AntigoIN - 2008 - Objetivamente Avaliar o Risco em Um Mundo Complexo

Objectively
Assessing Risk in a
Downloaded from ascelibrary.org by UFC - Universidade Federal do Ceara on 06/15/15. Copyright ASCE. For personal use only; all rights reserved.
Complex World
JAN LYONS
ABSTRACT: When engineers think of risk management, its often in the context of events
directly related to specific program elementsadequately addressing all design criteria,
identifying and securing commitments for the necessary program resources, or executing the
program plan within budget and schedule constraints. While risks specific to the
engineering effort must be addressed and managed to support a successful program
outcome, our increasingly complex and interdependent operating environments do not
allow the luxury of assuming events beyond the scope of the program plan are either
unlikely to happen, or if they do, will result in only minimal inconvenience. As recent
catastrophic events associated with large public projects have shownceiling panel
collapses in the Boston Big Dig tunnel, levee breaches in New Orleansevents beyond the
direct control of the designer and contractor can greatly affect not only the successful
implementation of the overall infrastructure program, but adversely impact professional
reputations and raise questions of institutional bias and complacency. Such externally
generated risks may be realized due to errors by an intermediate supplier, perhaps a
subcontractors subcontractor, or lack of action or oversight by a customer or governmental
representative, indirect risks that are easily overlooked when planning and executing in
a complex, multifaceted environment.
not so willing to blindly assume all potential risks not con-
E
xcessivefocusoncontract-specificinter-
nal risks can leave infrastructure imple- strainedbyprogramboundaries.
mentation not only exposed to external To successfully manage uncertainty in complex situations,
uncertainties beyond the program it is essential to address the relationships between internal and
scope, but give a false sense of security external contributors and engage in a proactive, multi-
by not promoting awareness or provid- disciplined risk investigation. Six overarching risk categories
ing visibility into the existence of all contributors to risk expo- are discussed that clarify and isolate the root causes of risk from
sure. The engineering community ignores, and by default throughout the operating environment, both the tangible
accepts, these latent sources of uncertainty at their peril. While risks directly related to program execution and risks having a
the contractual customer of the infrastructure-related goods more judgmental or emotional component. Since lack of
and services may only be interested in risks directly associated definitiveinformationoftenconstrainstheinclusionoflesstan-
with the specific undertaking, the community at-large is often gible issues in a rigorous risk assessment, alternative means are
explored for generating and deriving empirical information.
Leadership and Management in Engineering

231 OCTOBER 2008
Leadership Manage. Eng. 2008.8:231-254.

Not only does accurate likelihood and impact/consequence
Logically, the program management approach to risk
information assist in a balanced and objective risk evaluation,
managementcanmakeperfectsense.
but transparent and collaborative methods provide the insight
required for meaningful risk prioritization without undo bias Will the effort be completed within budget? If not,
towardpoliticallymotivatedorsociallyamplifiedissues. the program objectives may only be partially real-
ized or have to be scaled back, or the customer may
RISK MANAGEMENT IN have to cannibalize another program in order to
TECHNICAL/ENGINEERING DISCIPLINES
secure increased program funding. In either case,

overspending or reduction in scope, the outcome
Utilizing a Systems Perspective would be less than originally desired. Cost overruns
Engineers and other technical professionals have traditionally are a very real concern on complex, multiyear pub-
addressed risk management issues as a component of pro- lic works programs; one seldom hears of an effort
gram managementtasks are reviewed and designated as that was completed at a significant savings.
high, moderate, or low risk; a mitigation strategy is chosen; Will the program be completed on or ahead of
and the program plan is modified accordingly to include any schedule? The weather-dependent nature of many
additional risk combating efforts. construction efforts adds real risk to achieving de-
While this approach is effective in managing risk within sired schedules. Also the unique circumstances as-
a constrained system, such as within defined program scope, sociated with engineering effortsincorporating
programs do not exist in isolation from the rest of the oper- new technologies, combining proven solutions in
ating environment. Oftentimes, risk exposure is assumed via novel wayscan require time-consuming processes
indirect associationscompetitive pressure, reaction to geo- to resolve unanticipated interactions. On a very
political events, or secondary effects from fluctuations in the time-constrained effort, hard choices in terms of
business cycle. original scope or desired features may have to be
As opposed to having a rigid boundary defining program made when too much time is consumed addressing
scope and thus potential risks, programs and organizations in unforeseen problems.
reality operate in an interrelated system of systems. Internal Both the cost and schedule concerns expressed
operating environments are defined by the scope and influ- above have alluded to reducing performance criteria
ence of each participating organization, their immediate sup- when problems arisebut is that always a wise de-
pliers and subcontractors, any oversight authorities, and the cision or even an acceptable compromise? Often it
direct customers for the intended output. It is within these is the performance criteria of a program that drive
interrelated, bounded systems that the partners in an effort cost and schedule overrunsuse of unproven tech-
have the greatest ability to directly impact program out- nology, executing in an unknown environment, in-
comes. This includes the ability to identify and exert control tegrating components into a new configuration.
over any direct associations between the fundamental sources However, it is often these same originally proposed
of risk and the undesirable consequences. performance criteria that are the justification and
Unfortunately, excelling at managing risks within the in- impetus for securing the budget and scheduling the
ternal environment does not alleviate risk exposure concerns. program to start with.
While the contractor and customer may have complete con-
fidence in their abilities to prevent and protect against un-
desired consequences within the program scope, the external
operating environment adjacent to program boundaries is The Program Managers Dilemma in Risk Management
neither complacent nor static. While the affected internal Within the technical-professional community, the typical ap-
program entities may maintain good insight into external proach to risk management often takes a program manage-
environments government agencies, competitors, interna- ment perspective, focusing on performing agreed upon tasks
tional relationships by being outside the decision-making within cost, schedule, and performance constraints. These are
and thought processes of these organizations, the ability to items of primary concern to customers and are therefore of
affect future actions and anticipate repercussions is limited. great interest to most engineers and other program personnel
As the boundaries between the internal and external environ- working to meet or exceed customer expectations.
ments of each system continuously fluctuate due to changing As technical professionals, engineers are problem solvers,
alliances and market conditions, participants become ex- driven to find the most efficient, effective path to move an
posed to risks that are both unanticipated and outside the effort from point A to point B. Focusing on program man-
direct influence of the affected parties. agement information and processes to counter potential pro-
gram risks is, on the surface, quite logicalprogram goals
OCTOBER 2008
232 Leadership and Management in Engineering

are met by executing tasks; task plans define schedule, cost, able events are not constrained by the boundaries of partici-
and performance parameters; and if a problem develops on pating organizations.
one task, the impact on achieving overall program objectives Program scope provides a starting point for identifying
is readily determined. By taking into account the effort be- events that must be managed in order to achieve successful
ing executed by support functions e.g., finance or safety program completion. Many software tools used in program
within the organization and the contributions of subcontrac- management have the ability to incorporate upper and lower
tors and suppliers from outside the organization, all planned bounds for programmatic inputs such as duration and cost.
tasks associated with achieving program goals are visible and A most likely outcome can be determined for a series of tasks
readily assessed as potential risk sources. and balanced against known requirements and anticipated
Task-based risk assessment often focuses on what can go issues. In addition, knowledge of a range of likely results
wrong when executing the task: assists in identifying regions of program activity where the
impact of risk realization is reduced due to cost or schedule
Are resources available when required? slack or areas that are more critical to program success due to
Can the effort be accomplished within the original cost the lack of a buffer.
and schedule estimates? One benefit that is realized from investigating program
Are performance criteria achievable? activities is the ability to discern whether or not a task is
Some find the emphasis on unfavorable outcomes and less value-added. While a defined task may be within program
than desired performance depressing and demotivating. By scope, it may not be necessary to achieve program goals, or it
concentrating on what could go wrong in attempting to may not be an item of paramount interest to the customer.
execute each program task, feelings of incompetence or ex- Removal of any unnecessary activities from program scope
pectations of doom can develop. Alternatively, an overly posi- will also remove the potential for any risks related to the
tive perspective may have such high regard for the teams activity and will prevent diluting the resources and attention
abilities that a superior, and perhaps even arrogant attitude program participants have available to address issues more
develops with expectations that success is guaranteed. Care is directly associated with the defined work effort.
required to balance the emphasis placed on uncovering all While a customer may not be willing to directly com-
potential problems with applying effort to prevent all pos- pensate the infrastructure providers for addressing concerns
sible problems. If too little emphasis is directed to risk iden- beyond the defined program scope, there may be expecta-
tification, the program will dissolve into crisis management tions generated that warrant consideration see Table 1.
as the potential problems that could have been managed When supporting any program that will be accessible to the
become issues demanding resolution. Too much emphasis on public at large including public infrastructure and commer-
risk prevention and the program can become paralyzed by cial developments, the affected community is always an im-
fear that all effort is for naught and any actions will be over- plied customer even if not a direct participant. If unmet
taken by undesirable consequences. Either scenario can com- expectations resulting from problems encountered with ex-
plicate the path to a successful outcome. ternal issues will undermine customer satisfaction, the im-
Past experience is invaluable as an indicator of the mag- pact of blindly accepting sources of uncertainty in the exter-
nitude of potential causes for concern and the most likely nal environment may drastically outweigh the effort required
risk sources. Reviewing prior program results and deviations to actively address and mitigate such risks.
from plan gives program participants the opportunity to ei- Even after the proposal process has been successfully com-
ther define a revised, and hopefully more risk adverse, ap- pleted and a contract secured, the successes, failures, and in-
proach or put in place contingencies to alleviate any issue teractions of peer organizations cannot be ignored. Not only
that is expected to reoccur. However, the focus on program is success winning the next program affected by a competi-
tasks as the primary source of applicable risk does not address tors achievements, but execution of the current program el-
many of the external interactions that also contribute to un- ements may be impacted by the competitor as well.
certainty. Events completely unrelated to program tasks may Whether justified by performance or not, the potential for
have a profound impact on the ability to achieve desired buyers remorse and second guessing by the primary cus-
results. tomer and eventual consumers can require the infrastructure
providers to shift expertise and effort away from performing
required program activities and instead to continuous resell-
ing of the agreed upon undertaking.
Program Perspective Overlooks Indirect Risk Contributors Due to the global nature of customer and supplier inter-
While the attention to program tasks as risk contributors actions, all programs, from the smallest internal project to
helps ensure all elements of program scope are reviewed for the most complex global endeavors, are subject to real and
their potential to adversely affect results, prospective undesir- imagined economic distortions. The constant flux in ex-

233 OCTOBER 2008

Table 1. Undesired Outcomes Originate beyond Program Scope
Source of risk is beyond Gulf Coast flood control
program scope Big dig tunnel construction infrastructure
Consumerexpectationsnotmet Area roadway congestion increases as Floodingreducesavailablehousing
traffic is diverted during tunnel causingrentstoskyrocketafterstorm
construction
Adversepublicityisgenerated Competitorsandinterestgroupspub- Recoveryagenciesandadvocacy

liclycritiqueandsecondguessdesign groupspubliclycritiqueandbelittle
decisions resultsachieved
Globaleconomyaffectsresourceavail- Chinasdemandforsteelcutssupplyand Volunteersandaidforfloodrecovery
ability raisespricesfortunnelmaterials areredirectedtosubsequentnatural
disasters
Impactstopoliticalenvironment Oversightagenciesreviseregulations Conflictingagendas/allegiances
exposedatlocalandnationallevels
change rates, trading alliances, and government edicts means Broadening the Definition of Customer
any assumptions or factual basis for decision making may Immediate clients and all indirect program participants e.g.,
already be invalid when applied. Despite the best intentions oversight agencies, casual observers have knowledge and ex-
to remain informed or to limit external influences, every de- perience that may add clarity to the prevailing views within
cision made or course of action taken is subject to global a specialized discipline. Think of the child that incessantly
interference. asks Why? While the lack of specific, highly informed
Political forces affecting desired outcomes are often as in- understanding of the issue at hand by the questioner may
visible and misunderstood as global economic effects. In or- appear annoying at first, by looking at a situation from a
ganizations accustomed to measuring decisions and results slightly, or even dramatically, different perspective, a cogni-
against a profit motive, political obstacles may seem deceiv- zant expert can utilize their prevailing knowledge to provide
ingly simplistic or unimportant. However, to those inti- a unique resolution.
mately involved, the emotional reactions and value placed on It was just such a thought process that spurred Edwin
appearances are very real and significant. In addition to un- Land to invent the self-exposing film that created a minia-
desirable publicity or character assassination, political in- ture, portable dark room. When queried by a young child as
fighting and electioneering can result in disruptions varying to why pictures taken of her couldnt be seen immediately,
from contrived obstacles to full-blown civil unrest. Other Land investigated solutions that did not assume photo-
undesirable consequences with public sector roots include graphic development must be accomplished in a distinct
laws not being enforced as expected, interruptions in public location. The potential risk of customers losing interest in
services, or services being allocated based on political affilia- cameras due to delays in sharing photographs was overcome
tions. by developing consumer-accessible instant photography.
Seeking input from nontraditional, indirect participants
during the risk assessment process can be invaluable on com-
SEEKING INPUTS FROM NONTRADITIONAL plex, multifaceted efforts such as infrastructure programs.
SOURCES Since even non-public structures and concealed utilities affect
While a focus on the risks associated with program manage- the general population, casual observers can raise unantici-
ment tasks typically emphasize what can go wrong, the in- pated concerns or add value to the risk mitigation process
vestigation of these potential problem areas can yield a posi- through their perceptions and experiences.
tive impact that goes beyond merely preventing undesired On public sector efforts, objections and protests often
outcomes. Considering issues from nontraditional perspec- arise from unforeseen sources. When addressing environ-
tives allows a broader range of outcomes to be addressed mental concerns, groups such as Greenpeace or the Sierra
with the potential for adding greater value to the final result. Club are often asked to provide inputs during the program
OCTOBER 2008

definition process since these groups will seek to participate IMPACTS FROM GLOBALIZATION
in the process whether requested to or not. Uncertainty arises Every day it seems there are new fears raised related to inter-
when nontraditional participants in environmental issues, dependencies within the global economymassive infra-
most recently population and immigration control organiza- structure improvements in one country China affect job
tions, demand that their views also be incorporated. By pro- creation in another United States; a disputed election in
actively soliciting input from diverse sources, the program another country Kenya causes inflationary pressures in es-
can proactively counter risks associated with lack of broad- sential commodities petroleum products across work mar-
based customer satisfaction. The effort may also gain insights kets; or a rogue trader at a single financial institution Sin-
that improve the likelihood of receiving public praise or, at gapore threatens international currency stability.
least, neutralize criticism. While the unforeseen consequences of international
events on local circumstances are often not favorable, the
constant flux in global relationships and relative values can
Competitors and Suppliers create beneficial opportunities for organizations that are able
Visibility into potential risks and an understanding of exter- to recognize the influence of indirect relationships on local
nal environments can be gained by staying attuned to the outcomes. Changes in the relative values of process inputs
actions and intentions of suppliers, subcontractors, and com- e.g., the cost of labor relative to material can reverse con-
petitors. While specific circumstances may differ, the in- ventional wisdom regarding high-risk courses of action. In
creased knowledge of results and trends experienced in other many engineering disciplines, technological advances offer
environments can be used to justify internal risk manage- processing alternatives that would require the costly replace-
ment assumptions and provide insight into likely future sce- ment of non-obsolete plants and equipment. Where substi-
narios. tuting technology for labor may have been seen in the past as
By tracking the progress of a successful competitor in a an issue to resolve rather than an opportunity to grasp, a
losing competition, the organization can learn the lessons of change in global parameters may make the upgrade not only
the technical effort without direct participation or the as- cost-effective but the low risk alternative. Even a stable pro-
sumption of program risk. The schedule, cost, and perfor- cess may benefit as the changes in absolute or relative values
mance achieved during program execution can be compared of inputs complement a prior decision. Without disruptions
to what was anticipated by the losing contractor. Any com- in the marketplace, technological improvements and capital
ments or concerns expressed by the oversight authority or investments are often delayed, to the long-term detriment of
setbacks realized in executing the program should be re- an organizations competitiveness and the satisfaction of its
tained as part of internal lessons learned and applied to future clientele.
efforts. Disruptions are always painful to those affected person-
By not constraining experience-based knowledge to only ally, but many small disruptions or upgrade opportunities
internal results, a broader understanding of potential set- are more easily assimilated than a major disruption that
backs, and the means to thwart them, can be gained. This leaves few immediate alternatives. Consider the disruption
approach not only reduces uncertainty on future endeavors, and havoc caused by flooding in New Orleans in the wake of
but may provide the impetus to overcome an industry-wide Hurricane Katrina. Granted, it would have adversely affected
concern by developing a revolutionary solution. While the the local economy to restrict building in tidal areas or close
winning contractor is concentrating on meeting day-to-day existing waterways either permanently or for upgrades, but
performance obligations, peer organizations, unconstrained it would have given the area the opportunity to improve
by immediate program scope, are able to take a more inclu- flood prevention and other infrastructure in an orderly man-
sive perspective toward resolving overarching issues, poten- ner. Instead, the infrastructure is being modernized and up-
tially gaining an advantage in future competitions. graded but at a social cost of dislocating at least a third of the
An additional external source of information is the long- Gulf Coast population, in addition to massive repair and
term projections risk conscious organizations make regarding cleanup costs.
future expectations of uncertainty. While the results of these Other climate-related impacts also have the potential to
assessments are generally not made public, comments by the manifest disruptions, or opportunities depending on ones
organizations in annual reports or publicity statements give perspective. Warmer winters should result in less freeze-thaw
insight into their risk projections and anticipated outcomes. damage to roadways, perhaps allowing for lower cost con-
As with comparing inhouse program estimates against re- struction methods and less frequent maintenance. That is,
sults achieved by competitors, comparing internal risk and unless these transportation routes are in the far north where
growth projections to areas of concern or optimism expressed permafrost is relied on to provide a permanent support struc-
by other organizations provides valuable feedback on internal ture e.g., the Pan-Himalayan Railway. Within the United
assumptions and conclusions. States, as tornado alley migrates, existing infrastructure

235 OCTOBER 2008

may require reinforcement or redesign to withstand previ- often viewed as beyond the control, or even influence, of the
ously unanticipated weather forces while areas previously infrastructure provider. Even though many external factors
subjected to severe storms would experience reduced infra- are unaffected by internal actions, there are still effective
structure costs. Since occurrences of weather events and other means for moderating the impact of external associations on
natural disasters are beyond the control of infrastructure pro- program achievements. The challenge is to look beyond in-
viders and their customers, managing the risks associated ternal program plans and processes and consider instead
with these events is limited to attempts to reduce the sever- what affects the immediate customer and the eventual con-
ity of the anticipated consequences. sumer.
As with seeking the experiences and predictions of com- Public infrastructure programs are especially susceptible
petitors to gain an advantage on future competitions, inves- to differences in expectations for goal achievement. While
tigating technology adoption in other countries can assist in the client specifies what constitutes successful program
predicting future infrastructure requirements. The social ap- completion for the contracted effort, the public-at-large may
plications of cellular technology in Europe and Japan may form a different perception of the final products desirability.
foretell required design changes or future disruptions in the Both the Big Dig tunnel project and the Gulf Coast flood
United States. While cell phones are used primarily as com- control efforts shared several common risk exposure factors
munications and entertainment devices in the United States, resulting from unmet consumer expectations. A classic pro-
in Japan the cell phone has become a portable wallet. This gram management focused on shortfalls in task completion
impacts infrastructure required for purchasing goods and and resource allocation will overlook these risk sources, set-
servicesobsolescence of cash-dispensing machines includ- ting the stage for a potential crisis when external forces in-
ing provisions for security and access, physical payment sta- validate the clients perception of success Table 2.
tions replaced by portable receiver modules, and a reduction A major consideration in publicly funded efforts is the
in the need to produce and transport currency. Organizations ability to satisfy the many conflicting viewpoints claiming
that anticipate these changes and proactively incorporate ap- ownership over the process. It is often the inability to accu-
proaches to capitalize on the disruption will gain not only an rately link expectations to the results achieved that causes
advantage over their rivals but will reduce their risk to re- efforts to be severely criticized. An otherwise successful out-
source revaluations and inappropriate customer support. come can be deemed a failure, or an unsatisfactory compro-
Closely aligned with global economic impacts are politi- mise, as a result of not managing the risk of unmet expecta-
cal disruptions. Ethnic squabbles in a far-off land can foretell tions, whether those expectations are reasonable or not.
a change in commodity prices or provide the impetus to The multiplicity of participants joined together for the
implement a technological change e.g., the substitution of purpose of confronting issues surrounding the proposed ef-
biomass fuel for petroleum-based fuels. Change in the po- fort seldom have a common goal as the basis of their involve-
litical climate, or party in power, can alter conventional trad- ment. Motivations for participating include: seeking to ex-
ing alliances and the availability and cost of process inputs. pand the effort beyond the initial scope; modifying the scope
Beyond the pure changes in relative resource values, look- to address other unmet need; thwarting the effort entirely; or
ing to overarching global trends can assist in identifying cur- some combination of the above. Even among groups with
rent processes that may be less desirable in the future or offer somewhat similar goals, expectations for the progression of
insight on advantages and risks that may accompany future the effort, the impact on the immediate locale during imple-
scenarios. In recent decades, following the post-World War mentation, and acceptability of the final result may vary to
II rise of more socialistic-oriented governments, there has the point of conflict.
been a global rise of more conservative, and often more
religious-based, political authorities. How this will affect in-
frastructure decisions or the risk associated with infrastruc- Hiring and Budget Authorities
ture efforts is currently unknown, but it is safe to predict that The contractual or budgetary authority involved in a public
there will be an impact. The organizations and technical spe- infrastructure effort generally functions externally to the di-
cialists that recognize and most accurately envision the future rect program participants. In contrast to a privately funded
conditions and operate most effectively across multiple pe- endeavor, the approval process often is conducted in a series
rimeters will have lower risk exposure than organizations of open forums where it is not uncommon for participants to
that emphasize the status-quo. disagree on the overarching goals of the effort or lack suffi-
cient insight and understanding of the myriad of issues that
AN INTEGRATED APPROACH TO RISK must be coordinated.
MANAGEMENT Holding public reviews and forums assists in program
To adequately address and manage either program or risk reduction by providing visibility and transparency into
organization-wide risk exposure requires attention to items potential concerns, obtaining inputs from unconventional
OCTOBER 2008

Table 2. Instances of Projections Not Meeting Consumer Expectations
Gulf Coast flood prevention and
Proponent of original expectations Big dig construction project recovery
Contractingofbudgetaryagency: Overlyoptimisticinitialcostestimates underestimatedextentofdamageand
Projectseffortscopeandcost resultincostoverruns reliefneededextensivelossoflifeand
property
Inspectionandoversightauthority: Ceilingpanelinstallationdidnotmeet Leveeinspectionandmaintenance

Guaranteeseffectiveprogramexecution operationalrequirementsresultingina dependentoncommunityaction
catastrophicfailure despitelackoftechnicalknowledge
andabilitytoenforcement
Infrastructurecustomers,localcommu- Breachedpublictrustforcompetence Extensivedelaysinprovidingreliefand
nity:Expectbeneficialoutcome andsafety clean-up
Autonomousinterestgroups:Promote Expectedbeneficialresultforallmem- permanentchangeincommunities
outcomessupportingcommongoals bersofcommunity,notbiastocommut- affectedduetorebuildingpriorities
ers
sources, and capturing novel approaches to problem reso- beneficial to the infrastructure provider, shared authority can
lution. However, the formality of the review process can promote confusion and lapses in accountability as roles and
greatly increase the time required to reach a decision, during responsibilities cross organizational boundaries.
which value relationships and information are continuously Guaranteeing performance levels in an independent en-
changing. To incorporate new information and participant tity is exceedingly difficult. While it is anticipated that the
feedback into the decision-making process, additional review oversight authority would have considerable knowledge in
and feedback sessions are often required, adding to the risk the area being inspected and the infrastructure provider
that when a decision is finally achieved, it will be best suited would employ a competent workforce, neither party has the
to a prior scenario and not be the optimal solution in the ability to absolutely guarantee a sufficient level of expertise
current environment. beyond its own perimeter. In addition to operational au-
Underestimating program scope or the required resources tonomy, each participating organization would be influenced
not only risks successful completion, but may increase risk by, or subjected to, the opinions and preferences of additional
exposure as participants envision a more perfect outcome authorities and clients not necessarily within the operating
than can be guaranteed. While the planning and review pro- domain of other program participants.
cesses undertaken by the responsible agencies are not the On the Big Dig program, inspections were successfully
primary cause of the undesired outcomes, neither did the completed allowing the tunnel to open. However, latent
processes prevent or counteract the realized outcomes. If construction problems that led to a catastrophic event were
there is a failure to recognize and counter the insufficient not discoveredexpectations for public safety were not
preparations, the consequences of unmet expectations can be achieved using traditional program oversight and inspection
more severe than if more moderate expectations had been mechanisms. In the aftermath of Hurricane Katrina, it be-
initially promoted. Without a false sense of security or con- came apparent that local citizens groups that had been ex-
fidence in expected results, individuals and other organiza- pected to take the initiative in monitoring levee problems
tions would have an incentive to take individual actions to had not provided the necessary oversight needed to maintain
moderate the most objectionable consequences. levee performance. While local eyes and ears may have
been seen as a preferred monitoring approach, the result did
Oversight, Review, Inspection Authorities not meet users expectations to prevent a devastating flood.
Infrastructure projects typically require review by an inspec-
tion agency prior to being granted an occupancy or operat- The Ultimate Consumer, the Public
ing permit. As a result, the risk related to not achieving Public infrastructure consumers can be so numerous and di-
required performance standards is at least partially transferred verse that it is unrealistic to anticipate a uniform set of ex-
from the service provider to the oversight authority. While pectations. In addition to the often unpredictable whims of

237 OCTOBER 2008

the community at large, there may also be conflicting expec- elected officials, advocacy groups, and the general public may
tations of the sponsoring, funding, and inspection authorities cause an otherwise successful outcome to be criticized when
as each group strives to achieve specific results. The political one or more groups experiences undesirable or unintended
nature of many public infrastructure efforts can also precipi- consequences.
tate adverse interactions due to favoritism and power imbal- Although the Big Dig program achieved stated goals to
ances. improve traffic flow and harbor area aesthetics, concerns have
In highly politicized environments, it becomes even more been expressed regarding the loss of parking beneath the
important to broaden the scope of the applicable risk assess- former highway and impacts to air quality. Along the Gulf
ment to obtain visibility into the actions and motivations of coast, the character of many communities was altered as resi-
all participants. Unlike self-contained, privately funded ef- dents were permanently displaced by rezoning designed to
forts, the conflicting motives associated with the public over- attract new industries and encourage growth. While each of
sight process cannot be easily predicated or directly con- these scenarios achieved a specified set of goalsimproved
trolled. The downside of an abundance of divergent traffic flow, an enhanced tax base, urban renewalancillary
perspectives is that a vocal few may influence the implemen- participants have been adversely affected by outcomes that
tation plan to such an extent that the final result would not either they did not anticipate or were not considered when
meet the expectations of the majority of eventual users. The addressing overall suitability. The loss of support by affected
possibility also exists for all reviews to be technically com- groups may not impact the current effort, but will often be
pleted according to the established guidelines without realized as heightened resistance to subsequent infrastructure
achieving a successful conclusion in the eyes of the ultimate improvements.
consumers.
Such incompatible expectations were realized when the ANY RISK NOT SPECIFICALLY
Big Dig tunnel opened for usethe public consumer ex- ADDRESSED IS ASSUMED
pected a safe, effective transportation route which was as- Being technically or contractually successful does not neces-
sumed to have been provided as a result of client and con- sarily guarantee a successful outcome due to the influence of
tractor oversight. Gulf Coast residents likewise assumed that risk factors from beyond defined program boundaries. A key,
drainage canals constructed and managed by the U.S. gov- often overlooked, tenet of risk management is that the risks
ernment were fully functional and that should a tropical associated with any situation that are not specifically ad-
storm strike, the area would receive sufficient disaster recov- dressed are uncertainties that are accepted by default. There
ery assistance. In both instances, consumer expectations dra- lies the danger in focusing risk management actions too
matically exceeded the responsible agencys ability to per- heavily on events associated with internal activities and in-
form. While either instance may still have resulted in teractions constrained by program scopelimited knowl-
catastrophic consequences, the breach in the sense of security edge of and ability to affect issues inherited by association
felt by those affected will most likely continue to haunt in- with ancillary program contributors.
frastructure and support providers in those communities for As was seen on the Big Dig project, risk exposure that
some time to come. was evidently accepted by a lower tier subcontractor that
the epoxy selected was sufficient to secure ceiling tiles was
inherited by the higher level contractors and their customers.
Special Interest Groups and Autonomous Organizations Even though specific actions may have been taken to contain
Autonomous groups e.g., environmental organizations, citi- the potential hazardadditional reviews and inspections or
zen associations, government entities participating in the use of contract language that legally transferred
public oversight and review process should be expected to responsibilitythe primary contractors and clients are still
simultaneously promote their internal objectives while pro- subject to adverse consequences resulting from unfavorable
viding feedback and alternative perspectives on the issue un- perceptions of product quality and technical performance.
der study. The harm, from a risk perspective, is use of the While not all risk accepted by default will result in cata-
review process as a forum for solving problems only indi- strophic consequences, even outcomes that are only annoying
rectly related to achieving stated program goals. The intro- or inconvenient can cause major program distractions and
duction of additional objectives has the potential to increase disruptions. Effort must be expended to address misconcep-
program complexity, divert attention from pertinent issues tions and unfilled expectations and counter unwarranted ac-
or add superfluous tasks, all contributors to risk exposure. cusations and bad publicity, often by reallocating scarce re-
Since funding and advocacy of public works efforts are sources away from required program elements and instead to
linked to community and governmental purposes, coordina- crisis management.
tion is needed to focus on common goals and expectations. A common rationale for not managing risk as an inte-
The competing agendas and divergent expectations of grated issue across organizational and program boundaries is
OCTOBER 2008

Figure 1. Relationship of internal to external operating

environments
Figure 2. Internal and external environments from a com-
munity perspective
the lack of direct compensation for doing so. The real ques-
tion is, can a contractor or agency associated with a complex
effort afford not to? As lawsuits and adverse publicity have Although the representation in Figure 1 is from the per-
demonstrated, the cost both in monetary and societal spective of an operating organization or public agency, the
termsof accepting risk by default can be many times concept of interrelated associations can also be represented
greater than the effort that would have been required to from a community viewpoint. While communities of users
proactively lessen the probability or severity of the potential are less cohesive in their acknowledgement of their common
disaster. internal and external boundaries, multifaceted groups are of-
ten unified in their overarching expectations of a desired out-
Relationship of Internal to External Risks come.
Despite the perceived difficulty in obtaining non- Relabeling the operating environments figure from a
programmatic information and the lack of compensation for New Orleans perspective in Fig. 2 highlights the complex
addressing risk events that cross contractual perimeters, in interrelationships and conflicting expectations that must be
ongoing efforts to effectively manage direct, internal risks, overcome to satisfy the community as a whole. Due to over-
many organizations are already experienced in working lapping relationships and dependencies, an external organi-
across such boundaries. As illustrated in Fig. 1, even within zation providing relief aid to New Orleans after Hurricane
the boundary of a specific internal environment, wholly and Katrina flooding could not be successful unless expectations
partially contained peripheral systems exist that overlap the of all groups were addressed. While the majority of losses
internal operations of other programs, customers, suppliers, incurred from levee breaches may have been borne by local
and subcontractors. The external environment is defined as residents, the resulting impacts of the flooding risk were
including all competitors, future customers, and any other shared by all members of the community and organizations
organizations or agencies not directly associated with the in- associated with the community, regardless of whether their
ternal organization in the current timeframe plus all indi- property was directly damaged by the flooding.
rectly targeted end-users. In the aftermath of the storm, all members of the com-
While the concerns and perspectives of internal partici- munity required the support servicesclean water, shelter,
pants in an activity can be anticipated to differ from their safetythat local businesses and government agencies had
external counterparts, there are additional difficulties that difficulty providing. In addition to the entire communitys
must be addressed when working across a perimeter loss of basic infrastructure, businesses lost many of their cus-
consistency in terminology and definitions; incompatible as- tomers and suppliers due to displacements after large areas
sumptions regarding expectations and preferred processes; were flooded.
even instances where accepted units of measure for transfer- On the surface, it may not seem that shipping companies
ring information differed but were not communicated. using New Orleans ports would be affected by the destruc-
Where an organization shares a perimeter boundary both tion of local neighborhoods. However, loss of residential
with its parent organization and multiple internal and exter- communities meant the loss of skilled workers who were
nal colleagues, the increased complexity of multilayered forced to leave the area following the storm. An outcome of
communications and coordinated activities is a major source the residential flooding event has been a renewed effort to
of latent risk. create a wetlands buffer between the city and the Gulf of

239 OCTOBER 2008

Mexico by reducing waterway dredging and the number of
shipping channels. As an additional consequence of storm
recovery and flooding prevention activities, shipping compa-
nies may face limits on port access or experience longer de-
livery times.
While shipping companies may not have had the ability
to directly control the likelihood of canal failure and flood-
ing, it was not necessary for them to automatically accept the
consequences of flooding risk generated in their external en-

vironment. Actions shippers could have taken to modify
flooding probability or alleviate its consequences include
changing their operating parameters by using smaller or
lower draft vessels to avoid the need for larger and deeper
navigation channels. This strategy could have reduced the
volume of the storm surge reaching the city canals and as- Figure 3. Risk categories address both internal and exter-
sisted in mitigating the flooding risk. Shipping companies nal sources of uncertainty
may still have suffered undesired consequences as a result of
the hurricane, but the extent and longevity of those loses
would most likely have been reduced. also have trouble finding a place to live, in addition to re-
In some instances, formal agreements or permissions are quiring time to become a fully proficient workforce. By tak-
required before activities internal to specific segments of the ing actions that make it less likely that residents will need to
operating environment can be modified to be more favorable relocate, it also becomes less likely that skilled labor will be
to program participants. However, this handicap doesnt lost. A strategy directed at reducing the likelihood of work-
limit an organizations responsibility to actively address un- force displacement would not necessarily negate the need to
certainties that may be generated externally or are inherited have a plan in place to address anticipated consequences
as a result of having a shared or overlapping perimeter. should the risk be realized. But by addressing the root cause
Where the source of an undesired interaction cannot be di- of the potential risk, whether an increased likelihood of
rectly managed across a boundary and there is no desire to flooding or some other local disaster, the organization in-
assume the risk by default, indirect mechanisms such as creases its chances of averting a crisis and its unpleasant side-
transferring accountability become the most viable means for effects.
reducing event probabilities and/or moderating the likely In attempting to address sources of risk, both within pro-
consequences. gram scope and beyond, it becomes apparent that collabora-
tion across operating boundaries and insight into a broad
range of concerns is required to fully understand the associa-
Emphasizing Root Causes tions between undesirable events and their root causes.
As noted in the interrelationships discussed above, managing Without knowledge of the fundamental issues that promote
risk to an acceptable level requires considering more than a risk event, proactively determining a course of action that
potential events linked to internal operations or defined pro- will either reduce event probability or limit the severity of
gram tasks. For comprehensive risk identification and man- anticipated consequences is extremely difficult.
agement, a focus on the root causes of risk, both internal and
external to the organization, is required. OVERARCHING RISK CATEGORIES
So often in risk management, the focus of concern is the OVERLAP DEFINED BOUNDARIES
potential undesirable consequencemissing a deadline, ex- Focusing on program task outcomes, such as cost, schedule,
ceeding costs, or not meeting performance goals. But at- or performance, to isolate potential risk events for identifica-
tempting to manage risks only by managing the conse- tion and evaluation, can limit insight into the fundamental
quences is essentially accepting the prevailing likelihood that sources of events that precipitate undesirable outcomes. Six
the risk event will occur. A more proactive response is to overarching risk categories are recommended to concentrate
address the root cause of the potential problem and try to attention on overcoming related sources of uncertainty Fig.
limit both its probability and severity. 3. Each category addresses situations that cross internal and
If a situation causing workers to abandon their homes external boundaries that may be able to be affected by ap-
would create a labor shortage, a strategy addressing only the plying a targeted strategy. The classifications are applicable
lack of available workers may not have the intended effect. to both for-profit and nonprofit operations, including gov-
Any additional workers imported to resolve the crisis would ernmental agencies, though the proportion of risk events al-
OCTOBER 2008

located to each category would be expected to vary according Table 3. Scenarios That May Alter Internal
to unique program circumstances. In many organizations, Commitment to a Shared Agreement
these breakouts are equivalent to the classifications used for
risk governance reporting. Achangeinownershiporleadershipofanyparticipants
When assessing risk event likelihood and impact, each internalenvironmentmayleadtorevisedprioritiesthatare
category is investigated from the perspective of the internal inconsistentwithanexistingagreement
organization. However, due to the interrelated nature of
most operating environments, the risks identified are not Reactionstoeconomicconditionscouldforcemodifications
limited to internal activities or to information gained from tointernaloperatingstructuresandlongrangegoals

internal sources. By addressing the root causes of risk from Participantsmayceasetosupportanagreementifthey
multiple perspectives, including those external to the oper- believetheknowledgeandinsightbeingsharedaspartofthe
ating environment, more in-depth coverage of the multidis- teamingarrangementisnotbeingreciprocated
cipline associations that contribute to undesirable outcomes
can be realized. Onepartycouldhavelostkeyresourcese.g.,funding,exper-
tiserequiredforsuccessfulactivitycompletionandbe
unabletoperformaspromised
Eitherpartymayperceivetheyarecarryinganunfairshareof
Agreement Termination Risk
Potential instability in a shared opinion or arrangement, theburdenornotbeingadequatelycompensatedforthe
whether the agreement is implied or formal, is classified as responsibilityassumed.
agreement termination risk. From an organizations perspec-
tive, labor strikes are a primary example of an agreement that
is not fulfilled as expected. Other examples include: unethi-
cal employee conduct assuming ethical behavior is ex- Knowledge of likely root causes of an undesirable out-
pected; missing a schedule milestone that was agreed to as come allows all participants to proactively address any cir-
part of a program plan; overrunning an established budget; cumstances, that left unattended, could cause agreement ter-
withdrawing from a contractual arrangement; or insufficient mination risk to be realized. Possible root causes may vary by
cooperation by a team member where there was an arrange- participant depending on their respective internal circum-
ment to share responsibility, costs, or some other aspect of stances and unique external interactions Table 3.
the work effort. It is possible for agreements to be one-sided with one
In each of these examples, the activity covered by the party assuming the other participant is compelled to fulfill
agreement would be considered internal to each participant certain expectations. When residents assume the govern-
and would be within an area of overlapping boundaries. ment will provide specific services or infrastructure e.g., un-
While each party to the agreement may have a different congested transportation routes, or public agencies expect to
internal perspective of the arrangement, and possibly differ- receive desired levels of compensation or other essential re-
ent motives for entering into the agreement, consensus on sources, the overlap in common expectations of cooperation
the ultimate outcome would be expected in the area of com- or commitment may be minimal. The only portion of either
monality. Visibility into each participants commitment to environment in common could well be where the perimeters
the agreement and the factors that support cooperation helps of each internal environment meet. While local users, fee
to sustain the commitment. Any event or situation that un- payers, and voters may feel some ownership or right to dic-
dermines even the perception of a mutually beneficial rela- tate levels of government-provided services, expectations
tionship can change the dynamics of the union and destabi- may not be compatible with the providers mandate or abil-
lize the cooperation required for a successful result. ity to perform. Likewise, public agencies may interpret levels
While the consequences to both parties of a teaming of public financial support as a measure of services to be
agreement being terminated would be similarcost, sched- supplied. Where expectations are not met, by either party,
ule, and performance impacts as the specific work effort is even if the desired level of performance might be considered
not executed as originally anticipatedknowledge of the an- unreasonable e.g., absolutely no flooding in areas below sea
ticipated consequence does not provide much assistance in level, agencies in the disaster area being unaffected and able
defining a means to counteract the risk. By identifying the to provide relief, the implied or assumed agreement has
conditions and assumptions that form the basis of the agree- been breached.
ment as possible risk sources, each participant can more Due to the lack of coordinated expectations, these as-
readily visualize circumstances or events that could lead to a sumed agreements are the most likely to break down. With-
breakdown in the arrangement. out a mutual understanding of the internal priorities and

241 OCTOBER 2008

shared commitment of all participants, it is difficult to reach differentsince the parties to the agreement initially consid-
more than cursory agreement on common goals and expec- ered the course of action mutually acceptable, the provider is
tations. Even though there may be other significant factors typically held responsible for the inappropriate solution. As
that impact the ability to maintain realistic expectations the expert in the shared relationship, the provider should
e.g., differences in political affiliations, under-funded public have a better understanding of the customers long-term,
services, a sinking landmass, the lack of coordinated owner- overarching needs and the most comprehensively appropriate
ship and responsibility for the issue is a primary source of the means for meeting those expectations.
incompatible assumptions. When essentially all factors con- A case in point would be a community that is desperate
tributing to realization of a risk are external, the complexity for more local transportation capacity. Alternative solutions
associated with attempting to moderate or even isolate the for supplying that need could include widening existing
root causes greatly increases. Not only does realizing the un- roadways, adding a different complementary form of trans-
desirable event become more likely, but the extent of any portation, or submerging the existing roadway to limit ac-
consequences are also likely to be more random and wide- cess and increase flow. The provider may be able to meet
spread. customer goals by utilizing any of the alternatives, but the
Agreement termination risk was realized in the aftermath overall appropriateness of the approach selected is the first
of the New Orleans levee breaches. The U.S. government, step to maximizing suitability. If the area is already under air
through the Corps of Engineers, had primary ownership of pollution sanctions, an alternative that decreased long-term
the system of canals and waterways along the Gulf coast. air quality, even if it was the preferred customer solution in
However, within New Orleans, local citizen councils were the short term, would be unsuitable. Selection of an alterna-
considered to have some level of responsibility for monitor- tive that required extensive customer retraining e.g., getting
ing the condition of the drainage canals. Even if these citizen customers to switch to mass transit from private automo-
councils had the expertise to identify problems, they were biles would add complexity and risk of failure to the imple-
still dependent on the government for any corrective action. mentation of the solution.
Each group appears to have assumed that the other party was Alternatives that rely heavily on new technologies may be
ensuring proper canal functioning. Without mutual agree- unsuitable for certain customers due to the inherent un-
ment and cooperation on canal monitoring and mainte- knowns related to the performance, maintainability, and
nance, the likelihood of failures increased along with the po- functionality of an immature application. A highly technical
tential for more severe consequences than if coordinated, solution would be especially unsuitable if the client is not
proactive measures had been taken. known for being flexible in unknown situations or as being
an early adopter of new technology Table 4.
There is no requirement that clients be external to the
Customer Suitability Risk providers operating environment to be adversely affected by
Customer suitability risk focuses specifically on delivery of an customer suitability risk. Internal employees are customers of
inappropriate solution to the customer or ultimate user. Over the human resources and payroll functions. While employees
time, the inappropriate solution would be expected to in- may make specific requests, such as low-cost health insur-
crease the recipients overall risk exposure and decrease their ance, if the parent organization knows that certain conditions
satisfaction with the result provided. While this may appear have a higher incidence among its employees necessitating a
to be a risk assumed by the customer, it must also be ad- specific level of coverage, it would be unsuitable to provide
dressed from the perspective of the infrastructure provider an employee health insurance plan that did not meet antici-
due to the potential impact of the risk on the providers pated coverage needs.
reputation, their ability to attract future clients, and perhaps In many industries and communities, suitability is gov-
even the ability to retain certification credentials. Often this erned by industry-wide standards or acceptable practices. Of-
risk is not realized until some time following program ten, failure to achieve customer suitability occurs when ac-
completion after the customer has experienced multiple ad- cepted performance standards are not completely met. The
verse outcomes resulting from the agreed upon course of collapse of Enron is an extreme example of not performing to
action. The contractor may have met all technical require- accepted standards by giving misleading information regard-
ments, and may even have provided exactly what the cus- ing solvency, lack of transparency in contractual arrange-
tomer requested, but for some reason, the solution was inap- ments, and encouraging employees to hold large amounts of
propriate. company stock in personal retirement accounts. As a result,
Customer suitability risk may have the same end result, a courses of action were taken that were not suitable, in the
dissatisfied customer, as the specific example of agreement long term, for direct customers, employees, investors, suppli-
termination risk where an understanding is assumed but the ers, or business associates, even though many of these partici-
commitment is one-sided. However, the root cause is pants were quite satisfied with short-term results.
OCTOBER 2008

Table 4. Examples of Inappropriate Infrastructure Solutions
Root cause of unsuitable solution Example of less than desirable outcome
Overpromisingthebenefitsofanalternativeapproach Initialprojectdoesntresultindesiredfollow-on
efforts
Underestimatingthelongtermabilityofthecommu- Lowcostimplementationhasunaffordablerecurring
nitytosupportthealternative costs
Thepracticalimplementationofasolutionisinconsis- Pedestrian-friendlycommunitybisectedbyfreeway;
tentwithlocalnorms ormismatchinarchitecturalstylese.g.,colonial
versusVictorian
Limitedusefulnessofthealternativeselected Depressedroadwayonlyfunctionsproperlyingood
weatherduetoflooding
Complexrestrictionspreventcustomersabilityto Accessbygeneralpublictopubliclyfundedgarage
realizebenefits limitedduetosecurityconcernsatsitelocation
What happens if the customer insists on a solution that Not all sources of operations risk are under the direct
the provider judges to be unsuitable? The provider has to control of the provider or even directly related to processing
determine whether the risk exposure can be managed to an tasks. Weather events, natural disasters, pandemics, and fluc-
acceptable level by employing strategies that either modify tuations in the global economy are categorized as operations
the probability of realizing the undesired outcome or reduce risks since these events disrupt required processes. While
the severity of any likely consequences. The following strat- completely external events are beyond the direct control of
egies could be employed to successfully manage suitability internal actions, by examining the root cause of the antici-
risk depending on the providers risk tolerance: pated disruption, strategies can be employed to reduce the
likelihood of the event or the severity of any adverse impact.
The risk, from the providers perspective, is accepted with
the hope that the risk will not be realized; For most organizations, the greatest source of risk, at least
Attempts are made to transfer ownership of the risk to the in terms of frequency, are events related to operational pro-
customer by making it evident that the customer has ac- cesses including threats to physical and intellectual property
cepted responsibility for the chosen solution; and process malfunctions. Adverse effects on physical assets
The provider attempts to control the risk by implement- are realized as infrastructure damage, processing equipment
ing a pilot project or performing a detailed simulation as breakdowns, ruined inventories, and any other events, such
is done for disaster planning to gain additional insight as theft, utility outages, administrative errors or data loss,
into risk mitigation alternatives; or that disrupt normal operations. Operations risk can originate
The risk could be avoided entirely by declining to partici- from internal sourcesgovernance and oversight lapses, fa-
pate in the endeavor. cility design or maintenance problems, employee errors and
difficulties implementation process changes; or from external
sourcesnatural disasters and pandemics, increased liability
Operations Risk exposure, competitive pressures, customer demands, govern-
Operations risk includes all undesirable events associated ment regulations, and foreign trade and investment impacts.
with the processes required to create and deliver the final Risk events that impact operations are often closely
product. Most of these processing activities are accomplished aligned with program activities. Program plans and other
within the internal environments of each active participant documentation are invaluable information sources regarding
and are directly related to providing the final product e.g., the resources, tasks, and conditions that must be coordinated
design, construction, and management support functions. for successful program completion. While many program
Additional processing functions shared by customers, suppli- activities are directly or indirectly associated with an organi-
ers, and subcontractors may be included in overlapping in- zations internal processes and support functions, the root
ternal boundaries that result from ongoing partnerships and causes of operational risks may originate from either within
alliances. internal boundaries or independently of program functions.

243 OCTOBER 2008

Table 5. Risk Events Are Addressed Most Effectively by Targeting the Root Cause
Operations risk Response to Possible root Proactive strategy to
event symptom cause counter root cause
Hurricanedamages Relocateoperations Highwindsandwater Alterbuildingdesign
building awayfromcoast damagebuilding
Lowqualityworkman- Conductadditionaltests Notaccuratelyfollow- Clarifyinstructions,test
ship &reviews inginstructions competence

Scheduleslip Mandatelongerwork- Subcontractorshipment Provideadditional
days,canceltimeoff delayed resourcestosubcontrac-
tor
Fraud,Theft Installsurveillance Hiringstandardsnot Performbackground
cameras enforced checkbeforehiring
With expertise in specific program processes, technical Proactively managing risk exposure, rather than merely
professionals and discipline specialists have the ability to un- dealing with its unpleasant side effects, requires investigating
derstand intricate operations and recognize problematic in- the direct and indirect contributors to every component of
teractions. This detailed knowledge provides insight into not every process:
only operational uncertainty, but also into the situations that
contribute to undesired outcomes. If resources are not available, why not?
Where these specialists are closely aligned with delivering Has an agreement termination risk been realized?
program results, there is often a preference for addressing Has there been a change in an external relationship that
discipline-related symptoms over countering less obvious previously had no impact on operations?
systemic root causes. A focus on symptoms is more prevalent Was the situation caused by human error with a correct-
when the organization or specialty has a tradition of estab- able cause?
lished risk mitigation responses or if the underlying circum- If the risk was the result of a natural disaster, what pre-
stance that initiates the risk event has an external origin. vented action from being taken that could have reduced
Standard means for alleviating risk exposure may also be part the impact?
of an organizations culture, such as testing to control quality Did fraud or other deliberate deception promote the risk?
or prototype development to improve technical innovation.
While these methods have a historical basis in reducing the Legal or Other Specialized Process Risk
likelihood of an undesirable event or moderating its conse- Because the operations risk category can be so broad, organi-
quences, unless there is a direct impact on the root cause of zations having many high-probability or high-consequence
the uncertainty, risk exposure is merely made more palatable, issues that share a common process will often define separate
not dramatically altered see Table 5. risk categories to highlight distinct areas of concern. Special-
Infrastructure efforts, as with any complex process having ized categories are typically used to assess and monitor pro-
a large number of participants and multiple organizational cesses that require high levels of expertise e.g., legal, techni-
boundaries, are highly susceptible to operations risk. Where cal, or security knowledge, where the likelihood of latent
program participants are accustomed to a program manage- errors is high, perhaps due to lack of transparency in or un-
ment risk focus e.g., risk categories aligned with program derstanding of the process, and where any risk realized would
functions or deliverables, it may be reasonable to subdivide have long-lasting or very detrimental consequences, such as
the operations risk classification to be consistent with pro- death or the organizations demise.
gram divisions of responsibility, resources, or expertise. If The main purpose of elevating an operations risk to a
results-oriented risk classifications e.g., cost/schedule/ stand-alone category is to add visibility to a critical process
performance, work breakdown structure, product deliver- that is not normally given widespread attention on a daily
ables used are, care must be taken to address the underlying basis or may be overlooked in the haste to satisfy customer
cause of potential risk events, rather than the symptoms, demands or achieve crucial goals. Legal and other specialized
when assessing effective risk reduction strategies. processes must often be initiated prior to the formal start of
OCTOBER 2008

an endeavor when program-specific expertise may not be accurate predictor for a more generalized concern e.g., pot-
readily available for consultation and the risk focus of the holes in all pavement types and vice versa. Where no other
organization is likely to be directed elsewhere. Coupled with information is available, the imperfect data may have to suf-
the need to use exacting terminology to address specific pro- fice, however, it should be noted that the uncertainty in
visions or concerns, risk events associated with specialized analysis results has been increased by doing so. As with any
processes can expose the organization to severe consequences identified risk, a risk reduction strategy would need to be
should errors be made. Instances abound of organizations employed to counter the increased exposure.
rushing to secure agreements with customers or subcontrac- Methodology risk includes not only events that may re-
tors without adequately venting and resolving potential legal sult from employing a prediction or evaluation approach de-
issues or technical unknowns. Unless a clear understanding veloped for a different set of circumstances, but also from less
of mutual expectations and responsibilities regarding these than thorough development and implementation of analysis
processes is reached prior to the start of program activities, all methodologies. A primary example of data and methodol-
participants may face increased risk exposure due to acting ogy risk is using industry data and prediction models with-
on incompatible priorities and objectives. out customizing either to reflect specific internal conditions
On large infrastructure efforts, any complex processing or the current operating scenario.
concern that requires specialized knowledge and could result When custom analysis tools and models are developed,
in a catastrophic outcome would be a candidate for a distinct data and methodology risk is generated when assumptions
risk category. By segmenting such concerns from overall op- are used in lieu of factual evidence to define data trends and
erational risks, these highly volatile issues gain notice within distributions. This commonly occurs when a nonlinear rela-
the organization. Since the quantity of experts in a highly tionship, such as an exponential function, is defined using
specialized area can be relatively low and there may not be a only two data points or when it is assumed that a relation-
widespread appreciation of the risk being generated, high- ship remains valid beyond the original data range. While
lighting a critical area may be the best means of ensuring there may be a good rationale for relying on a less rigorous
that areas of uncertainty are not overlooked or trivialized. methodology for program predictions and analysis, this
However, care must be taken not to elevate too many pro- should only be done with the understanding that risk expo-
cesses to distinct risk categories. Not only is the potential for sure has been increased due to the possibility of inaccurate or
explicit attention diluted with more categories, but the ad- misleading results.
dition of more boundaries and hierarchies to navigate within If data processing errors are made involving the use of
the processing scope adds complexity to the entire endeavor otherwise accurate information e.g., the wrong data file is
and increases the potential for misunderstandings, errors, and loaded, a valid methodology is used incorrectly, or the correct
overlooked hazards. data is entered but in the wrong fields, then the resulting
outcome is considered an operations risk since the outcome
results from processing mistakes. While the overarching
Data and Methodology Risk concern on any program should be to adequately identify all
Risk events that may result from the inappropriate or invalid applicable risks, without regard to category, when care is
use of data or analysis tools is categorized as data and meth- given to correctly segmenting potential risks into analogous
odology risk. Until more recently, the misuse or misapplica- classifications, common strategies for overcoming multiple
tion of information was often a minor area of concern. How- similar risks become more apparent. This allows the risk
ever, as the workplace has become increasing automated and reduction effort to be conducted with greater efficiency and
computer-driven, problems arising from inadvertent data effectiveness.
corruption or use of unsubstantiated analysis methodologies
have increased both in frequency and severity. Data centers VALUATION RISK BOTH RELATIVE
and analysis sub-functions are typically segmented as ancil- CHANGE AND LOSS OF VALUE
lary organization functions which collaborate on an as- Valuation risk may result from the change in relative values
needed basis with the primary product and service providers. of two or more resources or a change in the absolute value of
Although there is the expectation of shared goals and con- any resource. While this is primarily thought of as an impact
cerns by information and program specialists, integrating an to program costs, fluctuations in value relationships can also
additional organizational component into program activities affect decision making related to optimal resource mixes or
increases operational complexity and thus the likelihood of make-or-buy decisions.
miscommunications or other errors. The changes in value between like items is not an indi-
Data and methodology risk is frequently realized due to cation of differences in quality, quantity or the performance
the assumption that data applicable to a specific situation of the resource. As long as value differences remain either
e.g., pothole frequency in concrete pavement, would be an constant or at the same proportion, no valuation risk has

245 OCTOBER 2008

Table 6. Valuation Risk Realized and Possible Root Causes
Original program plan Valuation risk Actionable root cause
Inflationestimatedat3%peryear Inflationexceeds3%peryear Rateincreasesfortheprogram
durationarenotagreedtoin
advance
Hireexpertsinanewtechnologyarea Assignexpertstoapositionrequir- Useofthenewtechnologydelayed
ingalowerlevelofexpertisebut bythecustomer
payathigherexpertrate
Stockpilematerialswhensupplier Materialsneverneededorare Materialssupersededbyabetter
ceasesproduction unusablewhenneeded productordegradewhileinstorage
Decidetoautomateaprocessto Efficienciesrealizedinmanual Startupcostspushpaybackperiod
reducelaborrequired executionreversesthebenefitof beyondcurrentprogramlife
thechange
been realized. However, when either the absolute value of a e.g., buying in bulk, taking early delivery of materials,
resource changes unexpectedly e.g., a supplier increases front-loading an effort, there is a risk that circumstances
prices or the value of one resource changes with respect to may change. Introduction of improved products or services
another e.g., material costs per unit increase while labor or changes in program schedules could render the pre-
costs decline, a valuation risk event has been realized. If an purchased material or effort as less valuable than originally
anticipated cost increase has been included in program plan- anticipated or could even drive the value to zero if the sup-
ning to account for inflation or it was anticipated that labor plies or effort expended are later deemed unnecessary Table
input per unit would decline over time, then any changes in 6.
absolute or relative values within the anticipated range
would not constitute a risk event unless the magnitude of
the deviation varied significantly from the plan. ASSESSING THE SIGNIFICANCE OF EACH
Adjustments in value may be the result of changes in ROOT CAUSE
supply or demand for a resource, changes in component val- In the risk management planning process, the participating
ues for a resource, or due to changes in resource location e.g., organizations must define criteria for classifying the signifi-
country of origin or purchase timing. In a global economy, cance of each identified risk. Typically, broad rating catego-
changes in the relative values of a resource such as labor, even ries are defined that are consistent across the internal envi-
in an unrelated application, can drastically alter both overall ronment and correspond to accepted industry practice. At a
costs and resource availabilities on a current effort. As the minimum, all participants in the current endeavor need a
demand for construction raw materials increases in a high common understanding of the significance of each defined
growth economy such as China, the availability and cost of risk level and of the level of attention and immediacy of
construction materials is affected around the globe. This can action each requires. As part of the risk assessment process,
occur even though the materials required locally may not be an exposure rating based on the combined significance of
identical to those required overseas or be from unrelated sup- both risk frequency and consequence severity is defined for
pliers. each event. While this results in the significance of each risk
Addressing valuation risk requires anticipating changes being summarized at a gross level e.g., high, moderate, or
in unrelated product sectors and understanding how the low exposure, the supporting probability and severity rating
fluctuations in one sector can affect another. When decisions scales consist of multiple subcategories that add granularity
are made to take advantage of pricing differentials due to to the rating process.
location e.g., outsourcing, it is also necessary to consider the Using risk rating data, all potential events are then
additional uncertainty that may be acquired by introducing ranked according to predefined guidelines. Some organiza-
another boundary between a required resource labor and tions employ numerical methodologies a potential source of
the target effort providing the desired product. When dif- data and methodology risk or frequency counts to prioritize
ferences in timing are exploited to achieve a cost advantage events while others rely on expert opinion or majority opin-
OCTOBER 2008

Figure 4. Risk assessment process yields prioritized risks contributing to risk exposure
ion to rank events by utilizing multi-voting techniques Fig. assessed with less than complete information or confidence,
4. could be tagged for additional monitoring or periodic review
In setting risk priorities it is essential to explore all pos- to take into account updated information.
sible root causes that could lead to an undesirable event since
even the smallest discontinuity in working towards a goal
can magnify rapidly. If any potential risk source or antici- Data Collection and Development
pated point of origin occurs beyond the immediate program Lack of sufficient data is a major obstacle faced when at-
boundary, even within either a customers or contractors in- tempting to establish a relationship between suspected root
ternal environment, or is completely external to the program causes and the problems that can result. Ideally, empirical
scope, additional significance should be assigned due to the data will be available to succinctly define a causeeffect rela-
potential impact of unknowns on overall risk exposure: tionship based on event probabilities and the extent of any
anticipated consequences. While organizations make an ef-
Information on risk likelihood is less concrete; fort to collect many types of information on internal pro-
Instantaneous visibility into when the conditions for the cesses and external interactions, there is typically never
risk are at their greatest is less immediate; and enough pertinent data to conclusively determine that an en-
The ability to affect a countermeasure to either prevent or during relationship exists, especially in a dynamic, global
control the risk event is constrained. environment. While not as desirable, subjective inputs and
highly correlated information often offer the best alternative
As experience in disaster prevention and containment has sources of decision-making information.
shown, a small issue can quickly escalate into a full-blown The most respected subjective inputs come from subject
crisis. In the overall construction of a multimillion dollar matter expertsthose professionals with in-depth knowl-
tunnel, the installation of ceiling tiles could almost be seen as edge of a specific topic or subject area. Experts are often
a cosmetic enhancement, and the choice of epoxy a fairly included in risk management planning activities to assist
minor decision. However, as was experienced on the Big Dig program personnel in brainstorming potential obstacles to
effort, a seemingly routine decision set in motion a chain of success. Due to in-depth knowledge of their specialties, these
events that resulted in a catastrophic outcome. While there experts should be able to provide supporting data or insight-
are literally thousands of these repetitive decisions made on ful speculation on event probabilities and consequence severi-
every complex effort, it is often such overlooked or less em- ties and any probable secondary effects. These specialists are
phasized concerns that prove to be the most significant in then consulted to provide advice and recommendations on
terms of risk exposure. strategies and alternatives to pursue either to prevent or re-
Many organizations include an evaluation factor in their duce the impact of the identified events.
probability and severity ratings to account for the complexity Internal experts typically provide the most assistance in
of the risk-related activity e.g., crossing organizational addressing issues that are distinctly associated with the cur-
boundaries or requiring the coordination of separate entities rent undertaking due to their intimate knowledge of
or to account for the risk associated with making rating and
ranking decisions using less than complete information Internal processesboth the virtues and shortcomings;
Table 7. Aside from using risk rating inputs to capture Concealed motivesis the overarching goal to satisfy cus-
situations where there are excessive unknowns, any risk event tomers or enhance the local power structure?

247 OCTOBER 2008

Table 7. Rating Factors That Measure Interactions across Operational Boundaries
Likelihood Maturity Complexity Dependency
level factor factor factor Stability factor
a Remote Technologyexists Simplerelativeto Entirelywithin Externalfactorswill
andcanbeusedasis currentenvironment projectcontrol notmakeanychanges
b Unlikely Technologyrequires Minorcomplexity Dependsonexisting Externalfactorswill
minorchangebefore relativetocurrent productsupplied makeminorchanges

use25% environment fromoutside 25%
c Likely Technologyrequires Moderatelycomplex Dependsonsupply Externalfactorswill
majorchangebefore relativetocurrent andmodificationof makemajorchanges
use50% environment existingproduct 50%
fromoutsideorgani-
zation
d HighlyLikely Technologyrequires Significantlycom- Dependsonnew Externalfactorswill
significantdesign plexrelativetocur- developmentfrom makesignificant
andengineering rentenvironment outsideorganization changes75%
beforeuse75%
e NearCertainty Stateoftheart,some Extremelycomplex Dependsonfinding Externalfactorswill
researchhasbeen relativetocurrent developmentfrom makeconstant
completed environment outsideorganization changes
Cultural normsif mistakes are tolerated, expect lots of provided, event frequency and severity data might also be
errors, despite proclamations to the contrary. able to be gleaned from the lessons-learned documentation.
One shortcoming of using expert opinion and past expe-
The experiences and opinions of external specialists riences to predict future events is that all are backward look-
should also be sought due to their assumed lack of bias re-
ing. Where there is extensive similarity between prior and
garding internal politics or risk-obscuring mantras e.g., we
current efforts, and little has changed in the affected environ-
dont make mistakes. An outside perspective will aid in
ments, utilizing past experiences would be expected to
including information that would otherwise not be available
on events experienced in other environments and provide greatly reduce the time and effort required to identify and
insight into how outside organizations, with differing view- classify potential risks. More effort could then be expended
points and cultural norms, respond to specific threats. on the areas of concern that are not adequately addressed by
There are risks associated with relying on too small a pool past experience.
of expertise to perform risk assessment activities. Inadequate Where there is very little similarity in the detailed execu-
coverage of the range of risks faced can result if dissenting tion of the current effort compared with prior experience,
viewpoints raised by other disciplines or non-expert person- relying on historical information and opinions can yield a
nel are not given sufficient consideration. In organizations false sense of securityin such instances the unknowns of
having a flatter and less hierarchical communications struc- the proposed effort would considerably outnumber the
ture, knowledge gained by working across internal bound- known outcomes in past efforts.
aries and addressing issues from a multidiscipline perspective In addition to the experienced-based inputs from specific
supplements limited expert input. operating entities, it is also important to address any unique
To supplement expert opinion, it is generally helpful to or previously experienced interactions along organizational
review performance successes and challenges on prior com- and activity interfaces. In larger organizations or in environ-
parable efforts. These lessons learned provide insight not only ments where highly complex programs are the norm, there
into the problems that were realized, but also feedback on may be expertise in working across subject matter and orga-
the success of any risk prevention or impact-reduction strat- nizational boundaries that can assist in identifying areas of
egies that were employed. Depending on the level of detail concern. As interfaces are crossed during the course of the
OCTOBER 2008

Table 8. Common Misrepresentations of Subjective Information
Subjective analysis Use as if
technique Subjective data continuous Fallacy
Simulationresults 10% cumulative Assumedcombined Cannot add cumulative
expressedascumulative probability of A, 15% 25%probabilityofA probabilities, must
probabilities cumulative probability andB collect a combined
of B simulated probability
for A and B
Ratingscales: Eventratedasmoderate Tendencytomultiply Exposurescaleisalso
1orAislow, probabilityandhigh 2 3 toget6forrisk discrete,mustlookup
2orBismoderate, consequence exposure intersectionofBandC;
3orCishigh 6ismeaningless
Extrapolatingtrendsfrom Assumemissingdatais Use2orfewerdiscrete Anyrelationshipcanbe
minimaldata consistentwith1or2 datapointstodefinea definedfor1datapoint;
knowndatapoints trend onlylineartrendscanbe
definedwith2data
points
program, any item left to conjecture and not specifically de- results obtained, but more rigorous subjective information
fined or any activity intersection having multiple contribu- may be overlooked in preference for apparently numerical
tors or crossing numerous organizational boundaries is a po- data. Subjective information that is presented so that it ap-
tential focal point for uncertainty. pears more rigorous and factual than warranted is a primary
source of data and methodology risk.
With the assistance of mathematical tools, such as simu-
Subjective Inputs as a Source of Risk
lation analysis, it is possible to use subjective, expert opinion
Social amplification of issues, especially in subjective evalua-
for parameter input ranges to generate apparently rigorous,
tions, can be an obstacle to thorough, unbiased risk predic-
statistically significant outcomes. The danger of this ap-
tion. Shared experiences, or in the case of catastrophic events,
proach lies in misrepresentation of the significance of any
situations shared via media exposure can overemphasize both
simulated data since it appears objective but is actually a
the significance and the potential likelihood of an event.
compilation of opinion. Additional risk is assumed if simu-
Even an issue of limited consequence a short delay in pro-
lated cumulative frequencies are treated as continuous values
gram completion can be repeated often enough and stri-
or if simulated conclusions are used to refute empirically de-
dently enough that the significance of the issue becomes ex-
rived recommendations.
aggerated. As the attention paid to a less worrisome concern
Discrete information, especially risk rating scales, should
becomes disproportional to its overall significance on the
only be expressed using nonnumeric labels. The purpose of
program, awareness and effort is shifted from more deserving
expending effort on risk assessment and management is to
issues, increasing risk exposure in the non-amplified areas.
reduce overall risk exposure, not to give a false sense of secu-
Even where empirical data is available, social amplification
rity from apparently rigorous, but unsubstantiated analysis.
can be difficult to overcome, so strong is the tendency to be
Numeric values should only be used for ratings if sufficient
blindsided by euphoria or despair.
information is available to verify and validate continuous re-
Assumptions are often made regarding information value
lationships between parameters.
based on whether the information is presented in a numeri-
cal or non-numerical format Table 8. When ordered data
or other relative information is described using a non- ALTERNATIVES FOR GENERATING
calibrated numerical scale, the user is more likely to conclude EMPIRICAL DATA
that the information is empirical, numerically exact and Two fundamental enablers of reduced risk exposure are vis-
mathematically continuous. If the user then performs math- ibility i.e., capable of being discerned and transparency i.e.,
ematical operations on subjective labels, not only are invalid lack of distortion or ambiguity especially when applied to

249 OCTOBER 2008

risk identification and assessment information. While self- While participants may derive a sense of satisfaction from
preservation encourages covering up errors or divergent participating and having their opinion registered, the poten-
viewpoints in most organizations, it is only by knowing all tial of a monetary payback if their prediction is correct is
perspectives and what has not worked well in the past that designed to elicit their true thoughts on the question, not
sufficient action can be taken to avoid problems in the fu- just the outcome that they might feel obligated to support.
ture. Since it is not possible for even rarified experts to know Equilibrium is achieved in the market when the prices for
absolutely everything, allowing unobstructed visibility into both points of view stabilize. Based on the percentage of
information sources, thought processes, and decision-making participants selecting one outcome over another, the prob-
motives is needed to stimulate discussion regarding potential ability of each outcome is determined.
risks that were not initially addressed or insights that counter Prediction markets gathered widespread attention when
conventional wisdom. it was proposed that a market be used to help predict future
Several methods, described below, are effective for adding terrorist attacks. While there is every indication that useful
rigor to available information when program boundaries ob- information would have been obtained, it was considered
scure detailed data or where information regarding a future unsavory for the U.S. government to run essentially a betting
event is not readily obtainable. Subjective data, including pool on when massive destruction and loss of life would next
opinions, can be captured and extrapolated to provide addi- occur. Since then, prediction markets have been used very
tional clarity and less ambiguous conclusions as long as re- successfully to forecast sales figures and election results with
sults are not treated with more precision than deserved. greater accuracy than outcomes predicted by experts or from
sampling surveys. While participants in the prediction mar-
ket should have some stake in the outcome other than just
Simulation Analysis
winning their bet, it is not necessary for participants to have
Simulation analysis is beneficial for assessing the possible
detailed knowledge of the subject area under assessment.
ranges of outcomes that could be reasonably anticipated from
Even though all participants in a market would not have
limited inputswhere minimal objective data is available
complete information on the subject addressed, the benefit of
and must be expanded using subjective information and as-
the system is that it has the ability to capture subjective
sumptions, or a range of plausible outcomes can be deter-
information or information that may have been rejected by
mined based on variations in initial assumptions and inputs.
experts as being insignificant or contrary to conventional
Simulation analysis is often used to predict future operat-
wisdom.
ing scenarios. Multiple outcomes with differing frequencies
Use of prediction markets is advantageous in situations
and impacts can be combined to predict a composite long-
where:
term forecast. This allows the organization or program to
gain an understanding of overall risk exposure and the mag- It is not feasible to gather empirical data e.g., predictions
nitude of resources required to offset the anticipated exposure of catastrophic events;
over time. Since simulations provide projections of cumula- Sampling does not yield definitive results e.g., an election
tive frequencies, conclusions should not be made regarding that is too close to call; or
specific event probabilities. A previously untried course of action is being attempted
Evaluating the interactions of plausible ranges of informa- e.g. demand for a revolutionary product such as wireless
tion can provide insight into expected norms and the likeli- networks.
hood of realizing extreme outcomes, However, care must be
taken in the presentation of the information gleaned from By soliciting inputs from a broad perspective, the predic-
simulation results to prevent misconceptions regarding the tion market may be capturing widespread perceptions of
preciseness of analysis results. Of special concern is using fundamental causeeffect relationships. As an example, resi-
simulated data as if the information were from a verifiable, dents of a low-lying area may combine information on lunar
independent source. cycles, when higher tides are expected, with knowledge of
storm formations and past experiences with flooding to sup-
port opinions on levee breaches. Participants in the likeli-
Prediction Markets hood of a levee breach market may be capturing previously
Prediction markets capture opinions of a range of expertise untapped information and combining it in unique ways to
regarding a single question e.g., Will the levees be breached form conclusions that might otherwise be considered trivial
in the event of a hurricane? The markets are essentially a or politically unacceptable.
dynamic version of multi-voting since participants can
change their positions on the resulting outcome at any time Analogy
until the market closes. A key component of prediction mar- Logical inference, reasoning that like occurrences have mul-
kets is the monetary stake participants have in the outcome. tiple similarities, can be used to build on basic observations
OCTOBER 2008

to extrapolate a broader conclusion. Use of analogy allows the highly correlated with the formation of potholes in pave-
maximum benefit to be realized from a limited initial set of ment, however, it is the expansion of frozen moisture that is
information. As with other data manipulation tools, using a root cause of the cracking that eventually leads to pothole
analogy to replace missing information introduces data and formation. A calendar can be used to assist in predicting an
methodology risk due to the reliance on assumptions in lieu anticipated frequency in pothole occurrence, but a calendar
of factual evidence. date is not a fundamental cause of pothole creation. To affect
Analogies in the form of power functions occur through- either the probability or severity of potholes, temperature or
moisture variations must be countered; altering the calendar
out the natural environment: leaf vein patterns are similar to

tree branch patterns; the shapes of rocks are analogous to the would be irrelevant.
shapes of mountains. In the industrial world, uses of power Taking this example a step further to illustrate the in-
functions to reduce risk include building scale models to test creased risk exposure when operating in an external environ-
design properties and initiating pilot programs to validate ment, risk control mechanisms that may be valid for pre-
new processes. If the attributes of a catastrophic event, such venting potholes in internally-managed structures
as a levee breach, are scalable to a more easily observable artificially keeping temperatures above freezing, preventing
event e.g., water flow exceeding the capacity of a field irri- moisture from touching the pavement, are less workable
gation ditch, it may be possible to relate the physical prop- when dealing with many external participants and differing
erties of the events to assist in predicting risk event frequency operating environments. While it may be easy to envision
and severity. the difficulty of controlling the physical environment affect-
Often it is possible to use analogy and internal experience ing pavement that is beyond internal operations, similar is-
to develop usable data from less concrete publicly available sues exist in all scenarios beyond internal boundaries: local
information. Data on the time and effort required to imple- residents may be put at risk for flooding due to national
ment an earlier process upgrade could be assumed to be priorities for more and deeper shipping lanes; regional driv-
ers are affected by the choice of ceiling bolt epoxy made by
proportional to information in a news article documenting a
the subcontractor of a local agency.
competitors timeframe for incorporating a new technology.
Mathematical modeling techniques, such as simulation
While data and methodology risk is incurred by assuming
and data extrapolation, are employed to expand the compre-
past internal experience is proportional to an independent
hensiveness of limited data sources. Analogies and empirical
external event, having more current information that can be
data that apply to a wide range of circumstances are com-
extrapolated into prediction factors provides balance to pos- bined based on observations and assumptions to assess po-
sibly dated internal projections. tential interactions that may either moderate or increase risk
Establishing relationships based strictly on orders of mag- exposure. While model outputs need to be interpreted con-
nitude is a straightforward application of power functions sistently within the constraints of the original data and any
the ratio of millionaires to billionaires could be assumed to modeling assumptions, insight can be gained into the range
be similar to the ratio of billionaires to trillionaires. On in- of possible outcomes, and expected extremes of the relation-
frastructure projects, order of magnitude relationships might ship interactions can be defined.
be observed between the frequency of small debris one inch Multiyear scenario models are frequently used to predict
in diameter blocking storm sewer drains and larger debris an expected range of risk exposure based on the combined
ten inches in diameter blocking flood control canal frequencies and impacts of internal and external factors.
pumping stations. Long-term risk exposure is projected based on both optimis-
Using analogy to support gross-level event predictions is tic and pessimistic predictions with extreme events and po-
not a substitute for seeking to understand the root cause of tential counter measures included as variations. The organi-
the anticipated risk. While information from an analogous zation can then develop plans to address the characteristics
situation may provide an early warning that an event is be- that contribute to risk exposure extremes with full knowl-
coming more probable, acting on the highly correlated event edge of the conditions that contributed to the predicted out-
will not affect the probability of the targeted risk. Correla- comes.
tions, while helpful, are not a replacement for knowledge of
true causeeffect relationships. ACHIEVING A BALANCED RISK
When using empirical information to postulate proper- EVALUATION
ties of an unknown event, it is important not to conclude The overarching goal of any risk assessment is to balance the
that a definitive relationship exists. Events can be highly effort expended on risk reduction activities, including inves-
correlated in specific situations and useful as indicators of an tigations and proactive intervention, with the expected loss
anticipated but unproven outcome, without being infallible in value in terms of labor, materials, or bad publicity if less
predictors. In the northern hemisphere, the winter season is or nothing was done. After appropriate actions are taken, the

251 OCTOBER 2008

risk exposure assumed by the organization and affected par- fort on addressing less significant issues leaves little effort
ticipants should be at a level that all find acceptable. In some available to address the events that contribute the most to
organizations an acceptable level of risk is providing continu- risk exposure. Not only can significant risks be left out of the
ous crisis intervention due to being an early adopter of new analysis, but the priority of the risks included may not real-
ideas or operating at a level of exposure that puts survival at istically reflect the potential impact on successful results.
risk on a daily basis. Others are so risk adverse that changes Past experience, without the expectation of repeating spe-
are only made to stay current with mainstream participants cific outcomes, does provide a valuable overview of a range of
in the global environment, never venturing beyond accepted
issues that may occur in the future. If past experience indi-

norms. Organizations that refuse to change at all, often in the cates problems with valuation risks, for example, the organi-
mistaken desire to be low risk, are actually assuming exten- zation should understand past contributors to the erroneous
sive risk exposure due to the possibility of becoming incon- value expectations and initiate the necessary countermeasures
sequential or obsolete. to limit future occurrences. To adequately address all prob-
able areas of concern, expectations based on experience can-
Effort Expended Must Be Value-Added not be allowed to obscure awareness of new conditions affect-
The risk assessment and mitigation process must be rigorous ing the internal and external environments such as
enough to provide confidence that an appropriate level of technology upgrades, revisions to governmental policy, for-
uncertainty, from both internal and external sources, has been mation of new alliances or modified customer expectations.
accepted. The risk evaluation effort should not be so inten-
sive that it outweighs the resource expenditures that would
be required to counter the consequences participants seek to
avoid. Nor should it be so lax that essentially no risk reduc-
tion value has been achieved for the effort expended. Address a Broad Range of Potential Risks
Many risk management efforts become enslaved by estab- The effort an organization expends on risk containment
lished processes that require specific analyses, detailed docu- should address both internal situations that can be directly
mentation and set review cycles. While a standardized ap- managed as well as external unknowns that may only be
proach allows sharing of common data and information and influenced indirectly. By considering common denominators
helps ensure all participants achieve a mutual appreciation of of risk exposure originating throughout the global environ-
risk tolerance, risk management is not a one-size-fits-all pro- ment, infrastructure providers and their customers can have a
cess. Use of a common framework provides process transpar- greater impact on incidental and inherited risks than by ad-
ency and synergy; however, since the acceptable level of risk dressing each potential source of exposure as an isolated oc-
exposure will vary with program scope and complexity, the currence.
extent to which the process is applied must correspond to Any bias among risk evaluation participants regarding
unique program needs. emphasis placed on one risk category over another can result
in invalid perceptions of total risk exposure. Mitigation ac-
Avoid Undue Bias Based on Experience tions will not have the desired impact on comprehensive risk
The need to rely on past experience and personal judgment exposure if the most consequential events are either not iden-
to identify and assess uncertainty can introduce prejudice tified or are incorrectly prioritized. False and misleading as-
into risk evaluation conclusions. It is human nature to em- sessment conclusions can result in the predicted exposure
phasize what one is most familiar with, either personally or level differing significantly from what should be anticipated.
via shared experience. The challenge in looking to the future An inaccurate perception of the magnitude and significance
is to learn from past experience without expecting the expe- of expected risk events increases the likelihood that proper
rience to provide a complete representation of all internal and attention will not be applied where the most benefit would
external situations that contribute to risk exposure. Since risk be obtained.
management is primarily forward-looking, overemphasizing Constraints on the scope of risks consideredby limiting
past experience can severely hamper efforts to anticipate and inquiries to only core operations or well-known risk
articulate unknown events. sourcescan result in an artificially low prediction of expo-
Bias in risk identification is not limited to past experi- sure. Lack of understanding of the realistic level of risk faced
ence, it can also result due to peer pressure and social ampli- may encourage lax enforcement of risk management policy
fication. Through exhaustive media reports or internal rep- or lead to the acceptance of additional uncertainty beyond
etition of events, groups and individuals may assume event what the organization would normally consider acceptable.
importance or significance is proportional to communication Either outcome may expose the participants to a magnitude
frequency. Placing unwarranted emphasis and extensive ef- of consequences that would overwhelm available resources.
OCTOBER 2008

Proactively Respond to Root Causes added, and previously actionable root causes become less ef-
Proper identification and investigation of the fundamental fective in transforming vulnerabilities.
sources of risk is invaluable in determining the most effective The primary means for overcoming or staying current
actions for alleviating risk exposure. In instances where the with dynamic conditions is to continuously seek new and
probability of an event can only be marginally affected by use updated sources of information. Not only is discrete informa-
of control mechanisms e.g., inspections or prototype devel- tion needed, but trends associated with relevant parameters
opment, measures must be implemented instead to moder- are required to give insight to future conditions. Effort ex-
ate the severity of anticipated consequences. pended monitoring the internal and external environments
Events that result from external factors are typically the and collecting pertinent data assists in updating assessment
least well-managed using internally initiated control strate- conclusions as well as supporting on-going risk reduction
gies. If a construction crane failure is due to an internal factor efforts.
such as human error, it may be feasible to prevent the root While expert opinion is invaluable in understanding
cause through proactive intervention such as performance re- technology-intensive situations, shared insight through sub-
views or reallocation of job tasks. If the root cause of the jective inquiry such as prediction markets and analogous
failure has an external source, such as severe weather, it is not comparisons provides multiple perspectives and may capture
practical to try to control or prevent the weather phenom- new perspectives and insights and incorporate previously un-
enon. Instead, strategies would need to be employed to explored connections or correlations. Where links can be de-
lessen the impact of the eventperhaps reducing the worst fined across participant and peripheral boundaries, common
outcome to injury rather than death, or being satisfied with root causes that can be addressed with synergistic actions
an extended delay in completion in lieu of project cancella- may become apparent providing more efficient application of
tion. risk management effort. Even in instances where expert and
Program-initiated actions, including risk control mecha- broad-based opinions differ, the inconsistency in perspectives
nisms, are best applied to situations within the participants yields valuable insight into areas requiring more investiga-
internal environments; external factors may be influenced by tion or situations where there are perhaps multiple root
internal actions but can seldom be directly controlled. causes necessitating a combination of mitigating actions.
Where a causeeffect relationship can be established between
an event and the ensuing outcome, the ability to affect a
more desirable result has a greater possibility of success. The
ability of program participants to initiate actions that di- Maintain a Global Perspective
rectly counter identified root causes is dependent on explicit Throughout design, development, and implementation, ef-
knowledge of event interactions. fective risk management requires not constraining risk event
Where there is less knowledge of reciprocal actions or the consideration to highly visible issues or traditional identifica-
relationship is merely highly correlated rather than directly tion methods. Infrastructure providers must maintain a glo-
linked, indirect stimuli are required to modify the likely bal outlook that encompasses all direct and indirect operat-
outcome. A decision must be made whether to focus on ing influences. Without sensitivity to the unknown
reducing the probability of an event or accept the event and unknowns, infrastructure providers run the risk of uninten-
attempt to reduce its impact. The choice depends on the tionally assuming more risk exposure than can be success-
anticipated ability of internal actions to influence indepen- fully managed. By remaining open to unconventional
dent external factors beyond program and organizational sources of information, encouraging collaboration across dis-
boundaries. ciplines, and aggressively seeking conflicting points of view,
the risk evaluation process is more likely to address the most
significant sources of uncertainty. The very nature of infra-
structure effortsoperating across organizational and cul-
Continuously Seek Information tural boundaries, providing products and services expected to
Although participants may have every confidence that the function without failureincreases the need for transparency
actions and strategies initiated will decrease event probability and collaboration to contain uncertainty and satisfy end-user
or limit risk impacts, the dynamic global environment does expectations.
not allow the luxury of assuming the solutions implemented
will remain optimal or effective throughout the program life.
Globalization creates constant flux in the overlap and con- BIBLIOGRAPHY
figuration of internal and external boundaries and in the Banks, E., and Dunn, R. 2003. Practical risk management,
makeup of peripheral alliances. Root causes of uncertainty Wiley, West Sussex, U.K.
change over time, additional fundamental risk sources are Defense Systems Management College. 2001. Systems

253 OCTOBER 2008

engineering fundamentals, U.S. Dept. of Defense, Jan Lyons is an adjunct professor in risk management
Washington, D.C. at Southern Methodist University in Dallas. She is the
Defense Systems Management College. 2002. Risk author of Risk Management for Technical Professionals
management guide for DOD acquisition, 5th Ed., U.S. Dept. written to address the complexities of managing risk in
of Defense, Washington, D.C. global operating environments by integrating program
Lyons, J. 2007. Risk management for technical and financial risk management approaches. She can be
professionals, draft Ed., http://www.Lulu.com.
contactedbye-mailatLyons.Engr@gmail.com.
Senge, P. M. 1990. The fifth discipline, Doubleday, New
York.
OCTOBER 2008

AntigoIN - 2008 - Objetivamente Avaliar o Risco em Um Mundo Complexo

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

AntigoIN - 2008 - Objetivamente Avaliar o Risco em Um Mundo Complexo

Hochgeladen von

Copyright:

Verfügbare Formate

Objectively

not so willing to blindly assume all potential risks not con-

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

secure increased program funding. In either case,

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Adversepublicityisgenerated Competitorsandinterestgroupspub- Recoveryagenciesandadvocacy

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

Inspectionandoversightauthority: Ceilingpanelinstallationdidnotmeet Leveeinspectionandmaintenance

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

Figure 1. Relationship of internal to external operating

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

consequences of flooding risk generated in their external en-

Leadership Manage. Eng. 2008.8:231-254.

limited to internal activities or to information gained from tointernaloperatingstructuresandlongrangegoals

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

ship &reviews inginstructions competence

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

minorchangebefore relativetocurrent productsupplied makeminorchanges

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

out the natural environment: leaf vein patterns are similar to

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

issues that may occur in the future. If past experience indi-

Leadership Manage. Eng. 2008.8:231-254.

Leadership and Management in Engineering

Leadership Manage. Eng. 2008.8:231-254.

Leadership Manage. Eng. 2008.8:231-254.

Das könnte Ihnen auch gefallen