On Wednesday night I attended the “Review of the year” at the Institute of Directors (IOD). It is an annual event for Chartered Directors to reflect on issues/opportunities directors have faced. The theme for the event was how company boards manage risk, and in particular a crisis.
There were four presentations chaired by Dr Neville Bain, the Chairman of the IOD. One was around the policies, structure, processes and culture that organisations require for risk management – although the presentation was from a main board perspective, there was nothing here that people familiar with OGC’s Management of Risk (M_o_R) wouldn’t recognise or disagree with.
Another presentation regarded the Icelandic Volcanic Ash Cloud that caused the UK airspace to shut down in April 2010. This was delivered by Mark Swan, the Director of Airspace Policy for the UK’s Civil Aviation Authority. The task to resolve the crisis fell at his feet. What was fascinating was that the Civil Aviation Authority had identified Volcanic Ash as a risk on their risk register. The contingency plan was simple. Pilots are instructed to fly around the ash cloud. This effectively meant closing the UK airspace. The crisis that ensued was not about closing the airspace but on how to open it. What followed over the next 6 days was lots of research into what was the actual threat from the ash cloud, lots of negotiation with engine and plane manufacturers to agree what ‘safe’ levels of ash planes can fly in, the drafting of 5 new policies (which would normally take around 4 months to complete) and numerous board meetings to sign them off. The latter was particularly difficult as UK corporate manslaughter laws meant that the board of directors could be criminally liable if they got it wrong!
Although I attended as a Chartered Director, I couldn’t help thinking about it from a project/programme risk management perspective. So in Risk Management terms what they had in their risk register was
- Risk = Volcanic Ash Cloud
- Risk Response = Declare no fly zone until ash cloud dissipates
- Cause = Volcanic Ash Cloud
- Risk = Having to declare a no fly zone
- Effect = £200m impact per day on UK Plc through lost earnings
- Risk Response = agree what is safe and introduce new policies in order to get as much of air space open as possible as soon as possible
I was really impressed with Mark Swan who, as a former RAF pilot, really understands real time management of risks. He asserted that the biggest problem they had was not in managing the risk (or in our language the threat), but in dealing with uncertainty. Much of the crisis management over the six days was focused on reducing the uncertainty of (a) understanding the nature of the ash cloud and (b) knowing what the safety tolerances were for flying through the less dense parts of it. If any project managers reading this blog want to take one key lesson from this case, it is this – identifying the cause of uncertainty and working ways to make it more certain is the most effective way of managing risks on a project.
I did have a bit of an issue with Mark’s view that ‘having it on the risk register didn’t really help.’ I come across these sorts of statements quite regularly when auditing failed or failing projects. It is common for project managers and project boards to identify risks and put them on their register, determine a reasonable risk response and then sit back with the comfort that it is being managed. Wrong. I regularly find poorly articulated risks on risk registers that do not distinguish properly between the cause, the risk and the effect. You can’t actually treat the risk, but you can treat the cause or the effect. If we were to apply OGC’s Management of Risk guidance to this scenario we could also have applied some additional techniques – for example identifying proximity ratings which would have triggered an early warning indicator so that some of the risk responses could have been started early, such as negotiating with the engine manufacturers.
It is undoubted that the Civil Aviation Authority did a brilliant job in resolving the crisis once they were in it – and what seemed to save them was strong leadership and clarity of the decision-making process. Most importantly, what decisions needed to be made at what level and with what information.
The other two presentations were on the role of Public Relations when dealing with a crisis (by the BBC’s head of media relations) and the importance of good governance (by the HBOS whistle-blower). Both were fascinating and both provided food for thought for project and programme context. But that’s the topic of a later blog!