Chapter 7. Mitigating Business Risk

Professional journals and conferences abound with horror stories of business change initiatives that have gone wrong:

• One manufacturer went out of business because it couldn’t implement its Enterprise Resource Planning solution, blaming it on the ineptitude of the consultants and the dishonesty of the software vendor. The owners ended up suing the participants for more than $500 million.

• In 1998, a chocolate bar manufacturer missed out on Halloween sales because the new forecasting approach and technology didn’t work on time.

• A state government couldn’t issue or renew drivers’ licenses due to systems troubles and operational chaos.

These are just a few of the disasters that take place every year that put whole organizations at risk, sometimes for their very existence. In 1995, the Standish Group reported that companies in the United States spent $150 billion alone for cancelled or late software development.^[1] Less spectacular but even more prevalent are the stories of projects that take years when they should have taken months, robbing the business of opportunity in the marketplace. In every case, it seems as though costs skyrocketed, but they weren’t as costly as the lost business opportunity, often reaching hundreds of millions of dollars.

^[1] The Standish Group. Chaos: Charting the Seas of Information Technology. Dennis, MA: Standish Group International 1994

The real questions that come with these types of failures are

• What could we have done in the marketplace if we had the capability we anticipated, at the time that we were supposed to have it, and at the price we were supposed to pay for it?

• What did we miss because our scarce resources weren’t available to do something additional that we had planned but couldn’t do because of a lack of quality or delivery?

In these situations, it seems as though everyone feigns surprise or perhaps didn’t want to face up to the horrible signs of impending failure. Looking at them in hindsight, these projects typically exhibited the warning signals of high risk and poor quality much earlier than anyone saw or wanted to see. In few cases were there any risk management strategies, checkpoints, or early off-ramps, nor were there any quality criteria put to use.

The value of good risk management was reported at Hughes Aircraft (now Raytheon) on its Peace Shield air defense project, which used a proactive risk-based approach to avoid problems. The project, seen as a potential minefield, came in 10% ahead of a 4 1/2-year schedule and significantly under budget.^[2] It did this in an environment of uncertainty and doubt.

^[2] “Peace Shield Risk Management.” Chuck Sutherland, In Proceedings of the 5th SEI Conference on Software Risk Management, Pittsburgh: Software Engineering Institute, 1997

Clearly, any change is inherently risky, but does this mean that we should never introduce new ideas? Of course not—the risk is usually accompanied by great opportunity. In many cases, the risk of not changing might be even greater than the risk of a major shift in direction if it means that our customers will leave us for something more exciting from a competitor. Staying the same doesn’t mean being the same. Risks are part of the territory.

We have to manage the risks we have in a professional manner. Our ability to do this better than our competitors gives us a barrier to entry for our competition and great opportunity to gain advantage. One significant area of risk is that of poor quality. Today, quality isn’t a differentiating factor that will gain us great advantage, but its absence will certainly cause us great loss. The management of quality and risk, like project management, must be seen as umbrella concepts that are prerequisites for process management to have a chance.