PMI_TW電子報第七期_專欄文章

Responding Flexibly to Risk~有彈性地回應風險~

Last week I travelled to London by train. We left the station at the scheduled time, followed a fixed route, stopping at a number of predetermined stations on the way, and arrived in London two minutes early. I also recently took a trip on a sailing boat across a small bay. Following a short delay in getting the boat ready, we set off in the right general direction, but were soon driven off course by the wind and tides. We also had to avoid other boats during the crossing, as well as one fast-moving jet-ski which appeared unexpectedly in front of us. Fortunately we were able to reach the other side by adjusting the sails and steering the boat carefully. Our route was certainly not a straight line across the bay, but we arrived at our chosen spot close to the expected time (and we had a very enjoyable time on the way!). Which of these two journeys best represents your project or your business? Are you travelling by train or sailing a boat? Do you follow a set plan and schedule, expecting each milestone to be passed on time, and hoping to arrive at your destination exactly when you planned (or at least reasonably close)? Is your motto “Plan the work, then work the plan”? Or are you affected by events and circumstances (both foreseeable and unplanned) which require corrections en route to ensure that you arrive safely? Most of us recognise that life, businesses and projects do not follow straight lines. In most cases, we can set clear goals, and we are often able to plan a route to get us there. However we know that reality is nearly always more untidy than our neat plans. Risk management is one response to this situation, seeking to look ahead and identify possible sources of variation to the plan, then developing appropriate actions to keep us on course. However even risk management is difficult if you try to run your project or business like a train journey. You have to stay on the fixed rails which lead from start to finish, follow the published timetable, and no deviation is possible. If unexpected events occur (such as fallen trees on the line, or a passenger is taken ill), delay or cancellation are the only options. It would be far better to treat projects and businesses like sailing boats. Their key characteristic is flexibility, the ability to respond quickly to changing circumstances. If the wind blows us off course we can adjust our sails to stay heading towards our goal, and we can even use the wind to assist us on the way. Of course train and boat journeys are just analogies or similes, which must not be stretched too far. But businesses and projects have to operate in changing environments, where it might not be possible or desirable to stick to the original plan. We need built-in flexibility to allow us to alter course rapidly when things around us change. We should not be rigidly restricted to “staying on track” or trying to avoid “coming off the rails”. Instead we should be free to take advantage of change in order to avoid or minimise threats, exploit or maximise opportunities, and so achieve our goal. How can businesses and projects ensure that they remain flexible? This starts with a management mindset and organisational culture that accepts uncertainty and does not demand unthinking adherence to “The Plan”. Good plans should include appropriate levels of contingency or reserve, to respond to emergent threats and opportunities. Processes must allow people to respond to changes as they arise, and should not form a straitjacket that imposes conformity. There must of course be a clear vision and a firm focus on the intended goal. The organisation must also have the ability to know where it is and where it’s heading. Finally people should be empowered to act quickly within clear boundaries of authority and accountability, so that they can act appropriately when things change. So next time someone asks whether your business or project is “on track”, why not reply that you are “navigating towards the goal”, with a clear view of where you are going and a flexible approach to respond to whatever happens along the way. 上週我坐火車到倫敦，我們準時開車、依循固定的路線、途中停靠了幾個預先設定的車站、並且提早了兩分鐘抵達倫敦；我最近也參加了一趟乘船橫越一個小海灣的旅遊，在預備出航時有一點耽誤、然後我們設定好航向出發、但很快就因為風向與潮汐而偏離了航道，我們也必須在橫越時避開其他船隻、其中包括一艘突然快速迎面而來的高速滑艇，索幸我們藉由小心地調整風帆及操縱船隻終得以到達彼岸。我們行經的路徑當然不是一條橫跨海灣的直線，但我們以接近我們所期待的時間到達了預定點（而且我們一路享受著愉悅的時光）。 以上這兩段旅程中，哪一段最能代表你的專案或事業？你是搭火車或是乘船出遊？你是否依據一組計畫及行程、期待能夠如期通過每一個里程碑、並希望在恰如你所規劃的時間（或至少在合理的範圍內）抵達目的地？你的座右銘是否為「規劃工作，然後照表操課」？或者你會受到一些事件或狀況（可預見的及未預期的）的影響、需要在中途改正以確保安全抵達？ 我們大部分的人都認為人生、事業、以及專案並不會遵循一條直線，多數的情況下，我們能夠設定清楚的目標、並且通常能夠規劃一條引領我們抵達的路徑；然而，我們知道相較於我們的完美計畫，現實經常是更不完美的，風險管理便是對此狀態的一種回應，尋求預先辨識在計畫中可能產生變異的來源，然後發展出使我們保持在航道上的適當行動。 然而，就算你想用火車旅行的方式運作你的專案或事業，風險管理也是困難的。你必須要維持在從起點到終點的固定軌道上、依據公告的時間表、且不可以有變動，如果發生了不預期的事件（如樹木倒在軌道上或旅客生病），延誤或取消班次就成為僅有的選項。將專案及事業視為乘船則遠較搭火車為佳，其關鍵特徵在於彈性，即對狀況改變的快速回應能力。如果風將我們吹偏離航道，我們可以調整風帆以保持航向目的地，我們甚至可以運用風力在途中協助我們。 當然，搭火車或乘船旅行只是類比或相似的概念，不可做過度的引伸；但是事業與專案必須要在變動的環境下經營，因此它不可能或不應期待綁死在原來的計畫上，我們必須置入彈性以使得我們可以在周遭發生改變時迅速地調整方向。我們不應該死板地受限於「維持既定軌道」或試圖避免「脫離軌道」，我們反而應該有利用改變的自由，以規避威脅或使之最小化、開拓機會或使之最大化、並因此而達到我們的目的。 要如何確保事業及專案能保有彈性呢？這要從接受不確定性及不要求未經思考地固守著「既定計畫」的管理心態與組織文化開始。好的計畫應該包含有適度的應變準備或預備金，以便於回應突發的威脅或機會。程序上必須允許人員在改變發生時採取回應，並且不能形成強制一致性的約束，當然在希望達成的目的上必須要有清楚的願景與確定的焦點，組織也必須有能力知道其身處何地及欲往何方。最後，應該要授權人員在明確的權責範圍內迅速採取行動，因此它們能在事情改變時採取適當的行動。 所以下一次當有人問到你的事業或專案是否「在既定軌道上」時，何不以你對去向何方及途中不論何事發生皆可以彈性方法回應的清楚視野，回答說你正「導航朝向目的地」。

……(閱讀全文與回應)

PMI_TW電子報第四期_專欄文章

Proving The Value of Risk Management(特別感謝范淼博士翻譯此專欄!)

Dear Risk Doctor, Risk management is considered by management to be a waste of time and money if nothing happens. How can project managers convince management and decision-makers that risk management is a good investment and necessary, even if an actual event does not occur? Yours hopefully, Project Manager Dear hopeful Project Manager, You raise an important and vexing question for risk practitioners – how do we prove we’re adding value?! I have a three-part answer: Firstly, in old-style implementations of risk management that focus only on threats, you’re right that successful risk management means “nothing happens” (or at least no unexpected problems happen). In line with Popper’s Falsifiability Principle, we know it’s impossible to prove a negative, even though absence of evidence is not evidence of absence. So we couldn’t say for certain that investing in risk management was positively correlated with lack of problems. However now we have a new view of risk which includes opportunities as well as threats. Now successful risk management results in avoiding problems as before, but we also create additional value through maximising and exploiting opportunities. And of course this can be measured. So perhaps we can create a demonstrable and measurable “Risk Management ROI” in this way. Secondly, while we cannot run a project twice so we have no control for proving risk management effectiveness, we can learn from experience over time. Organisations which have been tracking project performance over the years can demonstrate that as risk management maturity increases, so does project success. What gets measured gets improved. And nothing beats demonstrating success to get the attention of management! Thirdly, senior management will quickly realise and accept the value of risk management when they understand the close link between risk and objectives. They understand the need to “spend to save”, and will be looking for a payoff from risk management in terms of more successful achievement of project and business objectives. When they see those benefits then their commitment will be reinforced yet further. I hope that answers your question adequately and that you manage to persuade your management to invest in managing risk. With best wishes, The Risk Doctor -------------------------------------------------------------------------------- 親愛的風險醫師： 風險管理在什麼都沒發生的情況下，會被管理階層認為是浪費時間及金錢的。專案經理應如何說服管理與決策者，既使沒有實際發生什麼事件，風險管理也是個好投資而且是必要的？ 滿心期待的專案經理 親愛的滿心期待的專案經理： 你提出了一個對風險實務工作者而言重要且困擾的問題—我們如何證明我們是有附加價的？ 我對此的回答分為三部分： 首先，在舊式僅專注於威脅的風險管理執行上，你是對的，成功的風險管理意味著「沒有事發 生」（或至少是沒有不期盼的問題生）。根據帕伯(Popper)的可證否原則，我們知道對『沒有（其存在）的證據不能當作其不存在的證據』此一說法，是不可能做出否定的證明的，所以，我們當然不能說風險管理投資與不會有問題間是正相關的。然而，我們現在有一個新的風險管理觀點涵蓋了機會及威脅。現在成功的風險管理仍像過去一樣可導致問題的規避；但是，我們也經由對機會的開拓與極大化創造了額外的價值，同時這些當然是可以衡量。因此，也許我們可以用這種方式建立可展示及衡量的「風險管理投資報酬率」。 其次，因為我們不能對同一個專案執行兩次，所以我們不能在有對照控制下證明風險管理的效益，然而我們可以從時間中學到經驗。長年追蹤專案績效的組織可以顯示，當風險管理成熟度增加時，專案成功的機率也跟著增加。可以衡量了就可以改善，沒有東西比展現成功更能引起管理階層注意。 第三，資深的管理階層在瞭解到風險與目標間的密切關聯後，將會迅速理解並接受風險管理的價值。他們瞭解「支出以求得節省」的需要，並且尋求因風險管理使得專案及企業在目標的達成上獲致更大成功的報酬。當他們看到這些利益後，他們將更進一步強化其承諾。 我希望這些可以適切地回答你的問題，並且讓你可以有效地說服你的管理階層投資於風險管理 祝你好運 風險醫師

……(閱讀全文與回應)

PMI_TW電子報創刊號_專欄文章

Risk is defined in two dimensions: uncertainty and effect on objectives. ...

Risk is defined in two dimensions: uncertainty and effect on objectives. It is common to use the terms “probability” and “impact” to describe these two dimensions, and assessing the significance of any given risk means considering both. It is relatively simple to assess effect on objectives, since this merely requires defining the situation after the risk has occurred, and then imagining what happens: “If this risk occurred, what would the effect be?” Probability is not so easy however. Risk practitioners and project teams alike experience repeated difficulty in assessing the probability that a given risk might occur. There are a number of reasons for this. •Language. In English, different words are often used interchangeably to describe the uncertainty dimension of a risk, such as “probability”, “frequency”, “likelihood” or “chance”. In fact these do not mean the same thing, and confusion can arise if the terms are misused. For example “frequency” describes how often an event or set of circumstances is expected to occur based on previous experience, either in a period of time (e.g. once per year) or in a number of trials (e.g. seven times out of ten). So frequency really applies to repeatable events. This is not the same as “probability” which is a statistical term describing how likely a single uncertain event or set of circumstances is to occur. One solution is to use a more general term such as “likelihood”, and recognise two variants called “probability” (for single events) and “frequency” (for repeatable events). •Format. The uncertainty dimension of a risk can be expressed in several ways, including both numerical and textual formats, such as: 35%, “once per month”, 2:7, “unlikely”, “one in six times”, 10-4, “low probability”, 0.2, and so on. Most people have problems interpreting different numerical formats, and even the textual phrases can mean different things. This problem can best be overcome by education, as well as using a set of agreed definitions which everyone understands. •Subjectivity. Assessment of probability requires forming an opinion about a future event or set of circumstances which have not yet happened. Different people will take different views about the future, and there is no “single right answer” since the future has not yet happened. Risk probability cannot be measured, only estimated. Assessments of the uncertain future are influenced by many factors, including perceptual filters, motivational bias, cognitive bias, or subconscious heuristics. The solution here is to take a team-based approach, exploring different perspectives, examining underlying assumptions, and reaching consensus wherever possible. Sources of bias should also be understood and corrected where possible. •Lack of data. Some risks have never been experienced before, especially those relating to the unique aspects of projects. In other cases, even though a risk might have been encountered previously, there may be no record of its existence due to absence of a learning mechanism (such as a knowledge base or checklist). As a result there is no body of evidence to assist in estimating the probability of occurrence of these novel risks. Addressing these shortfalls requires acknowledging that some areas lack relevant previous experience, as well as implementing an effective lessons-to-be-learned process (e.g. a post-project review). All this matters for two reasons: •Faulty probability assessment means risks will be wrongly prioritised, leading to a failure to focus on the most significant risks, selection of inappropriate responses, inability to manage risks effectively, and loss of confidence in the risk process. •Sound assessment of risk probability improves the understanding of each risk, allowing appropriate prioritisation, better response selection, enhanced risk management effectiveness, and more reliable achievement of project and business objectives. We need to understand the problems associated with assessing probability, and take action to address the concerns, by using appropriate language and formats, identifying and managing sources of bias, learning lessons to improve the effectiveness of the probability assessment process, and monitoring risk management performance to determine the accuracy of assessed risk probability. -------------------------------------------------------------------------------- 風險是以兩個向度：不確定性與對目標的影響來定義的，一般用「機率」與「衝擊」描 述這兩個向度，而評估風險的嚴重性意指同時考慮兩者。評估對目標的影響是相對容易的，因 為只需要定義風險發生後的情況，然後想像：「如果這個風險發生，其影響為何？」然而，機 率就不是那麼容易了，風險實務專家與專案團隊在評估某特定風險可能發生的機率時都會一再 碰到困難，以下是一些這些困難的原因： •語意 通常會交替使用不同的詞彙來描述風險的不確定性向度；如「機率」、「頻率」、「可能 性」、或「機會」，事實上這些詞彙代表不同意義，如果誤用了會造成混淆。例如「頻率 」是描述基於過去的經驗，預期一個事件或一組狀況多常發生，可以是在一段期間（如一 年一次）或數次嘗試中（10次中有7次），因此頻率是應用在可重複的事件上的，這和用 以描述一個單一不確定事件或一組狀況有多可能發生的統計名詞「機率」是不同的。一種 解決方法是用更一般化的詞彙如「可能性」，並認知兩個相異的詞彙「機率」（用於單一 事件）與「頻率」（對重複事件）。 •格式 風險的不確定向度有7種表達方式，包括數字及文字格式，如：35%、「每月1次」、2：7 、「不可能」、「6次中1次」、10- 4、「機率低」、0.2等，大部分人有解讀數字格式的問題，既使是文句也可能代表不同意 義。這種問題最好是由教育來克服，並且使用大家都能瞭解的定義。 •主觀 機率的評估需要對尚未發生的未來事件或一組狀況形成一個看法，不同的人對未來有不同 觀點，由於未來尚未發生所以沒有「單一的正確答案」。風險機率無法衡量只能估計，對 不確定未來的評估被許多因素所影響，包括感知的過濾、動機偏差、認知偏差、以及潛意 識的直覺。解決方法是採取一個以團隊為基礎的途徑、探究不同的觀點、檢驗內在的假定 、以及盡可能取得共識，偏差的來源也應該盡可能瞭解並改正。 •資料缺乏 有些風險是過去從來不曾經歷過的，特別是和專案特殊面向有關的風險。另外，既使風險 可能之前經歷過，也可能因為缺乏學習機制（如知識庫或檢查清單）而沒有其存在的紀錄 ，因而導致沒有具體證據可用來協助估計此一新風險的發生機率，應付此種缺失需要瞭解 某些領域缺乏之前的相關經驗，並且實行有效的教訓檢討程序（如一個專案的結案後檢討 ）。 以上這些之所以需考慮是基於以下兩個原因 •錯誤的機率評估代表風險將有錯誤的優先等級，導致無法專注在最嚴重的風險上、選擇了 不適當的風險回應、沒有有效管理風險的能力、以及對風險程序失去信心。 •健全的風險機率評估，可增進對每一個風險的瞭解、得到適當的優先等級、選擇較佳的風 險回應、增進風險管理效益、以及更可靠地達成專案與企業目標。 我們需要瞭解關於風險評估的問題，並採取行動來因應，經由使用適當的語意與格式、 辨識並管理偏差的來源、從教訓中學習以改進機率評估程序的效果、以及監督風險管理績效以 決定評估風險機率的精確性。

……(閱讀全文與回應)