Risk Log Zero: How to keep your risk log empty and your mind free of worry
17 April 2015, by Chris Harris
Today I’m going to share with you my Risk Log Zero strategy – an attempt to do for my risk log (and risk management) what Inbox Zero did for my inbox (and self-management)
What are risk logs really for?
Risk management can be defined as the stuff that PMs never quite find the time to do. You’re haring around doing the things that obviously need doing on your project, and it’s easy to ignore the nagging voice in the back of your head that says “what if this happens?” Risk logs are intended to make this voice harder to ignore. A good risk log will ask you every week “what are you worried about?”, and will remind you about the risk at the point when you can do something about it. I claim that your risk log does neither of these things.
A bad risk log
Not a bad start – day 1 and I’ve identified 5 major risks on the project. However, the next Monday, I got a calendar pop-up telling me to update the risk log. So I looked at this table, and checked for the following:
- Can I close any of the risks? No
- Have any of these vague transition indicators definitely occurred (definitely enough that I can’t justify leaving it until next week)? No
- Do I need to perform any of the mitigation actions? …No
This isn’t a very useful exercise. There are some major issues:
- It’s easy not to take any actions, and just go back to the comfort of my more tangible (and very long) to-do list.
- If I’m worrying about all these, then I’m not worrying about them enough (or alternatively, I’m living in a perpetual state of worry).
- Most dangerously, because this exercise gives the illusion of risk management, and because I can see lots of pretty risks in my table, I don’t feel any imperative to think up any new, more relevant risks.
Risk Log Zero – the blank page
The principle behind Inbox Zero is that if your inbox is nearly empty, it means you’ve done something sensible with nearly all your emails, and you can now attend properly to the remaining ones. Applied to risk logs, my strategy has more emphasis on addressing risks immediately.
An empty risk log is a great reminder to ask the question “what’s worrying me about the project right now?” – much more incentive to fill it up, compared to the incentive to leave a full risk log as it is.
Actions and checks
Here’s the important bit – the part that enables you to stare at a blank page again next week and identify the newest risks. We are essentially going to ask ourselves this questions for each risk: “what do I need to do right now so that I can stop worrying about this?”.
It turns out that the things you need to do will generally fall into three categories:
- Something you can do right now
- Something you can ask someone else to do
- Something you should check on a certain date in the future.
Emptying your risk log again
All I need to do now, to get back to an empty risk log, is to:
- Add this risk log snapshot to my status email, so the customer / my boss knows what the major risks are.
- Add the actions to my to-do list (or delegate them to others).
- Delete the risk!
When I come back next Monday, I will need to very quickly check if any of the dates in the second table have passed, and answer the question if so. And then I can get on with staring at the blank first table and deciding what to worry about next.
What this doesn’t help you do
This is all very well, but remember it doesn’t help you do any of the following:
- Knowing what you should be worried about. But it does remind you to ask the question! And you should get into the habit of asking everyone else too. Your team, your boss, your customer – everyone.
- Knowing how to mitigate the risk. But I’ve found that if you publicise your risk log (again, to the team, your boss, your customer) then half the time they’ll sort it out for you anyway.
- Actually carrying out the actions. Although it might shame you into doing so – especially if you make it public!
Please do let me know how you get on with Risk Log Zero.