What criteria would you use to know if a risk assessment was successful?
I've certainly witnessed plenty of projects in the planning phase where it was obvious that a project's risk assessment was meaningless. I write this based of what those projects' risk assessments concluded: The project needs
no risk controls of any type, because
- we don't believe any of those risks (because that's "stinkin thinkin"!)
- we "monitor" risk (and magically avoid or somehow instantly suppress it?)
- we don't have the budget for risk controls
I've heard the second bullet point so very often and it always causes my eyes to roll. Rarely are the actual metrics called out for "monitoring", and even then there ought to be a plan for what will happen
should the alarm go off. (*1) Each time I saw those same conclusions I wondered why even bother doing a risk assessment.
Post-hoc, it is trivial to objectively determine that a project's risk assessment was inferior.
(*1) trying to tie back to the actual video... I've seen poorly managed companies that also could not recognize opportunities, even distinct from a "risk management" concept. I suppose if the video got such companies to recognize that
opportunities are not themselves risks there could be some value, but honestly those diagrams would would probably just send the executives on a 8-month retreat trying to weaponize them as process flow charts.