016 - Risk Management on Megaprojects: Lessons from the Leviathan Project - The Major Project Podcast

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
.9998474121Welcome to Major Project Podcast. 2 00:00:01,659.9998474121 --> 00:00:10,139.999866486 We're here to talk about some of the biggest projects in the world, how they get done, talking with leaders that have been on the ground understanding this amazing space. 3 00:00:10,139.999866486 --> 00:00:12,699.999332428 So today with me is Matt Mitchell. 4 00:00:13,0.000476837 --> 00:00:14,590.001087189 He works, in capital projects. 5 00:00:14,590.001087189 --> 00:00:23,789.99994278 He is a certified risk management professional with over a decade of experience in risk, project controls across energy and industrial sectors. 6 00:00:24,199.999790192 --> 00:00:34,950.000553131 So, his prior job, he was at Noble Energy leading ri- risk management initiatives, and now he is working at Electrical Grid Monitoring, which is a new venture focused on innovative power line sensors. 7 00:00:35,359.999637604 --> 00:00:37,449.999790192 Matt is also a member of Mints International. 8 00:00:37,449.999790192 --> 00:00:40,29.997806549 He's got real great analytical rigor. 9 00:00:40,299.998264313 --> 00:00:46,310.000400543 We've had some great conversations around solving challenging problems in capital projects and risk assessments. 10 00:00:46,310.000400543 --> 00:00:47,909.998874664 I'm excited to bring them to you today. 11 00:00:48,219.999485016 --> 00:00:50,170.000247955 Matt, welcome to the podcast. 12 00:00:51,170.000247955 --> 00:00:51,820.001773834 Thank you, Orion. 13 00:00:51,870.001773834 --> 00:00:52,380.000095367 Thanks, Matt. 14 00:00:52,380.000095367 --> 00:00:58,470.000247955 And before we get started, maybe you can just give us a little bit of your history and how you got into working in major projects. 15 00:00:59,640.001468658 --> 00:01:09,239.999027252 I actually started off more on the technical side IT and software development, and I, got into risk management with a couple of different things that I did. 16 00:01:09,239.999027252 --> 00:01:12,870.003910065 First, I worked at Enron, and we had some formal training around risk management. 17 00:01:13,460.000247955 --> 00:01:18,649.995059967 But then I worked for a software company that had a really strong risk management platform. 18 00:01:19,209.992618561 --> 00:01:32,170.006046295 And so we were rolling that out to various customers and doing a lot of, prospecting, of what risk management would look like and what the global risk management system would do, and ended up going to work for one of our customers. 19 00:01:32,640.007266998 --> 00:02:10,34.00880174 And as we rolled out this global risk management system, they realized they didn't have anybody to manage it, and so that became my role, and th- eventually started working on a variety of their con- construction type projects and, you know, oil and gas type stuff, and, took on the role of risk lead and ended up with some of the very large projects that they had It's interesting to go from the software side because when I look at the project control space and the software space, I feel like risk is probably the one area that I've seen more often than not managed from small to really large enterprises in Excel. 20 00:02:10,374.00704698 --> 00:02:18,604.00582628 So you're really in a interesting niche to come from s- a software solution that focuses on risk, and then rolling it out broadly. 21 00:02:18,604.00582628 --> 00:02:31,494.01093797 Did you, do you find that's true as well in your experience? But what is interesting about it is that for risk management, you know, you think of just any kind of software at large, the software has to do whatever the company's business process is. 22 00:02:32,104.01154833 --> 00:02:42,314.0106328 But with risk management, we have some pretty good guidance out there, ISO 31000, we've got Project Management Institute, that all kind of lay out this framework of what you should be doing for risk management. 23 00:02:42,714.00834398 --> 00:02:45,964.00834398 And so the software was built to, to do those things. 24 00:02:45,994.01093797 --> 00:02:51,134.01080446 As I understand it, we also are gonna get to talk a little bit about the Leviathan Project. 25 00:02:51,414.01101427 --> 00:02:57,264.01044206 You know, public information only, of course, but this was a large gas field project in Israel. 26 00:02:57,264.01044206 --> 00:03:02,654.01173906 And so maybe you can tell us a little bit about that and your role on the Leviathan Project. 27 00:03:02,934.01166277 --> 00:03:07,24.01181535 It's a very large project that takes many years to develop. 28 00:03:07,24.01181535 --> 00:03:16,534.00723772 It's interesting with the backdrop of what's going on in world, geopolitical things today that, these projects are decades in the making in some cases. 29 00:03:16,534.00723772 --> 00:03:20,214.00449114 You have people on and off, and a lot of, knowledge gaps here and there. 30 00:03:20,214.00449114 --> 00:03:40,334.01700334 So risk management is crucial because as projects get mothballed or delayed or scope changes or even the entire concept changes, the capturing of that information and the risks that we considered and the reasons why we made certain decisions that we made, those should be documented and documented well. 31 00:03:40,334.01700334 --> 00:03:42,494.02066545 And risk management is one of the best ways to do that. 32 00:03:42,644.02219133 --> 00:03:48,614.02676897 We consider doing this, we said the cost was too much for that, we chose a different concept, but those things change over time. 33 00:03:48,644.02554826 --> 00:03:59,34.02951555 So, you know, these huge projects, risk management is a key part of the entire life cycle of the project, even up until the point where the project might get canceled. 34 00:03:59,224.02432756 --> 00:04:04,874.02585344 You know, somebody might pick it up again five years down the road, and it's gonna be important to understand what took place. 35 00:04:05,794.02402239 --> 00:04:07,254.02310686 Well, so tell us about Leviathan. 36 00:04:07,304.02493791 --> 00:04:14,424.0276845 What was the project and when did you intersect it? And then your role was risk, so just give us a little background there. 37 00:04:14,654.02646379 --> 00:04:26,574.02615862 So, it started off, you know, it was pretty far offshore, and it started off as a floating, production, FPSO, float- floating production basically a ship. 38 00:04:27,334.02066545 --> 00:04:32,684.02676897 And so that concept was kind of battered around for, I think, a couple of years. 39 00:04:33,224.02310686 --> 00:04:42,114.02249651 And then it ultimately based on some of the s- the, successes of the other two platforms that had been put in it became a very large platform a little closer in. 40 00:04:42,664.02860002 --> 00:04:46,214.03165178 And, and so that was the, that was the final investment decision. 41 00:04:46,844.03958635 --> 00:05:03,178.03779344 But, you're talking about years of research that led into that, and so I became- this? That was around 2000- 14, 15- Was that FID? So it was not long after Tamar went in, which was, I believe, 2013. 42 00:05:04,28.03817491 --> 00:05:13,548.03844194 So the concept, kind of shifted to using Tamar as part of the whole system of production, versus just having the ship do everything. 43 00:05:14,88.03859453 --> 00:05:20,328.03836565 I got into that project around the 2015 timeframe, '15 or '16, I believe. 44 00:05:21,58.03790788 --> 00:05:27,638.04050188 And that was, right around the time that they made final investment decision and sanctioned that project as that large, platform. 45 00:05:27,668.03928118 --> 00:05:29,658.03714494 So massive platform, in fact. 46 00:05:29,658.03714494 --> 00:05:30,918.03760271 So quite fascinating. 47 00:05:31,648.03714494 --> 00:05:37,258.0339406 So how big was the project when it FID'd? I believe at FID, it was about 3.8 48 00:05:37,258.0339406 --> 00:05:38,478.0351613 or 3.9, 49 00:05:38,478.0351613 --> 00:05:39,78.03363542 something like that. 50 00:05:39,128.03363542 --> 00:05:39,478.03210954 Okay. 51 00:05:39,848.03104143 --> 00:05:40,188.03500871 Great. 52 00:05:40,638.03195696 --> 00:05:46,308.0301259 And then your role, so you intersected right around FID, right after. 53 00:05:46,698.03256731 --> 00:05:47,858.03622942 So what did you... 54 00:05:47,858.03622942 --> 00:05:51,568.03531389 And you came in as a, as a risk lead. 55 00:05:51,568.03531389 --> 00:05:52,518.03226213 Is that right? Risk, yeah. 56 00:05:52,688.03806047 --> 00:06:08,928.04392557 So did you, when you started that job did you inherit- The risk register and like how did you approach risk right at that FID point? 'Cause that's a very interesting point when a project goes from, you know, are we doing this to like, we are doing this. 57 00:06:09,358.04423075 --> 00:06:20,178.04468851 But you really wanna honor all the risk work that's gone on in the past, but you're also new to this job, Walk me through how you navigated that, 'cause that's kind of a complicated little s- point to intersect a project. 58 00:06:20,238.04415445 --> 00:06:24,278.04201822 It's interesting because, obviously every company's different, every project is different. 59 00:06:24,758.04156046 --> 00:06:30,868.03988199 But the better developed and the more mature that risk management process is, the easier it is to do something like that. 60 00:06:30,898.03866129 --> 00:06:41,338.04323892 So in my role at that time we were working from only kind of what we had seen with the previous platform, and let's take that risk register and we'll repurpose it, and it'll kinda... 61 00:06:41,338.04323892 --> 00:06:43,998.03927164 Some of these apply, some of these don't, and go forward with that. 62 00:06:44,398.04079752 --> 00:06:49,298.04156046 But we eventually, this was such a large project, it had so many, aspects of it. 63 00:06:49,668.03667764 --> 00:06:57,568.03515177 We eventually ended up running two different risk registers because we had so much that was on the commercial side of things, and then there was the project execution. 64 00:06:57,568.03515177 --> 00:06:59,338.03637247 And, and when you, when you, kinda... 65 00:06:59,638.04247598 --> 00:07:07,178.04339151 the overlap of those kind of muddies the water a little too much for the project team, so we just really wanted to focus on project execution. 66 00:07:07,178.04339151 --> 00:07:12,438.04552774 What's gonna, what's gonna impact the project, and don't worry about the commercial aspects of it. 67 00:07:12,438.04552774 --> 00:07:13,458.0498002 We'll manage that separately. 68 00:07:13,458.0498002 --> 00:07:28,848.0494998 So you were able to kind of like bifurcate the risk register that you received, and then focus, target more in on execution risk rather than get involved in maybe the more complex commercial risks, which might have been the bigger focus pre-FID anyhow. 69 00:07:28,848.0494998 --> 00:07:29,8.04934721 Right. 70 00:07:29,8.04934721 --> 00:07:29,638.05041532 That's smart. 71 00:07:30,308.04972868 --> 00:07:30,558.04972868 Yeah. 72 00:07:30,558.04972868 --> 00:07:51,668.04957609 You know, like it's public information that, you know, they're selling gas to Egypt, right? And it's almost like maybe some of that risk involving maybe geopolitical things is a different discipline in some respects than- Yes engineering risk, which maybe is a little bit more quantitative, like, and can be defined a bit differently. 73 00:07:51,668.04957609 --> 00:07:52,588.05155973 So that seems... 74 00:07:52,638.05079679 --> 00:07:52,918.04957609 yeah. 75 00:07:53,548.04988127 --> 00:07:54,908.05049162 I should probably back up. 76 00:07:55,48.04911833 --> 00:08:04,258.04362516 So maybe we can just define when we talk about project risk on a major project, can you kind of take us through a little bit of a 101 on that and just kind of get... 77 00:08:04,258.04362516 --> 00:08:10,618.04881315 give us a refresher even for the advanced project people? Because it's such a niche space, I think it's always good to go back and, and just learn. 78 00:08:10,618.04881315 --> 00:08:11,938.04850797 So tell, tell me about risk. 79 00:08:12,488.04393034 --> 00:08:21,758.0405734 What is risk? The ISO definition of risk risk is the effect of uncertainty on our objectives where that uncertainty is a deviation from what we expected. 80 00:08:21,918.03752165 --> 00:08:24,868.04209928 That's the textbook definition from a project perspective. 81 00:08:25,698.04393034 --> 00:08:30,128.04423551 So what that means is we have to consider all of the objectives of the project. 82 00:08:30,158.04301481 --> 00:08:35,198.03172331 What are we trying to do? You know, of course, CD cost schedule, and, and time. 83 00:08:35,838.03111296 --> 00:08:43,268.02378874 But it's most effective to boil those things down into what's the effect on the schedule, what's the effect on the cost. 84 00:08:43,818.02684049 --> 00:08:58,138.01890592 Yes, you'll find things that are, are effects on health and safety and environmental and all, but those, those are, are sometimes hard to kind of quantify, hard to mitigate and, sometimes again muddy the water around what are the objectives of the project. 85 00:08:58,138.01890592 --> 00:09:04,958.02623014 So focus on those objectives, identify what things could happen to prevent us from achieving those objectives. 86 00:09:05,398.02867155 --> 00:09:18,728.01829557 Or if something bad were to happen, what would we do to get it back on track to make that objective? So that, that is what risk management is just trying to make sure that we prevent the things that might not allow us to achieve the project objectives. 87 00:09:20,760.02439819 --> 00:09:22,180.02443724 And then does that also... 88 00:09:22,240.02437048 --> 00:09:36,970.02551489 so does risk also include the upside, managing that deviation from an expected outcome? And so that's, it's an interesting perspective because the COSO ERM framework says that your objective is your objective. 89 00:09:37,60.02566748 --> 00:09:41,530.02398901 If you come over or under that's, either of those is a risk and should be considered. 90 00:09:41,950.02520971 --> 00:09:53,990.02498083 W- whereas PMI and, and others, in essence, they say, you know, if you come over the, you know, like if your production target is 100 barrels and you come in at 150, that's an opportunity. 91 00:09:54,580.02513342 --> 00:10:06,950.02360754 But e- the, I, I kind of prefer the COSO perspective because it makes you think, "If I come over, you know, 150, can my production handle it?" So the COSO ERM is a good perspective. 92 00:10:07,400.02437048 --> 00:10:08,480.02620153 This is what we wanna get. 93 00:10:08,840.02681188 --> 00:10:12,480.02620153 If we go over, we have to consider what risks might occur there. 94 00:10:12,720.0240653 --> 00:10:39,428.031427 If we come under, we have to also consider, what risks could occur and what the commercial aspects of it are What I'm hearing is risk management is always has a time component in a way, 'cause it's like if we're at time T zero and you pick a point out here at T 10 or whatever and you, you also have this observer, a frame, where you're like, "By these mechanisms, this should be here." 95 00:10:39,848.03150329 --> 00:10:56,128.02936706 And then risk is saying what is the actual deviation from expected, like- So there's always an element of there's a time horizon that you have to be considering, and then you also have to be considering whose perspective are you looking at for that risk. 96 00:10:56,558.02967224 --> 00:11:00,548.03211364 Is there always one? We talk about risk registers, it's like that's your list of risks. 97 00:11:00,548.03211364 --> 00:11:06,58.03043518 You kind of have to have alignment, right? If, if people don't understand what the goal is, you can't really tell them the deviation from that goal. 98 00:11:06,318.03562316 --> 00:11:07,898.02982482 Right how do you... 99 00:11:08,228.03165588 --> 00:11:10,238.03379211 Is that the risk manager's job, or is that... 100 00:11:12,38.03226623 --> 00:11:13,408.03501281 you have to get beyond the bias. 101 00:11:13,408.03501281 --> 00:11:18,438.03379211 You talk through what the risks are, things that might occur and you often get the, "Oh, yeah, that'll never happen. 102 00:11:18,438.03379211 --> 00:11:19,738.03684387 I, we've never seen that." 103 00:11:19,738.03684387 --> 00:11:22,608.03959045 Or, or the opposite is, "Oh, we have to... 104 00:11:22,648.04050598 --> 00:11:26,518.03562316 You know, we need to order 12 extra valves because we're gonna have so many fail." 105 00:11:26,988.03989563 --> 00:11:29,178.04233703 So you, you kind of talk them through. 106 00:11:29,178.04233703 --> 00:11:35,638.0414215 The, the valve one is a good example where we had an engineer that said, you know, we're ordering eight or 10 or 12 valves. 107 00:11:35,638.0414215 --> 00:11:38,358.04264221 I don't know how many it was, but you know, we're talking about risk. 108 00:11:38,358.04264221 --> 00:11:39,278.04081115 He said, "Oh, yeah, the... 109 00:11:39,278.04081115 --> 00:11:43,138.0414215 It's an ex- extremely high likelihood that, that we're gonna, they're gonna fail. 110 00:11:43,328.04691467 --> 00:11:43,748.04508361 Very high." 111 00:11:44,268.04935608 --> 00:11:46,548.04813537 And so I said, "Well, okay, you know, we're putting this in the risk register. 112 00:11:46,548.04813537 --> 00:11:49,288.04599914 And it's gonna be at the top of the list if it's a very high likelihood." 113 00:11:49,338.04599914 --> 00:11:54,828.03928527 I said, "Okay, well, if you ordered 100 valves, how many of them would you expect to fail?" probably three." 114 00:11:55,248.03745422 --> 00:12:02,248.03745422 "Okay, that's a very low probability of, of that failure occurring, so, you know, we put it in at, at very low in the risk register." 115 00:12:02,248.03745422 --> 00:12:12,788.04599914 So it's about having that conversation and talking them through and, and making them think about is this really a risk or, you know, have I considered all the things that, that could occur. 116 00:12:13,628.04233703 --> 00:12:17,738.04294738 Well, maybe that gets into that term I think we've heard, a, a black swan. 117 00:12:17,838.0490509 --> 00:12:18,648.04660949 Like, how do you... 118 00:12:19,118.05088195 --> 00:12:21,278.05454406 so maybe t- talk about black swan. 119 00:12:21,278.05454406 --> 00:12:30,580.05319849 Is that actually in a defined ISO term, or is it just sort of something we've come up with? That it's so, outrageous that we can't... 120 00:12:30,850.05270258 --> 00:12:37,630.05357996 we shouldn't even consider it because there's nothing we could do about it if it occurred, and there's nothing we could do about to, to prevent it from occurring. 121 00:12:38,90.05380884 --> 00:12:39,480.05510584 But yeah, there... 122 00:12:40,250.0555636 --> 00:12:48,560.05045191 You have to focus on what you can control and what reasonably will impact the project, and that's the word that I use cannot reasonably occur. 123 00:12:48,830.05090967 --> 00:12:57,490.04999414 Otherwise we're, you know, we're gonna waste a lot of money and waste a lot of time thinking about things like, planes crashing and things that, are very unlikely to occur. 124 00:12:58,490.0492312 --> 00:13:16,970.05335108 So you did risk management for broad portfolio I believe for a large company, and you were managing small project risk and then really large project risk, and sort of how do you make risk economical? 'Cause I think sometimes as, like, an executive, you're gonna be looking at this saying, risk management... 125 00:13:16,970.05335108 --> 00:13:19,320.0518252 Like, the risks are probably gonna occur anyhow. 126 00:13:19,970.05335108 --> 00:13:25,400.05365625 I could spend millions of dollars trying to prevent that one in 1 million thing. 127 00:13:25,640.05914942 --> 00:13:27,430.05243555 You know, how do you properly... 128 00:13:27,490.0530459 --> 00:13:37,730.05090967 what's the right economic model to look at risk so that you're spending the right amount and being, you know, a, a good sort of steward of the funds of a project? What... 129 00:13:38,50.05060449 --> 00:13:52,610.03473535 How do you balance that? Every project is different, and one of the things that, I feel like some project teams get, twisted up on is that the company might have a global risk matrix or a corporate risk matrix, but the project has to have its own. 130 00:13:52,740.03961817 --> 00:13:56,650.04328028 And, generally, that's going to be in terms of the cost and schedule impacts to that project. 131 00:13:56,730.04205957 --> 00:13:57,760.04083887 You know, is it, is... 132 00:13:58,120.04144922 --> 00:14:18,290.04114405 Do you do the matrix at, you know, 10%, 25%, 50%, 75%, 100%, budget impact? That, that lets you frame that project in terms of its biggest risks and, you know, compare it to other projects of similar sizes or, you know, that a big risk on a million-dollar project might be $100,000, but a big... 133 00:14:18,560.03015772 --> 00:14:24,100.0417544 But $100,000 risk on a billion-dollar project is really, you know, has a different frame of reference. 134 00:14:24,100.0417544 --> 00:14:31,90.03504053 So, the risk matrix is the important way to differentiate big risks on different projects. 135 00:14:32,746.02954811 --> 00:14:41,276.0285849 And then you rolled out, I believe as well, as part of managing a global portfolio you rolled out a training program, is that right? So when you... 136 00:14:41,566.02873749 --> 00:14:44,346.02965302 but what would you say when you gave those... 137 00:14:44,726.02881378 --> 00:14:52,376.03033966 'Cause w- who was your audience with that? It was like project, project control managers, the engineers, you know, folks involved in the, the project. 138 00:14:52,376.03033966 --> 00:15:01,80.0298056 Like what- What do you think were some of the aha moments or things that you gave these people when you were doing risk training, in 2000? Yeah. 139 00:15:01,130.0298056 --> 00:15:03,320.03033966 We used the term risk champions. 140 00:15:03,360.03030151 --> 00:15:14,920.03091187 A- and what that meant was people who kind of understood and had an interest in knowing more about what project risk management looked like, that we could go out and teach them and then let them go do. 141 00:15:14,970.03091187 --> 00:15:16,130.03075928 So that worked really well. 142 00:15:16,180.03075928 --> 00:15:23,0.02877564 It's hard to do it all as a single individual, and risk management is all about everybody understanding how the whole process works. 143 00:15:23,0.02877564 --> 00:15:26,650.03228516 So we just tried to teach everyone that we could and find interested people. 144 00:15:27,320.0304541 --> 00:15:28,960.03060669 But, yeah, it was a variety of folks. 145 00:15:28,960.03060669 --> 00:15:32,850.02999634 Project controls, engineers, a lot of coordinators. 146 00:15:33,460.03060669 --> 00:15:49,240.03014893 So if somebody was listening to this and they were like, "I wanna set up something like that for my company," what would you advise them in terms of, like, leveling up risk? 'Cause it sounds like it's not just hire the perfect risk manager, it's actually something that has to be baked within the organization. 147 00:15:49,240.03014893 --> 00:15:52,350.03075928 It, sort of it organically, kind of like safety. 148 00:15:52,730.03564209 --> 00:15:54,820.03960938 You know, you don't get safe- you have to have a safety culture. 149 00:15:54,820.03960938 --> 00:15:57,630.03716797 It sounds like you worked on creating a risk culture. 150 00:15:58,90.0393042 --> 00:16:01,320.03503174 Yes how do you create that? It's just about getting in there and doing it. 151 00:16:01,320.03503174 --> 00:16:10,710.03991455 Like, get in and start a risk register and, you know, begin working through what that whole process looks like who should be involved. 152 00:16:10,710.03991455 --> 00:16:23,150.03625244 And the first risk workshop is the hardest, and after that it starts to become a little bit more mechanical and people know what they're expected to do, and you can do a lot of, prep work up front before you get into the workshop. 153 00:16:23,150.03625244 --> 00:16:29,400.03625244 So it's just a matter of getting in and starting to do it, and then making it better every chance you get. 154 00:16:31,70.03442139 --> 00:16:32,930.03503174 Okay, so risk workshops. 155 00:16:33,80.02892822 --> 00:16:35,240.03259033 Maybe we can go back to Leviathan real quick. 156 00:16:35,390.02953857 --> 00:16:41,140.0325903 I'm assuming day one you had a risk workshop to kind of, start that process. 157 00:16:41,678.0258756 --> 00:16:56,958.0255904 Maybe talk to, tell us the story of the first risk workshop on Leviathan or, like, how did, how did you create that process and So it was the first workshop, yes, it was a little awkward because it was kind of the first time that team had come together to talk about risk registers. 158 00:16:56,958.0255904 --> 00:17:04,478.0279555 And, the risk workshop, the whole idea is that everybody understands what those risks are and what they mean, even if they don't have anything to do with it and it's not their discipline. 159 00:17:05,38.0274214 --> 00:17:16,238.0258955 And so, you know, you have a lot of vocal voices and, y- that- that's half the role, is being able to kind of manage those personalities and, "Yeah, we'll ta- Yes, let's put that in the parking lot. 160 00:17:16,238.0258955 --> 00:17:17,448.02498 We'll, we'll take that offline. 161 00:17:17,448.02498 --> 00:17:18,558.0255904 We'll talk about it later. 162 00:17:18,868.025743 --> 00:17:20,538.0277266 Yeah, yes, that's a valid risk. 163 00:17:20,938.0292525 --> 00:17:25,938.0284895 Let's, we considered it and, here are the mitigations and here's why we don't think it's gonna happen." 164 00:17:26,418.0289473 --> 00:17:31,498.0269637 But then, you know, once the team is, is used to doing the workshop together, it goes pretty smoothly. 165 00:17:33,38.0278792 --> 00:17:34,958.0260481 So tell me about the personality management. 166 00:17:35,48.0300154 --> 00:17:35,468.0281844 Like, what... 167 00:17:35,588.0309309 --> 00:17:45,742.0265509 That's, that gets out of the comfort zone of the numbers and into something a little more- you know, probably a little more real about how real work gets done. 168 00:17:45,782.0265509 --> 00:17:46,152.0264365 Yeah. 169 00:17:46,652.0264365 --> 00:17:59,252.0278479 You know, It's, it's- Yeah it's back to the comment about the psychologist, right? Not only do you have to, manage the loud personalities, but you have to coach the quiet ones as well and, what the term they use is elicit risk. 170 00:17:59,402.0274664 --> 00:18:16,152.0296027 Get them to tell you what is it that they're thinking and then kind of understand that and present it back to them as the, "Are you saying that this could occur?" Or, "Are you saying that we need to do this?" So it's a lot of, working with people and people management tell me more about that. 171 00:18:16,272.0285345 --> 00:18:18,462.0271612 'Cause so you brought in people in the field. 172 00:18:18,492.0297552 --> 00:18:18,552.0273138 Right. 173 00:18:19,122.0270087 --> 00:18:23,882.0291449 So it wasn't just the corporate office, 'cause they're the ones that really are getting the project done. 174 00:18:25,372.0300604 --> 00:18:25,852.0296027 Me what... 175 00:18:25,932.0314337 --> 00:18:35,512.0227362 How was that? Yeah, and that's another big challenge you face is you've got these experts from the field which are necessarily there, but they don't wanna be there. 176 00:18:35,562.025788 --> 00:18:45,2.0151068 You have to be considerate of their time, do as much, upfront work as you can to make that meeting valuable the whole time they're there and meaningful the whole time they're there. 177 00:18:45,32.0138861 --> 00:18:47,842.0114447 And again, that also goes back to the, the people management. 178 00:18:47,842.0114447 --> 00:18:50,382.0123602 Don't let just the one person rule the whole meeting. 179 00:18:50,432.0163275 --> 00:18:53,912.0196844 We need to get all the opinions and have all the conversations. 180 00:18:53,992.0184637 --> 00:19:04,272.017243 One example, we went into a risk workshop and the leader of the entire group said, "You guys are here today to tell me why X is our biggest risk." 181 00:19:05,212.012055 --> 00:19:06,312.0181586 conducted the workshop. 182 00:19:06,422.0111395 --> 00:19:11,882.0178534 Everybody had their input, and X came out as the third-biggest risk from that group. 183 00:19:12,2.0129706 --> 00:19:20,732.0193793 So it's about having those conversations and everybody else understanding, w- what's his risk or her risk versus mine and my scope. 184 00:19:22,70.0199889 --> 00:19:29,530.0205039 So if you're facilitating a risk workshop, is there like, Is there some sort of like 80 people in a room talking about risk doesn't work? Is there... 185 00:19:30,0.0198173 --> 00:19:34,150.0213432 Like how do you prep the conversation? What's a good... 186 00:19:34,350.0201988 --> 00:19:40,420.021038 Is it like an hour, hour and a half? Like how do you do those? Yeah. 187 00:19:40,450.0198173 --> 00:19:44,570.0187492 Sometimes dependent on the, the size of the project and the experience of the people. 188 00:19:45,20.0195121 --> 00:20:08,860.0150871 What I find m-most useful, of course, what you always want to be able to do is to start from a lessons learned review, whether that's doing it yourself and going through and saying maybe these things apply to this project, and putting them into the risk register, and going and looking at similar projects and seeing what risks they identify or, or experienced, and-- but putting all those into the risk register. 189 00:20:09,270.0187492 --> 00:20:13,360.0227165 And then do as much as you can, upfront interviews with people. 190 00:20:13,390.0214957 --> 00:20:16,490.0199699 You know, give them a call and just say, "Hey, we're doing a risk workshop. 191 00:20:16,490.0199699 --> 00:20:18,0.0221061 Was wanting to get your perspective." 192 00:20:18,0.0221061 --> 00:20:23,790.030651 And, you know, try to get those individual perspectives ahead of the group meeting, and come with something to show them. 193 00:20:24,50.0251579 --> 00:20:31,420.0309562 You know, if you start off the meeting with all those personalities in the room and you got a blank screen and you say, "Okay, what are the risks?" You're, you're destined to fail. 194 00:20:32,50.0282096 --> 00:20:36,60.0333976 So w-we wanna have as much, work done upfront as you can. 195 00:20:36,650.0318717 --> 00:20:43,260.0346183 But so instead of starting with a blank, like everybody list your risks, one, two, three, four, you set up a lessons learned. 196 00:20:43,260.0346183 --> 00:21:00,790.041027 Is that usually around a risk that has triggered or, you know, something like that, so it's gets everyone disarmed to actually talk about risk? Or h-how-- what's the lesson that you share? The, the PMI guidance is that a lesson learned is a future project risk. 197 00:21:01,280.0343131 --> 00:21:07,340.02882 Part of your project, you should be capturing lessons learned on a regular basis and, writing them in a way that it's useful for a future project. 198 00:21:07,810.0300407 --> 00:21:16,800.0318717 And then to start a risk register to kick off a project, you would wanna go and look through the lessons learned from previous projects, especially those that are similar to the one that you're working on. 199 00:21:16,890.0312614 --> 00:21:19,340.0251579 That's always the best starting point if you can do that. 200 00:21:19,480.0245475 --> 00:21:21,590.0282096 Also, previous risk registers. 201 00:21:22,0.0318717 --> 00:21:32,820.0239372 One of the reasons I say don't delete a risk just because it's mitigated or it's no longer applicable, leave it in there and just say that it's closed out because somebody's gonna need to review that sometime in the future. 202 00:21:33,440.02882 --> 00:21:35,970.0245475 You know, that technically would be a lessons learned review. 203 00:21:36,660.0312614 --> 00:21:49,642.053811 So that's a lot of what the homework is to lead up to the workshops And so you said the, the, on Leviathan, the workshop- the first workshop was, was obviously rocky 'cause you're just getting everything started. 204 00:21:49,642.053811 --> 00:22:03,382.0528573 And I imagine myself, let's say I'm a risk manager listening to this podcast, and I just got on a billion-dollar job, and I'm thinking about, what, what do I need to do here? One question I would have is I think everything usually has, like, a rhythm. 205 00:22:03,672.0537729 --> 00:22:11,62.0531625 You know, when you look at, like, risk, safety, you know, any function within an organization, there's sort of like a sine wave of activity. 206 00:22:11,102.0521707 --> 00:22:18,412.0516366 And it seems like those meetings and that sort of regular risk management process is kind of that, that flywheel. 207 00:22:18,592.0511789 --> 00:22:39,446.051465 What's the frequency that you might wanna do it, like monthly, quarterly? What are those activities that help anchor good risk discipline? I'll say, the, the easiest way to dovetail a risk review in is to kind of piggyback on a cost or schedule review, or a cost and schedule review if you can do that. 208 00:22:39,856.0513124 --> 00:22:40,716.0500154 They're all related. 209 00:22:40,836.0508546 --> 00:22:46,426.0510072 And it's easiest since you already have that team assembled to do that review to say, "Hey, let's, let's do risk review after that." 210 00:22:46,636.0500917 --> 00:22:47,46.0499391 Okay. 211 00:22:47,706.0497865 --> 00:23:01,176.0471925 And then how do you deal as the project psychiatrist during that? You know, 'cause cost review, schedule review, oftentimes I find people don't want to identify r- I, I... 212 00:23:01,616.0496339 --> 00:23:19,516.0473451 risk is one of those things that, like you said, there's the quiet folks in the room, but like people oftentimes don't wanna surface risk 'cause there might be political problems with surfacing a risk, and it's actually easier in their world to like let that risk ride, and if it triggers then it's just like, "Hey, this happened." 213 00:23:19,866.0534486 --> 00:23:30,26.0571107 How do you break through that and sort out the political consequences of like raising a risk for someone? 'Cause I think that sometimes keeps the risks unsurfaced. 214 00:23:30,946.0552797 --> 00:23:53,566.0549745 Like do you address that specifically or is that an organic thing? Like, how do you surface risk given that it can create political problems for other people? Maybe it's like, "Why did we ever even order these types of fasteners? Like, who would order something that could rust in, in a storm?" You know, it feels like sometimes risk turns into a witch hunt, and people don't wanna be the one to kick off the hunt, so to speak. 215 00:23:54,396.0568055 --> 00:24:05,906.0513124 What I will say at Noble, w- one thing that their drilling group did an excellent job of was a lesson learned review is not a finger-pointing session, and so everything is on the table. 216 00:24:06,576.0494813 --> 00:24:08,286.0592469 And they're, they were really good at that. 217 00:24:08,286.0592469 --> 00:24:17,376.0555848 And so we, we kind of piggybacked off of that in projects to say, "Look let's implement this really good lessons learned program, and just put everything out there." 218 00:24:17,836.0500917 --> 00:24:26,116.0214051 Once people understood it they knew, yes we c- we're finding faults and things, but w- this is good because we're gonna prevent it from occurring again. 219 00:24:26,196.0354432 --> 00:24:30,746.038495 Yeah, it's, it's again back to the people management aspect of, of getting people to, to talk. 220 00:24:31,136.0378846 --> 00:24:41,306.0360536 And it also, you know, the, the prep t- that you do ahead of time, if you can have a one-on-one with somebody you're more likely to get something like that and say, "Well, here's how we're gonna address it in the big group session." 221 00:24:42,794.0311699 --> 00:24:57,384.0310945 Is there, on a large project, is it that anything that deviates from the expected is either a risk that was documented or a risk that you never knew about, but it all kind of fits into risk in a way? Is that... 222 00:24:58,64.0313997 --> 00:25:11,60.0323533 Because I, I guess m- my question is, what do you do about those risks where something happened in the field and it caused, you know, 1,000,005- deviation on the project, you find out about it. 223 00:25:11,90.0323247 --> 00:25:12,850.0323152 It's, it has nothing to do with the risk register. 224 00:25:12,850.0323152 --> 00:25:15,260.0321626 It was, but it's not a black swan. 225 00:25:15,590.0320863 --> 00:25:27,960.0310182 Like, is there some cleanup activity you have to do to kind of be like, "Okay, this actually was a risk we never caught"? How do you surface those? Like, how does that play in? It's the known unknowns versus the unknown unknowns. 226 00:25:28,180.0314759 --> 00:25:36,420.0331544 It's just that you, you do as much work upfront as you can to try to identify what types of those things might occur. 227 00:25:37,60.0325441 --> 00:25:50,540.0363588 You know, we talked about in the, in the Mediterranean, we had a, a survey go through where the, you know, where the, one of the pipelines was supposed to be laid, and they found some ancient jugs on the, on the sea floor, right? Yeah. 228 00:25:50,980.0349855 --> 00:25:55,540.0363588 But you do the survey for a reason, and so you, you might carry some of those risks just in case. 229 00:25:56,280.0342225 --> 00:26:01,0.0392579 So, it's about thinking through, you know, what, what might go wrong with each of the activities that we have planned. 230 00:26:01,540.0401735 --> 00:26:10,970.0404786 And again, will it truly impact our objectives? We could have a delay and, piece of equipment arriving, but it doesn't impact the schedule. 231 00:26:11,80.0365113 --> 00:26:12,720.035901 It doesn't change our start-up date. 232 00:26:12,920.0404786 --> 00:26:15,760.0368165 So okay, it was delayed a week, that's okay. 233 00:26:15,840.0355958 --> 00:26:26,310.0261354 We might have some cost impact of that, carrying cost or time delay or whatnot, but it doesn't impact the objectives of the project, so it might not be as big of a risk as it sounds. 234 00:26:27,120.023694 --> 00:26:31,30.0197267 Okay, so maybe this gets into Monte Carlo and things like that. 235 00:26:31,450.0178956 --> 00:26:45,410.020337 But maybe you can talk about that, 'cause how do you actually, when you get down to brass tacks and you say, "Okay, what's the impact?" How do you quantify that? How does Monte Carlo fit in? What is Monte Carlo, Monte Carlo is a very interesting approach. 236 00:26:45,450.0212526 --> 00:27:18,790.0297975 If you think of it just at its at the core, if you have an activity and you have a 50% chance of finishing up on a day, and there's a dependent activity that you have a 50% chance of finishing it on, on, on time, you only have a, a 25% chance of meeting that, that schedule, right? So that's kind of what Monte Carlo is, is it says all these activities that you have in here, you've said that you've got a 10% chance of a risk occurring here, a 5% chance here, 25% chance here. 237 00:27:19,110.0218629 --> 00:27:33,356.025525 It goes through and- Does a thousand iterations of that schedule or that budget and says, "Okay, 10 of 10 of these or, you know, 100 of these, we're gonna apply this risk, and 200 of these we're gonna apply this risk." 238 00:27:33,766.0253724 --> 00:27:41,736.0244569 And then it cycles through the thousand iterations and says, "Okay, you have a 50% chance of meeting this number or this date." 239 00:27:42,346.0250673 --> 00:27:53,116.0236177 And so, The company has to make a determination whether they go with, that 50% chance number, the P50 as we call it,, or something more conservative like a P75. 240 00:27:53,116.0236177 --> 00:27:58,306.0222444 We have a 75% chance of coming in with this result, and therefore we're very confident we'll be within that. 241 00:27:58,916.0228547 --> 00:28:27,446.0192394 So the Monte Carlo just takes your cost estimate or your schedule estimate, runs through 1,000,, or, a count of your choosing iterations of that and applies the risks that you've identified where you've said they might impact that budget or schedule Do you do the Monte Carlo monthly or is that really pre-FID before you're making your final decision, you get that P50 and you're like, "That's good enough"? Like, how often- Yeah. 242 00:28:28,606.0190868 --> 00:28:37,306.0188961 Y- yeah, let me, let me back up a little bit and say Monte Carlo is most effective on large to very large projects. 243 00:28:37,816.018362 --> 00:28:45,756.0158443 A very small project, Monte Carlo is not nearly as effective, and you're not gonna get you know, the accuracy of the results that you would want to have. 244 00:28:46,276.0193539 --> 00:28:51,416.0187435 For smaller projects, we have the PERT method, the Pro- Program Evaluation Review Technique. 245 00:28:51,846.0182857 --> 00:28:53,846.0182857 That's what I recommend for smaller projects. 246 00:28:53,846.0182857 --> 00:28:55,596.0173702 Oh how do you present it? Yeah. 247 00:28:55,706.0179806 --> 00:29:08,926.0192013 So the inputs to a good Monte Carlo are an accurate up- updated budget or forecast, an accurate and updated schedule, and an accurate and updated risk register. 248 00:29:09,466.0201168 --> 00:29:13,616.0216427 So, you know, if you're doing those things monthly, you can run your Monte Carlo monthly. 249 00:29:14,386.0182857 --> 00:29:21,866.0262203 But Monte Carlo is, you know, you're typically talking about a very long timeline of the project, so you might not necessarily need it every month. 250 00:29:22,106.0240841 --> 00:29:26,56.0286617 So we, what we did on Leviathan was we did it approximately every quarter. 251 00:29:26,566.0231685 --> 00:29:30,46.0265255 We would update the Monte Carlo every month, but we would only present it every quarter. 252 00:29:31,26.022253 --> 00:29:31,456.0225582 Okay. 253 00:29:32,46.0265255 --> 00:29:38,166.0216427 And then when you say present, so risks are interesting, right? Because they I think oftentimes they can go all the way up to the board level. 254 00:29:38,396.0249996 --> 00:29:43,836.0283565 So you're surfacing a risk- down at this tiny little spot, and then it sort of bubbles up the organization. 255 00:29:44,166.0225582 --> 00:30:01,246.0060787 How does that work for, like, Leviathan, you, as the risk manager, do you present to, like, the project director, and the project director then presents up the chain? Is that typically how risks are surfaced, the project manager, project director, you know, they ultimately own all the risks. 256 00:30:01,276.004858 --> 00:30:06,506.0158443 You know, the risks should be individually owned by the people who are working to, to mitigate or close them out. 257 00:30:06,906.0097408 --> 00:30:09,66.0103512 But the project manager has final say on that. 258 00:30:09,66.0103512 --> 00:30:15,166.0298824 And so, yeah, we prepare the documentation for the project manager to present those items and those risks. 259 00:30:15,596.02561 --> 00:30:31,294.0124867 And then separately the risks that are assigned to people you know, as the risk lead, you're responsible for getting those updates from those people and making sure that, that the project manager is in alignment You're working, let's say Leviathan, right? So you've got your team. 260 00:30:31,374.0124104 --> 00:31:10,704.0198109 There's above you the risks are percolating kind of up through the org, right? Right there's also this sort of corporate b- barrier on big projects where a lot of times you have contractors that are doing major scopes of work, and so they have, how do you surface them from that part? 'Cause then you get this sort of like corporate boundary line, and those risks, like, how do you manage contractor risk, basically? Do you enforce it in the contract, or how does that work? What we tried to do is we would go directly to them, meet them at their office and tell them what we were doing, that we wanted to do a risk workshop with them. 261 00:31:10,704.0198109 --> 00:31:14,744.0169118 Could they bring what- whatever they were working from, whatever their risk registers were. 262 00:31:15,294.0199635 --> 00:31:23,554.0182851 And, you know, if, if we found deficiencies, we would just coach them and work with them to get them to do things the way that we preferred. 263 00:31:24,104.0196584 --> 00:31:30,194.0147755 But we found that most of our big contractors like that did have a risk management function and they were willing to meet with us to do that. 264 00:31:30,284.0156911 --> 00:31:34,4.0169118 So the risk manager is kind of a social animal, would you say, Lots of meetings. 265 00:31:34,684.0172169 --> 00:31:43,804.0254567 Yeah, and what's the right way, to approach those things? Because I feel like you can kind of be the almost like the tax man as a risk per- Feels like there's a few buckets. 266 00:31:43,844.0263722 --> 00:31:55,174.0205739 Either it's like, "Is this person helping me? Is this person draining my time?" Or, "Is this person going to get me?" And I feel like risk managers or risk conversations could fall into any of those buckets. 267 00:31:55,174.0205739 --> 00:32:08,554.0184377 So how do you disarm folks to have, to see you as like a helpful, good guy versus other- You know, my favorite, icebreaker is, you show up for a first meeting and say, "I'm from corporate. 268 00:32:08,584.0248463 --> 00:32:09,434.0233205 I'm here to help." 269 00:32:09,704.0199635 --> 00:32:11,744.0208791 And, you always get a bunch of laughter. 270 00:32:11,774.0208791 --> 00:32:12,944.0114186 Everybody finds that one funny. 271 00:32:12,944.0114186 --> 00:32:31,438.0183416 It's like I acknowledge that it, you guys don't wanna be here and you don't wanna hear from me, but, let's get through this and, and hopefully we'll see that we're adding some value to this activity So 'cause you're a personable guy, what can people do to work on those soft skills, do you have advice for someone that... 272 00:32:32,358.0184179 --> 00:32:40,848.0195242 'Cause it almost sounds like, a sort of math and science discipline of risk, and then there's this sort of social soft skill of risk. 273 00:32:40,848.0195242 --> 00:32:41,808.0186086 Like, how do people... 274 00:32:41,978.0186849 --> 00:32:47,178.0183035 The math and science, it's like ISO 3100, right? 30- Yeah, 31,000. 275 00:32:47,438.016625 --> 00:33:03,108.0147939 And then, but how do you develop the soft skills? Or are those in the ISO docs or, like, what do you recommend there? They're not in the ISO docs and, there's not a lot of very specific guidance in those frameworks, right? So, honestly I think it's, just a matter of getting your feet wet. 276 00:33:03,188.0158621 --> 00:33:04,38.0143362 Get in there and do it. 277 00:33:04,588.0173879 --> 00:33:19,918.019219 And yes, the first meeting and the first run-through is gonna be a little bit awkward people are kinda figuring out what you're doing, but after a couple of iterations it'll be a lot more natural and, everybody'll know what each personality is and it just gets easier. 278 00:33:19,918.019219 --> 00:33:22,268.0176931 So just get started, get going. 279 00:33:22,308.0186086 --> 00:33:23,318.0207449 It gets easier as you go. 280 00:33:24,238.0189138 --> 00:33:34,558.0216604 What's the one personality that's the most difficult, you would say, that you have to, like, manage right off the bat for risk? It's one end of the spectrum or the other. 281 00:33:34,558.0216604 --> 00:33:51,398.0155569 It's the everything is bad and is going to happen and you need to put 15 risks in your risk register for me, or none of that'll never happen so don't even put it in there, right? And you have to kinda talk them off the ledge and try to explain to them is why we're doing this. 282 00:33:51,398.0155569 --> 00:33:52,368.0091482 This is what we need to capture. 283 00:33:52,368.0091482 --> 00:33:57,508.0161672 It's not just about you, it's about future projects the project manager wants this, and report to the board." 284 00:33:57,508.0161672 --> 00:34:05,457.9987722 And so it's a, coaching and influencing activity for the ones that just kinda don't get it or, have an extreme view. 285 00:34:06,557.9972463 --> 00:34:08,767.9963308 So it sounds like there's sort of two ends of the spectrum. 286 00:34:08,767.9963308 --> 00:34:18,527.9938894 There's sort of the Pollyanna people, and then there's sort of this dooms- doomsayers, and Exactly sort of the center to moderate. 287 00:34:19,327.9969412 --> 00:34:19,667.9932791 Yeah. 288 00:34:20,77.9999929 --> 00:34:30,848.0042654 And th- those two are the ones that it's sometimes better to go meet with them in person out of the workshop and try to, you know, head off any of those types of outcomes. 289 00:34:32,354.0085378 --> 00:34:38,734.0085808 We've talked a ton about the soft skill, the, process of risk, things like that, kind of approaches. 290 00:34:39,404.008657 --> 00:34:43,394.0089622 One piece that I would love to get your perspective on is technology. 291 00:34:43,844.0097252 --> 00:34:45,824.0092674 I always say it's process before tool. 292 00:34:45,824.0092674 --> 00:34:47,304.0088096 We have discussed the process. 293 00:34:47,644.0089622 --> 00:34:56,474.0107933 But what's the role that good technology plays in risk management? And I guess I mean that from the, you were in the software side. 294 00:34:56,474.0107933 --> 00:34:59,424.0096489 You said you had a really great risk platform. 295 00:34:59,424.0096489 --> 00:35:07,24.008123 Like, how do you implement good technology solutions that actually help with this situation? Yeah. 296 00:35:07,504.0076652 --> 00:35:10,574.0073601 You know, it, it's, a- again, to go back to one is greater than zero. 297 00:35:10,574.0073601 --> 00:35:14,794.0098015 Having a risk register is i- infinitely better than not having one at all. 298 00:35:14,824.0085808 --> 00:35:24,24.0093437 And so, the s- somewhere far down the list is the what tool do you use? But the, the top of the list is create a risk register. 299 00:35:24,104.0111747 --> 00:35:24,414.0087333 That's it. 300 00:35:24,994.0105644 --> 00:35:32,284.0076652 You know, obviously Excel lends itself really well to doing that because you can, you specify what columns you want in the, in the spreadsheet. 301 00:35:32,814.0064445 --> 00:35:40,854.0073601 The main thing is to keep it simple for the, for especially for risk reviews and especially for the project teams and te- the leads. 302 00:35:41,374.0040031 --> 00:36:05,524.0064445 Keep it simple because, a fancy, complex tool sitting around a workshop is a, a big waste of their time, keep their time reviewing risks to focusing on exactly what they're supposed to be looking at and not, these, these big fancy, what's the risk velocity and what's the, we got a variety of other things that a lot of risk tools do that aren't necessary for a project. 303 00:36:06,24.0064445 --> 00:36:17,463.9948478 These very involved scientific risk studies, and risk reviews like failure mode effects analysis security vulnerability analysis pick one, HAZOPs, HAZIDs. 304 00:36:18,183.9960685 --> 00:36:28,263.9902702 Those are very specific and very detailed and very engineering-oriented, and they are not suited for project risk registers. 305 00:36:28,313.9902702 --> 00:36:32,143.9921013 The project risk register is the simplest form of risk review that exists. 306 00:36:32,143.9921013 --> 00:36:34,763.9872184 It's very basic, focused on project objectives. 307 00:36:34,763.9872184 --> 00:36:44,373.9750451 So you wanna use the simplest tool you can, especially when it comes to doing the reviews and workshops But you had a tool that you said was one of the best in the industry. 308 00:36:44,373.9750451 --> 00:36:53,433.9754361 Like, what was that doing that was so cool? That one was, was pretty cool because it did all of those methodologies in one single platform. 309 00:36:53,623.9750165 --> 00:37:01,833.9742917 So, we actually ended up using it and kind of customizing it a little bit to make it super simple for project risk registers. 310 00:37:02,253.973605 --> 00:37:10,753.9716977 But we would in many cases export that from that tool for a review because we only wanted a few fields from that risk register, while we were doing the review. 311 00:37:10,753.9716977 --> 00:37:14,93.9718503 So yeah, that's where the technology is important because you... 312 00:37:14,573.9752072 --> 00:37:32,1.9734518 if you choose too complex of a tool and it's too difficult to do that export and review or, you know, put it in a PowerPoint even then it just won't get done and it won't get updated and, and, you know, you'll have bad data in there So that was really like a point solution for people that were specialists. 313 00:37:32,321.9731466 --> 00:37:46,61.9748251 But when it actually came to communicating risk or trying to, like, assign s- like workflow related stuff was better managed in Excel rather than- Right having 20 people have a login to a risk tool that they have to, like, organize their risks in and all of that. 314 00:37:46,601.9757406 --> 00:37:47,431.973757 Exactly, yeah. 315 00:37:47,481.973757 --> 00:37:47,841.9743673 Okay. 316 00:37:48,521.9746725 --> 00:37:57,411.9740621 And did you find that was also the case when you were doing sort of a, a enterprise-wide multi-project portfolio as well, that you kind of allowed people to... 317 00:37:57,801.9734518 --> 00:38:11,511.976351 Did you roll a tool out for that, or did you also just kind of allow people to, to work one at a time? Y- we did roll a tool out, and by keeping it simple and training those risk champions in the various areas, we were able to drive usage of it, yes. 318 00:38:11,621.9743673 --> 00:38:18,341.9679586 But having those, those point contacts, risk champions, people who understood the process out in the field, that was very valuable. 319 00:38:19,231.9673483 --> 00:38:43,761.9517843 And was it like for that particular case, did you start with the training and then get the tool in place afterwards? Or was it like, "Here's a new tool," and you trained as you introduced the tool? There's always this kind of question of does it help to have a system kick off? We had the tool had it rolled out ahead of time but realized that we weren't getting the adoption that we wanted, which is when we developed the training to teach them the process. 320 00:38:44,131.9545309 --> 00:38:45,761.9517843 "And by the way, here's a tool you can use." 321 00:38:46,741.9551412 --> 00:38:47,191.9520895 Okay. 322 00:38:48,151.951174 --> 00:38:53,821.9557516 And then you and I have talked a little bit just to like zoom out, 'cause I feel like we're sort of, we're starting to go further out. 323 00:38:54,311.9566671 --> 00:39:04,761.9490377 I think you had, talked about how risk has been around for tens of thousands of years, that there's a,, a book that you recommended which maybe you could talk a little bit about. 324 00:39:04,761.9490377 --> 00:39:07,531.9456808 But when you actually get down to it, like risk is a very... 325 00:39:08,381.9517843 --> 00:39:14,251.942629 is something that humans have been dealing with for many of years, and now it's kind of sitting in ISO for projects. 326 00:39:14,671.940798 --> 00:39:33,515.9463093 Where do you see risk? What do you see as the, like, history of risk? Maybe you can teach us a little bit about that, and then where do you think risk as a discipline is going in the future? Once you have that risk management mindset, it kind of gives you a different perspective of things. 327 00:39:33,595.9460423 --> 00:39:42,295.9419987 It said something about how the lifecycle of a jet, it's, like 25 years for passenger service, after which it's only for cargo. 328 00:39:42,825.940778 --> 00:39:44,895.9442875 It's like, that's a risk mitigation. 329 00:39:45,125.9438298 --> 00:39:54,925.9384892 We're not gonna kill 300 people, we're only gonna kill two, you know? So you have a different perspective on life when you think of it from a risk management, aspect. 330 00:39:55,575.9392521 --> 00:40:00,335.9375737 But the book was the title is Against the Gods: The Remarkable Story of Risk. 331 00:40:00,925.9377263 --> 00:40:17,545.9328434 And it's very interesting because it talks about some of the early philosophers and how they loved to gamble because they understood what the odds were, and they were all about taking these low probability, high impact risks, gambling, trying to win something. 332 00:40:17,855.930402 --> 00:40:19,685.9322331 And, that's not all the book is about. 333 00:40:19,685.9322331 --> 00:40:20,675.9377263 It's a fascinating book. 334 00:40:20,725.9377263 --> 00:40:28,245.9419987 One of the things that I say is that the AI that we're using in 5 years or 10 years is going to be reading the data from today. 335 00:40:28,395.938947 --> 00:40:40,845.9358952 And so I feel like where risk management is going is leaning on AI to help us figure out what we need to be doing to avoid risks, not only in the project world, but, you know, broadly. 336 00:40:41,415.93559 --> 00:40:55,593.9331963 And I think that AI, but just like everything else is going to help with that focus on risk management and history and what has happened and good outcomes and bad outcomes, and how do we prevent that? How do you see... 337 00:40:55,673.93312 --> 00:41:31,673.935838 Is risk, like you run your Monte Carlo and then you also run your LLM,, is it sort of a new category of risk identification and forecasting? Like, how do you see this AI tools intersecting risk, like in a practical way? I think Monte Carlo was maybe sort of a rudimentary early, application of AI, right? Where it's saying we have the compute power to go through these cycles of, of trying to forecast what, what you think might happen. 338 00:41:32,323.9335492 --> 00:41:35,53.9330914 Whereas AI, I think would be a little... 339 00:41:35,393.933244 --> 00:41:48,193.9286663 will be, better at saying over the course of the life cycle of the project, you know, these things did or didn't occur, and therefore your Monte Carlo is changing in this way, or your potential outcomes are changing. 340 00:41:48,193.9286663 --> 00:42:01,405.9327236 And I think AI will outpace Monte Carlo as an approach to, you know, the, the potential outcomes of a project AI is like a super Monte Carlo. 341 00:42:01,545.933067 --> 00:42:15,225.9342304 Right markov chains are kind of like, chained together tokens where you're like, "This is probabilistically connected to this, that's connected to this," and then you zoom that up into trillions of connections. 342 00:42:15,655.9326283 --> 00:42:26,165.9347645 And so that's kind of like if you took your risk register and then you broke it into tokens, which would be like words, and then had probabilities that... 343 00:42:26,415.9347645 --> 00:42:44,485.9344593 You know, instead of Monte Carlo having a schedule that has like 10 dependencies that it's running it on, an LLM is looking at those tokenized values and running it against trillions of connected points to like suss out probabilistic outcomes. 344 00:42:44,485.9344593 --> 00:42:49,165.9347645 So it really does seem like, yeah, maybe it is like a super Monte Carlo in a way. 345 00:42:49,215.9347645 --> 00:42:59,665.9385792 Yeah, and the Monte Carlo is very dependent on the quality of the inputs, whereas with AI I feel like, you can be a little softer on that quality and still have a good outcome. 346 00:42:59,665.9385792 --> 00:43:05,755.9394947 And also I think it's easier to look across other projects with an LLM than it is to, today's software. 347 00:43:06,885.9397999 --> 00:43:12,155.936443 Do you see as the downside of this AI in risk? Obviously hallucinations, things like that. 348 00:43:12,155.936443 --> 00:43:21,725.9361378 Is there some dangers that the future holds? I still think for a lot of project scope y- you have to have the expert opinions. 349 00:43:21,825.9376637 --> 00:43:26,445.9425465 AI can do a lot but, you need people who have the experience and, and have been through it. 350 00:43:27,75.9385792 --> 00:43:37,505.9388844 I don't think for some project disciplines that there is a, you know, near to midterm risk of anything going away for, for them. 351 00:43:37,545.9397999 --> 00:43:46,685.9489552 I believe those skills and experiences are, are important to have, and the- it'll be a, a long time before those are impacted by AI in my opinion. 352 00:43:48,381.9471337 --> 00:43:49,191.9470764 So what's your... 353 00:43:49,241.9472672 --> 00:44:00,711.947744 Are you thinking we're probably 50 to 100 years away from just robots building everything and doing their own risk registers and- Once we're fully globalized, right? I say that because who knows what the future holds. 354 00:44:00,711.947744 --> 00:44:07,41.9476677 I mean, just the last couple of years of technology, you know, seems like w- we've made some pretty big leaps. 355 00:44:08,261.9481255 --> 00:44:13,761.9511772 Let's say that I'm a project director and I just hired a risk manager for a mega project. 356 00:44:14,711.9519402 --> 00:44:40,777.9516069 What advice would you give that project director to enable that risk manager and get their risk going? Like, what am I doing to help the risk situation? If that person is starting from scratch obviously we need to know wh- who to talk to make those connections, establish those relationships, get to know the leads of the various disciplines that'll be working on the project, if those are known at the time. 357 00:44:41,327.950844 --> 00:44:44,747.9490129 But yeah, certainly develop those relationships as early as possible. 358 00:44:45,747.9490129 --> 00:44:46,37.9499284 Okay. 359 00:44:46,37.9499284 --> 00:44:48,327.950844 I'm vice president of this company. 360 00:44:48,617.9479448 --> 00:44:50,967.9502336 We're gonna take on this mega project. 361 00:44:51,27.9477922 --> 00:44:53,877.950081 We just FID'd or we're a little bit into it. 362 00:44:54,127.950081 --> 00:45:04,717.9502336 How do I know if risk is actually being managed well? What are the signals that I could see where I'm like, "We probably have a risk problem we need to, like, figure it out," or, "This is excellent. 363 00:45:05,127.950081 --> 00:45:17,117.937874 Risk is running really well in my organization"? What would you advise someone like that to look for? As long as they are very well aware of the risks of their various projects, I would say it's running well. 364 00:45:17,147.9366533 --> 00:45:26,497.9427568 One of the main things that I encourage people to do is to describe Risk in a way that it can be understood by someone who has nothing to do with the project. 365 00:45:27,67.9424516 --> 00:45:27,597.9412309 Okay. 366 00:45:28,617.937874 --> 00:45:35,567.9271928 So, they need to understand exactly what that risk is, not just $10 million. 367 00:45:35,567.9271928 --> 00:45:42,357.9281084 We have to say what that risk is and it has to be described in a way that is meaningful for outside parties. 368 00:45:43,537.9284135 --> 00:45:43,847.9259721 Okay. 369 00:45:43,937.9299394 --> 00:46:06,37.9284135 So if I'm an executive and I'm, I'm s- looking at this project and I get the risk register out, and it's highly technical stuff where I'm like, "I could not hand this to an investor or somebody else, and they would have no idea what's going on here," that's probably- Correct a flag that you wanna you wanna take a harder look at risk and, and maybe level up a little bit for the organization. 370 00:46:06,507.932686 --> 00:46:18,57.920479 Absolutely what if I'm on a project and I wanna be I'm like a scheduler or an engineer or someone in the field, and I wanna be good for the risk manager. 371 00:46:18,57.920479 --> 00:46:50,757.9176513 Like, what advice would you give them to support this new risk manager that started, Always analyze inputs into your, your cost or your schedule with a little bit of skepticism, and ask questions to try to make sure that you as a, as the scheduler or, or as the, cost control person, also buy into that result and, and you know what the risks are, and you know that they have been identified and/or mitigated. 372 00:46:51,207.9184143 --> 00:46:51,487.9210083 Okay. 373 00:46:52,297.9185669 --> 00:47:06,917.9283325 And then I guess one last thing if I'm starting a new project, should I insource or outsource risk? What's the, what's the cost benefit on that? Because a lot of big orgs, they just sort of have a outsourced risk function, and some people bring risk in-house. 374 00:47:07,357.9269592 --> 00:47:14,117.9290954 Do you have a strong preference or opinion on that? I found it to be pretty effective to be insourced. 375 00:47:14,357.9269592 --> 00:47:17,267.9229919 Obviously, not everybody can or, or wants to do that. 376 00:47:17,297.9217712 --> 00:47:23,577.9281799 And certainly with risk management, if it's not very well understood in the organization, it might be more effective to outsource it. 377 00:47:25,17.9229919 --> 00:47:30,107.9300109 Certainly I, I have a little bit of a bias that I can recognize there that, it worked really well by insourcing it. 378 00:47:30,637.9287902 --> 00:47:53,757.9269592 But I, I would just say, you know, again, a- a- all of those key things, making sure that, that whoever the person is that's doing it, especially if it's outsourced, that you know that they're meeting with those key, individuals, key contractors, discipline leads, having regular meetings, having regular updates, and describing risk in a way that your organization can understand it, not just the risk manager. 379 00:47:54,307.9223816 --> 00:47:56,127.9220764 Y- you can have success either way. 380 00:47:57,757.9193298 --> 00:47:58,27.9236023 Okay. 381 00:47:58,727.9205505 --> 00:48:22,103.9201507 Is there a single takeaway that you would love for someone to get from our conversation? What do you think is the most important thing or one of the most important things that you'd like them to remember or that we could highlight? I would say there are a couple of key concepts in risk management that have always stuck with me. 382 00:48:22,103.9201507 --> 00:48:26,423.921524 One of them I, I said a little bit ago a lesson learned is a risk on a future project. 383 00:48:26,463.9205322 --> 00:48:28,953.9203033 I feel like lessons learned are extremely important. 384 00:48:29,483.9209899 --> 00:48:36,983.9209899 Whether you call them that or not, you know, even an old risk register is a lessons learned register, right? You've captured a number of lessons learned there. 385 00:48:36,983.9209899 --> 00:48:40,413.9193878 So, risk, lesson learned is risk on a future project. 386 00:48:40,993.9212188 --> 00:48:48,753.9195403 And then another one that I found in an old Navy training slide deck was change is the mother of all risk. 387 00:48:49,963.9224395 --> 00:48:50,73.9192352 Okay. 388 00:48:50,73.9192352 --> 00:49:05,193.9190826 And if you think about that, as a concept, a lot of times when you have bad outcomes, it can be traced back to some kind of a change or a decision or something that we did differently than we had originally planned. 389 00:49:05,853.91893 --> 00:49:16,156.917037 And so anytime there's any talk of change, that, that should be a risk conversation change is the mother of all risks. 390 00:49:16,506.9169416 --> 00:49:21,136.9174947 It, kind of gets back into how time is always required for risks. 391 00:49:21,136.9174947 --> 00:49:21,356.9177617 Right. 392 00:49:21,726.9176473 --> 00:49:22,176.9174566 Yeah. 393 00:49:22,356.9177617 --> 00:49:22,536.9171132 Yeah. 394 00:49:22,736.9169225 --> 00:49:23,76.9170751 It's... 395 00:49:23,526.9170751 --> 00:49:28,266.9168462 and the, and the whole CUSO concept, right? This is your outcome, and any deviation from that is a risk. 396 00:49:28,906.9181432 --> 00:49:29,286.917304 Yeah. 397 00:49:30,186.9169225 --> 00:49:49,36.9153966 So what advice would you give if someone's listening to this and they're in college and they wanna go become a risk manager? Do you have advice for someone that might be pursuing a career? Just keep in mind that project risk management is the simplest form of risk methodologies that exists. 398 00:49:49,96.9129552 --> 00:49:59,966.9149389 It's very basic, that the simpler you approach it, the more success you'll have and the easier it will be to replicate that success over time, especially over the life cycle of a project. 399 00:50:00,486.9153966 --> 00:50:01,306.9150915 Keep it simple. 400 00:50:01,616.9147863 --> 00:50:07,736.9137182 Don't overanalyze the, all the Google results that are out there that tell you what project risk management should be. 401 00:50:07,736.9137182 --> 00:50:08,896.9173803 It's, it's very basic. 402 00:50:09,916.9216527 --> 00:50:16,836.9200601 But how do you get a job in risk? So there are, there are jobs open currently for project risk managers. 403 00:50:16,866.9197931 --> 00:50:18,336.9200601 That does exist as a role. 404 00:50:18,446.9204034 --> 00:50:29,436.9201745 Typically, it's within, like, an EPC-type company, and they're working across multiple projects, which means that that company is trying to, have a, a discipline across every project that is risk management. 405 00:50:29,496.9198694 --> 00:50:31,166.9199457 Kind of everything we described today. 406 00:50:31,246.9206323 --> 00:50:32,336.9207849 Those jobs exist. 407 00:50:32,846.9210138 --> 00:50:33,726.9201745 You know, you, you... 408 00:50:34,266.9203271 --> 00:50:39,896.9194879 it's, sometime easier to move into that role once you're within a company and are working on a project. 409 00:50:40,296.9181146 --> 00:50:43,486.9167413 That sometimes is a, a good approach to getting into that role. 410 00:50:43,486.9167413 --> 00:50:44,996.9150628 It's kind of how I found myself there. 411 00:50:45,986.9167413 --> 00:50:47,426.9191827 So it's sort of a lateral move. 412 00:50:47,426.9191827 --> 00:50:53,206.917962 You sort of start on these projects and then make your way into the risk space when a opportunity opens up. 413 00:50:53,996.9181146 --> 00:50:54,286.9152154 Yeah. 414 00:50:54,686.9159784 --> 00:51:05,606.9133844 If you're really into risk management as a discipline you, you'll know it, right? But, for an organization that recognizes the value of that, they love to have people in those types of roles. 415 00:51:06,336.9167413 --> 00:51:12,526.9191827 If I'm that student, how do I sense-check that myself? Like, let's say I'm, like, an engineer, I'm thinking about risk. 416 00:51:12,566.9200982 --> 00:51:13,866.9155206 Maybe that's where I wanna go. 417 00:51:14,356.9133844 --> 00:51:16,866.9155206 But then I'm like, "You know what? I really don't like working with people." 418 00:51:16,926.9130792 --> 00:51:20,996.9204034 You know, I think from our conversation we'd know, okay, that your profile might not actually enjoy this. 419 00:51:20,996.9204034 --> 00:51:23,176.9207086 Or what's something students could think about to, like... 420 00:51:24,266.9200982 --> 00:51:30,486.9213189 someone who's very curious and loves to always be learning, because every project Is different. 421 00:51:30,546.9188775 --> 00:51:32,206.9225396 The scope of the project is different. 422 00:51:32,206.9225396 --> 00:51:53,116.919101 Materials are different, right? So you always have to think through what is different about this project? What risks might I have? What have I not thought of yet? So it's like if you're considering a job in patent examining, you might want, think about risk too, right? Like just being able to be on a continual learner as well. 423 00:51:53,116.919101 --> 00:51:53,176.9195206 Yeah. 424 00:51:53,176.9195206 --> 00:51:56,116.9200547 It sounds like you have to kind of have that curiosity. 425 00:51:56,116.9200547 --> 00:52:07,596.9203598 I've heard it said that,, you know, a project manager might work on three projects in their career but when you're talking about a risk manager, you, you are likely going to work on dozens of projects. 426 00:52:08,716.9211991 --> 00:52:17,336.9247086 Well, is there any books or industry associations that you would recommend? We talked about Against the Gods: The Remarkable Story of Risk. 427 00:52:17,786.9247086 --> 00:52:22,296.9230301 Any other sort of resources out there or things that... 428 00:52:22,606.9244034 --> 00:52:31,626.9240982 podcasters you follow, anything that other people could go deeper with? I would say the Project Management Institute guidance on risk management is really good. 429 00:52:32,46.9253189 --> 00:52:33,56.9274552 It's applicable. 430 00:52:33,326.9279129 --> 00:52:42,586.9247086 There are some concepts in there that are, maybe a little more advanced for some projects, and it tries to be, all-encompassing every type of project. 431 00:52:42,696.9253189 --> 00:52:47,66.9311173 But that's good guidance and it's specific to projects. 432 00:52:47,66.9311173 --> 00:52:48,696.9329483 So that's kind of where I would start. 433 00:52:49,196.9283707 --> 00:52:50,956.9305069 I mentioned ISO 31000. 434 00:52:51,506.9335587 --> 00:53:02,966.9402726 That is a framework and it's more geared toward corporate-type risk management implementation, so I wouldn't say let that be too much of an influence other than to say that there's a process that should be followed. 435 00:53:03,506.9366104 --> 00:53:04,886.9414933 Same with COSO ERM. 436 00:53:05,266.9417984 --> 00:53:16,116.9402725 Another good reference is, I believe it's ISO Guide, I think it's 73, but it's all of the definitions of terms around risk management. 437 00:53:16,366.9402725 --> 00:53:21,286.939357 The one I gave about the definition of risk, that's from the ISO Guide, I think the number is 73. 438 00:53:21,286.939357 --> 00:53:23,46.9338639 That's another good one to get familiar with. 439 00:53:24,486.9363053 --> 00:53:24,996.9384415 Cool. 440 00:53:25,376.9387467 --> 00:53:41,696.9308121 Is there any conferences that people go to on risk that are really good to go into or surface? Is it really the PMI conference or is there like little niche risk people association? Yeah, I mean, there, there's all kinds of stuff on LinkedIn that you can find. 441 00:53:41,796.9338639 --> 00:53:50,296.9186051 Risk can mean so many different things and project risk is, is a very specific discipline within that larger risk concept. 442 00:53:50,976.9112809 --> 00:53:58,326.9021256 But things like IPA and project analysis, they do a lot of, of project specific focus on risks. 443 00:53:58,326.9021256 --> 00:54:01,116.8832047 So any kind of IPA conference you can attend, I would encourage. 444 00:54:01,846.8789322 --> 00:54:06,186.8752701 Matt, I really appreciate you joining us, sharing all of your wisdom. 445 00:54:06,186.8752701 --> 00:54:14,540.8712259 Is there any other tips or tricks you want to leave us with before we wrap up? That's one thing we didn't talk about just the terminology. 446 00:54:14,590.8714166 --> 00:54:23,460.8703485 Settle on a set of definitions, and just know that people will have experienced other terms that meant the same thing. 447 00:54:23,940.8717981 --> 00:54:24,240.8710351 Mm-hmm. 448 00:54:24,240.8710351 --> 00:54:31,460.8695855 Like severity or impact, right? Those kind of mean the same thing or in a risk management, in, in risk management terminology. 449 00:54:31,980.8700433 --> 00:54:36,240.8721795 But just define what all those terms are for your project and for your program. 450 00:54:37,760.8688226 --> 00:54:46,400.8689752 Going back to, like, having a singular perspective is really important- Right because if you have two different scales that you're measuring things against, doesn't work at all. 451 00:54:46,710.8695855 --> 00:54:56,900.871264 Do you send out that appendix to everybody before as, like, a prep activity? Or how do you actually get that front and center? We build it into the guideline documentation. 452 00:54:57,70.869433 --> 00:55:00,620.86867 So anyone who's curious enough to read that would, would see it. 453 00:55:01,40.8698907 --> 00:55:11,790.8734002 But yeah, at, at a workshop, we typically would have a series of handouts, your risk ra- risk, matrix so, you know, people are, are grading their risk, they know what they're working from. 454 00:55:11,790.8734002 --> 00:55:14,190.8791986 And then, you know, terminology, definitions. 455 00:55:14,980.8801141 --> 00:55:16,700.8825555 Well, Matt, thank you for joining us today. 456 00:55:16,700.8825555 --> 00:55:21,360.8862176 I was- learned so much, about Leviathan, kind of your role in that. 457 00:55:21,750.8856073 --> 00:55:29,390.883471 We went deep on the high end of risk with Monte Carlo and down to the low, sort of just conceptual definition of it. 458 00:55:29,390.883471 --> 00:55:32,120.886828 I, I can't thank you enough for taking us through this. 459 00:55:32,160.8877435 --> 00:55:37,990.8926263 Sure appreciate your time today, and hope that we get to chat with you again about this important topic. 460 00:55:38,870.8907953 --> 00:55:39,440.8904901 I appreciate it. 461 00:55:39,470.8892694 --> 00:55:40,210.8871331 Thanks for your time as well.

All Episodes

016 - Risk Management on Megaprojects: Lessons from the Leviathan Project

Episode Transcript

Popular Podcasts

Stuff You Should Know

Crime Junkie

NFL Daily with Gregg Rosenthal

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}016 - Risk Management on Megaprojects: Lessons from the Leviathan Project