This narrative was born out of a question I missed on a CBAP practice exam and this source might actually fuel all kinds of different content for me to write about. This one in particular seemed to indicate that root cause analysis techniques have nothing to do with risk management. They told me that risk deals with uncertainty and root cause techniques do not.
I do not believe my answer was wrong but now see that my choice wasn't the best one for the context of the question. The question did describe root cause and my risk related answer was a bit of a small stretch. However, I do not believe that root cause techniques and risk management are necessarily separate. I also do not agree that risk management deals only with areas of uncertainty. It would be hard to have a risk without uncertainty but risk isn't just about uncertainty.
When someone brings up a project risk, I think the Five Whys technique is a very valid response. The uncertainty aspects of a risk may become less uncertain if the business analyst digs a little deeper. The risk might not be a risk at all but the fountain head for a set of requirements.
Lets say that a business owner communicates a risk regarding vendor availability. I believe there is an information opportunity lost if the business analyst writes that risk down and asks for additional potential risks. Actually, I will back peddle on that one. It is fine to do that, as long as you circle back and do a root cause technique. For the sake of discussion and my article word count, how about employing the Five Whys technique here.
BUSINESS OWNER: I see a significant risk regarding the vendor availability, we have had problems with them in the past.
BUSINESS ANALYST: (WHY 1) Why do you think their availability issue in the past would affect us here?
BUSINESS OWNER: Because the project manager they have assigned us was never available.
BUSINESS ANALYST: (WHY 2 & WHY 3) Why were they unavailable? Did they ever communicate why this was a problem?
BUSINESS OWNER: First off, she was sick all the time. In fact she was sick an entire week and we were counting on her supplying her project schedule to align to ours.
BUSINESS ANALYST: It sounds like we might need to document a requirement that the vendor needs to identify a proxy for their project manager for critical areas. (WHY 4) Why do you think the vendor wasn't able to handle this situation better?
BUSINESS OWNER: That project manager is a command and control type, she probably felt it wasn't necessary. I'm not even sure she was actually sick.
BUSINESS ANALYST: (WHY 5) Why do you think that she might not have been sick?
BUSINESS OWNER: Because she seems to get sick a lot around critical deadlines.
So you can see that the Five Whys root cause analysis technique being used here identified a set of vendor management requirements. Take a look at your current or past risk registers and see if a 5 Whys root cause analysis technique might provide some value for you!
© 2017 Dwayne Wright