The risk game, of not knowing how to respond to a Risk.

RISK is a classic and very popular board game that involves strategy, diplomacy, conflicts and conquests. The game is divided into 42 territories, grouped into 6 continents and the objective of each player is to capture all territories of the other players, through the results determined by dice rolls. The game takes this name because all the players´ actions depend on the results of the dice rolls and no player knows for sure if it will conquer or defend territories with 100% of success. In project management, we "play" with risk all the time. Our project is the board, the work packages our territories, the armies our resources and when the dice are rolled we can not determine whether the work packages will be impacted or not. Or can we? In this article I'll talk about how we can respond to project risks so we can minimize our threats and maximize our opportunities.

Let's first define what a risk is. Whenever someone comments on analyzing risks, the first thing that comes to our minds are the misfortunes and threats that a risk can cause, but a risk can also be an opportunity. According to PMI the definition of a risk is "an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives." In other words, we can estimate the risks, or even better, we can estimate the opportunities and threats, so we can better respond to them, should they occur. Fortunately the likelihood of a risk occurring can also be calculated, which will always vary between 1% to 99% chance. 0% or 100% are no longer risks, but certainty that something will happen or not. Risk has an unknown outcome, but we know what the underlying outcome distribution looks like. We know the potential outcomes in advance, and we may even know the odds of these outcomes in advance. The table below shows the odds of conquering a territory in the Risk game.

Note that even if you attack with 10 armies against 1, there is no certainty of success because according to the rules of the game, if the defender rolls dices results that equals the attacker results, the defender wins the battle even if he is playing with less dices than the attacker. It is a fact that the probability of this happening is minimal but it is not impossible, what makes this game so popular and exciting.

In order to improve our odds of success, maximizing our opportunities and minimizing threats, we need to create a risk plan and define the risk responses. In project management, each risk has 4 types of responses. For the Opportunities we can Exploit | Share | Enhance | Accept and for the Threats we can Avoid | Transfer | Mitigate | Accept. Let's see each of them in more details.

EXPLOIT | AVOID

EXPLOIT - “This strategy seeks to eliminate the uncertainty associated with a particular upside risk by ensuring the opportunity definitely happens. “– PMBOK® Guide Sixth Edition

AVOID - Risk avoidance is a risk response strategy whereby the project team acts to eliminate the threat or protect the project from its impact. – PMBOK® Guide Sixth Edition

In the above example we can see that the Green Army is well positioned in Southeast Asia and has full control of Oceania. Oceania is one of the safest continents of the game because there is only one way to invade it that is through Indonesia. This is an example of an EXPLOIT because the green player is ensuring that every turn he will receive 2 armies for having full control of Oceania. In addition, he is responding to the Risk of an attack, by allocating many armies in the Southeast Asia to eliminate the possibility of losing control of Oceania. This is a response called AVOID.

There are some examples that we can apply the response of EXPLOIT | AVOID in our projects. We could either train the team to give them extra skills or tweak your deliverables slightly so that they respond better to the opportunity, this way we are allocating resources to ensure that the risk happens. In the same way we also prevent our team from being unprepared and failing to deliver the project. It is up to the Project Manager to think about ways to explore and avoid these risks, but the project team can also help identify these responses in brainstorming sessions promoted by the manager.

Share | Transfer

SHARE - “Sharing a positive risk involves allocating some or all of the ownership of the opportunity to a third party who is best able to capture the opportunity for the benefit of the project.”- PMBOK® Guide Sixth Edition

TRANSFER - "A risk response strategy whereby the project team shifts the impact of a threat to a third party, together with ownership of the response." – PMBOK® Guide Sixth Edition

In the situation above, the blue player has a great opportunity to conquer Africa, but he is still being threatened by the green and gray players. A good strategy that the blue player could make is an alliance with the green player. The green player wants to conquer Europe so the blue player could weaken the black player´s army to facilitate the invasion of the green player and in return he will not attack the blue player. This is an example of how to respond to Risk using the SHARE strategy. Now the biggest threat is the gray player who has an immense army ready to invade Africa. The blue player could attack the Gray player but with fewer armies his probability of success is lower. Since the rules of the game favor the defending player, the blue player decides to tell the gray player "You can atack first", that is to say he is transferring the risk to the gray player. It is up to him now to decide if he will attack and face the risk of weakening and dividing his army and be susceptible to a counterattack.

Our projects are always very complex and laborious and our resources are very limited and valuable to be impacted with risks, so we always seek partnerships to assist us in the project deliveries and increase our chances of success. We contract insurance to ensure that if a risk occurs we have our assets guarded or safe with counter measures. When we share some of our earnings with those who help us succeed we are pursuing the SHARE strategy and when we separate some of our resources to ensure that our assets or projects are protected by a third party, we are using the TRANSFER response.

ENHANCE | MITIGATE

ENHANCE - “The enhance strategy is used to increase the probability and/or the positive impacts of an opportunity. “- PMBOK® Guide Sixth Edition

In this scenario the green player wants to conquer Ukraine at all costs and for this he allocates all his armies to attack the yellow player. This strategy does not guarantee success (as seen in the table of dice results) but increases the likelihood of good outcomes.

MITIGATE - Risk mitigation is a risk response strategy whereby the project team acts to reduce the probability of occurrence or impact of a risk. – PMBOK® Guide Sixth Edition

In this example the green player positioned their armies homogeneously among his territories, to reduce the risk of losing them. While the Red Player, has concentrated his armies on a single territory leaving Egypt with only one defense. The green player worked well in mitigating the risk of losing his territories, with a good positioning and resource management.

Whenever we want to achieve the best results in our projects, we allocate the best resources to work on them, thus increasing the chance of delivering on time and with the expected quality. Likewise, we need to think about strategies and solutions that cover all scenarios in order to reduce the likelihood and / or impact of problems on our deliveries. Some good examples we can cite are: a software to make the new product more marketable or shareable, a restaurant maintaining sanitary food practices to reduce the chances of food poisoning, a health care process that establish complex IT protocols to improve fraud detection and so on.

ACCEPT

ACCEPT - Risk acceptance is a risk response strategy whereby the project team decides to acknowledge the risk and not take any action unless the risk occurs, be it positive or negative. – PMBOK® Guide Sixth Edition

In this case we can notice that the poor black player is surrounded and does not have a way out of it. The better strategy would be to stand in that position and wait for his doom. With luck he will be able to defeat and weaken some armies, but he knows that allocating more resources would be a waste, because the benefit of maintaining that territory does not worth it.

As above, this is the "do nothing" response. It’s a perfectly valid response, but one that might need a bit of explaining to your project customer and sponsor. It simply means that you accept that the opportunity or threat is going to come your way or it isn’t. You do nothing to influence it either way, and you don’t put any plans in place to deal with it, untill the risk is triggered. This is a perfect solution for those low-priority work packages in your project.

In a nutshell, every project manager should adopt a culture of risk management, but unfortunately this is not a reality in all companies. According to a survey by PMI, only 26% of the organizations interviewed use risk management practices in all of their projects. Knowing the probabilities and impacts that the risks can affect on any project, should be a cornerstone in any project team culture. Now that you know the risks of not responding to the "risk game", start encouraging your team to think and discuss the threats and opportunities in your project meetings, influence them to do research and brainstorming on this subject and monitor the risks on the Project Board or start rolling the dices and good luck.