Malcolm Gladwell is one of my favorite authors. I have yet to read one of his works that failed to captivate me. I was originally told by a close friend to check out his book Outliers, which I thought was so wonderfully constructed that I had to check out his other books. About a year ago was the first time that I had read Tipping Point, which offers an interesting explanation on the diffusion of responsibility – which can offer some insight to how risk is managed on a project team.
Diffusion of responsibility is a natural human reaction. You have surely witnessed it, and probably even fallen under its spell without even knowing. Perhaps you witnessed a car accident and kept driving. Diffusion of responsibility becomes easier when there are more people present. If you are on a deserted road with just one other car, and it hits a tree – you’d be more likely to stop and help than if the same situation happened on a busy highway and the car was in opposing traffic. You simply assume, or at least hope, that someone else will take care of the situation.
This natural condition is so prevalent that we must specifically train and prepare to counter it. I remember years ago taking a CPR-AED certification at work, and the instructor made a specific point that after you realized you would have to render medical aid to a person you should do two things: point at a specific individual in the crowd (if one was to gather, that is) and loudly tell them “YOU, go get the AED”, and point at someone else and loudly tell them “YOU, call 911!”
Risk management has drifted from a science to an art form as it has been tailored into forms that could be readily adopted at various organizational levels. While performing at the upper levels of an organizational hierarchy, professionals are often in place to ensure that certain principles and methodologies are adhered to. At lower levels, specifically small to medium size projects, risk management can be adopted haphazardly.
I would like to present a scenario, one that a colleague brought to my attention not long ago, to illustrate exactly what I’m talking about: an organization went to the effort to formally establish a project using a defined methodology, and from here went onto developing plans on how to address risk within the project. So far, so good! In fact, they may even go onto identify every conceivable risk and conduct deliberate qualitative and quantitative risk analysis. It sounds like they are on the path to successfully manage the risk within their project.
Risk management on projects can be tricky to implement. There will be times when people do not know each other well and times when tacit-knowledge on risk is lacking. Right now, I want to focus on two important aspects of risk management within small and medium-sized projects that are worth noting here: rarely do they have a truly dedicated ‘risk management’ team, and uncertainty within work is ever-evolving – even within low-task-uncertainty work. Both can be addressed through appropriate role assignments within risk management.
The people involved in the identification and analysis of risks within the project have other responsibilities that they must tend to so, after the initial ‘heavy-lift’ of risk management is complete, their attention often returns to tasks at hand. This presents the first root cause of failure: failure to clearly identify responsibilities for risk management. The lazy answer is claiming that risk is everyone’s responsibility. Let’s be honest though: when anything is everyone’s responsibility, it becomes no one’s responsibility. This is due to the creation of a diffusion of responsibility, as everyone will expect someone else to take the lead on a specific risk should it occur.
The Project Management Institute offers a solution to this within their Practice Standard for Project Risk Management: assign risk owners and risk action owners. Risk owners are responsible for managing the risk through all risk management processes, which includes establishing response strategies and conducting periodic reassessments. The actual implementation of a response strategy may be delegated to risk action owners, under the supervision of the risk owner. This eliminates the expectation that someone will take care of the issue. This eliminates wasted, precious time, that is often spent arguing about who should do what, and instead allows actions to implemented swiftly. Most of all, it prevents the diffusion of responsibility.
While this is not a perfect solution, it combats our natural tendencies of shocked observation and the bystander effect should an unfortunate turn of events occur.