How efficient and effective is your project portfolio risk management?

In my opinion, it is important that the project team takes the lead in this matter. Measuring maturity is just a step that must be done periodically, but promoting risk management must be done continuously. For instance, the project team, being an experienced team in project management as a whole, must promote and provide in-company training on the topic for the main stakeholders. Another way is to create knowledge pills on this topic by sharing some positive and negative experiences and events regarding risk management.

Some risks to projects can arise from long-standing systemic problems in the business and are nothing to do with the projects at all. It’s important that those involved with monitoring and managing the portfolio know when this sort of systemic risk has surfaced – and there’s a clear line of escalation to the leadership team to plan a resolution. In my experience, some of the biggest risks materialise due to a lack of communication – in person, and via risk reporting tools. When the project steering committee understands what’s happening at the delivery level, and the leadership team is equipped with information to make decisions, risks don’t get lost in the rush of day to day operations.

As a program/porject manager, identifying the risk is one of your key responsibility. Every high/medium risk identified should have a mitigation plan and a contigency plan. The former is within your control to take mitigating actions, the later is more of organizational risk management strategy. It is sometime challenging for a PgM/PM to convince your sponsor to set aside $$ for contingency actions and this is where project struggle.

💡 In my experience, reaching a high level of risk management maturity is an evolutionary journey. 📚 Concept Integration The more integrated your risk management processes, the higher the maturity level. Consider how well it's linked with other PM processes. 🛠 Tool Sophistication Advanced software aids in sophisticated risk analysis. Maturity often aligns with the complexity of tools being used. 🌐 Stakeholder Engagement High maturity levels usually see active stakeholder involvement, ensuring collective and comprehensive risk assessment. 📌 Concluding, while the PMI model offers a structured approach, maturity is best gauged by real-world integration, advanced tooling, and stakeholder collaboration.

Top Risk Management´s Software in 2023 were Alyne, Fraud.net, StandardFusion and Beanchmark Gensuite EHS. Sadly, in my experience, even the first world class companies don´t manage any digital tool for this crucial task. Many of them follow a risk management metodology in order to catch the red flags but it is not always consistent. The process includes risk register template, root cause analysis, SWOT, probability and impact Matrix, brainstorming and lessons learned sessions. I invite the organizations to provide to functional leaders with robust digital tools to effectively identify risk and enhance portfolio performance.

Risk management is not about eliminating risk completely, but about reducing it to an acceptable level. Project portfolio risk management has many benefits, but perhaps the most important is it helps identify and mitigate risks early on in a project's lifecycle. This can save a lot of time and money in the long run, as well as avoid any potential disruptions to the business. It's also a great way to monitor a project's progress. This helps ensure that projects stay on track and are not delayed or derailed

By simply having a way to identify risks, an organization can begin its risk management system. Once a process of defining is established, there are only a few ways to respond: accept, insure, avoid, reduce. Once listed, you can define your response and ensure that thresholds are determined and will trigger responses at appropriate levels. This is a great conversation with the stakeholders: what is the threshold, what is the response and what is your tolerance level. Those tolerances and thresholds dictate if this is strategic enough to engage, if triggers occur. If it is not strategically aligned, then halt the work.

One thing to add please don’t use the template as is. Make sure the template is adjusted as required by the culture, risk tolerance, and the organization’s objectives

In my experience, risk identification is an elementary and well know task, but many projects are affected by an innefective and delayed anaylisis and the lack of response and action derivated from the burocracy, lack of procedures, power centralization, negative gross margin, quality issues and non skill staff inside the organization. I suggest companies to review their Estrategy and Governance in order to be more lean.

There are several risk management frameworks available - Management of Risk (MoR), ITIL Risk Management, NIST Risk Management etc... The important piece is that the framework is known/published, used and improved for your organisation. Additionally you may already have a Risk or Group Risk department that will have a framework and methodology for managing risk so ensure these stakeholders are linked in to your Portfolio practice

Tools produce decision SUPPORT data. No tool should be treated as pure intelligence upon which actions are taken. The data will assist managers as they make certain decisions to act. These are not automatic. Priorities, value evaluation, balance, optimization and other techniques should assist managerial review to give perspective to a more informed response. In this way, the input to ANY tool becomes more important to the tool itself-- any tool will do its job if given the appropriate input. Concentrate on input validation processes rather than tool selection.

Tools such as the OODA loop, risk register template, root cause analysis, SWOT, probability and impact Matrix, brainstorming, lessons learned sessions and digital software are fantastic for desicion-making. In addition, the following soft skills are needed too: 1. Be operational, technically and financial aware 2. Invest in Decision-Making trainnings 3. Be organized 4. Have the ability to atay calm and communicate well 5. Be adaptable to changes

If raising red flags causes backlash, then your organization is not ready for risk management. The cultural tolerance for predicting poor outcomes or running tests that prove poor performance in future are not accepted; no risk management process will be used or effective. The culture must celebrate finding errors before the customer does, or must listen to those who find where the future is not as rosy as imagined. They are viewed as critical, negative and buzz-killing energy vampires: but they are often right and are not afraid to tell others what they are seeing.

A great example from my experience that supported the promotion of active risk management was from a Group Risk department where large strategic change initiatives would be assigned a risk manager from the team to work alongside the programme manager.

Hello team! the following are my recommendations in this topic: 1. Start from the Top Management. Risk culture depends on the support and engagement of executive leadership. 2. Employee risk awareness education. Employees should receive customized training based on their duties and business unit. 3. Increase visibility. When employees have better visibility into jeopardized situations, they can understand individual and collective actions necessary to manage them. 4. Incentivate risk performance. Rewards and motivation are powerful ways to drive and reinforce positive employee behaviors. 5. Report Progress with metrics and document critical risk-related decisions.

6 key metrics to track in order to know risk management performance: 1. Positive gross margin in the portfolio 2. Customer satisfaction and no complains 3. Number of risks identified 4. Percentage of risks monitored 5. Percentage of risks mitigated 6. Cost of risk management programs, trainings, software rent and mistakes, versus gross margin.

Regularly assessing and prioritizing risks across the portfolio is key. For example, in a recent enterprise software initiative we used a risk scoring matrix to evaluate each project's potential impact and likelihood of risks. This helped us allocate resources strategically and address high-priority risks proactively. We also made sure that specific people were responsible for managing risks and had plans in place to respond to them. By keeping an eye on risk trends and adjusting our approach, we were able to deliver the portfolio on time and within budget. To manage risks better, encourage discussing them openly and learn from other projects. Using data-driven risk management helps software projects succeed.

Risk Management framework should aid in keeping the Portfolio goals intact and keep the Portfolio relevant to the Organizational strategy during Portfolio execution period. From time-to-time the Risk Management process effectiveness should also be measured based on quantifiable (Ex:- Cost's avoided) and soft measures.

Something we hav´nt talk about is industry experience. In my last job, I realized that I felt comfortable taking risks and avoiding them because my expertise in the company and knowledge of contracts and customers. Definitely, there are two ways to become an expert, dedication and passion.

Our project portfolio risk management is efficient and effective by proactively identifying and assessing risks, implementing mitigation strategies, and continuously monitoring for new risks. We use data analytics and stakeholder input to ensure comprehensive risk management. Regular reviews and adjustments keep our portfolio aligned with strategic goals and risk tolerance.