016: Risk Management on Megaprojects: Lessons from the Leviathan Project

Orion Matthews: [00:00:00] Welcome to Major Project Podcast. My name is Orion Matthews. We’re here to talk about some of the biggest projects in the world, how they get done, talking with leaders that have been on the ground understanding this amazing space.

So today with me is Matt Mitchell. He works, uh, in capital projects. He is a certified risk management professional with over a decade of experience in risk, project controls across energy and industrial sectors. So, uh, his prior job, he was at Noble Energy leading ri- risk management initiatives, and now he is working at Electrical Grid Monitoring, which is a new venture focused on innovative power line sensors.

Uh, Matt is also a member of Mints International. He’s got real great analytical rigor. We’ve had some great conversations around solving challenging problems in capital projects and risk assessments. I’m excited to bring them to you today. Uh, Matt, welcome to the podcast. 

Matt Mitchell: Thank you, Orion. Pleased to be here.

Orion Matthews: Thanks, Matt. And before we get started, maybe you can just give us a little bit [00:01:00] of your history and how you got into working in major projects. 

Matt Mitchell: Sure, yeah. I, I actually started off more on the, the technical side, um, you know, IT and, and software development, and I, um, got into risk management with a couple of different things that I did.

First, I worked at Enron, and we had some, some formal training around risk management. Um, but then I s- worked for a software company that had a really strong risk management platform. And so we were, uh, rolling that out to various customers and doing a lot of, uh, prospecting, uh, of what, what risk management would look like and what the global risk management system would do, and ended up going to work for one of our customers.

And as we rolled out this global risk management system, they realized they didn’t have anybody to manage it, and so that became my role, and, uh, th- eventually started working on a variety of their con- uh, construction type projects and, you know, oil and gas type [00:02:00] stuff, and, uh, took on the role of risk lead and ended up with some of the very large projects that they had 

Orion Matthews: Wow.

Well, it’s interesting to go from the software side because when I look at the project control space and the software space, I feel like risk is probably the one area that I’ve seen more often than not managed from small to really large enterprises in Excel. So you’re really in a interesting niche to come from s- uh, a software solution that focuses on risk, uh, and then rolling it out broadly.

Did you, do you find that’s true as well in your experience? 

Matt Mitchell: Yeah, it’s definitely niche. It’s definitely a, a different approach to get there. But what is interesting about it is that for risk management, you know, y- you think of just any kind of software at large, the software has to do whatever the company’s business process is.

But with risk management, we have some pretty good guidance out there, ISO 31000, we’ve got Project Management Institute, that all kind of lay out this framework of what you should be doing for risk [00:03:00] management. And so the software was built to, to do those things. And so, you know, w- in essence, what I had to do was learn what the risk management process was from the, those frameworks perspective and then, you know, implement it for various companies.

And so it, it’s, it’s, yes, it’s very much a niche, but, but it, you know, it, it was kind of a natural fit 

Orion Matthews: Awesome. Well, and as I understand it, we also are gonna get to talk a little bit about the Leviathan Project. You know, public information only, of course, but this was a large gas field project in Israel. I think it was maybe one of the largest energy developments, um, for offshore natural gas in the Mediterranean.

And so maybe you can tell us a little bit about that and your role on the Leviathan Project. 

Matt Mitchell: Sure, yeah. Yeah, it’s, um, you know, it’s a, a very large project like that takes many years to develop. And, um, you know, it’s interesting with the, with the backdrop of, of what’s going on in, in world, uh, geopolitical, [00:04:00] uh, things today that, you know, th- these projects are decades in the making in some cases.

And, you know, you have people on and off, and on and off and, and, you know, a lot of, um, knowledge gaps here and there. So risk management is, is, uh, crucial because a- as, as projects get mothballed or delayed or scope changes or even the entire concept changes, you know, the, the, the capturing of that information and the risks that we considered and, and the reasons why we made certain decisions that we made, those should be documented and, and documented well.

And, and risk management is one of the best ways to do that. You know, we consider doing this, we said the, the, the cost was too much for that, we chose a different concept, whatnot, but those things change over time. So, um, you know, these, these huge projects, risk management is a key part of, of the, the entire life cycle of the project, even up until the point where the [00:05:00] project might get canceled.

You know, somebody might pick it up again five years down the road, and it’s gonna be important to understand what, what took place. 

Orion Matthews: Well, so tell us about Leviathan. What, what was the project and when did you intersect it? And then your role was risk, so just give us a little background there. 

Matt Mitchell: Sure. Yeah. So, um, it started off, you know, it was pretty far offshore, and it started off as a, uh, floating, uh, production, uh, FPSO, float- floating production, uh, basically a ship.

And so that concept was kind of battered around for, I think, a couple of years. Um, and then it ultimately based on some of the s- the, uh, successes of the other two platforms that had been put in, it, it became a very large platform a little closer in. Uh, and, and so that was the, that was the final investment decision.

Um, but, you know, you’re talking about years of research that led [00:06:00] into that, and so I became- And what time frame was 

Orion Matthews: this? This was like 2000… 

Matt Mitchell: That was around 2000- 14, 15- Okay … ish, I believe. 

Orion Matthews: Was that FID? 

Matt Mitchell: Yeah. Yeah, so it was right after, it, it, it was not long after Tamar went in, which was, I believe, 2013. Um, so the, and, and, and the concept, you know, kind of shifted to using Tamar as part of the whole system of, of production, uh, versus just having the ship do everything.

So, uh, I became, I got into that project around the 2015 timeframe, ’15 or ’16, I believe. And that was, uh, right around the time that they did, they made final investment decision and sanctioned that project as that large, uh, platform. So massive platform, in fact. So quite, quite fascinating. 

Orion Matthews: So how big was the project when it FID’d?

Was it about 10 [00:07:00] billion, something like that? 

Matt Mitchell: Uh, I believe at FA- FID, it was about, uh, 3.8 or 3.9, something like that. And I, I, I believe it came in, you know, right around there. 

Orion Matthews: Okay. Great. And then your role, so you intersected right around FID, right after. Uh, so what did you… And you came in as a, as a risk lead.

Is that right? 

Matt Mitchell: Risk, yeah. 

Orion Matthews: Risk manager. Risk, yeah. So did you, I guess, when you started that job, like, did you inherit- The risk register and sort of like how did you approach risk right at that FID point? ‘Cause that’s a very interesting point when a project goes from, you know, are we doing this to like, we are doing this.

But you really wanna honor all the risk work that’s gone on in the past, but you’re also new to this job, and you’re getting… Your job is to show all the risks. Like, there’s… Walk me through how you navigated that, ’cause that’s kind of a complicated little s- point to intersect [00:08:00] a project. 

Matt Mitchell: Yeah. And, and it’s interesting because, you know, obviously every, every company’s different, every project is different.

Um, but the, the better th- developed and the more mature that risk management process is, the easier it is to do something like that. So for, you know, my, in my role at that time, uh, we were working from only kind of what had, we had seen with the previous platform, and let’s take that risk register and we’ll repurpose it, and, and it’ll kinda…

Some of these apply, some of these don’t, and m- m- go forward with that. But we eventually, uh, this was such a large project, it had so many, uh, aspects of it. We eventually ended up running two different risk registers because, because we had so much that was the, on the commercial side of things, and then there was the project execution.

And, and when you, when you, you know, kinda… The, the overlap of those kind of muddies the water a little too much for the project team, so we just really wanted to focus on project execution. What’s gonna, what’s gonna impact the project, and [00:09:00] don’t worry about the commercial aspects of it. We’ll manage that separately.

So, uh, we… It, it evolved as, as the project went on and, and, you know, we saw all the things that we needed to consider as part of that scope of the project 

Orion Matthews: That’s great. So you were able to kind of like bifurcate the risk register that you received, and then s- maybe focus, target more in on execution risk rather than get involved in maybe the more complex commercial risks, which might have been the bigger focus pre-FID anyhow.

Right. Yeah. 

Matt Mitchell: Right. 

Orion Matthews: That’s smart. Um- 

Matt Mitchell: Yeah. You know, like it’s public information that, you know, they’re selling gas to Egypt, right? 

Orion Matthews: Mm-hmm. 

Matt Mitchell: But that… And, and so of course that was one of the things we had to consider as part of all the commercial risk, but that’s not a project execution item, right? It’s a, you know- Yeah

existing pipeline and so on and so forth. 

Orion Matthews: And it’s almost like maybe some of that risk involving maybe geopolitical things is a different discipline in some respects than- 

Matt Mitchell: Yes … 

Orion Matthews: [00:10:00] engineering risk, which maybe is a little bit more quantitative, like, and, and can be defined a bit differently. So that seems…

That, that makes a lot of sense. Um- 

Matt Mitchell: Yeah. 

Orion Matthews: I don’t think people split their risk registers like that. But, you know, before we get any deeper, I should probably back up. Uh, I think we were hoping for people that are in the audience that don’t know what the word risk really means, they, you know, it’s risk, as you pointed out to me, Matt, goes back like tens of thousands of years.

So maybe we can just define when we talk about project risk on a major project, you know, can you kind of take us through a little bit of a 101 on that and just kind of get… give us a refresher even for the advanced project people? Uh, because it’s such a niche space, I think, I think it’s always good to go back and, and just learn.

So tell, tell me about risk. What is risk? 

Matt Mitchell: Yeah, absolutely. Yeah. The… So the ISO definition of risk, uh, risk is the effect of uncertainty on our objectives where that uncertainty is a deviation from what we expected. [00:11:00] That’s the, that’s the textbook definition from a project perspective. So what that means is we have to consider all of the objectives of the project.

What are we trying to do? You know, of course, CD cost schedule, uh, and, and time. Uh, but it’s most effective to boil those things down into what’s the effect on the schedule, what’s the effect on the cost. Uh, yes, you’ll find things that are, are effects on health and safety and environmental and all, but those, uh, those are, are sometimes hard to kind of quantify, hard to mitigate, and, and, um, sometimes again muddy the water around what are the objectives of the project.

So focus on those objectives, identify what things could happen to prevent us from achieving those objectives. Or if something bad were to happen, what would we do to get it back on track to make that objective? So that, that is what risk management is, uh, just trying to make sure that we prevent the things that could, uh, uh, prevent, uh, prevent the things [00:12:00] that might not allow us to achieve the project objectives.

Orion Matthews: And then does that also… ‘Cause, like, if you talk about deviation from a number, you can have, like, a negative and a positive deviation. So does risk also include the upside, managing that deviation from an expected outcome? 

Matt Mitchell: It can, absolutely. And so that, that’s, it’s an interesting perspective because the, the COSO ERM framework says that your objective is your objective.

If you come over or under, uh, that’s, either of those is a risk and should be considered. Uh, w- whereas, uh, PMI and, and others, in essence, they say, you know, if you come over the, you know, like if, if your production target is 100 barrels and you come in at 150, that’s an opportunity. Um, but e- the, I, I kind of prefer the COSO perspective because it makes you think, “If I come over, you know, 150, can my production handle it?”

[00:13:00] We’re actually seeing some instances where it couldn’t, where that, that occurred and y- you know, it flooded the whole system and they had to redesign. Um, so the, the COSO ERM is a, is a good perspective. This is what we wanna get. If we go over, we have to consider what risks might occur there. If we come under, we have to also consider, you know, what, what risks could occur and, and what the commercial aspects of it are 

Orion Matthews: So let me play it back for you as a layman on risk.

What, what I’m hearing is, like, risk management is always has a time component in a way, ’cause it’s like if we’re at time T zero and you pick a point out here at T 10 or whatever, uh, and you, you also have this observer, a frame, where you’re like, “By these mechanisms, this should be here.” And then risk is saying, like, what is the actual deviation from expected, like- 

Matt Mitchell: Right

Orion Matthews: so there’s this, there’s always an element of, like, there’s a time horizon that you have to be [00:14:00] considering, and then you also have to be considering whose perspective are you looking at for that risk. Is there always one? Is it when you have a… We talk about risk registers, it’s like that’s your list of risks.

Is it always like… Maybe for you it was, too. You had, like, commercial risks got split, so you can have these, like, multiple perspectives of, of what the deviation is, or is it generally… ‘Cause you kind of have to have alignment, right? If, if people don’t understand what the goal is, you can’t really tell them the deviation from that goal.

Like, how do you- 

Matt Mitchell: Right … 

Orion Matthews: how do you… Is that the risk manager’s job, or is that… How do you 

Matt Mitchell: define- You know, it’s, it’s, it’s the… You, you have to get beyond the bias. No- nobody… You know, you, you talk through what the risks are, things that might occur, and, and you often get the, “Oh, yeah, that’ll never happen. I, we’ve never seen that.”

Or, or the opposite is, “Oh, we have to… You know, we need to order 12 extra valves because we’re gonna have so many fail.” Uh, so you, you kind of talk them through. The, the valve one is a good example where [00:15:00] we had an engineer that said, you know, we’re ordering eight or 10 or 12 valves. I don’t know how many it was, but, um, you know, we’re talking about risk.

He said, “Oh, yeah, the… It’s an ex- extremely high likelihood that, that we’re gonna, they’re gonna fail. Very high. Very high.” And so I said, “Well, okay, you know, we’re putting this in the risk register. Do we want to put it in there? And, and it’s gonna be at the top of the list if it’s a very high likelihood.”

Says, “Well, yeah, yeah, we, we need to, we need to keep that risk in there.” I said, “Okay, well, if you ordered 100 valves, how many of them would you expect to fail?” “Uh, probably three.” “Okay, that’s a very low probability of, of that failure occurring, so, you know, we put it in at, at very low in the risk register.” So it’s about having that conversation and talking them through and, and making them think about is this really a risk or, you know, have I considered all the things that, that could occur.

Orion Matthews: Well, maybe that gets into that term I think we’ve heard, a, a black swan. Like, how do you… You know, some people’s black… Some people kind of live in the world of black swans where everything is probably [00:16:00] catastrophically- Yes … going to happen, and others don’t. So maybe t- talk about black swan. Is that actually in a defined ISO term, or is it just sort of something we’ve come up with?

Matt Mitchell: I- i- the, the Latin term is de minimis. Um, that it’s, it’s so, uh, outrageous that we can’t… we shouldn’t even consider it because there’s nothing we could do about it if it occurred, and there’s nothing we could do about to, to, to prevent it from occurring. Um, a- and there, there are other terms, um, escalation factors, o- other things that they say to talk about risks that you cannot mitigate.

But yeah, there… You have to focus on what you can control and what reasonably will impact the project, and that’s the word that I use, um, cannot reasonably occur. Uh, otherwise we’re, you know, we’re gonna waste a lot of money and waste a lot of time thinking about things like, you know, planes crashing and things that, uh, are very unlikely to occur.

Orion Matthews: Well, and, and, and I think the [00:17:00] key point you just made there was waste a lot of money. So you did risk management for broad portfolio, um, I believe for, uh, a large company, and you were managing small project risk and then really large project risk, and sort of how do you make risk economical? ‘Cause I think sometimes as, like, an executive, you’re gonna be looking at this saying, risk management…

Like, the risks are probably gonna occur anyhow. I could spend, I could spend millions of dollars trying to prevent that one in 1 million thing. You know, how do, how do you properly… Like, what’s the right economic model to look at risk so that you’re spending the right amount and being, you know, a, a good sort of steward of the funds of a project?

What… How do you balance that? 

Matt Mitchell: Yeah. Yeah, you know, again, every project is different, and one of the, one of the things that, that I, I, I feel like some project teams get, uh, twisted up on is that the company might have a, a global risk matrix or a corporate risk [00:18:00] matrix, but the project has to have its own.

And, uh, and gen- generally, that’s going to be in terms of the cost and schedule impacts to that project. So, you know, is it, is… Do you do the matrix at, you know, 10%, 25%, 50%, 75%, 100%, uh, uh, budget impact? Um, that, that lets you frame that project in terms of its biggest risks and, uh, you know, compare it to other projects of similar sizes or, you know, that a big risk on a million-dollar project might be $100,000, but a big…

But $100,000 risk on a billion-dollar project is really, you know, has a different, uh, frame of reference. So, um, the, the risk matrix is the important way to differentiate big risks on different projects. 

Orion Matthews: Okay. I, this makes sense. And then, um, you rolled out, I believe as well, as part of managing a global portfolio, um, you rolled out a training program, is that [00:19:00] right?

Sort of an educational- Yes … piece, which I’m super excited about. So when you… I’m trying to condense your entire sort of educational thing into a couple minutes here, and it’s not gonna work. Right. But what would you say when you, when you gave those… ‘Cause w- who was your audience with that? It was like project, project control managers, the engineers, you know, folks involved in the, the project.

Like what- What do you think were some of the aha moments or things that you gave these people when you were doing risk training, um, in 2000? 

Matt Mitchell: Yeah. We used, we used the term risk champions. A- and what that meant was people who kind of understood and had an interest in knowing more about what project risk management looked like, that we could go out and teach them and, and then let them go do.

You know, uh, so we, we had the, you know, kind of a dog and pony show going around, teaching every, all of our risk champions. We would have a regular check-in with them, or just, just the risk champion call, and, “What are you guys learning?” And they would feed off of each other. Uh, [00:20:00] so that worked really well.

You know, it’s, it’s hard to do it all a- as a single individual, and risk management is all about everybody understanding how the whole process works. So we, we just tried to teach everyone that we could and, and find interested peop- interested people. But, yeah, it was a variety of, of folks. Project controls, engineers, a lot of coordinators.

Orion Matthews: So if somebody was listening to this and they were like, “I wanna set up something like that for my company,” how… what would you advise them in terms of, like, leveling up risk? ‘Cause it sounds like it’s not just hire the perfect risk manager, it’s actually something that has to be baked within the organization.

It, sort of it, uh, sort of organically, kind of like safety. You know, you don’t get safe- Sure … execution of a project by hiring a safety manager that was really great at safety on another project. Like, that doesn’t work. Uh, you have to have a safety culture. It sounds like you worked on creating a risk culture.

What- 

Matt Mitchell: Yes … 

Orion Matthews: how do you create that? 

Matt Mitchell: Yeah. You know, it, it’s, it really [00:21:00] it’s the w- what I say one is greater than zero. It’s just about getting in there and doing it. Like, get in and start a risk register and, you know, begin working through what that whole process looks like, who, who should be involved. And, uh, y- the first risk workshop is the hardest, and after that it starts to become a little bit more mechanical and, and people know what they’re expected to do, and you can do a lot of, a lot of, uh, prep work up front before you get into the workshop.

So it’s just a matter of getting in and starting to do it, and then making it better every chance you get. 

Orion Matthews: Okay, so risk workshops. Maybe we can go back to Leviathan real quick. I’m, I’m assuming day one you had a risk workshop to kind of, uh, you know, start that process. Maybe talk to, tell us, tell us the story of the first risk pro- risk workshop on Leviathan or, like, how did, how did you, uh, create that process and 

Matt Mitchell: what’s- Yeah, I’d rather tell you the best way to do it.

Okay. [00:22:00] But I’ll tell you what we did instead. No, uh, no, we… So it was the, the first workshop, yes, it was a little awkward because it was kind of the first time that team had come together to talk about risk registers. And, you know, the, the risk workshop, the whole idea is that everybody understands what, what those risks are and what they mean, even if they don’t have anything to do with it and it’s not their discipline.

And so, you know, you have a lot of vocal voices and, and, um, y- that- that’s half the role, is being able to kind of manage those personalities and, “Yeah, we’ll ta- Yes, let’s put that in the parking lot. We’ll, we’ll take that offline. We’ll talk about it later. Um, yeah, yes, that’s a valid risk. Let’s, you know, we considered it and, you know, here are the mitigations and here’s why we don’t think it’s gonna happen.”

So it’s a lot of personality management, especially initially. Um, but then, you know, once the team is, is used to doing the workshop together, it goes pretty smoothly. 

Orion Matthews: So tell me about the personality management. Like, what… That’s, that [00:23:00] gets out of the comfort zone of, like, the numbers and into something a little more- Uh, uh, you know, probably a little more real about how real work gets done.

Like, how do, how- 

Matt Mitchell: Yeah. 

Orion Matthews: You know, and- 

Matt Mitchell: It’s, it’s- 

Orion Matthews: Yeah … 

Matt Mitchell: it’s back to the, the comment about the psychologist, right? It, it, not only do you have to, you know, kind of manage the loud personalities, but you have to coach the, the quiet ones as well and, and, you know, what the, the term they use is elicit risk. Get them to tell you the, you know, what is it that they’re thinking and, and, and then kind of understand that and, and present it back to them as the, “Are you saying that this could occur?”

Or, “Are you saying that we need to do this?” So it’s, it’s a lot of, uh, working with people and, and people management and, and, in some cases, people who aren’t happy to be in the office locked in a room in a meeting. So, you know, you have to consider all those things. 

Orion Matthews: Well, tell me more about that. ‘Cause so you brought in people in the field.

Right. So it wasn’t just the [00:24:00] corporate office, ’cause they’re the ones that really are getting the project done. They probably don’t- Yeah … wanna be there. Yeah, tell me what… How was that? 

Matt Mitchell: Yeah, and that’s, that’s another big challenge you face is you- you’ve got these experts from the field which are, are necessarily there, but they don’t wanna be there.

They don’t wanna be looking at a risk register on a, you know, projected on the wall, and have to listen to all these other people that don’t have anything to do with, with, you know, from their perspective that don’t have anything to do with what they’re doing. So, you know, you have to be considerate of their time, do as much, uh, uh, homework and, and upfront work as you can to, to make that meeting valuable the whole time they’re there and, and meaningful the whole time they’re there.

And, and again, that also goes back to the, the people management. Don’t let just the one person rule the whole meeting. We, you know, we need to get all the opinions and have all the conversations. Um, you know, uh, one example, we went into a, a risk workshop and the, the leader of the entire group said, [00:25:00] “You guys are here today to tell me why X is our biggest risk.”

conducted the workshop. Everybody had their input, and X came out as the third-biggest risk from that group. So it’s, it’s about having those conversations and everybody else understanding, you know, w- what’s his risk or her risk versus mine and my scope. 

Orion Matthews: So how do you– do you have a– you said there’s some prep work that goes into it.

So if you’re facilitating a risk workshop, is there like, uh… Amazon has this term called a, a pizza man team, I think, where it was like if you have a dev team and, and it’s two pizzas, they can eat more than two pizzas, you have the wrong number of people on a project. Is there, is there some sort of like 80 people in a room talking about risk doesn’t work?

Is there… Like how do you prep the conversation? What’s a good… Is it like an hour, hour and a half? Uh, like how do you do those? 

Matt Mitchell: Yeah. I, you know, it’s, it is, a-again, [00:26:00] sometimes dependent on the, the size of the project and the experience of the people. Um, what I find m-most useful, of course, what you always want to be able to do is to start from a lessons learned review, uh, whether that’s doing it yourself and going through and saying maybe these things apply to this project, and putting them into the risk register, and going and looking at similar projects and seeing what risks they identify or, or experienced, and– but putting all those into the risk register.

And then do as much as you can, uh, upfront interviews with people. You know, do a drive-by in the office or, you know, give them a call and just say, “Hey, we’re doing a risk workshop. Was wanting to get your perspective.” And, you know, try to, try to get those individual perspectives ahead of the group meeting, and come with something to show them.

You know, if, if you start off the meeting with all those personalities in the room and you got a blank screen and you say, “Okay, what are the risks?” You’re, you’re destined to fail. So w-we wanna have as much, uh, work [00:27:00] done upfront as you can. Which is not to say that everything can be. 

Orion Matthews: Yeah. But so instead of starting with a blank, like everybody list your risks, one, two, three, four, you try to– you set up a lessons learned.

Is that usually around a risk that has triggered or, you know, something like that, so it’s gets everyone disarmed to actually talk about risk? Or h-how– what’s the lesson that you share? 

Matt Mitchell: Yeah. Yeah. The, the PMI guidance is that a lesson learned is a future project risk. So, you know, a-as part of your project, you should be capturing lessons learned on a regular basis and, and, you know, writing them in a way that it’s useful for a future project.

And then to, to start a risk register to kick off a project, you would wanna go and look through the lessons learned from previous projects, uh, especially those that are similar to the one that you’re working on. So, uh, that’s always the, the best starting point if you can do that. Um, also, uh, previous risk registers.

One of the reasons I [00:28:00] say don’t delete a risk just because it’s mitigated or it’s no longer applicable, leave it in there and just say that it’s closed out because somebody’s gonna need to review that sometime in the future. Um, you know, that, that technically would, would be a lessons learned review. Um, so that, that’s a lot of what the homework is to lead up to the, the workshops 

Orion Matthews: Okay.

And so you said the, the, on Leviathan, the workshop- the first workshop was, was obviously rocky ’cause you’re just getting everything started. And I imagine myself, let’s say I’m a risk manager listening to this podcast, and I just got on a billion-dollar job, and I’m sort of thinking about, what, what do I need to do here?

One question I would have is I think everything usually has, like, a rhythm. You know, when you look at, like, risk, safety, uh, you know, any function within an organization, there’s sort of like a sine wave of, of activity. And it seems like those meetings and that sort of regular risk management process is kind of that, that flywheel.[00:29:00] 

So, like, how do I get that flywheel started? What… How… What’s the frequency that you might wanna do it, like monthly, quarterly? Kinda what are those like activities that help anchor good risk discipline? 

Matt Mitchell: Yeah. I’ll say, um, the, the easiest way to dovetail a risk review in is to kind of piggyback on a cost or schedule review, or a cost and schedule review if you can do that.

They’re all related. And if you can listen in on a cost review, listen in on a schedule review, that will feed a lot of information into what goes into the risk register, what needs to be updated in the risk register. And it’s easiest since you already have that team assembled to do that review to say, “Hey, let’s, let’s do risk review after that.”

So typically it’s gonna be about a monthly type activity just depending on the, the timeline of the project. 

Orion Matthews: Okay. And then how do you deal as the project psychiatrist during that? You know, ’cause cost review, schedule [00:30:00] review, oftentimes I find people don’t want to identify r- I, I… Hmm. Risk is one of those things that, like you said, there’s the quiet folks in the room, but like people oftentimes don’t wanna surface risk ’cause there might be political problems with surfacing a risk, and it’s actually easier in their world to like let that risk ride, and if it triggers then it’s just like, “Hey, this happened.”

So how do you, how do you break through that and sort out the political consequences of like raising a risk for someone? ‘Cause I think that sometimes keeps the risks unsurfaced. Like do you, do you address that specifically or is that an organic thing? Like, how do you surface risk given that it can create political problems for other people?

Maybe it’s like, “Why did we ever even order these types of fasteners? Like, who would order something that could rust in, in a storm?” You know, there’s just alwa- it feels like sometimes risk turns [00:31:00] into a witch hunt, and people don’t wanna be the one to kick off the, the hunt, so to speak. 

Matt Mitchell: Yeah. It’s, it’s, it also g- it’s similar approach with lessons learned.

Um, what I will say at Noble, w- one thing that their drilling group did an excellent job of was a lesson learned review is not a finger-pointing session, and so everything is on the table. And they, they’re, they were really good at that. And so we, we kind of piggybacked off of that in projects to say, “Look, let’s, let’s implement this really good lessons learned program, and just put everything out there.”

Uh, and it, it worked really well. And again, once people understood it, they, they knew, yes we c- we, we’re finding faults and things, but w- this is good because we’re gonna prevent it from occurring again. So, um, yeah, it’s, it’s again back to the people management aspect of, of getting people to, to talk. And it also, you know, the, the prep t- that you do ahead of time, if you can have a one-on-one with [00:32:00] somebody you’re more likely to get something like that and say, “Well, here’s how we’re gonna address it in the big group session.”

Orion Matthews: Is there, uh, on a large project, is it that anything that deviates from the expected is either a risk that was documented or a risk that you never knew about, but it all kind of fits into risk in a way? Is that… Because I, I guess m- my question is, what do you do about those risks where something happened in the field and it caused, uh, you know, 1,000,005- deviation on the project, you find out about it.

It’s, it has nothing to do with the risk register. It was, but it’s not a black swan. Like, is there some cleanup activity you have to do to kind of be like, “Okay, this actually was a risk we never caught”? How do you surf- do you surface those? Like, how does that play in? 

Matt Mitchell: Those, those do happen, right? It’s the, the known unknowns versus the unknown unknowns.

Uh, so yeah, those things happen. It’s, it’s just that you, you [00:33:00] do as much work upfront as you can to try to identify what types of those things might occur. Um, you know, we talked about in the, in the Mediterranean, uh, we had a, a survey go through where the, you know, where the, one of the pipelines was supposed to be laid, and they found some ancient, uh, jugs on the, on the sea floor, right?

So they had to reroute the pipeline. So those kinds of things happen and, and, you know, it’s not every day that you’re gonna have a, a, uh, find an artifact like that. Yeah. But you do the survey for a reason, and so you, you might carry some of those risks just in case. So, um, it’s about thinking through, you know, what, what might go wrong with each of the activities that we have planned.

And again, will it truly impact our objectives? You know? We, we could have a delay and, uh, some, a piece of equipment arriving, but it doesn’t impact the schedule. You know, it doesn’t change our start-up date. Uh, so okay, it was delayed a week, that’s okay. We, we might have some co- [00:34:00] cost impact of that, you know, carrying cost or time delay or whatnot, but it doesn’t impact the objectives of the project, so it might not be as big of a risk as it sounds.

Orion Matthews: Well, okay, so maybe this gets into Monte Carlo and things like that. Uh, I always thought Monte Carlo was like a casino or something that you could, that you know? Yeah. But, uh, maybe you can talk about that, ’cause how do you, how do you actually, when you get down to brass tacks and you say, “Okay, what’s the impact?”

How do you quantify that? How does Monte Carlo fit in? What is Monte Carlo, um- 

Matt Mitchell: Yeah. Monte Carlo is, is a very interesting approach. Um, if, if you think of it just at its, at, at the core, if you have an activity and you have a 50% chance of finishing up on a day, and there’s a dependent activity that you have a 50% chance of finishing it on, on, on time, you only have a, a 25% chance of meeting that, that [00:35:00] schedule, right?

So that’s kind of what Monte Carlo is, is it says all these activities that you have in here, you’ve said that you’ve got a 10% chance of a risk occurring here, a 5% chance here, 25% chance here. It goes through and- Does a thousand iterations of that schedule or that budget and says, “Okay, 10 of 10 of these or, you know, 100 of these, we’re gonna apply this risk, and 200 of these we’re gonna apply this risk.”

And then it, it cycles through the thousand iterations and says, “Okay, you have a 50% chance of meeting this number or this date.” And so, uh, you know, you, you… The company has to make a determination whether they go with that, that 50% chance number, the P50 as we call it, uh, or something more, um, more conservative like a P75.

We have a 75% chance of coming in with this result, and therefore we’re very confident we’ll be within that. Um, so the Monte Carlo just takes your cost estimate or your [00:36:00] schedule estimate, runs through 1,000, uh, or, you know, a count of your choosing iterations of that and applies the risks that you’ve identified where, where you’ve said they might impact that, uh, budget or schedule 

Orion Matthews: And then who presents those Monte Carlo?

Like, do you do the Monte Carlo monthly or is that really pre-FID before you’re making your final decision, you get that P50 and you’re like, “That’s good enough”? Like, how, how often- 

Matt Mitchell: Yeah. Y- yeah, let me, uh, let me back up a little bit and say Monte Carlo is, uh, most effective on large to very large projects.

Uh, a very small project, Monte Carlo is not, not nearly as effective, and you’re not gonna get, um, you know, the accuracy of the results that you would want to have. Uh, for, for smaller projects, we have the, the PERT method, the Pro- Program Evaluation Review Technique. Mm-hmm. That’s what I recommend for smaller projects.

Uh, [00:37:00] but yeah, Monte Carlo, um… Can you re- restate the question ? Delete this part. Yeah, no, no. 

Orion Matthews: The, uh… I think w- what I was sort of asking about is, um… God, I think I forgot my question. It’s, uh, yeah, how, how does the Monte Carlo- 

Matt Mitchell: Oh, how, how, how do you present it? 

Orion Matthews: Yeah. 

Matt Mitchell: And how often? Yeah. Yes. So the, the inputs to a good Monte Carlo are an accurate up- updated budget or forecast, uh, an accurate and updated schedule, and an accurate and updated risk register.

So, you know, if you’re doing those things monthly, you can run your Monte Carlo monthly. Um, but, uh, Monte Carlo is, is, you know, we- you’re typically talking about a very long timeline of the project, so you might not necessarily need it every month. So we, what we did on Leviathan was we did it approximately every quarter.

Um, we would update the Monte Carlo every month, [00:38:00] but we would only present it every quarter. 

Orion Matthews: Okay. And then when you say present, so risks are interesting, right? Because they, I, I think oftentimes they can go all the way up to the board level. So you’re surfacing a risk- Yeah … down at this tiny little spot, and then it sort of bubbles up the organization.

How does that work for, you know, maybe for, like, L- Leviathan, you, y- as the risk manager, do you present to, like, the project director, and the project director then presents up the chain? Is that typically how risks are surfaced, 

Matt Mitchell: um- Yes, yeah. The project manager, project director, uh, you know, they ultimately own all the risks.

Um, you know, the risks should be individually owned by the people who are working to, to mitigate or close them out. But the, the project manager has final say on that. And so, yeah, w- we prepare the, the documentation for the project manager to present those items and those risks. Uh, and then separately, the, the risks that are assigned to people, um, you know, as the risk lead, you’re responsible for getting those [00:39:00] updates from those people and making sure that, that the project manager is in alignment 

Orion Matthews: Okay, so this makes sense.

You’re working, let’s say Leviathan, right? So you’ve got, you’re here, you’ve got your team. There’s above you the risks are percolating kind of up through the org, right? But- 

Matt Mitchell: Right … 

Orion Matthews: there’s also this sort of corporate b- barrier on big projects where a lot of times you have contractors that are doing major scopes of work, and so they have, uh…

How do you surface them from that part? ‘Cause then you get this sort of like corporate boundary line, and those risks, uh… Like, how do, how do you manage contractor risk, basically? Do you enforce it in the contract, or how does that work? 

Matt Mitchell: Yeah. What we tried to do is we would go directly to them, meet them at their office, and, and tell them what we were doing, that we wanted to do a risk workshop with them.

Could they bring what- whatever they were working from, whatever their risk registers were. [00:40:00] And, you know, if, if we found deficiencies, we would just coach them and work with them to, to get them to do things the way that we, uh, preferred. Uh, but we found that most, most of our big contractors like that, uh, did have a risk management function and, and they were willing to meet with us to do that.

So, um, a- again, it’s, it’s getting out and going and meeting, meeting with the, the right people. 

Orion Matthews: So the risk manager is kind of a social animal, would you say, 

Matt Mitchell: then? Right. Right. And what’s the- Lots of meetings. 

Orion Matthews: Yeah, and what’s the, what’s the right way, I guess, to approach those things? So you’re… Because I feel like you can kind of be the almost like the tax man as, as a risk per- Feels like there’s a few buckets.

Either it’s like, “Is this person helping me? Is this person draining my time?” Or, uh, “Is this person going to get me?” And I feel like risk managers or risk conversations could fall into any of those buckets. So how do you disarm folks to have, to see you as like a, a helpful, good guy [00:41:00] versus other- 

Matt Mitchell: Yeah. You know, my, my favorite, uh, icebreaker is, you know, you show up for a first meeting and say, “I’m from corporate.

I’m here to help.” And, you know, you always get a bunch of laughter. Everybody, everybody finds that one funny. It’s like I acknowledge that it, you know, you guys don’t wanna be here and you don’t wanna hear from me, but, you know, let’s get through this and, and hopefully we’ll see that we’re adding some value to this activity 

Orion Matthews: And then, uh, one, one question I guess I have for you then.

So you- so, so ’cause you’re a personable guy, what can people do to work on those soft skills, you know, that… Do you have advice for someone that… ‘Cause it almost sounds like, uh, y- the, uh, you… There’s an elem- there’s a, there’s a sort of math and science discipline of risk, and then there’s this sort of social, uh, soft skill of risk.

Like, how do people… The math and science, it’s like ISO 3100, right? Uh- 

Matt Mitchell: [00:42:00] 30- 

Orion Matthews: Yeah, 31,000. And then, but how do you develop the soft skills? Or are those in the ISO docs or, like, what, what do you recommend there? 

Matt Mitchell: They’re not in the ISO docs and, and, um, there’s not a lot of very specific guidance in those frameworks, right?

So, uh, honestly, I, I think it’s, uh, just a, a matter of getting your feet wet. Get, get in there and do it. And yes, the first meeting and the first run-through is gonna be a little bit awkward and, and, you know, people are kinda figuring out what you’re doing, but after a couple of iterations it’ll, it’ll be a lot more natural and, you know, everybody’ll know what, what each personality is and it, it just gets easier.

So just get started, get going. It gets easier as you go. 

Orion Matthews: What’s the one personality that’s the most difficult, you would say, that you have to, like, manage right off the bat for risk? 

Matt Mitchell: Uh, you know, it’s, it’s one end of the spectrum or the other. It’s the everything is bad and is going to happen and, and you need to put 15 [00:43:00] risks in your risk register for me, or n- none of that’ll never happen so don’t even put it in there, right?

And, and you have to kinda talk them off the ledge and, and try to explain to them and, and, you know, “This is why we’re doing this. This is what we need to capture. It’s not just about you, it’s about future projects and, and, you know, the project manager wants this, and report to the board.” And, uh, so it’s, it’s a, you know, coaching and, and influencing activity, uh, for the ones that just kinda don’t get it or, or, you know, have an extreme view.

Orion Matthews: So it sounds like there’s sort of two ends of the spectrum. There’s sort of the Pollyanna people, and then there’s sort of this dooms- doomsayers, and you wanna kind of… Almost like with stock picking or something, you wanna kind of avoid those two outliers or bring them- Exactly … sort of the center, um, to moderate.

Matt Mitchell: Yeah, yeah. And, and th- those two are the ones that it’s sometimes better to go meet with them in person out of the [00:44:00] workshop and, and try to, you know, head off any of those types of, uh, outcomes. 

Orion Matthews: Okay. Well, so we’ve talked a ton about the soft skill, the, you know, process of risk, things like that, kind of approaches.

One piece that, uh, uh, that I would love to get your perspective on is, that you can layer onto that, is technology. So, you know, it… I always say it’s process before tool. We have discussed the process. But what’s the role that good technology plays in risk management? And I, I, I guess I mean that from the, you were in the software side.

You said you had a really great risk platform. Like, how do you implement good technology solutions that, that actually help with this situation? 

Matt Mitchell: Yeah. Um, you know, it, it’s, a- again, to go back to one is greater than zero. Having a risk register is, is i- infinitely better than not having one at all. And so, uh, [00:45:00] the s- s- somewhere far down the list is the what tool do you use?

But the, the top of the list is create a risk register. That’s it. Um, you know, obviously Excel lends itself really well to doing that because you can, you know, you specify what columns you want in the, in the spreadsheet. Uh, the main thing is to keep it simple for the, for especially for risk reviews and especially for the project teams and te- uh, the leads.

Keep it simple because, uh, a fancy, complex tool sitting around a workshop is a, a big waste of their time, and they’ll see it as that. So, you know, you wanna, you want to keep their time reviewing risks to focusing on exactly what they’re supposed to be looking at and not, you know, these, these big fancy, you know, uh, what’s the risk velocity and what’s the, you know, the, um…

We got a variety of other things that a lot of risk tools do that aren’t necessary for a project. [00:46:00] Um, these, these very involved scientific risk studies and, and risk reviews like failure mode effects analysis, um, security vulnerability analysis, uh, pick one, HAZOPs, HAZIDs. Those are very specific and very detailed and very engineering-oriented, and they are not suited for project risk registers.

You want– The project risk register is the simplest form of risk review that exists. It’s, it’s very basic, focused on project objectives. So you wanna use the, the simplest tool you can, especially when it comes to doing the reviews and workshops 

Orion Matthews: And then but you had a tool that you said was one of the best in the industry.

Like, what was that doing that was so cool? 

Matt Mitchell: Uh, that one was, was pretty cool because it did all of those methodologies in one single platform. So, uh, we actually ended up, uh, using it and, and kind of customizing it a little bit to make it super [00:47:00] simple for project risk registers. Uh, but we would in many cases export that from that tool for a review because we only wanted a few fields from- Yeah

from that risk register, uh, while we were doing the review. So y- yeah, that’s where the technology is important because you, you… if you choose too complex of a tool and it’s too difficult to do that export and review or, you know, put it in a PowerPoint even, uh, then it, it, it, it just won’t get done and it won’t get updated and, and, you know, you’ll have bad data in there 

Orion Matthews: So you had a tool that you could kind of export into a simple view to actually conduct your meetings, but on the back end it, like, imported schedule and did the Monte Carlo, or it had PERT for…

It had portfolios and, and things like that. So that was really like a point solution for people that were specialists. But when it actually came to communicating risk or trying to, like, assign s- like workflow related stuff was better managed in Excel rather than- Right … having 20 people have a login to a risk [00:48:00] tool that they have to, like, organize their risks in and all of that.

Matt Mitchell: Exactly, yeah. It, it just doesn’t get done. 

Orion Matthews: Okay. And did you find that was also the case when you were doing sort of a, a enterprise-wide multi-project portfolio as well, that you kind of allowed people to… Did you roll a tool out for that, or did you also just kind of allow people to, to work one at a time?

Matt Mitchell: Y- we did roll a tool out, and by keeping it simple and, and training those risk champions in the various areas, we were able to drive usage of it, yes. So, um, w- could we get an entire project team to go into a tool and put risks in? No, absolutely not. But having those, those point contacts, risk champions, people who understood the process out in the field, that was, uh, very valuable.

Orion Matthews: And was it like, for, for that particular case, did you start with the training and then get the tool in place afterwards? Or, or was it like, “Here’s a new tool,” and you trained as you introduced the tool? There’s always this kind of question of does it help [00:49:00] to have a system kick off? 

Matt Mitchell: Yeah. I mean, we had the tool and it…

and had it rolled out ahead of time, uh, but realized that we weren’t getting the adoption that we wanted, which is when we developed the, the training and the, you know, to teach them the process. “And by the way, here’s a tool you can use.” 

Orion Matthews: Okay. And then so, you know, you and I have talked a little bit just to like zoom out, ’cause I feel like we’re sort of, we’re starting to go further out.

Uh, I think you, you had, uh, talked about how risk has been around for tens of thousands of years, that there’s a, uh, a book that you recommended, uh, which maybe you could talk a little bit about. But when you actually get down to it, like risk is a very… is something that humans have been dealing with for, for many of years, and now it’s kind of sitting in ISO for projects.

Where do you see risk? What do you see as the, like, history of risk? Maybe you can teach us a little bit about that, and then where do you think risk as a discipline is going in the future? 

Matt Mitchell: Yeah, I [00:50:00] think, um, it’s interesting. Um, once you have that risk management mindset, it, it kind of gives you a different perspective of things.

Um, I saw an article recently that, uh, I, I have to pull it up to give the exact statist- statistics, but it said something about how cargo or a jet, the lifecycle of a jet, it’s, uh, like 25 years for passenger service, after which it’s only for cargo. It’s like, that’s a risk mitigation. We’re not gonna kill 300 people, we’re only gonna kill two, you know?

So you, you have a, you have a different perspective on, on life when you think of it from a risk management, uh, aspect. Um, but yeah, the, the book was, uh, the title is Against the Gods: The Remarkable Story of Risk. And it’s very interesting because it, it talks about some of the early philosophers and how they loved to [00:51:00] gamble because they understood what the odds were, and they were all about taking these low probability, high impact risks, uh, you know, gambling, trying to, to win something.

And, uh, that’s not all the book is about. There’s a whole lot more to it. It even talks about how, you know, the, in early civilizations, the sacrifice of, of animals was what was perceived to be a risk mitigation of, you know, fertility or crops or who knows what, right? Um, so it’s, it’s a fascinating book.

It’s a great read, and, uh, it’s pretty cheap on Amazon. Um, but w- where do I think we’re going? Uh, one of the things that I say is that the that excuse me. One of the things that I say is that the AI that we’re using in 5 years or 10 years is going to be reading the data from today. And, and so I feel like where risk management is going is leaning on AI to help us figure out what, [00:52:00] what we need to be doing to avoid risks, not, not only in the project world, but, you know, broadly.

Um, and I, I think that AI, but just like everything else, is, is going to help, uh, with that, that focus on risk management and history and what has happened and good outcomes and bad outcomes, and how do we prevent that? 

Orion Matthews: How do you see… Is risk, like you run your Monte Carlo and then you also run your LLM, you know, uh, is it sort of a new category of risk identification and forecasting?

Like, how do you see this AI, AI tools intersecting risk, like in a practical way? 

Matt Mitchell: I, I, I think Monte Carlo was maybe sort of a rudimentary early, uh, application of AI, right? Where it’s saying we have the compute power to go through these cycles of, of, uh, trying to [00:53:00] forecast what, what you think might happen.

Uh, whereas AI, I think would be a little… will be, uh, better at saying over the course of the life cycle of the project, you know, these things did or didn’t occur, and therefore your Monte Carlo is changing in this way, or your potential outcomes are changing. And I, I think AI will, will be a… will outpace Monte Carlo as an approach to, you know, the, the potential outcomes of a project 

Orion Matthews: You know, it’s kind of interesting because in a way AI is like a supe- super Monte Carlo.

So like- 

Matt Mitchell: Right … 

Orion Matthews: AI, you know, oftentimes you can think about it like Markov chains are kind of like, um, chained together sort of, uh, uh, tokens where you’re like, “This is probabilistically connected to this, that’s connected to this,” and then you zoom that up into trillions of connections. Uh- Right … and so that’s [00:54:00] kind of like if you took your risk register and then you broke it into tokens, which would be like words, and then had probabilities that…

You know, instead of Monte Carlo having a schedule that has like 10 dependencies that it’s running it on, an LLM is looking at those tokenized values and running it against trillions of connected points to like suss out probabilistic outcomes. So it really does seem like, yeah, maybe it is like a super Monte Carlo in a way.

Yeah. Uh- 

Matt Mitchell: Yeah, and the Monte Carlo is, is very dependent on the quality of the inputs, whereas with AI I, I feel like, you know, you can be a little softer on that quality and still have a good outcome. And, and, and also I think it’s easier to look across other projects with, with an LLM than it is to, you know, today’s software.

Orion Matthews: Do you… For all of the AI sort of haters in the room, um, what do you see as [00:55:00] the downside of this AI in risk? Is there… You know, obviously hallucinations, things like that. Is there some dangers that the future holds? 

Matt Mitchell: I, I still think for a lot of project scope y- you have to have the expert opinions. Uh, AI can do a lot but, you know, you need, you need people who have the experience and, and have been through it.

Um, I, I, I don’t think for some project disciplines that there is a, you know, near to midterm risk of anything going away for, for them. Uh, I believe those skills and, and experiences are, are important to have, and the- it’ll be a, a, a long time before those, uh, are impacted by AI in my opinion. 

Orion Matthews: So you, you said midterm, so what’s your…

Are you thinking we’re probably 50 to 100 years away from just robots building everything and doing their own risk registers and- 

Matt Mitchell: Yeah, the, the… Once we’re fully [00:56:00] globalized, right? Um, yeah, who- y- I say that because who knows what the future holds. I mean, just the last couple of years of technology, you know, seems like w- we’ve made some pretty big leaps.

Orion Matthews: Yeah. Okay, well, so just to kind of, kind of wrap this a little bit into a couple different dimensions, um, you know, we’ve talked about a lot here. Let’s say that I’m a project director and I just hired a risk manager, um, for a, for a mega project. What advice would you give that project director to enable that risk manager and get their risk going?

Like, what am I, what am I doing to help the risk situation? 

Matt Mitchell: Uh, if that person is starting from scratch, uh, obviously we need to know wh- who to talk to, um, make those connections, establish those relationships, uh, get to know the, the leads of the various disciplines that’ll be working on the project, uh, if those are known at the time.

Um, give [00:57:00] them the, the homework to do to, to go look at past projects and lessons learned, and talk to other project managers, project directors and, you know, just kind of get a, an understanding of the landscape of, of, for that company or, or, you know, that organization. Um, but yeah, certainly develop those relationships as early as possible.

Orion Matthews: Okay. And then let’s go up a level. I’m vice president of this company. We’re gonna take on this mega project. We just FID’d or we’re a little bit into it. How do I know if risk is actually being managed well? What are the signals that I could see where I’m like, “We probably have a risk problem we need to, like, figure it out,” or, “This is excellent.

Risk is running really well in my organization”? Like, what, what would you advise someone like that to look for? 

Matt Mitchell: I- if, uh, as long as they are very well aware of, of the risks of, of the, of their various projects, I would say it’s running well. Uh, one of the main things that I encourage people to do is [00:58:00] to describe risk in a way that it could be understand, understood, excuse me.

Describe risk, risk in a way that it can be understood by someone who has nothing to do with the project. 

Orion Matthews: Okay. 

Matt Mitchell: So they, they need to understand exactly what that risk is, you know, not just $10 million. We, we have to say what that risk is and, and it has to be described in a way that is meaningful, uh, for outside, uh, parties.

Orion Matthews: Okay. So if I’m an executive and I’m, I’m s- looking at this project and I get the risk register out, and it’s highly technical stuff where I’m like, “I could not hand this to an investor or somebody else, and they would have no idea what’s going on here,” that’s probably- Correct … a flag that you wanna, um, you wanna take a harder look at risk and, and maybe level up a little bit for the organization.

Yeah. Yeah. That’s- 

Matt Mitchell: Absolutely … 

Orion Matthews: that’s great advice. Okay. Yeah. And then what if, uh, just like one [00:59:00] more perspective here. What, what if I’m sort of, uh, on a project and I wanna be, uh, I’m like a scheduler or an engineer or someone in the field, and I wanna be good for the risk manager. Like, what, what advice would you give them to support this new risk manager that started, um- 

Matt Mitchell: Y- y- a- always analyze inputs into your, your cost or your schedule, uh, with a little bit of skepticism, and ask questions, uh, to try to make sure that you as a, as the scheduler or, or as the, uh, cost control person, uh, also buy into that result and, and, and you know what the risks are, and you know that they have been identified and/or mitigated.

Um, yeah, to, to, to the extent that that person can be kind of the front end of that, uh, elicitation of the [01:00:00] risk, that that would be helpful for the risk manager. 

Orion Matthews: Okay. And then I guess one, one last thing, uh, out of, uh, if I’m starting a new project, should I insource or outsource risk? What’s the, what’s the, uh, what’s the cost benefit on that?

Because a lot of big orgs, they just sort of have a outsourced risk function, and some people bring risk in-house. What… Do you have a strong preference or opinion on that? 

Matt Mitchell: I found it to be pretty effective to be insourced. Obviously, not everybody can or, or wants to do that. And certainly with risk management, if it’s not very well understood in the organization, it might be more effective to outsource it.

Excuse me. Um, certainly I, I have a little bit of a bias that I can recognize there that, you know, it worked really well by insourcing it. Um, but I, I would just say, you know, again, a- a- all of those key things, making sure that, that whoever the person is that’s doing it, [01:01:00] especially if it’s outsourced, that you know that they’re meeting with those key, uh, individuals, key contractors, uh, discipline leads, having regular meetings, having regular updates, and describing risk in a way that your organization can understand it, not just the risk manager.

Um, y- you can have success either way. 

Orion Matthews: Okay. Is there a single takeaway that you would love for someone to get from our conversation? What do you think is the most important thing or one of the most important things that you’d like them to remember or that we could highlight? 

Matt Mitchell: That’s a good question. Um, I’d, I’d say…

Oh, sorry, I got a frog in my throat. I would say, uh, there are a couple of key concepts in risk management that have always stuck with me. One of them I, I said a little bit ago, um, a lesson learned is a risk on a future project. I [01:02:00] feel like lessons learned are extremely important. Mm-hmm. Um, whether you, whether you call them that or not, you know, even an old risk register is, is a lessons learned register, right?

You’ve captured a number of lessons learned there. So, um, risk, uh, lesson learned is risk on a future project. And then another one that I found in an old Navy training slide deck was change is the mother of all risk. Okay. And if you think about that, you know, as a concept, a lot of times when you have bad outcomes, it can be traced back to some kind of a change or a decision or something that we did differently than we had originally planned.

Uh, and, and so anytime there’s any talk of change, that, that should be a risk conversation 

Orion Matthews: Cool. Change is the mother of all risks. It, uh, kind of gets back into how time is always required for, [01:03:00] for risks. 

Matt Mitchell: Right. 

Orion Matthews: Yeah. 

Matt Mitchell: Yeah. 

Orion Matthews: It’s… That’s, uh, 

Matt Mitchell: that’s- Yeah. And the, and the whole CUSO concept, right? Y- this is your risk, and any deviation from that is…

I- I’m sorry. This is your outcome, and any deviation from that is a risk. 

Orion Matthews: Yeah. Well, so what, what advice would you give if someone’s listening to this and they’re in college and they wanna go become a risk manager? Do you have advice for someone that might be pursuing a career? 

Matt Mitchell: Uh, I would say y- you can do a lot of research.

Um, just keep in mind that project risk management is the simplest form of risk methodologies that exists. It’s very basic, uh, that the simpler you approach it, the more success you’ll have and the easier it will be to replicate that success over time, especially over the life cycle of a project. Keep it simple.

Um, don’t, don’t overanalyze the, all the Google results that are out there that tell you what [01:04:00] project risk management should be. It’s, it’s, it’s very basic. 

Orion Matthews: But how do you get a job in risk? Like, if they’re graduating What’s the- 

Matt Mitchell: Yeah … what’s the pathway? Uh, the… So there are, uh, there are jobs open currently for project risk managers.

Uh, that does exist as a role. Uh, typically, it’s within, like, an EPC-type company, and they’re working across multiple projects, which means that that company is trying to, you know, have a, a discipline across every project that is risk management. So, uh, kind of everything we described today. Those, those jobs exist.

Um, you know, you, you… It’s, it’s, uh, sometime easier to move into that role once you’re within a company and are working on a project. Um, that, that sometimes is a, a good approach to getting into that role. It’s kind of how I found myself there. 

Orion Matthews: Okay. So it’s sort of a lateral move. You sort of start on these projects and then m- make your way into the risk space when a opportunity opens [01:05:00] up.

Matt Mitchell: Yeah, yeah. Yeah, if you’re really, if you’re really into risk management as a, as a discipline, um, you, you’ll know it, right? But, um, that, that for s- for an organization that recognizes the value of that, they love to have people in those types of roles. 

Orion Matthews: If I’m that student, how do I sense-check that myself?

Like, let’s say I’m, like, an engineer, I’m thinking about risk. Maybe that’s where I wanna go. But then I’m like, “You know what? I really don’t like working with people.” You know, I think from our conversation we’d know, okay, that your profile might not actually enjoy this. What pro- w- what profile would, do you feel like?

Or what’s something students could think about to, like… 

Matt Mitchell: The, the, the very curious. Someone who’s very curious and loves to always be learning, because e- every project is different. And though you’ll have a lot of repetition of, of types of risks and, and individual risks, every, every project is different.

The site is different. The geography is different. The climate is different. The scope [01:06:00] of the project is different. Materials are different, right? So you always have to think through what, what is different about this project? What risks might I have? What have I not thought of yet? 

Orion Matthews: Interesting. So it’s like if you’re considering a job in patent examining, you might want, you know, you could, you know, think about risk too, right?

Like just being able to be on a continual learner as well. Yeah. It sounds like you have to kind of have that curiosity. 

Matt Mitchell: It is, absolutely. Yeah, yeah. I’ve heard it said that, um, you know, a project manager might work on three projects in their career, uh, you know? But when you’re talking about a risk manager, you, you are likely going to work on dozens of projects.

Orion Matthews: Interesting. Okay. Well, uh, is there any books or industry associations that you would recommend? We talked about Against the Gods: The Remarkable Story of Risk. Uh, any other sort of resources out there or [01:07:00] things that… podcasters you follow, anything that other people could go deeper, um, with? 

Matt Mitchell: I, I would say the, uh, the Project Management Institute guidance on risk management is really good.

Uh, it’s, it’s applicable. There are some concepts in there that are, um, you know, maybe a little more advanced for some projects, uh, and it tries to be, you know, all-encompassing every type of project. Um, but that’s, that’s good guidance and it’s, it’s specific to projects. So that, that’s kind of where I would start.

Uh, you know, I mentioned ISO 31000. Uh, that is a framework and it’s more geared toward corporate-type risk management implementation, so I, I, I wouldn’t say let that be too much of an influence other than to say that there’s a process that should be followed. Uh, same with COSO ERM. Uh, another good, uh, reference is, I believe it’s ISO Guide, I think it’s 73, but [01:08:00] it’s all of the definitions of terms around risk management.

The one I gave about the definition of risk, that’s from the ISO Guide, I, I think the number is 73. That’s another good one to, to get familiar with. 

Orion Matthews: Cool. And, um, is there any conferences that people go to on risk that are really good to go into or surface? Is it really the PMI conference or is there like little niche risk people association?

Matt Mitchell: Yeah, I mean, there, there’s all kinds of stuff on LinkedIn that you can find. Um, risk can mean so many different things and, and project risk is, is a very specific discipline within that larger risk, um, concept. Uh, but things like, um, IPA and, and project analysis, they do a lot of, of project specific focus on risks.

So any, any kind of IPA conference you can attend, I would encourage. 

Orion Matthews: Okay. Great. Well, Matt, I really appreciate you [01:09:00] joining us, sharing all of your wisdom. Is there any other things, any other tips or tricks you want to leave us with before we wrap up? 

Matt Mitchell: Any other tips and tricks? Uh, you know, I talked about the ISO Guide 73 and, and, uh, language.

That’s one thing we didn’t talk about, um, just the terminology. S- settle on a set of definitions, and just know that people will have experienced other terms that meant the same thing. Mm-hmm. Like severity or impact, right? Those kind of mean the same thing or in a risk management, uh, in, in risk management terminology.

But just define what all those terms are for your project and for your program. 

Orion Matthews: Going back to, like, having a singular perspective is really important- Right … because if you’re, if you have two different scales that you’re measuring things against, doesn’t work at all. Do you- Exactly … like, do you send out that appendix to everybody before as, like, a prep activity?

Or how do you actually get that front and center? 

Matt Mitchell: [01:10:00] Um, that’s a good question. We build it into the guideline documentation. So anyone who’s curious enough to read that would, would see it. Uh, but yeah, at, at a workshop, we typically would have a series of handouts, your risk ra- risk, uh, matrix, uh, so, you know, people are, are grading their risk, they know what they’re working from.

And then, uh, you know, terminology, uh, definitions. 

Orion Matthews: Very cool. Very cool. Well, Matt, uh, thank you for joining us today. I was- learned so much, uh, about Leviathan, kind of your role in that. We went sort of deep on the high end of risk with Monte Carlo and down to the low, uh, sort of just conceptual definition of it.

I, I can’t thank you enough for taking us through this. Uh- Sure … appreciate your time today, and, um, hope that we get to chat with you again about this important topic. 

Matt Mitchell: Absolutely. I appreciate it. Thanks for your time as well.