{"id":46,"date":"2020-02-03T15:47:10","date_gmt":"2020-02-03T15:47:10","guid":{"rendered":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/?post_type=chapter&#038;p=46"},"modified":"2020-04-23T07:50:19","modified_gmt":"2020-04-23T07:50:19","slug":"the-challenges-to-your-assessment","status":"publish","type":"chapter","link":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/chapter\/the-challenges-to-your-assessment\/","title":{"raw":"The Challenges to your Assessment","rendered":"The Challenges to your Assessment"},"content":{"raw":"<hr \/>\r\n<p style=\"text-align: center\"><em>Your risk assessment faces many challenges but some of the most significant will occur before you even start.\u00a0<\/em><\/p>\r\n\r\n\r\n<hr \/>\r\n\r\nSince 2002, I\u2019ve been involved in well over 100 risk assessments as either an in-house risk manager or as a consultant.\r\n\r\nActually, let me rephrase that.\r\n\r\nSince 2002, I\u2019ve been involved in the beginning of well over 100 risk assessments. However, I\u2019ve seen many fewer risk assessments completed. Of those completed assessments, fewer still actually get turned into any kind of meaningful action.\r\n\r\nTake a minute and think about your organization. How many risk assessments were started but then fizzled out? Even when a risk assessment was completed, were the recommendations put into action? Did anyone really know what to do next? How many of these assessments are in a forgotten folder or gathering dust on a shelf somewhere?\r\n\r\nThis has always been deeply frustrating to me: an incomplete risk assessment or one that doesn\u2019t prompt corrective action is unsatisfying and a waste of time and money. Worst of all, it erodes the organization\u2019s faith in the whole risk management process. This makes people question the importance or usefulness of a risk management system at all.\r\n\r\nIf you\u2019ve found yourself thrown into the middle of a risk assessment project like Bobbie, your inclination will be to get straight into the details and to start planning the assessment itself. Getting these details right is very important (and the point of this book is to help you get them right) but these aren\u2019t the things that prevent your assessment from being successful. Instead, it\u2019s usually the bigger issues that prevent you from getting finished or, in some cases, even starting in the first place.\r\n\r\nLooking back at the assessments that I\u2019ve been involved in and comparing those that weren\u2019t finished to those that were completed successfully, the same five challenges cropped up time and time again.\u00a0 So before you get into the weeds, take a moment to think about these issues which, at a minimum, will make your assessment more difficult.\u00a0 At worst, they can kill your assessment altogether.\r\n<h1>No Mandate or Buy-in<\/h1>\r\nManagement support and buy-in is critical for any major initiative to succeed. You will definitely need this for something that requires you to poke around in an organization's deepest, darkest corners and then tell people to change their work habits.\u00a0 So make sure that you have genuine buy-in from senior management before you start. This mandate also needs to be made public. This will ensure that everyone involved knows that you are working with the support of the senior management.\r\n\r\nEven then, that might not be enough to guarantee plain sailing.\r\n\r\nYears ago, I was on a three-month project with an oil and gas firm in West Africa.\u00a0 They had contracted me to conduct a risk assessment and develop a series of corrective steps to help comply with some maritime regulations. This had all been agreed upon and sanctioned by their corporate security team who had issued the contract. However, the local Operations Manager didn\u2019t think this was necessary. Every week, we would meet to review the project. And every week, he would spend the first half of the meeting telling me why it was a waste of time.\r\n\r\nThis made the project more challenging but at least I had the mandate from Corporate Security to fall back on. Without that, the Operations Manager would have simply stonewalled me and the risk assessment would have fizzled out.\r\n\r\nI think that the lack of a mandate from senior leadership is the single biggest risk assessment problem you can face and the one that will have the greatest impact on the success or failure of your assessment.\r\n<h1>Under-resourced<\/h1>\r\nA mandate without resources is almost as bad, so make sure that you have the support you need to actually see the project through.\r\n<ul>\r\n \t<li>Do you need additional staff?<\/li>\r\n \t<li>What about a travel budget to get you to the various sites?<\/li>\r\n \t<li>Do you need external consultants or to buy software?<\/li>\r\n<\/ul>\r\nAnd what about the time available? Do managers across the organization know that the senior leadership team wants them to allocate time to this? And has your own time been freed up to complete the task or is this yet another \u2018to-do\u2019 on your list?\r\n\r\nYou can complete a risk assessment from your desk. However, without the time and resources required, it will be a thin piece of work which will make definitive action difficult. Make sure that your\u00a0mandate also includes approval for the resources you need.\r\n<h1>Unclear Purpose<\/h1>\r\nIn case you think that I was being too hard on the Ops Manager I mentioned earlier, he did do one thing right.\r\n\r\nHe\u2019d always ask \u201c<em>Tell me again, why are we doing this?<\/em>\u201d\r\n\r\nAlthough it was frustrating to rehash the conversation each week, he wasn\u2019t wrong to keep asking that question. If you don\u2019t have a purpose for your risk assessment - and stick to it - you will lose your way and are unlikely to fulfill the mandate.\r\n\r\nFor example, an annual risk assessment to meet a compliance requirement will look different from the assessment of a potential partner before a merger. Without keeping the end result in mind, you and the assessment could easily get off track.\r\n\r\nSo keep asking questions. What\u2019s the purpose? Who is going to implement the mitigation? Is there even a need for an action plan or is this more of an \u2018academic\u2019 survey?\r\n\r\nRemember, the risk assessment is part of a bigger risk management process. People in your organization will be planning to do something with the results so have a clear purpose and a defined path in mind. That will ensure that they can use the report to support whatever decision making or planning process they are engaged in.\r\n<h1>Unclear Process<\/h1>\r\nSometimes, teams can get quite far on in the risk assessment process before they start to think about how they will actually assess the risks. A lack of clarity about the methodology, language and metrics\u00a0that you are planning to use before you actually start to analyze the risks is disastrous.\r\n\r\nThe worst example of this was a major assessment that I was involved in where two different groups were using two different methodologies. Safe to say, bringing the whole assessment together was an emotional time.\r\n\r\nLuckily, we had the time and resources needed to fix the problem. However, without that buffer, months of work would have been wasted.\r\n\r\nIt\u2019s worth noting that everyone involved was a risk management professional and we should definitely have known better. Our mistake was to assume that we were all using the same process without explicitly checking before we started. If we had been a less experienced team, we probably wouldn't have made this mistake as we would have spent time discussing and confirming the assessment process.\r\n\r\nMake sure that everyone involved understands the process and methodology that you are using from the get-go. At a minimum, this will save you a lot of work later. Otherwise, the results could be so garbled that they\u2019re unusable and you will have failed to achieve your aim.\r\n<h1>Too Specialized or Esoteric<\/h1>\r\nFinally, keep things simple. There are a lot of different risk assessment methodologies and I\u2019ve also been guilty of trying to reinvent the wheel at times. As someone who has dabbled in security risk management, I would say that security teams are repeat offenders here with no sign of giving up anytime soon.\r\n\r\nBut if what you produce is too specialized or esoteric, it\u2019s probably not something that the rest of the organization can use. Using a totally untested methodology, producing a report solely in emoji or using 5 different shades of red to show risks is going to be really interesting.\u00a0 Really, really interesting\u2026.\r\n\r\nHowever, it won\u2019t be very effective.\r\n\r\nSo remember KISS. Make sure that your work will align with the organization\u2019s risk management system and adhere to whatever guidelines or regulations are in place.\r\n<h1>The Overlooked Risk Assessment Problem is...<\/h1>\r\nI said that there were five problems but in addition to the challenges listed above, there\u2019s a sixth, squishier problem.\r\n\r\nPeople simply lose interest.\r\n\r\nEvery organization has a lot going on and everyone is \u2018busy\u2019 but people also have limited attention spans. So they get bored with the risk assessment and it gets less and less attention. Or something more shiny and exciting comes along which takes priority. This happens even when they have paid - or may still be paying - a lot for consultants to manage this process.\r\n\r\nThe result is a zombie project: one that\u2019s stumbling along, not fully dead, waiting for someone to put it out of its misery.\r\n\r\nThink about your project like a gym membership. Most people are only interested in the first month or two. After that, you will see a real drop-off in interest so plan accordingly.\r\n\r\nKeep interviews tightly scheduled and make sure the participants see some results within a few weeks. Plan activities over a six- or eight-week sprints, not a six-month slog. And embrace \u2018good enough.\u2019 The \u2018perfect\u2019 12-month plan doesn\u2019t exist and trying to create one only benefits one group: consultants on a day-rate.\r\n<h1>Stack the Odds in Your Favor<\/h1>\r\nThere are other things that can go wrong and derail your risk assessment. Civil unrest, key staff being fired or the company simply going out of business. I've seen projects abandoned for all these reasons.\r\n\r\nBut these are the exceptions.\r\n\r\nThe six issues noted above recur time and time again. These account for the majority of abandoned or unsuccessful risk assessments.\r\n\r\nSo keep these in mind when planning your assessment and you are much more likely to achieve your aim. This way you can stack the odds in your favor and see the whole process through.\u00a0 Don't just add another file to the abandoned projects stack.","rendered":"<hr \/>\n<p style=\"text-align: center\"><em>Your risk assessment faces many challenges but some of the most significant will occur before you even start.\u00a0<\/em><\/p>\n<hr \/>\n<p>Since 2002, I\u2019ve been involved in well over 100 risk assessments as either an in-house risk manager or as a consultant.<\/p>\n<p>Actually, let me rephrase that.<\/p>\n<p>Since 2002, I\u2019ve been involved in the beginning of well over 100 risk assessments. However, I\u2019ve seen many fewer risk assessments completed. Of those completed assessments, fewer still actually get turned into any kind of meaningful action.<\/p>\n<p>Take a minute and think about your organization. How many risk assessments were started but then fizzled out? Even when a risk assessment was completed, were the recommendations put into action? Did anyone really know what to do next? How many of these assessments are in a forgotten folder or gathering dust on a shelf somewhere?<\/p>\n<p>This has always been deeply frustrating to me: an incomplete risk assessment or one that doesn\u2019t prompt corrective action is unsatisfying and a waste of time and money. Worst of all, it erodes the organization\u2019s faith in the whole risk management process. This makes people question the importance or usefulness of a risk management system at all.<\/p>\n<p>If you\u2019ve found yourself thrown into the middle of a risk assessment project like Bobbie, your inclination will be to get straight into the details and to start planning the assessment itself. Getting these details right is very important (and the point of this book is to help you get them right) but these aren\u2019t the things that prevent your assessment from being successful. Instead, it\u2019s usually the bigger issues that prevent you from getting finished or, in some cases, even starting in the first place.<\/p>\n<p>Looking back at the assessments that I\u2019ve been involved in and comparing those that weren\u2019t finished to those that were completed successfully, the same five challenges cropped up time and time again.\u00a0 So before you get into the weeds, take a moment to think about these issues which, at a minimum, will make your assessment more difficult.\u00a0 At worst, they can kill your assessment altogether.<\/p>\n<h1>No Mandate or Buy-in<\/h1>\n<p>Management support and buy-in is critical for any major initiative to succeed. You will definitely need this for something that requires you to poke around in an organization&#8217;s deepest, darkest corners and then tell people to change their work habits.\u00a0 So make sure that you have genuine buy-in from senior management before you start. This mandate also needs to be made public. This will ensure that everyone involved knows that you are working with the support of the senior management.<\/p>\n<p>Even then, that might not be enough to guarantee plain sailing.<\/p>\n<p>Years ago, I was on a three-month project with an oil and gas firm in West Africa.\u00a0 They had contracted me to conduct a risk assessment and develop a series of corrective steps to help comply with some maritime regulations. This had all been agreed upon and sanctioned by their corporate security team who had issued the contract. However, the local Operations Manager didn\u2019t think this was necessary. Every week, we would meet to review the project. And every week, he would spend the first half of the meeting telling me why it was a waste of time.<\/p>\n<p>This made the project more challenging but at least I had the mandate from Corporate Security to fall back on. Without that, the Operations Manager would have simply stonewalled me and the risk assessment would have fizzled out.<\/p>\n<p>I think that the lack of a mandate from senior leadership is the single biggest risk assessment problem you can face and the one that will have the greatest impact on the success or failure of your assessment.<\/p>\n<h1>Under-resourced<\/h1>\n<p>A mandate without resources is almost as bad, so make sure that you have the support you need to actually see the project through.<\/p>\n<ul>\n<li>Do you need additional staff?<\/li>\n<li>What about a travel budget to get you to the various sites?<\/li>\n<li>Do you need external consultants or to buy software?<\/li>\n<\/ul>\n<p>And what about the time available? Do managers across the organization know that the senior leadership team wants them to allocate time to this? And has your own time been freed up to complete the task or is this yet another \u2018to-do\u2019 on your list?<\/p>\n<p>You can complete a risk assessment from your desk. However, without the time and resources required, it will be a thin piece of work which will make definitive action difficult. Make sure that your\u00a0mandate also includes approval for the resources you need.<\/p>\n<h1>Unclear Purpose<\/h1>\n<p>In case you think that I was being too hard on the Ops Manager I mentioned earlier, he did do one thing right.<\/p>\n<p>He\u2019d always ask \u201c<em>Tell me again, why are we doing this?<\/em>\u201d<\/p>\n<p>Although it was frustrating to rehash the conversation each week, he wasn\u2019t wrong to keep asking that question. If you don\u2019t have a purpose for your risk assessment &#8211; and stick to it &#8211; you will lose your way and are unlikely to fulfill the mandate.<\/p>\n<p>For example, an annual risk assessment to meet a compliance requirement will look different from the assessment of a potential partner before a merger. Without keeping the end result in mind, you and the assessment could easily get off track.<\/p>\n<p>So keep asking questions. What\u2019s the purpose? Who is going to implement the mitigation? Is there even a need for an action plan or is this more of an \u2018academic\u2019 survey?<\/p>\n<p>Remember, the risk assessment is part of a bigger risk management process. People in your organization will be planning to do something with the results so have a clear purpose and a defined path in mind. That will ensure that they can use the report to support whatever decision making or planning process they are engaged in.<\/p>\n<h1>Unclear Process<\/h1>\n<p>Sometimes, teams can get quite far on in the risk assessment process before they start to think about how they will actually assess the risks. A lack of clarity about the methodology, language and metrics\u00a0that you are planning to use before you actually start to analyze the risks is disastrous.<\/p>\n<p>The worst example of this was a major assessment that I was involved in where two different groups were using two different methodologies. Safe to say, bringing the whole assessment together was an emotional time.<\/p>\n<p>Luckily, we had the time and resources needed to fix the problem. However, without that buffer, months of work would have been wasted.<\/p>\n<p>It\u2019s worth noting that everyone involved was a risk management professional and we should definitely have known better. Our mistake was to assume that we were all using the same process without explicitly checking before we started. If we had been a less experienced team, we probably wouldn&#8217;t have made this mistake as we would have spent time discussing and confirming the assessment process.<\/p>\n<p>Make sure that everyone involved understands the process and methodology that you are using from the get-go. At a minimum, this will save you a lot of work later. Otherwise, the results could be so garbled that they\u2019re unusable and you will have failed to achieve your aim.<\/p>\n<h1>Too Specialized or Esoteric<\/h1>\n<p>Finally, keep things simple. There are a lot of different risk assessment methodologies and I\u2019ve also been guilty of trying to reinvent the wheel at times. As someone who has dabbled in security risk management, I would say that security teams are repeat offenders here with no sign of giving up anytime soon.<\/p>\n<p>But if what you produce is too specialized or esoteric, it\u2019s probably not something that the rest of the organization can use. Using a totally untested methodology, producing a report solely in emoji or using 5 different shades of red to show risks is going to be really interesting.\u00a0 Really, really interesting\u2026.<\/p>\n<p>However, it won\u2019t be very effective.<\/p>\n<p>So remember KISS. Make sure that your work will align with the organization\u2019s risk management system and adhere to whatever guidelines or regulations are in place.<\/p>\n<h1>The Overlooked Risk Assessment Problem is&#8230;<\/h1>\n<p>I said that there were five problems but in addition to the challenges listed above, there\u2019s a sixth, squishier problem.<\/p>\n<p>People simply lose interest.<\/p>\n<p>Every organization has a lot going on and everyone is \u2018busy\u2019 but people also have limited attention spans. So they get bored with the risk assessment and it gets less and less attention. Or something more shiny and exciting comes along which takes priority. This happens even when they have paid &#8211; or may still be paying &#8211; a lot for consultants to manage this process.<\/p>\n<p>The result is a zombie project: one that\u2019s stumbling along, not fully dead, waiting for someone to put it out of its misery.<\/p>\n<p>Think about your project like a gym membership. Most people are only interested in the first month or two. After that, you will see a real drop-off in interest so plan accordingly.<\/p>\n<p>Keep interviews tightly scheduled and make sure the participants see some results within a few weeks. Plan activities over a six- or eight-week sprints, not a six-month slog. And embrace \u2018good enough.\u2019 The \u2018perfect\u2019 12-month plan doesn\u2019t exist and trying to create one only benefits one group: consultants on a day-rate.<\/p>\n<h1>Stack the Odds in Your Favor<\/h1>\n<p>There are other things that can go wrong and derail your risk assessment. Civil unrest, key staff being fired or the company simply going out of business. I&#8217;ve seen projects abandoned for all these reasons.<\/p>\n<p>But these are the exceptions.<\/p>\n<p>The six issues noted above recur time and time again. These account for the majority of abandoned or unsuccessful risk assessments.<\/p>\n<p>So keep these in mind when planning your assessment and you are much more likely to achieve your aim. This way you can stack the odds in your favor and see the whole process through.\u00a0 Don&#8217;t just add another file to the abandoned projects stack.<\/p>\n","protected":false},"author":253,"menu_order":2,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[47],"contributor":[],"license":[],"class_list":["post-46","chapter","type-chapter","status-publish","hentry","chapter-type-standard"],"part":42,"_links":{"self":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/46","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/users\/253"}],"version-history":[{"count":2,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/46\/revisions"}],"predecessor-version":[{"id":303,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/46\/revisions\/303"}],"part":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/parts\/42"}],"metadata":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/46\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/media?parent=46"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapter-type?post=46"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/contributor?post=46"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/license?post=46"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}