They are not dramatic. They are quiet, competent adaptations that leave every formal indicator intact.
Which is why acceptance risk needs a third dimension beyond likelihood and impact. If this happens, how would the organisation find out, and when?
A risk that announces itself is manageable almost regardless of its likelihood. A system nobody can log into produces a service desk queue within an hour, and the correction is cheap.
A risk that would take two years to surface is expensive at any likelihood. By the time it is visible, the project has closed, the team has dispersed, and the workaround has become infrastructure.
Two things follow. Detectability is a design choice rather than a property: the measures that would reveal the quiet failures can be built, cheaply, before go-live. And those are the risks worth spending measurement effort on.
Every organisation that discovered a failed implementation eighteen months late had the evidence available in month two. What it did not have was anything built to see it.
From Built to Be Used, chapter 7.
#RiskManagement #DigitalTransformation #ITgovernance
They are not dramatic. They are quiet, competent adaptations that leave every formal indicator intact.
Which is why acceptance risk needs a third dimension beyond likelihood and impact. If this happens, how would the organisation find out, and when?
A risk that announces itself is manageable almost regardless of its likelihood. A system nobody can log into produces a service desk queue within an hour, and the correction is cheap.
A risk that would take two years to surface is expensive at any likelihood. By the time it is visible, the project has closed, the team has dispersed, and the workaround has become infrastructure.
Two things follow. Detectability is a design choice rather than a property: the measures that would reveal the quiet failures can be built, cheaply, before go-live. And those are the risks worth spending measurement effort on.
Every organisation that discovered a failed implementation eighteen months late had the evidence available in month two. What it did not have was anything built to see it.
From Built to Be Used, chapter 7.
#RiskManagement #DigitalTransformation #ITgovernance
This article accompanies the book Built to Be Used.