Dr. David Hillson

Dr. David Hillson is The Risk Doctor, an international risk management consultant and director of Risk Doctor & Partners. A 25-year veteran who has worked in more than 40 countries and published eight major books and more than 100 journal papers and articles on risk, he is recognized globally as a leading thinker and expert practitioner in risk management.

Articles by Dr. David Hillson

• Should we use external risk consultants?

  Friday, March 19, 2021

  Many organizations use external risk consultants to support them in managing risk. Before choosing a risk consultant, it’s important to be aware of the possible benefits and associated risks, as well as having clear selection criteria. For example, the benefits of using an external risk consultant should include guaranteed expertise, drawing on proven solutions from other engagements and leading-edge thinking, among others.

• Quantitative risk analysis: Strengths and weaknesses

  Thursday, December 03, 2020

  Many people view quantitative risk analysis with a mixture of fear and awe. It’s clearly a very powerful technique in the risk professional’s toolkit, but it seems to be hard to use. As we decide whether it’s appropriate for us to include quantitative risk analysis in our risk approach, we should consider the strengths and weaknesses of this technique, so that we can make a balanced judgment.

• Understanding the risk mindset

  Thursday, August 27, 2020

  We all know that how we think determines what we do. This is particularly true when we are considering how to act towards risk. When we face uncertainty, we’re not always rational. Instead we fall back on deep-seated values and feelings about risk, which can often lead to unexpected results. We react rather than respond, driven by gut-level influences instead of thought-through reasoning.

• All decisions are risky, so it’s time to stop talking about ‘risk-based decision-making’

  Friday, May 15, 2020

  The idea of "risk-based decision-making" is becoming increasingly popular, and decision-makers at all levels are keen to ensure that their decisions take risk properly into account. But perhaps the term "risk-based decision-making" is mistaken. Surely all decisions are risk-based, by definition? Whenever we encounter a situation where we need to make a decision, two vital characteristics are always present. Every decision involves uncertainty, and the outcome of every decision matters.

• 5 Cs for why we should include opportunity in risk management

  Thursday, November 07, 2019

  Many of the pieces are now in place to support widespread adoption of inclusive risk management that addresses both threats and opportunities. International standards define risk as double-sided, and this is supported by professional bodies, recognized thought-leaders, expert practitioners, and leading-edge organizations. All that’s needed is for more people to start doing it! But why should we? Here are five reasons.

• Providing risk infrastructure to support opportunity management

  Wednesday, August 07, 2019

  Failure to provide an appropriate level of risk infrastructure can cripple risk management in an organization. Too little support makes it difficult to implement the risk process efficiently, while too much infrastructure adds to the cost overhead. Getting the supporting infrastructure right is essential for effective risk management, enabling the risk process to deliver the expected benefits to the organization and its projects. It’s particularly important to get all the elements right if we want to use an inclusive risk process that addresses both threats and opportunities.

• Modifying the IACCM Capability Maturity Model for risk

  Thursday, June 27, 2019

  The International Association for Contract & Commercial Management (IACCM) is the professional body for contracting and commercial professionals, with over 50,000 members across 166 countries. Its mission is to enable both public- and private-sector organizations and professionals to achieve world-class standards in contracting and relationship management process and skills. As part of fulfilling this mission, IACCM has developed a Capability Maturity Model, which can be used by organizations to benchmark their contracting processes against global best practices. The nine factors of the IACCM Capability Maturity Model are also all relevant to the ability of an organization to manage risk effectively.

• Scoring schemes for prioritizing project risks

  Tuesday, May 07, 2019

  Several leading project risk management standards and guidelines suggest that individual risks can be ranked using a risk-scoring scheme that represents a combination of probability and impact. The Risk Score for each risk is produced by multiplying P by I, then this score is used to rank the risks. But have you ever wondered where these numbers come from? This particular risk-scoring scheme was developed by a small group of risk consultants in the mid-1990s to bring some consistency to our practice. The thinking was as follows in this article.

• Professionalism in risk management

  Thursday, March 14, 2019

  Are you a "risk professional"? How do you know? Do you use the services of "risk professionals"? How can you tell they’re really professional? This article provides 10 criteria that risk practitioners and their clients can use to determine whether the risk services being offered can be described as "professional" or not. Before you start your next risk engagement, as either the provider or receiver of risk services, consider how you would answer these questions.

• Overcoming the fear of failure

  Friday, December 07, 2018

  The fear of failure often stops us taking risks, because most of us think of failure as "a bad thing." Reality is more balanced. Accepting the possibility and likelihood of failure gives us freedom to think outside the box, to act unconventionally, to challenge norms and stereotypes, and to be different — which can be very enjoyable! The 10 key characteristics of failure in this article show it includes both negative and positive aspects. Of course, not all of these characteristics are evident in every instance of failure, or they may appear at different times in the same failure.

• The life cycle of a project risk

  Thursday, September 06, 2018

  As we manage individual project risks, they pass through a life cycle that can be described using a set of status values. These can help us to understand where each risk is in its life cycle, so that we can determine what we should do next. The following set of standard status values in this article might be useful. Using these status values, we can describe the life cycle of a typical individual project risk.

• 10 things businesses need to know in uncertain times

  Friday, June 08, 2018

  Everyone knows that "business hates uncertainty." Uncertainty poses a clear threat to business, but it also contains significant opportunity. Sources of uncertainty must be understood so that these threats and opportunities can be effectively managed, avoiding and minimizing unnecessary problems as well as capturing and maximizing benefits. In the current uncertain business climate, it has never been more important for businesses to assess and manage their risks. But how do we do that when we are surrounded by uncertainty?

• Risk management in developing countries

  Wednesday, April 18, 2018

  ​Based on experience, it seems that the majority of companies in developing countries who are implementing risk management do not get the added value they expect. This is often because they are attempting to import risk management from a different cultural setting, from developed to developing parts of the world.

• The expanding risk management universe

  Thursday, April 05, 2018

  ​Like the physical universe, the risk management universe is expanding. This is true in two distinct ways: enhanced depth of analysis and increased breadth of application. We might describe these as the micro perspective (looking closely at the nature of the risks we face) and the macro perspective (looking at the bigger picture to see if we are missing anything). In addition to these, we need to think about how to manage the risks that we currently cannot see.

• Managing contract claims risk

  Friday, March 16, 2018

  Many organizations involved in or with the construction industry want to know how to minimize the risk of contractor (or subcontractor) claims during the execution phase of a project, after contracts have been signed and work has started on site. While this is important, it is better to focus on not getting claims in the first place. This the key answer to the question, "How can we manage claims risk effectively?"

• Risk leaders need to dance the tango

  Wednesday, January 17, 2018

  ​Risk practitioners seek inspiration from many different places, but not many look to the world of professional dancing to improve their leadership effectiveness. An innovative workshop has recently been developed by ​LeaderTango, which uses the Argentine tango as a metaphor for the leadership strengths and skills needed to succeed in today's business world.

• The evolution of risk

  Thursday, December 07, 2017

  The concept of risk has evolved a long way since its origin at the end of the Middle Ages, up to the way risk is understood today.

• Managing risky stakeholders in 3 dimensions

  Wednesday, October 18, 2017

  Stakeholders can pose a real risk to our businesses and projects — at least some of them can — and managers and their teams need to be aware of this so they can take steps to control the risks that arise from risky stakeholders. As with all "uncertainties that matter," stakeholders present both positive as well as negative risks, and we need robust ways of identifying which stakeholders offer opportunities, and where potential threats might lie.

• Headline risks: Seeing the big picture

  Wednesday, August 23, 2017

  Risk assessments are often undertaken in detail, or several assessments are conducted in different parts of an organization, project or program. Detail may be appropriate for tactical decisions and specific treatment planning, but there is often too much detail to support high-level decision-making.

• Prioritize opportunities using red/yellow/green

  Tuesday, July 11, 2017

  A client recently said they were not happy using the standard red/yellow/green color scheme in the Probability-Impact (P-I) Matrix for risk prioritization, because it was "designed for threats." For organizations who want to use an integrated risk process to manage opportunities alongside threats, this is a common perception — but it is wrong.

• 7 elements in the anatomy of risk

  Wednesday, June 14, 2017

  ​It is clearly important for us to understand the nature of a risk properly if we are to manage it effectively. Many people only consider a limited number of risk characteristics, leading to a limited ability to manage risk. Effective risk management requires a deeper understanding.

• Addressing risk with VUCA-Prime

  Wednesday, May 10, 2017

  ​Many risk practitioners have heard of VUCA as a way of describing an environment which gives rise to risk. VUCA stands for volatility, uncertainty, complexity and ambiguity. It was first developed in the 1990s by the U.S. Army War College, but it has become widely used in business as a way of characterizing the risky environment in which organisations operate.

• Communicating risk for attention and action

  Thursday, January 26, 2017

  Communication is difficult, especially when we are dealing with uncertainties that matter. People need to know which uncertainties are most important, and what can be done to manage them effectively and proactively.

• Risk escalation — a new strategy

  Tuesday, November 01, 2016

  ​Risk-response strategies help us to focus our risk treatment efforts. With a small number of strategy options from which to choose, deciding on a preferred strategy allows us to concentrate on developing specific actions to implement that strategy and manage the risk in the desired way.

• Risk communication through storytelling

  Thursday, September 22, 2016

  Albert Einstein is reported as saying, "Logic will get you from A to B. Imagination will take you everywhere." A lot of our risk communication is logical but not imaginative. Experience shows people listen better if the message is presented attractively, and storytelling is one powerful way to achieve that goal. An expressively-told story grabs the attention of the listener and creates vivid images in their minds, which aid understanding and retention of the underlying message — especially when we're dealing with concepts of uncertainty and risk.

• Defining and using risk appetite

  Monday, August 08, 2016

  ​There is a growing recognition that a proper understanding of risk appetite is a vital influence on organizational performance. This is supported by regulators who expect boards to understand and express their risk appetite, and some senior executives in a range of public- and private-sector organizations are already taking a lead in this area.

• Effective risk facilitation: Handling difficult people

  Wednesday, June 29, 2016

  In addition to being able to flex their facilitation style to meet the varying challenges of the risk workshop and different risk identification techniques, risk facilitators need to handle the people who participate in the risk workshop. Unfortunately, it is common to find at least some participants in every risk workshop who are not fully committed to its success, or who are not willing to contribute freely.

• Effective risk facilitation: Matching style to technique

  Thursday, May 19, 2016

  There are many techniques for identifying risks, and a skilled facilitator can help to make these more effective. ​Part II of this series outlined three main styles a risk facilitator can adopt.

• Effective risk facilitation: Understanding styles

  Tuesday, April 19, 2016

  When a facilitator is leading a group in a facilitated workshop or meeting, he or she can adopt a range of facilitation styles. These vary by the amount of control exercised by the facilitator compared with the degree of control allowed for the group.

• Effective risk facilitation: Understand the 4 P’s

  Wednesday, March 02, 2016

  The role of the facilitator is to make things easier for a group of people working together on a common task. This is a difficult job that needs special skills and careful preparation, particularly when facilitating a risk workshop, where the element of uncertainty introduces special challenges.

• Risk landscapes and international development

  Tuesday, January 26, 2016

  We all have our own "risk landscape," representing a set of opportunities from which we can benefit, along with challenges that can limit us or threaten our development. The risk landscape differs for each of us as individuals. Different communities, professional associations, social or ethnic groups also have their own risk landscape.

• How to counter the top 10 risk myths

  Tuesday, November 24, 2015

  Myths help us to make sense of the uncertainty that surrounds us. In the world of business and projects, risk management performs the same role. Unfortunately, there are also myths about risk management. These are often partly true, but they do not represent reality.

• Modifying risk behavior with change management

  Tuesday, October 06, 2015

  ​Have you found it hard to get commitment to risk management from your project team, sponsor or other stakeholders? Project practitioners are naturally focused on delivery, and they prefer to think about their next deadline, instead of worrying about something that may never happen. Some project leaders resort to threatening their team into doing risk management ("Think what might happen if we don't do it!") or to bribing team members with promises ("Life will be so much easier if you succeed in managing your risks.").

• Don’t treat your contracts like a suit of armor

  Thursday, August 27, 2015

  Many people view a contract like a suit of armor. It is there to protect you against uncertainty, and the thicker it is, then the better you are protected. But relying on a strong contract for protection can lead to unexpected problems. Most of these problems arise from the structure of the contract, as we can see by comparing it with armor.

• Boards and risk: Have we got it right yet?

  Tuesday, July 28, 2015

  Regulators have shown a growing interest in the way boards manage and report risk. So what has changed in the last four years? Despite encouraging progress in some areas such as risk appetite or risk culture, the underlying problem still seems to exist, arising from differences in perception around the board table about the nature of risk.

• A Grand Unified Theory for managing risk?

  Tuesday, June 09, 2015

  Albert Einstein tried for decades to develop a single "theory of everything," but he failed. Since then, physicists have looked for a Grand Unified Theory to unify the various fundamental forces (weak, strong, electromagnetic and gravitational) and offer a more elegant understanding of the organization of the universe and the nature of matter, energy, space and time.

• 7 ways to influence risky project decisions

  Wednesday, May 06, 2015

  ​Many project decisions are made by other people that affect you and your career, and often these decisions are about risk. Decisions about budgets, assignments, team allocations or priorities can significantly change the risk profile of a project.

• Scaling the PEAKS of competence

  Tuesday, March 31, 2015

  How can you know if you are competent to perform in your role? Many professional organizations produce competence frameworks that attempt to answer this question. Unfortunately, most of these frameworks are limited to assessing what you know or what you can do. But knowledge and skills are only two of the elements that are required for a person to be competent in a role.

• Managing cybercrime risk in your business

  Wednesday, February 11, 2015

  ​Cybercrime is a rapidly growing threat to the global economy. However, it is not well-defined, and it is often confused with cyberwarfare or cyberterrorism. Risk professionals need to understand cybercrime and its links to risk management, as we can provide valuable assistance in countering this significant threat to business and society.

• 7 questions to shape the risk process

  Wednesday, January 07, 2015

  Anyone facing a risky and important decision or project will need to answer seven basic questions. In fact, we could shape the risk management process around asking and answering them. If we do, then the risk process will become intuitive and natural, easy to follow, and less bureaucratic or forced.

• 3 success factors for schedule risk analysis

  Wednesday, November 12, 2014

  ​For most projects, it is important to finish on schedule. For example, it might be necessary to supply gas on a certain date that drives gas exploration and production, processing or pipeline projects. Or there may be liquidated damages for late completion.

• Questions for the board about risk

  Wednesday, October 08, 2014

  It is quite common for risk professionals not to talk to senior executives or board members. After all, they probably think we are technical staff or analytical specialists involved in the detail of the business, and not relevant to the strategic direction of the organization. And perhaps we think that executives are too important or too busy to waste their valuable time listening to us.

• Stress testing for risk management

  Tuesday, July 08, 2014

  Stress testing originated in engineering to check that structures such as bridges, roads, tunnels and buildings would carry the expected load without collapsing. Specifically in the risk field, the concept of stress testing also forms part of business continuity and disaster recovery, where business continuity plans are tested in advance to ensure they will work if a real disaster arises.

• How can reputation risk be managed?

  Thursday, June 12, 2014

  ​How can reputation be integrated within an enterprise risk management framework? This is not possible, because reputation is both a behavioral and consequential risk, so you never know what might cause it until it is too late.

• Risks with 100 percent probability

  Wednesday, May 07, 2014

  ​One of the first things I learned about risk was that every risk has both a probability less than 100 perfect as well as an impact on at least one objective. Some of my risk colleagues talked about risks with 100 percent probability, but I disagreed with them. As I've discovered more about risk, I've realized that my colleagues were right.

• Mindfulness in managing risk

  Friday, March 14, 2014

  ​Mindfulness has its roots in Eastern religion. It is also used therapeutically to treat a variety of psychological conditions (including anxiety, depression and stress), as well as in coaching to encourage excellence in healthy people. Used properly, mindfulness can also make our risk management more effective.

• How to manage risk in complex projects

  Tuesday, January 28, 2014

  Some people say complex projects are not the same as other "ordinary" projects, and so they need to be managed differently. We need to develop flexibility and resilience at all levels in order to cope with the special risk challenges associated with complexity. When we consider the risk angle, there are three questions to answer: Are complex projects inherently different from other projects? Are complex projects exposed to different types of risk? Do these types of risk require managing differently?

• Including sustainability in the risk framework

  Tuesday, January 07, 2014

  Sustainability has become increasingly important to organizations across the world in recent years, as both a business objective and a necessary constraint. But what does it mean? And how should it be included in the risk process? The word sustainability has changed its meaning significantly over time in the business world.

• Using the ‘Six Value Medals’ to identify and assess risk

  Monday, November 11, 2013

  Edward de Bono is famous for promoting creative thinking, and he has written many books to explain his radical ideas. Perhaps his best-known technique is "Six Thinking Hats," encouraging people to adopt a range of different perspectives when thinking about an issue. One of de Bono’s other thinking tools is the "Six Value Medals." The Six Value Medals have many potential uses, as we seek to create and protect value. But they may also help us to think about risk in a new way.

• Implicit and explicit risk management

  Monday, October 07, 2013

  Have you ever been asked, "How risky is your project?" Most project managers find it hard to answer this question. Your risk register lists all the risks you've identified, and these are prioritized for attention and action, with responses and owners allocated to each risk. But how can a list of risks answer the "how risky" question?