Information Management projects belong to most challenging in my opinion. One of the reasons is the degree of uncertainty related to current state of data, and usually duration of the program. Although there are discrete steps within ECM programs that are handled by specific projects, overall duration of the initiative is pretty long. This makes such initiatives sensitive to changing environment, political landscape changes within organization, changing external laws and regulations and so on.
Managing risks is key factor in achieving success in the program. Risks must be managed constantly, maybe not weekly, but definitely should be reviewed at least monthly. In my current organization we set up monthly Risk Review Board consisting of individuals representing various aspects of ECM program – including business analysis, technology, architecture, change management and governance. During our meetings we focus on new risks that appear, prioritization and working out mitigation plans for 20% of them (according to Pareto law – 80% of biggest threats comes from 20% of risks). Risks are assigned to owners who need to manage them, and report back on their status.
We have to be transparent to the stakeholders communicating the biggest risks, although this needs to be done in a way that takes into account their level of tolerance. We do not want to create panic when it is not necessary. This is the point where program manager’s experience comes into play. If we are confident that we can handle these, we should provide brief statement about the risks showing confidence in handling them. Only risks that are outside of program manager’s influence, requiring stakeholders stepping in to mitigate them, should be worked out in detail. After all, this is similar to flying a plane. It is sufficient for the captain to say to passengers to fasten belts due to entering into turbulence area, rather than getting into details that the autopilot has just stopped working.
