Risk Management

Dependencies...

I’ve been scratching the surface of contingency planning lately and have been asked how an organization can better identify risks that might require contingencies. In many cases, and for many companies, the process of risk identification comes from ‘tribal knowledge’ and experience of senior managers. While these domain experts can provide valuable input, there are other tools that can enable anyone to help identify risks and potentially manage them. One of my favorites is dependency mapping or benefits dependency mapping.

Dependency mapping is used in project management, application development, system architecture, and many more disciplines. There are software packages to help with it, but even a simple whiteboard and post-it-notes can suffice to get started. The concept is simple: what is needed to perform a given step in a process, and where do those items come from?

If you are making widgets, what are the raw materials for them? Where do those materials come from? Once you have the starting map for your process, you can elaborate and add detail. How are the materials delivered? How much of each material is stored on-site? What is the lead-time for deliveries?

As you build the map, you will naturally identify risks. Suppose a sprocket is in short supply or has a long-lead-time; what can you do about it? What if the supply dries up? What if orders for widgets increase by 10%?

Each of these risks, once identified, can then be planned for, even if the plan is simply to accept the risk. As an additional benefit, you should have a well-documented process once the map is complete that can help with a wider range of business problems, such as training, process management, forecasting, and more.

Contingency plans can become business as usual.

In my last post, I mentioned that standard policies can help with contingency planning. Similarly, policies put in place during the COVID-19 (or any) crisis can create needs for additional contingency plans, and become the basis of revised internal policies.

With many states requiring non-essential personnel to work from home, companies that can have put tools in place to allow remote work. Those companies unable to work remotely, which is most of the non-technology-based sectors, have to reduce staff or take other actions. The re-hiring and re-starting of production or service, once the crisis winds down is going to create additional risks with the need for potential contingencies:

  • Is the start-up process for production documented with appropriate maintenance, training, and safety checks in place, especially if there is a risk of new people starting up the process?

  • How will supervisors ensure their areas of responsibility are operating safely and as required by the business?

  • Will the supply process deliver expected volumes and quality of raw materials as production resumes, or will there be constraints on supply? How do you know?

  • What will happen if the down-stream distribution is constrained? Will you throttle production or stockpile? If you stockpile, how much capacity is there and when would you throttle production?

As you can see, it is easy to start thinking of risks that will require additional contingency plans. As you develop plans for the risk you prioritize, you should then feed those plans back into your standard operating procedures to ensure you are that much more ready the next time a crisis hits.