I was talking to a colleague the other day who dismissed risk workshops in a rather peremptory way.  He painted a picture of a pompous facilitator locked up in a room with 20 or so bored people with better things to do.  “In any case we know all the risks and we can always review it later.”

I’ve probably taken it a little too much for granted that a risk workshop is the starting point for risk analysis and risk management so it seemed like a good opportunity to think why this is the case – if it is – and to review my approach which has certainly got a bit set in stone over the years.  It’s an obvious occupational hazard of the independent consultant that you can can get overly fixed in your ways.

Let’s start with my own recipe.  First of all try not to be pompous.  That’s not difficult when you’re in a nervous funk following a sleepless night because you’ll be meeting a bunch of new people who not only know far more about what’s going to be looked at than you do, but, as my colleague says, have no wish to be there.

Secondly, don’t have 20 or more.  Clients can often think of reasons to extend participation, generally on the grounds of covering all expertise bases, but there is a limit to the number who can meaningfully participate, and people can and should contribute outside their silos.  This is what makes it work.

This brings me back to preparation.  Given the forthcoming sleepless night it is vital that you get up to speed as far as possible on whatever is to be looked at and the people attending.  I am happy to have briefing meetings, and peruse specifications, drawings, programmes, contracts and the like to an almost unlimited extent.  This highlights an important difference between me and the colleague I mentioned.  I am generally working with a new client in a new business for the first time whereas he is embedded in a client organisation which does projects of a broadly similar type.

I also usually issue a brief a week or so ahead of the event if there is time.  This covers objectives and logistical items, and contains a process outline and agenda.  Its main purpose is to give the impression I know what I am doing.  I’m not sure how effective it is in this regard especially as I have no hesitation in ignoring the agenda.  I generally finish the brief with a few set of prompts driven from different perspectives such as stakeholders, project activities and programme, systems, and so on.  Of these, stakeholders is the most valuable as it is generally them that mess up your project.

And so to the meeting.  The first item after intros (which are worth spending a little time on to develop the context) and reviews of the brief is to make sure everyone is on the same page with regard to what’s being risk assessed.  Be careful.  Everyone will generally say they know what it is, and the top dog almost certainly will, but in practice there may well be some disagreement or misunderstanding over what the project or programme comprises.  I once started a risk workshop at 6 o’clock in the evening.  It was the sort of organisation where they could only find time for risk outside normal hours.  We then spent the next 2 and a half hours clarifying what the project was.  By the time we got to risk, everyone’s evening was well and truly ruined, but the discussion was definitely useful.

Coming to risk identification, I use a very simple device which I think works well but I have not seen elsewhere.  I just go round the table asking everyone to name their biggest risk.  We have the usual discussion around phrasing it properly as a risk and I generally allow a bit of debate, especially around the early stages until everyone gets into their stride.  I record the results on Post-its (make sure you get the super sticky sort) with a large print, marker pen headline and small print details.  So we go round the table 2 or 3 times, and then review the prompts that are in the brief (the most useful bit of the brief).  By the time everyone has run out of steam you have maybe 50-70  Post-its.

This discussion is the key phrase.  You have to make it relevant and you have to probe.  You are constantly trying to find a balance between asking questions which take you somewhere  useful and those which just make you look silly.  (Yes, contrary to accepted facilitating wisdom there are silly questions, at least for the facilitator.)  You are trying to uncover areas which some participants might prefer not to face up to and you are trying to maintain momentum without cutting back useful discussion.  You have to concentrate on what’s being said, record it, formulate a plan for where you’re going, and remain adaptable, all at the same time.  You do miss that sleep! 

You then spend a nervous lunch trying to sort the Post-its into coherent issues whilst minimising discussion with people whose Blackberrys have not created enough for them to do during the morning.

This ‘affinity mapping’ stage (not my term – it was invented by someone I used to work with) presupposes that the next stage is to try to develop the outline risk management plan.  I am not a great fan of populating probability impact matrices as I don’t find them sensible or useful.  Of course, house rules may require this and you need to have a slick patter to do this quickly and paper over the many conceptual cracks this implies.  It’s interesting how people seem to manage to prioritise risks quite happily into High, Medium or Low or whatever without the two dimensional probability-impact crutch and this may be a fertile topic for a future post.

And now is the time to say with great certainty that a risk workshop is not the place to put numbers on the risks.  Quantification is definitely best left to a focussed and controllable group of relative experts who know what’s involved and can be trusted to take a workmanlike approach.  The alternative is a disastrous and uninformed debate which wastes everyone’s time.

So the best use of time is to group the Post-its into issues and then invite a discussion of how the issues are to tackled.  This can be recorded on flipcharts and stuck on the walls.  (My second playschool tip is to have a roll of plastic film you can put on the wall and write on – eg Legamaster Magic Chart.  This is essential if you are in a law firm’s offices, a bank’s or the like.  They generally have smart meeting rooms aimed at impressing clients with smart, bluetack-unfriendly decor and expensive artwork.  Engineers and designers are less of a problem.)

Now the nightmare starts.  This disorganised collection of material has to be turned into a coherent risk register with action plan.  I think I’ve described this in the post on risk registers, so I’ll say no more here.  Hopefully the team has found the discussion enlightening and useful and not such a drag as they were expecting.  I have found some clients who enjoy the discussion alone; they don’t care about the risk register.  The point for them is that a discussion framed by risk can be very useful.

There’s an important cultural point here.  In the UK it’s not difficult to draw people out on what might go wrong and enjoy a faintly ghoulish discussion of the implications.  The truth is that this is what makes risk workshops successful.  But in other countries it might not be acceptable to own up to the possibility of things going wrong, especially in front of a local big cheese.  In others the idea of chance (as opposed to the will of god or whatever) may be difficult to work with.  I’m afraid I have little experience of how to deal with this.

I’ll finish instead with a list of things I don’t do, in addition to not quantifying.

• No beautiful assistant.  In principle it would be good to have someone else to record events and maybe take over.  But in practice it’s difficult for others to appreciate the nuances, follow my changing plans and generally not get in the way of getting the most value out of limited time.  Anyway I can’t afford it.
• No recording on screen.  Again this gets in the way.  Everyone follows the typing and gets bored.  It detracts from the organised chaos.
• No voting.  You can get these little pads which enable to people express their views on where each Post-it should be located in probability impact space.  The stupidity of this is beyond words.  Well it’s not really, so let me just say that it’s completely contrary to the idea is to have a workshop where people pool and share their ideas and experience.
• No remote participation.  No teleconferencing is as immediate as being all together and working together in a room.  I once did one with two participants sitting in Sweden.   The ambiance and demeanour were pure Wallender and I was lucky to escape alive.
• And as an extension of this, no virtual or modularised workshop.  Some time ago I was persuaded by a new customer to hold the workshop in stages throughout the day with different specialists.  We collected quite a decent set of risks, but they all seemed somehow mundane, the sort of things I could indeed have written down myself.  As the work proceeded after the workshop many turned out to be non-issues or were not recognised by other people in the team.  I’m pretty sure that the eventual risk profile suffered from not having been kicked off by a diverse team engaged in a meaningful discussion.

You have to remember that it is exactly for this that we hold risk workshops.  Of course, if, like my colleague, you know it all already, there’s no need.