One of the most striking aspects of distressed programmes – the ones that materially overrun and overspend – is the extent to which risk management simply falls into disuse.  Right when the programme is at its most reactive, and therefore desperately needs mechanisms to capture and deal with risk effectively, its ability to do so is not just poor, it is demonstrably AWOL.  Passive acceptance of risk as a mere occupational hazard has become the order of the day, and the programme is unable even to articulate its cumulative risk exposure.

But why does it happen? PUPs (practitioners under pressure) often insinuate that risk management is inherently flawed: “You can’t make an omelette without breaking a few eggs.”  Perhaps though, the real answer is something very different that happens down at the atomic level of risk management which defines the fundamental make-or-break for a programme’s ability to manage its risks.

To illustrate the point, let’s take the classic example, probably found in 99% of corporate programmes: “There is a risk that insufficient levels of SME (subject matter expert) resource will be available to the programme.”

Dissect that risk.  It doesn’t tell the reader when the risk will occur.  Nor does it explain the type of subject matter expertise required, to do what, or for how long.  And it doesn’t explain the implications of the risk – the bad things that will happen if the risk is not addressed.  Consequently, any risk rating is disembodied (as there’s no practical context), so meaningful prioritisation of the risk amongst a multitude of others is nigh-on impossible.  That one simple sentence of 19 words has just dropped a risk into plain sight that has the potential to cost millions of pounds of slippage across a multi-year multi-million-pound programme, and completely unintentionally, it has been framed in such a way that it is incapable of qualification, quantification, comprehension and above all, resolution.  Wow.

And yet it is ludicrously easy to get a completely different outcome.  Here’s the same risk, reframed:  “There is a risk that insufficient levels of SME (subject matter expert) resource will be available within the Finance team (specifically the Purchase-to-Pay team) across Q1 2026 due to the workload associated with the financial year end.”

That’s 39 words.  For the investment of an extra 20 words, the risk now has the all-important context.  We know when.  We know where.  We know why.  We know for how long.  We have an inkling of what the implications will be, which may add some colour to whatever risk score has been assigned.

So, if an investment of an extra 20 words has paid off, why not go for broke?  52 words gives the reader this:  “There is a risk that insufficient levels of SME (subject matter expert) resource will be available within the Finance team (specifically the Purchase-to-Pay team) across Q1 2026 due to the workload associated with the financial year end, resulting in two months of critical path impact at a cost of £1.5M.”

Now at this point, a PUP will say “But we have examples of SME resource challenges all over the programme.  I’d have to write and manage multiple risks.”  Hmmm.  Could it be that they are multiple risks, each with its own specific characteristics and path to resolution?

Why don’t practitioners think – and behave – like this? Usually because they haven’t been asked, educated or directed to.  Take a long hard look at the typical programme risk strategy – if it even exists – and you probably won’t find clear direction on programme risk:  Lots of lofty corporate verbiage about how important risk management is, but zero direction to be specific about the event or situation that might arise.  Zero direction to specify the when, whom, and the all-important why.  And zero direction to spell out the potential consequences.

19 words and a £1.5M overspend, or 52 words and some smart backfill?   The difference between the two is an effective programme risk management strategy, well communicated and consistently applied.  And quite frankly, doing programme risk well is easier than doing it badly.  Done well, it’s undramatic and time-efficient.  Done badly, it’s the polar opposite.

So, maybe it’s time to skip the omelette?