The name of the exercise “Plan your trip” speaks to the goal of determining the appropriate level of rigor. Most people can associate with planning for a walk or hike and this is the context we use for the activity called the 4Cs. Early in any collaborative workshop, get people working. If you let them spectate for too long, some will retreat into “observer” rather than “participator” mode.

Collaborative, visual, activities can break down barriers to effective risk management. Facilitators should help the team identify the level of rigor used to effectively manage risk for their unique project. Outputs of risk management activities for the project team should be updated project documents and stories for the project backlog.

This practice is about deciding and defining how to conduct risk management activities for the project. Goals are:

1. Tailored risk management process - to ensure that the degree, type, and visibility of risk management are commensurate with both the risks and the importance of the project to the organization

2. Teach some risk basics to the team - since they may not be familiar with the concepts or terminology

Working individually (again to encourage active engagement and avoid groupthink) ask the team to consider what they would pack for a two-mile hike in the country on a warm day. Give them a couple of minutes to create lists on Post-it notes and review their responses as a group. Some will suggest taking nothing, or just a bottle of water; others will suggest rain jackets, bear spray (I live near the Rocky Mountains in Canada) and all sorts of other things. Then review the pros and cons of these items. They are useful if you need them, but a burden to carry. We then repeat the exercise, changing some parameters such as making it a ten-mile hike, or multi-day trip, in the mountains, in the winter time. Now the lists get longer as people prepare for more eventualities.

For each situation review the 4Cs—the Costs, Consequences, Context and Choices. What we bring (and how we prepare for risk management) varies based on the Cost of bringing/using it, the Consequence of not having it (rain coat — get wet, warm jacket — cold/hypothermia). Examine the Context talked about, preparations for elite ultra-marathoners who are hardy, capable, and resourceful or a kids' group who need more protection. Finally, the Choices we make should be an informed balance of Cost versus Consequence in the frame of the Context.

Another tool to relate the need to tailor the process appropriately is to ask the team to consider the decision rigor they put into their purchases. They way we consider buying a Coffee (US$2), a Couch (US$2,000), a Car (US$20,000), or a Condo (US$200,000) vary as the figures involved escalate.

For a coffee, we probably just find something close, maybe at our favorite coffee-brand store. For a couch, people will shop around and likely buy the one they like the best without much further research. When it gets up to car territory, safety, economy and resale factors are routinely examined. For a condo purchase the stakes are so high that most people engage professional help from home inspectors and condo document review companies. We need to do the same for our projects, asking what is appropriate for the endeavor.

Finally, if the team is new to risk management, then a discussion on trade off between business value and risks might be necessary. We undertake projects usually for the potential upside (or for compliance projects to avoid the downside). Getting business value out of a project is like receiving deposits into our bank account; we want them as often as possible, and preferably as large as possible. Given the uncertainty in the world, we want the biggest gains as soon as possible, before anything changes that may threaten future deposits.

In this bank analogy risks are like withdrawals; or bank fees, should they occur, set the project back, take away resources from delivering business value, and threaten the delivery of future value. So, to get the most out of a project we need to maximize business value while avoiding or reducing risks.

These exercises and discussions aim to get the team thinking about the appropriate level of risk management for the project and gain consensus and support for the strategy that is agreed upon. Without this shared understanding of “why?” we will not get people invested in the process.