Risk Management: Known / Unknown Unknowns

On February 12 2002, US Secretary of Defence Donald Rumsfeld made a now famous remark that has since went on to be commented on widely by critics and thinkers. It would become so famous that it would become the title of his autobiography "Known and Unknown: A Memoir", and provides a superb basis to discuss our approach to Project Risk Management:

"...because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know. And if one looks throughout the history of our country and other free countries, it is the latter category that tend to be the difficult ones"

Let's break this down:

• Known Knowns - Things we know we know (to a good degree of confidence) which were identified in our planning phase - so our Project Plan. Be it what tasks are required to complete the project (design/build/test etc) the staffing requirements for a task based upon a solid estimate, or dependencies between two tasks. These will form the basis of our cost and schedule baseline for the Project.
• Known Unknowns - For us this is our Risk Log. We know we have uncertainties, but we have identified and recorded them, analysed them and carefully manage them. We don't know how they will turn out, but we can apply qualitative ratings to their likelihood of concurrence, size of impact, and proximity of impact. We have detailed action plans and perhaps contingency plans - all of which is reflected in our plan. We should also aim to manage these quantitatively, identifying expectation value of costs before and after actions - again reflected in our cost baseline and sometimes called the "Contingency Reserve".
• Unknown Unknowns - These are what will sink us. The left-of-field issues which we never saw coming and we are completely unprepared for. We don't have the time, resources or funding to deal with them. So how do we deal with them? We keep an additional pot of money sometimes called the "Management Reserve", usually based on a % figure of the total cost baseline - that size is dependent on the perceived risk and critical of the project

So together we can financially plan for Unknowns in our Projects with our Total Risk Budget= Contingency Reserve + Management Reserve. There are complications of course: residual risk costs, secondary risk costs, action costs (factored in your plan baseline?), Accepted Risk costs etc - but the basic principle is quite simple at its core.

Do you use this approach for Risk management, or do you use only a management-type reserve OR a calculated risk budget? Let us know in the comments. We will soon be making available a Risk Log Template for sale that helps you document these costs to make sure you are managing your Unknowns as effectively as possible - to maximise your chance of project success!

Stay Healthy! Project Health Check - projecthealthcheck.org