In an Expert Focus article for Waterbriefing, Paul Taylor, Head of Programme Development in the UK for MWH, now part of Stantec, explains how the UK water sector can use programme management to control risks.

Paul Taylor: In the current AMP cycle, the success of UK water companies is measured by Ofwat in terms of outcomes. This marks an evolution from previous AMP cycles, which focussed on outputs.

This emphasis on outcomes demands that programme management (the control of a group of projects) is deployed at a strategic level and it has brought risk management to the forefront of business need. This change in approach to consideration of outcomes rather than individual project outputs means that appropriate risk management is now required at programme level.

The move to managing outcome based risks is best developed from day one, using four key components: the risk management framework, the business case, risk identification and impact management.

Risk management framework

Risk management focuses on points of failure, so it has a tendency to run counter to programme management, which focuses on strategy and delivery, and is more optimistic. This cultural difference brings its own danger – which is that risk management is marginalised.

In order to overcome this, there are a few simple rules an organisation can apply:

• Develop a programme with full risk exposure visibility connected to the outcomes
• Categorise and assess risks at programme level
• Use best practice risk management methodologies such as Axelos or HM Treasury models
• Maintain risk registers
• Continuously track and communicate risk implications
• Risk identification
• Impact evaluation
• Probability evaluation
• Mitigation measures

A key difference between programme risks and project risks is when programme risks materialise, there is always an impact to the projects within the programme. As these overarching risks impact individual projects’ scope, time or cost, an effective change control mechanism must be in place, beyond the normal contractual early warnings, instructions and compensation events to the supply chain.

Strategic programme management will become even more critical as organisations try to balance outcomes with supply chain capacity. The focus on outcomes and how we mitigate the associated programme risks will be in full view. This means we have to structure the risk management approach into clearly defined blocks, as shown in the diagram below.

‘Policy’, is an organisation’s overarching policy on risk management.

The second two blocks of ‘Processes’ and ‘Strategy’ will be developed to suit the individual programmes. The processes and strategy need to be detailed enough to allow the delivery supply chain to provide the level of information around the last block, ‘Control’, once each individual programme enters the delivery stage.

We also have to acknowledge that risk management is not isolated to delivery and has to fit in with other business best practices. There should be a corporate risk management policy spanning both strategy and delivery with which the overall programme must comply from the start. The strategy stage is very much in the asset owner’s domain, whilst the delivery stage can involve both the asset owner and delivery supply chain.

The programme team should understand the principles of risk, as the information can influence design requirements, acquisition strategies, and even delivery timescales. Companies must not fall into the trap   of inventing internal processes as there are best practice models available such as ISO 31000 Risk Management, Axelos  MoR, HM Treasury Orange Book and HM Treasury Green Book.

From a programme perspective the risk management is closely linked to supporting the overall programme business case.  Using the best practice models will provide guidance on the management and intervention of programme risk management throughout the overall lifecycle.  As the programme moves from an overarching strategic view where the risks to the outcomes need to be understood, to an outline view where the risk mitigation measures are evaluated to an implementation approach which physically manages the risks.

Risk identification

Companies need to consider having a central risk function as part of their programme structure with the skills and ability to effectively manage programme risks and aggregated project risks.

From a programme perspective there are four key common approaches companies should consider to ensure that all the risks and opportunities are identified. To maximise the understanding of the programme these approaches should be used in a sequential order.

Assumptions

When the business case is produced, a suite of assumptions is developed to assist in proving the programme’s business case. As these items are not confirmed facts, in reality they are risks to the programme and need to be categorised and managed as such.

PESTLE

The PESTLE technique evaluates how the programme sits within its external environment. PESTLE covers a range of categories: political, economic, social, technical, legislative, and environmental. It looks at how each issue influences the programme in both a positive and negative manner. The positives are examined for further opportunities and the negatives highlight risks that will require mitigation.

SWOT

SWOT (strengths, weaknesses, opportunities and threats) is an inward examination of the programme and what can influence it. This mature process is invaluable in both the strategic stage and delivery stage to maximise opportunities and mitigate risks.

Horizon scanning

As programmes usually have a far longer life span than the projects within them, horizon scanning is essential to identify what is on the periphery and the strategic directions that are emerging. 

Impact management

Risk appetite

The amount of risk an organisation is willing to take to achieve the outcomes of the overall programme or a programme tranche is a critical factor in corporate governance.

Once the risk is assessed, if the value exceeds the pre-agreed appetite level, then before the programme is approved a risk mitigation measure is applied to base scope to reduce the impact to an acceptable level. For example, at programme level this could be too much work with a single supplier creates a delivery risk.

Tolerance thresholds

The programme’s business case should set the variance / tolerance parameters for the programme outcomes. If the programme performance indicates that the tolerance is going to be exceeded then measures should be put in place to mitigate.

Risk workshop techniques

There are several different techniques to identify risks such as brainstorming, nominal grouping and Delphi. Whatever technique is deployed, a facilitator is needed to break the risk process down into distinct segments to ensure all are able to contribute. The segments as a minimum will include:

Using nominal grouping, attendees silently identify the risks to the programme. Once the list of risks are defined the impacts are only then discussed in group. Delphi works on questionnaires and is an autonomous process.

A new technique is to work from the premise that the programme has seriously failed then ask delegates to individually think of why it failed. Once captured these are discussed and working backwards using Ishikawa diagrams, the root cause of the failure is identified. This removes the negative phase of asking people what the risk could be, to a ‘why it failed’ mode.  HM Treasury Green book provides common causes of failure.

Summary

If programme risk management is broken down into its component parts, it is not complex.

The demonstrable proof of its effectiveness is that an organisation will not be forced into taking reactive moves to recover when a failure occurs. Although risk mitigation demands considerable due diligence, it is an incredibly valuable component in ensuring the success of the delivery of programme outcomes.

But to have a thorough approach to risk mitigation, it must be on the agenda from day one.