Projects are risky activities. We take on a managed level of risk in order to achieve defined rewards. It's therefore not surprising that some projects fail — completely eliminating failure would be a sign that we're being too risk averse. Problems arise when the level of failure across our program or portfolio is not commensurate with the desired risk/reward profile.
Project reviews and assurance can be a very useful tool to help monitor risk levels across our portfolio, and hence to identify and mitigate the risks which are not being managed effectively. This talk looks at some factors you should consider when setting up an assurance programme.
Using Reviews and Assurance to Manage Portfolio and Programme Risk
1. Using Reviews and Assurance
To Manage Programme and Portfolio Risk
Graham Oakes (graham@grahamoakes.co.uk)
December 2013
2. Outline
• Projects fail
• That’s OK
• Portfolio mgt is easier than project mgt…
• … provided you can get the right information
• Setting up an assurance programme
28. Summary
• We engage with risks to achieve rewards
• Sometimes the risks win
• Aim is to eliminate unnecessary failure
• Program & portfolio mgrs have a lot of tools
• They need information in order to use them
• Reviews & assurance provide this information
(provided they’re set up appropriately)
29. Unnecessary Failure…
… happens when people with the
skills, resources and authority to act effectively
don’t get full, validated information about
project status and issues.
The role of reviews and assurance is to provide
this information.
45 minutesI’m Graham Oakes. I help orgs work out how to use technology to achieve business goals. I then help them set up and deliver projects and programmes to deliver their strategy. This talk is based on experience with latter – providing independent reviews and assurance to help people deliver projects effectively.
Can give a long list – fuzzy requirements, mismatched goals, lack of sponsorship and stakeholder buy-in, lack of resources & skills, poor communications.We’ve known about these for decades. The literature keeps reiterating them. Yet our projects keep failing. There’s something going on beneath this…
We get overloaded – too much going on, too much info coming in, to keep on top of it all. We miss stuff, make bad connections, don’t hear warnings from team members, etc.We’re subject to biases and gaps in our cognition (Daniel Kahneman: Thinking, Fast & Slow)We fool ourselves. We hope we’ll recover.We create incentives to hide failure.Most project mgt is about building mechanisms to keep in touch with reality – status reports, plans (make it more obvious when we’re deviating), earned value, risk mgt (triggers tell us if risk has come into play), etc.
Eventually we run back into reality. We have to hit it at some point, when we need to deliver into outside world. Can no longer fool ourselves and failure becomes obvious.Great statistics from my time at Psygnosis, showing how people face up to failure as they start to hit major milestonesKey message: failure typically happens a long time before it becomes obvious.This is the real problem: now have less time to deal with the failure, and it’s more likely to have grown and cascaded, causing related failures.
Projects are one-ff activities. Level of novelty & research & learning. Engage with risks to achieve rewards. Sometimes the risks win.Oil industry is great example.
Inherent = built into the statistics of what we’re trying to do. Some percentage will fail by virtue of complexity, unknown nature, etc. That percentage varies from domain to domain – high in research, low in stuff we do over and over again with little variation. Whatever level, it’s not fundamentally a problem – a sign we’re attending to meaningful risk/reward trade-offs.Unnecessary = failure that happens because we don’t get the basics right. We don’t plan. We don’t communicate. We don’t resource appropriately. Etc. Avoidable failure that we don’t avoid. This is the real problem.
Only have one project. Either it succeeds or it doesn’t. You tend to get tarred with the failure – a real problem in orgs with blaming or risk-avoiding cultures.
Can achieve higher level goal provided the proportion of failure is within tolerance. Still want to eliminate the unnecessary failures, but can live with the inherent ones (& have tools to mitigate these too)Portfolio management, esp, is all about getting a balanced level of risk, not zero risk.
Can shift resources between projectsTypically have larger pool of expertise – can access specialists that aren’t fully available to project managersCan adjust schedules - delay one in order accelerate othersTypically have better access to senior stakeholders – can work with them to remove blockages, add resources, adjust scope & objectives
4 slides:There’s a lot going on – hard to keep track of it all; significant stuff gets lost in amongst all the detail and the sheer weight of info hitting usStatus reports paint a rosy view – project managers may have fooled themselves. Optimism is a human bias & esp in project managers – convince themselves there chances of success are better than average. Even if aware of issues, don’t want to share failure due to machismo & independence, or for fear of being pushed aside (valid fear: many senior managers micro-manage & intervene too early).Status reports become ritualised – lots of cut and paste. Become an overhead – don’t add value for project manager and team, so they put minimal effort into themPeople have agendas behind the info they reveal and the view they have of the project
4 slides:There’s a lot going on – hard to keep track of it all; significant stuff gets lost in amongst all the detail and the sheer weight of info hitting usStatus reports paint a rosy view – project managers may have fooled themselves. Optimism is a human bias & esp in project managers – convince themselves there chances of success are better than average. Even if aware of issues, don’t want to share failure due to machismo & independence, or for fear of being pushed aside (valid fear: many senior managers micro-manage & intervene too early).Status reports become ritualised – lots of cut and paste. Become an overhead – don’t add value for project manager and team, so they put minimal effort into themPeople have agendas behind the info they reveal and the view they have of the project
4 slides:There’s a lot going on – hard to keep track of it all; significant stuff gets lost in amongst all the detail and the sheer weight of info hitting usStatus reports paint a rosy view – project managers may have fooled themselves. Optimism is a human bias & esp in project managers – convince themselves there chances of success are better than average. Even if aware of issues, don’t want to share failure due to machismo & independence, or for fear of being pushed aside (valid fear: many senior managers micro-manage & intervene too early).Status reports become ritualised – lots of cut and paste. Become an overhead – don’t add value for project manager and team, so they put minimal effort into themPeople have agendas behind the info they reveal and the view they have of the project
4 slides:There’s a lot going on – hard to keep track of it all; significant stuff gets lost in amongst all the detail and the sheer weight of info hitting usStatus reports paint a rosy view – project managers may have fooled themselves. Optimism is a human bias & esp in project managers – convince themselves there chances of success are better than average. Even if aware of issues, don’t want to share failure due to machismo & independence, or for fear of being pushed aside (valid fear: many senior managers micro-manage & intervene too early).Status reports become ritualised – lots of cut and paste. Become an overhead – don’t add value for project manager and team, so they put minimal effort into themPeople have agendas behind the info they reveal and the view they have of the project
3 slidesIndependent, validated information so people can intervene effectively in their projects, programmes & portfoliosOutside view helps cut through many of the biases and politicsStructured approach helps overcome cognitive gaps = review approach
3 slidesIndependent, validated information so people can intervene effectively in their projects, programmes & portfoliosOutside view helps cut through many of the biases and politicsStructured approach helps overcome cognitive gaps = review approach
3 slidesIndependent, validated information so people can intervene effectively in their projects, programmes & portfoliosOutside view helps cut through many of the biases and politicsStructured approach helps overcome cognitive gaps = review approach – will come back to this
A dozen pointers for you.
If you only review projects when they’re in trouble, sending a review gives message “your project’s in trouble”. Project mgrs resist this message – can be pretty threatening. Means they’re less willing to open up about what’s going on. Cuts off the information flow.Unexpected reviews add overheads – people need to prepare materials, reschedule meetings, make space available, etc. Disruption is much lower if reviews are planned into project from outset.Ad hoc reviews also tend to be more heavyweight – happening infrequently, so need ot drill down into details & ask a lot of questions. Can’t do much in a lightweight review at this point – barely get up to speed. Adds to disruption.PMO does a lot to set the context for this – sets expectation that reviews will be norm, builds it into methods & tools & templates
Can be project mgr, programme/portfolio mgr, or senior execIf not clear, will deliver wrong info (too detailed, not actionable with resources and power they have, etc)Even if focused on needs of sponsor or exec, need to try to deliver value to project team – rely on them for interviews, access to docs, etc. Give value in return for this disruption – draft recommendations that they can use, benefiting from the experience and perspective of the reviewers. (Doesn’t help to be condescending as do this!)Also need to get the communication protocols around this right, e.g. team will hide info if see no benefit for themselves and/or see fear of over-intervention by senior mgrs. E.g. Psygnosis protocol.NB there’s a risk here – assurance should be a redundant info channel, supporting & not supplanting info flows from project mgr & team. There’s a risk that these normal flows wither as people become too dependent on the flow from the assurance teams.PMO’s help frame objectives for reviews & hence set this up
People ask how much to invest? Hard question – we lack good statistics.Tune it to the expected failure rate in your org – if projects overrun by an average of 40%, then what percent of budget is it worth spending to halve this? That puts a ceiling – start lower and work up to it if getting results.Consider film industry – completion bond costs 2-5% of production budget. Reasonable to spend same on IT project.
Frequent, regular lightweight vs larger, milestone-based gate reviews (latter are more disruptive & require more effort from project & review teams, but go deeper, heavyweight means generally too infrequent to spot trends until too late; former are good for spotting trends; combining the two makes a lot of sense)Formal vs informalSelf-assessmentvs peer vs independent outsiderProcess vs outputsProject, design, code, … - all depend on the objectivesPMO helps design the review programme
Can’t be both broad and deep (within bounded time & budget) – either skim across entire scope of project, or delve deeply into 1 or two aspectsOften good to go T-shaped – broad initial phase, then drill into 1 or 2 areas selected by first phaseWork with stakeholders (exec, sponsor, project mgr, team) to agree what areas you’re going to focus on & how deep you’ll go – will influence time needed, people you’ll need to talk to, etcJust like a project really – time spent definign clear objectives will repay itself during the reviewPMO helps facilitate the negotiation
Quickly walk through the process
Everyone has opinions. May be driven by evidence, but also by prejudice, bias & agendas. Need to cut through this – goal is to deliver info that’s validated by links to facts.Gets very political if can’t back findings with evidence – comes down to contest of credibility, political power, etc. Can be very messy. Not my idea of fun.Look for dates, metrics, photos. Try to get attributable quotes from people. When making an inference, be clear that it is an inference, and link back to the facts supporting it. Likewise link recommendations to your inferences of what’s going on & hence back to the underlying facts.Can take time to gather clear, documented facts. Not essential if relationships are good and findings are uncontentious, but definitely essential in political environments or a lot is at stake.
Military saying: “Amateurs discuss tactics. Professionals discuss logistics.”Review requires a lot of organising – getting docs, getting security passes, getting access to systems, booking meeting rooms, scheduling meetingsEsp time-consuming for external review teamsIf you don’t plan for the time this takes, your review will be behind schedule before it even starts – ends up wasting even more of the project team’s time.A lot of this is about reducing load on the project team – review often isn’t focused to help them, so need to work carefully to keep them onsidePMO often best placed to provide administrative support, access to systems & tools & docs, etc, to minimise burden on project & review teams
Project teams are busy – none of them have spare time. Review is getting in way of delivery activities (even if it does end up adding value through perspective and expertise of reviewers).Work from existing project artefacts – don’t ask team to create special docs, fill in questionnaires & checklists, etc just for the review. (Planning reviews into project helps ensure the artefacts will be there.)Reviewers need to understand the standard docs produced within this org (if defined), so can get up to speed quickly & not disrupt project team.Plan logistics so as to minimise disruptionTreat people with respect – turn up for interviews on time, read project docs in advance so know the basic context, don’t overrun, thank them for their time
Cover:Org’s project methods, tools, artefactsTypes of review, review processConducting interviewsGathering evidence & building a chain of inferenceWriting and presenting findings so they’re well-formed, actionable, concisePMO is natural place to provide this training, and to manage the pool of skilled (& apprentice) reviewers – build review capability within the org
It’s all largely a waste of time if don’t act. (Some benefit from regularly shining light on project: people tend to maintain risk registers, etc, rather than let them lapse.)Review & project teams lose heart iif don’t see action from reviews – stop taking them seriously / start cutting cornersNB reviewers need to deliver actionable findings – backed by evidence; within authority, skills & resources of recipient; aligned to wider goals and politics. Lot of review teams shoot themselves in the foot here – requires experienced, savvy people who are well connected to organisational context and/or have appropriate senior backing.
Are reviews happeningAre findings being acted onAre projects delivering better as a resultAgain, this is an area where PMO gets heavily involved – monitoring stats about reviews, tracking project-level actions after review team has left, managing portfolio-level actions
For me, this is the really big benefit of reviews – bunch of people see what’s working & not working across range of projects in org; talking to people in different projects. Natural channel to disseminate news about what is & isn’t working. Build this into their operations.Can do this tacitly (through discussions that happen as part of reviews) and explicitly (by adding items to review checklists, updating tools & methods & standard doc templates & etc).Also a way to build skills – (1) give people a chance to see a wide range of projects; (2) give project mgrs a chance to talk to experienced PMs running reviews.I’d give this at least as much emphasis as the communications side.This again is very close to the PMO’s mission: they typically own the tools, methods, templates, etc, and are responsible for building PM skills and capabilities within org.
But comms is the prime purpose – ensuring we get clean info to the stakeholders who can act on it.Come back to the risk I identified at point (2) – Assurance is a way of supporting effective stakeholder communications – ensures that people get the info they need to act effectively. But it shouldn’t replace the normal flows – it supports, doesn’t supplant. If people getting too dependent on assurance for info, then you have a problem within your project management & teams that needs to be addressed head on.
Add a point about PMO – naturally placed to help set them up & maintain them