By Andy Anderson Risk management is fundamental to the success of programs that are large, or that involve multiple projects, significant integration, or transformation. Standard risk management processes may not “scale up” to meet the needs of big, complex programs, and will be more successful when you add a few key techniques.

Senior business leaders define such programs, so they understand best what constitutes program success. The program manager should capture the insights of those leaders about high-level threats and approaches to mitigating those threats. The program manager can then use these insights in guiding the managers of individual projects as they identify specific risks, and strategies for mitigating those risks, for their projects. 

As programs become very large, the list of potential risks can seem endless. Good methodology applied correctly will mitigate many of these risks. For the remainder, focus your thinking with ROI. What would have the greatest impact on the project? Where can you make the greatest difference? Focus your mitigation efforts to maximize your ROI.

Contingency planning is an example of this kind of thinking. You could have contingency plans for every risk, but what’s the ROI in doing so? Contingency planning takes the time of your most experienced people (yours and your consultants’), and contingency preparations consume time and money. Where are the powerful investments? Develop contingency plans for risks whose impact is truly unacceptable. Develop them early, so contingencies with long lead times are feasible. Keep your business leaders involved — their ability to think in ROI terms, and their understanding of the business, will help this effort succeed.

A common mistake is allowing risk management to be an “extra.” When mitigation activities are on someone’s “to-do” list, that someone will update plans and report status only when you demand it. Instead, integrate risk management with project management. Assess risks and develop mitigation strategies as you plan and organize a project. Let risk mitigation influence your overall approach. Include mitigation activities in the overall task plans. Require your program and project leaders to report on mitigation as part of their routine progress reporting.

Another common mistake is “checking-off” action items, and thinking that you’ve mitigated risk. What if the mitigation strategy is ineffective? Periodically, you must assess your progress thoughtfully. Have your program leaders reduced the impact of the risk, or its likelihood of occurring? Why do they believe that? Be objective. Involve your senior staff. Do it monthly if needed, and never less than quarterly. If a mitigation strategy isn’t working, you need a new one.

And work hard at communication. Managers must constantly communicate with their peers, as problems in one project quickly cascade across other projects in the program. Senior program leadership (both yours and your consultant’s) must stay close to this aspect of the program — their experience will help identify problems early that the less experienced project managers might miss until they grow larger.

Business executive involvement in large, complex programs is, and should be, a given. A critical role of the program manager is keeping them involved — too many failures can be traced (at least in part) to business executives and sponsors that disengage. Regular executive involvement also helps overcome the natural reticence of program participants to escalate their problems quickly. Let your business executives help you keep your priorities straight.

Andy Anderson joined CSC's Federal Sector three years ago as a vice president. He manages complex transformations and leads the turnaround of troubled programs.