You already manage risk

“I don’t have time for risk management. We have a project to deliver.”

I’ve been hearing that sentence for twenty years. And every time, the person saying it has just made three or four risk management decisions in the same conversation without naming them.

They chose the more expensive supplier because the other one “worried” them. They added two weeks to the schedule “just in case”. They called the client before sending the invoice “to avoid surprises”. They asked for the soil to be tested before the pour.

Each of those moves is a risk decision: a threat identified, assessed by instinct, treated.

So the problem isn’t that you don’t manage risk. You manage it every day. The problem is that you manage it in your head.

And risk management that lives in your head has three defects:

— It’s invisible. Your read on that supplier exists only for you. A colleague signs the same contract next month without the benefit of your worry.

— It can’t be prioritised. Ten risks carried mentally by five people is fifty worries with no hierarchy. So organisations treat the loudest risk, rarely the most dangerous one.

— It leaves no trace. When the project ends, everything the team learned leaves with them.

Formalising isn’t bureaucratising. It’s three things: write down what worries you, put it where everyone else’s worries are, and decide together what deserves action this week.

A register of ten well-written risks, reviewed monthly, beats a binder of two hundred dead ones. Every time. For the next year I’ll publish here weekly on project risk management. Follow the page if