investors use a number called beta to represent how much a company's results are affected by general economic conditions. These investors consider a low beta desirable and worth paying extra for because it shows that returns from the company are steadier whatever the economic climate. One way to reduce your beta is to do what you can to keep fixed costs a low proportion of your total costs. Fixed costs are costs that do not vary with your output or sales.

• Systematic risk reduction through counter cyclical activities: Another way to get a lower beta is to combine two activities that react in opposite ways to economic conditions. For example, insolvency plus services to create new companies, or selling new and used cars, or housebuilding and renovation, or taking deposits and making loans, or a recruitment agency that also does outplacement advice.

Example: Best Practices Bob and Risk Savvy Rachael. Two similar research companies embark on similar projects to implement "knowledge management". Each begins with the idea of creating a bespoke computer system to harness the power of knowledge more fully in their organisations. This is a strategic objective and has good support in both companies. Both hire top project management talent to steer their project to success.

Best Practices Bob is in charge of one of the projects. He is an impressive figure with many years of experience behind him. His knowledge of project management techniques is formidable and his confident manner is just what his steering committee wanted. Bob likes to apply "best practices" on his projects and feels he has an impressive track record of success as a result. Of course some projects fail for reasons outside his control, like the last one, where the customers changed their mind late in the day.

Bob sets up a project office to help him run his project. He's got quality management, requirements management, resources management, earned value reporting, risk management, change management, configuration management, benefits management, release management - you name it. (Project managers will know I'm not joking.) Bob's plan features a pilot and global roll out, so with the risk management and risk budgeting he knows he has risk covered.

Risk Savvy Rachael would agree that Bob has just about everything - except, that is, for a realistic plan. She is in charge of the other project and knows that a two year project like this is much more of a challenge than that. She too has management systems and in fact spends longer on looking at the benefits than Bob. Where Bob was intent on establishing measurable goals for benefits and getting commitment to them, Rachael knows that people have little clear or reliable idea of benefits so early in a change project. She also wants to know how the various interested parties would value other, potential outcomes.

The most obvious difference with Rachael is that she has submitted a radically different plan. Her plan shows 34 sub-projects, each of which is thought to be worthwhile on its own, except for 3 which are marginal or worse. Her Steering Committee were initially taken aback by this and even more so when she explained that she expected to change the list of sub-projects as she proceeded. "So what is it you are asking us to approve, Rachael?" asked the Chairman. As Rachael explained the inherent difficulty of anticipating benefits and outcomes of large change projects and gave examples of similar projects and their outcomes the Committee began to see that Rachael was talking a lot of sense. Rachael showed how, with her evolutionary approach, there was no risk of spending money for a year and having nothing to show for it. Rachael's metric of progress was not earned value, but delivered value.

By the end of month 3 Bob's project is going well. Some tasks fell behind schedule but by reallocating resources and moving some tasks off the critical path he has put things back on course. Rachael is doing even better. She has finished the first two projects. One has improved backups for the office servers that will run the new system while the other has put in place a new training course in knowledge management for research team leaders. Already they are being encouraged to share knowledge more effectively using existing systems.

Month 8 and Bob's systems have been specified and some coding has started. He is slightly behind schedule because of user indecision over some requirements. They can't agree on what they want. Eventually Bob had to exert pressure to get a decision. Now they are under time pressure, but Bob feels he should be able to pull things back later and remains confident in his dealings with the Steering Committee. No need to get them worried unnecessarily.

Rachael too found that users were not sure what they wanted. The reason was simply that they didn't know what would actually work for them. By this stage Rachael already has a working system - it's not bespoked yet and its functionality is very limited, but it is usable and some content is already in place. She suggests that a set of experimental features be added and that different ways of working should be tried out by users for three months to see what worked. Seeing a way past the impasse, the Steering Committee agree to this.

Month 10 and already Rachael's users have found two things that seem to work well and attract popular support. First, using the systems to allow people to find out who shares their interests turns out to be simple but vital. Second, they like to have pages on the system owned by named individuals, who are motivated to contribute by the chance to raise their profile and show some knowledge. Bob's users did not have the benefit of experience and agreed to the more conventional approach of collecting documents in a database. Their databases are nearly ready.

Month 13 and Bob's users are testing his databases. Rachael's work is far from over but knowledge management is already much more developed than in Bob's company. To everyone's amazement both companies are bought by a mega-group from Japan. Both companies come under the same regional head and he wastes little time in explaining that, in his opinion, knowledge management systems are over-rated. Investment in databases is to cease but investment in training and facilitation for knowledge management is to be stepped up.

Bob appears philosophical. "There's nothing you can do about that sort of thing", he says. "If the users change their minds who are we to say they are wrong?" Privately he is devastated and can hardly believe what he sees as his bad luck. His training plans were geared entirely to the system under development. The system cannot be delivered. He has been spending money for a year and has nothing to show for it. Suddenly, his statistics on "earned value" look like a joke.

Rachael's position is completely different. Throughout the project she has been getting together a group representing interested parties to review the discoveries from sub-projects and revisit the original ideas about benefits and goals. As a result her projects have been changing throughout. For example, once it had been recognised that putting people in touch with each other was a vital benefit of the system, the benefits of this and of the activities people do when they then get together had received more attention in her later sub-projects. The implications of the new instruction to stop work on databases are minimal as she already has a working system - though not perfect - and already has plans for several training and facilitation sub-projects, all of which were designed to stand alone.

7. Design systems of internal control

If your job includes making sure some system or process is operating smoothly and reliably you will need some skill at designing internal control systems and individual internal controls. Rather than trying to think up responses to individual risks or areas of uncertainty, the idea is to design a single system that deals with them all.

If you analyse the activities in just about any part of an organisation you will find that a surprisingly high proportion are done to try to make sure something else happens as it should i.e. they are internal controls. Designing internal controls well can make your operations and projects more efficient as well as more reliable.

Design internal controls as a system rather than one by one. Start with a grand scheme and work down to the details. This can be done in four steps:

1. Choose an generic scheme: This will be a diagram or list of headings showing all the elements of an internal control system. Good schemes have multiple layers and divide the controls into control types rather than control objectives. This generic scheme helps you think in terms of a system and avoid missing important elements.

2. Look at aspects of what you are trying to control and think about what they imply for your internal controls: Anything that is important or characteristic of the process, the products, the company, its strategy - anything important - can be a source of implications for your controls scheme. Think about the implications for the risk of things going wrong, the cost and time of implementing and operating different types of control, and for the style of control your culture needs.

3. Sketch out your design at a high level in terms of types of control mechanism: Sum up your ideas by making decisions about the most important controls, and about the types of control mechanism you intend to put most effort into.

4. Identify the detailed design work needed to fullfil your overall system: Take a look at your design and list out the work needed to make it happen.

5. Do the detail: Assign the work and get it done. If some of your original decisions need revising, revise them.

Controls design is a fascinating area but doing it really well takes a lot of knowledge.

The one-page summary

Here's a summary of the 7 techniques:

Putting this into practice

For most people, putting into practice the common sense techniques described above does require a change in habits. Most of us are under daily pressure to appear more certain than we are and fix our minds on one future outcome, rather than thinking more widely as we should.

However, it is not difficult if you start gently and get started without delay. Soon more things will be going right and fewer things will be going wrong.

First, become aware of the role of uncertainty and risk, and watch how you and others think about it. There's no need to wait for a special occasion, because just about everything we do involves thinking under uncertainty.

Then start small, doing simple analyses on your own. Write some lists. Don't commit to doing complete analyses every time. Even doing a little will be beneficial. Doing more is better, as you will soon be able to confirm.

Once you feel more confident and familiar with the techniques and your area of work, involve colleagues, starting with subordinates.

One of the main reasons we shut uncertainty out of our minds is that our boss encourages us to. If you are the boss and you start behaving in a risk-aware way and encouraging your team to do the same you can start a chain reaction of better planning and day-to-day decision making.

Conclusion

If you've read everything up to this point you are equipped with most of the basic ideas and techniques needed to manage risk at any scale, in any field. Of course your knowledge of your business has to be combined with these simple techniques, and in some jobs there are more sophisticated methods that have to be used. However, for most people, most of the time the simple techniques explained above are all that's needed.

If you are involved in a company programme to manage risk take note of any special instructions and specific formats that are used. The formats suggested above are generally applicable but there are many variations and extensions.

About the author: Matthew Leitch is an independent consultant and researcher specialising in internal control and risk management. He is a Chartered Accountant with a degree in psychology whose past career includes software development, marketing, auditing, accounting, and consulting. He spent 7 years as a controls specialist with PricewaterhouseCoopers, where he pioneered new methods for designing internal control systems for large scale business and financial processes, through projects for internationally known clients.

Contact the author at: matthew@managedluck.co.uk