Introduction
It is a fact that most large, complex projects and programmes fail to meet their planned objectives – either failing to deliver what was promised, sliding the timeframes or exceeding the budget – or all three! Most organisations are undertaking one or more aggressive,
“must do” programmes at any point in time. These may fundamentally change the way the company conducts its business and failure to meet objectives on time may have a catastrophic impact on business. One of the major root causes of projects’ and programs’ failure is due to inadequate risk management.
Why doesn’t traditional risk management deliver?
Many programmes and projects will use some form of risk management process to try and improve delivery performance. This may range from very informal approaches, where the lack of process means that it ultimately has little impact, to formal documented processes, which deliver varying degrees of benefit. Very often these “traditional” risk management approaches are sound in theory but disappointing in practice due to:
- • Tendency to focus on today’s issues rather than tomorrow’s risks
- • Generic risk statements that communicate very little
- • Over- analysis using unsubstantiated quantified data
- • Under- analysis using misleading HML (high, medium, low) type scales
- • Inappropriate prioritisation so you “can’t see the wood from the trees”
- • Inability to get anyone to actually do anything about the risks
What can be done to improve this?
Once we have clear objectives and plans, programme and project managers must ultimately control two fundamental factors if they are to successfully deliver their objectives
- The assumptions that underpin the business plan must be clearly identified and communicated
- The assumptions made by the individuals in the implementation of the programme must be made explicit, rated and communicated.
Therefore, the capture, analysis and communication of assumptions are critical to the success of the project or programme, and this forms the basis of the ABCD process. ABCD has been applied to help many diverse organisations to deliver large, complex projects and programmes on time, to budget and meeting the expectations of demanding customers and end-users.
What is ABCD and why it is effective?
Assumption Based Communication Dynamics (ABCD) is a highly effective risk management process that captures the collective knowledge and viewpoints from stakeholders on the project. By dramatically improving the communication of key assumptions, risks are avoided
or managed proactively and project objectives are delivered on time. ABCD works far more effectively than traditional risk management processes because it:
- • Naturally forces people to look to the future (i.e. their assumptions) and therefore ensures true risk management
- • Captures specific root-causes of risks (i.e. the assumptions) that gives pin-point fixes
- • Uses meaningful analysis that provides true insight and accurate prioritisation
- • Provides clear prioritisation and escalation from project through programmes to enterprise levels
- • Ensures follow through on actions via simple but effective roles and governance structures
- • At the most basic level ABCD works because it is an intuitive process that takes a positive rather than negative view of the enterprise (i.e. what do you need to achieve your objectives – your assumptions, rather than what might go wrong – your risks).
ABCD Process Overview
The ABCD process consists of an integrated closed loop method that logically progresses through:
- • Project Prioritisation (for multiple project environments)
- • Risk Assessment
- • Risk Prioritisation (to decide the “order of attack”)
- • Risk Control (to put the mitigation plans into action and monitor their effectiveness)
We will focus in this paper on the assumption’s analysis and risk prioritization and we may detail how ABCD is used for project prioritization in another article.
The ABCD scales
The ABCD scale is defined for multiple use throughout the process. It always means effectively the same thing i.e. A is always good and D is always bad and B and C express tendencies to the two extremes. Just like school grades, you are always trying to turn Cs and Ds into Bs and As.
- • A means very good, high confidence, not important
- • B means fairly good, reasonable confidence, not very important
- • C means quite poor, uncomfortable, important
- • D means very poor, little or no confidence, critically important
Assumption Analysis
Fundamentally, projects only fail due to a small number of reasons:
- • the wrong assumptions were made, or
- • the significance of the assumptions was not understood, or
- • there was a failure to communicate the assumptions.
The plans for any project are based on a few facts and many assumptions. If the final outturn cost and time scales are excessive, it is obvious that either the assumptions were wrong, or the estimators did not understand their significance.
It is important to note that these assumptions are made due to the inevitable lack of total
understanding or information that is inherent, particularly in the early stages of any project.
Assumptions are made to allow us to proceed with the project design or plans but if they are important and prove incorrect, they will jeopardise the success of the project. Low quality assumptions are at the heart of the risks in a project.
Assumption Analysis is the backbone of the ABCD method. It can be used at any stage in a
project, however one should start the analysis as early as possible in the project to capture
issues.
Assumptions come from a wide range of sources e.g. people, technology, processes, laws …etc. Assumptions are captured by interviews with the “key players” in a project and its interfacing environment. Detailed interviews are conducted to start the process. Follow-up interviews are then scheduled to track the status of active assumptions and to capture new assumptions throughout the lifetime of the project. Assumptions are categorized for their sensitivity and stability as follows:
Sensitivity:
How much does it matter to the critical (business) objectives (e.g. milestones and deliverables) of the project if the assumption proves to be incorrect?
- A = matters little (minor impact if incorrect)
- B = matters but manageable impact
- C = matters and impact will be significant
- D = matters a lot (critical impact)
Stability:
How confident are we that the assumption will prove correct?
- A = very confident that the assumption is stable (will turn out to be true)
- B = Fairly confident
- C = uncomfortable (for any reason?)
- D = very uncomfortable (Assumption will almost certainly prove incorrect)
The below diagram illustrates plotting the sensitivity against stability
Converting Critical Assumptions into Risks
Assumptions are identified by conducting an Assumption Analysis. Where the Sensitivity/Stability ratings are AA, AB, BA or BB, then the Assumption is not crucial to the project and is likely to prove correct. It is not essential to take any specific action with these Assumptions, but they must be monitored at regular intervals until the event has passed. Sensitivity/Stability ratings of AC, AD, BC, BD, CA, CB, DA and DB are potential risks. These Assumptions must be reviewed with the owners regularly and actions should be identified that will maintain the low ratings.
Assumptions that are important to the project (i.e. C or D Sensitivity) and are considered to be unstable (i.e. C or D Stability), represent significant risks to the project. These Risks require action(s) to bring them under control. The most effective way of achieving this is by referring the risks to a suitable body within the organisation with the power to make the necessary decisions, set the actions and make sure that they are followed through.
Communicating risks to senior management groups is always difficult, as they are often not familiar with the detail of the project. The risks need to be presented in a concise, clear way that explains the cause of the risk and the consequences if the risk were allowed to impact the project. Assumptions are converted into Risks using the following format:
The assumption is that…
“Six Oracle Developers resources will be available for requirement capture starting on 12 February, despite the demands of the XYZ project, to ensure that this critical path activity will be completed by 25 February”
If not, then the impact is…
“Critical path activity (12 to 25 February) will be delayed leading to a late project implementation date (currently 1 April).”
Risk Prioritisation
Prioritisation allows the Project Manager to direct limited resources at the most critical project risks. The objective of the risk prioritisation is to identify the most significant risks out of all those that have been identified by the various analysis methods used. Once all the risks have been collected in a consolidated list or register, they should be placed in order of priority and attacked via a logical, planned programme. The problem is to decide how to place risks in an appropriate order.
The primary criteria used for prioritising risks in ABCD are:
- • Criticality
- • Timing
- • Controllability
Criticality :
Criticality can be classified as follows:
Red:
- • Critical. The project will stop and hence project/programme will not meet its objectives/completion date. (“Showstopper”)
- • Unacceptable cost impact to business
- • No possible or acceptable Contingency Plan
Amber
- • Significant impact to programme objectives
- • Delay of non-critical project
- • Significant cost impact to project/business
- • Difficult Contingency Plan
Green
- • Minor/localised impact to project/business objectives
- • Minor cost impact
- • Contingency Plan identified and acceptable
Timing :
Impact Date” is defined as the latest possible time to start the first of actions to avoid the risk.
Controllability :
Controllability is a measure of confidence that the risk will be managed. It should not be confused with the probability of the risk occurring, which is a measure of how likely the risk is to occur if nothing is done. The controllability rating cannot normally be assigned until the risk has been reviewed and discussed by senior management, whereby an agreement is reached as to their confidence that the risk can ultimately be managed. The rating may be interpreted as follows:
- A Very Confident. The management can exercise much control over the Risk. Action plans are in place and are proving successful.
- B Fairly Confident. The Risk is mainly under control. Action plans are in place and in
- progress.
- C Uncomfortable. The Risk is mainly outside control. There are minimal action plans.
- D Out of Control. There is currently no idea how to manage the Risk. There are no risk plans in place or risk plans have failed. This risk must be escalated to a higher level of influence.
Bubble Charts
The Bubble diagram is a way of combining these parameters in a graphical form and producing a simple risk profile that may be understood by non-specialists.
- • The Timing is represented on the horizontal axis against a scale of months or parts of a project phase
- • The Criticality is represented by the vertical axis – critical risks (Red) touching the x-axis
- • The Controllability is represented by the size of the bubble. The largest bubbles represent
- • uncontrollable (“D”) risks.
The origin represents the critical objective of the project. If a risk (bubble) is allowed to impact at the origin it is by definition a “showstopper” risk and will undermine the prime objectives of the project. Therefore, an acceptable risk profile is one where the Bubbles are well away from the origin, whereas a dangerous risk profile has Bubbles clustered around the origin. The Bubble Diagram shown below illustrate an example. Note that the absolute size and positioning of the bubbles is not intended to be precise. The idea is to create a picture of the risks where relative size and position is more important.
There are several tools that uses ABCD risk management model but one can create his own tool using MS Excel.
