The human side of risk management

or ‘The answer to risk management that isn’t working is not more risk management’

I was invited into the office of a Director of a large, regulated infrastructure business. In the UK, companies regulated in this way are obliged to invest in the country’s infrastructure. The target amount of investment is agreed with the regulator and the company suffers penalties if it fails to meet that target. This particular Director was responsible for £500 million of capital works projects over the course of a year.

The purpose of the meeting was nominally to discuss the fact that he wanted us to conduct some Monte Carlo analysis training for his project managers. Naturally, I asked why he specifically wanted training in Monte Carlo analysis so he explained his problem:

All his project managers had been trained in basic risk analysis. Every project ran risk workshops and entered the results in their risk registers. Suitable responses were planned and risk budgets calculated – which then became part of the budget in the approved business case.

But of course, not all risks actually occur, so not all the money in the risk budget is needed. But of course, a project manager is reluctant to release money from their budget because they may need it for a rainy day.

From the overall regulated budget point of view, if money that was originally in the risk budget gets used to cover increased costs elsewhere, that’s not a problem because the money has been spent on improving infrastructure.

The problem in this case was where the money sat in the risk budgets of several projects and never got spent.

An audit in the October of this particular year had shown several millions of pounds sitting in risk budgets that were unlikely to get spent. By that time it was too late to get any new schemes underway with the cash that had been released.

The Director faced the prospect of having to explain to the regulator why the investment target had not been met.

His initial reaction was ‘our risk management isn’t good enough, we need more sophisticated techniques’.

After a lengthy conversation, we agreed that Monte Carlo training probably wouldn’t make much difference. What we ended up doing was running workshops that aimed to change behaviour and concentrated how risk management should be applied in the context of a regulated budget.

Successful application of any technique is 20% about the technique and 80% about the behaviour that applies it.