CVS Health\nIn my last blog with Stephen Gold, EVP of Business and Technology Operations and CIO of CVS Health, we discussed Gold\u2019s approach to continuity of value, a process that Gold uses to make sure he and his business partners make the right IT investments.\u00a0\nNo doubt, you have a process that you use to tie investments to value.\u00a0 Once you\u2019ve spent all of that time making sure you are investing wisely, wouldn\u2019t it be great if your projects were successful? That\u2019s where \u201crisk management\u201d comes in.\nProblem Seeking, Not Problem Solving\n\u201cCIOs and IT leaders often don\u2019t pay as much attention to risk as they should because it goes against human nature,\u201d says Gold. \u201cBy nature, people are optimistic; we tend to assume the positive, even when we develop software.\u00a0 We test to make sure our functional designs work. But are we planning, building, and testing for the \u2018negative\u2019 use cases? Generally not as often, and it\u2019s not because we are technically deficient.\u00a0 It\u2019s because that kind of thinking puts us out of our comfort zone. Most people think about problem solving; \u2018risk management\u2019 is about problem seeking \u2013 anticipating problems and searching for them proactively \u2013 it\u2019s a different mindset.\u201d\nAccording to Gold, most project management literature addresses several critical aspects of managing a project: charters, project membership, status reports, cadence and metrics. \u201cThese topics are all important and necessary, but they are not sufficient,\u201d says Gold. \u201cI have noticed throughout my career that the skills and tools we are missing the most are those which deal with managing risk.\u201d\nIf risk management is not already a part of your organization, then CIOs would be wise to adopt a formal risk management program to embed a more complete perspective into the IT team\u2019s every day thought.\nRisk Management: a Five Step Process\nAt CVS Health, risk management is a five-step process that includes planning, identification, quantification, response, monitoring and control.\n\u201cOur formal risk management practice starts in the earliest stages of portfolio planning and continues through to project execution and post-project review,\u201d says Gold.\n\u201cIf you look at a work breakdown structure, there is a whole laundry list of risks that should be a part of every project,\u201d says Gold. That laundry list might include:\n\nAvailability of resources\nNewness of technology\nLack of familiarity with technology or processes\nLack of training\nCritical path tasks\nTasks with several predecessors\nOptimistically-estimated tasks\nTasks reliant on external resources\nTasks in parallel\nTasks with many people assigned\nQualifications and skills\nHolidays, vacations, illness and turnover\n\nKey to risk management is the formula that states \u201crisk equals the function of probability x impact\u201d. \u201cIf a risk has a low probability and low impact, you might be able to accept the risk,\u201d says Gold. \u201cBut if a risk has a high probability and a high impact, you have to pay attention.\u201d Depending on the probability\/impact equation, you can accept, avoid, transfer, share, reduce or ignore the risk.\nPost Go-Live Review\nTo Gold, one of the most critical components in a risk management process is immediately following the launch of a project. \u201cWe look back at what went well and what didn\u2019t go well,\u201d says Gold. \u201cWhere did we miss the risk?\u201d \u00a0It\u2019s the continuous improvement aspect of the program.\nThroughout the year, Gold and his team turn a lessons learned inventory from project post mortems into a checklist for every single project. \u201cIf issues show up often enough, they should become part of our risk management process,\u201d he says.\nOne lesson learned that Gold and his team rely on is looking at the percentage of time that someone is assigned to a project along with what else they are working on. \u201cIf I am assigned to four projects with 25 percent of my time allotted to each, the probability that I can do all of those on time, on budget, and high quality is very low,\u201d says Gold. \u201cWhat are the odds that every project will demand my time without a collision? It\u2019s zero.\u201d\nThis means that whenever people are assigned to projects less than full time, Gold and his team include a proactive conflict analysis to understand what else that person is working on and the probability that there will be a collision.\nTo Gold, \u201cThe key point is that risk management is less about process and communication, and more about the depth and rigor of risk identification and remediation strategy at the outset of a project. Some people will just check the risk management box and then wonder what went wrong. After projects fail, you will then get a thesis on what went wrong, but that\u2019s after the event. How do we anticipate and plan for this before we start?\u201d\nIt is more fun to go full-steam ahead with a project than stop to think about potential pitfalls, but when your business is more dependent than ever on good technology, a culture of risk management is your next horizon.\nAbout Stephen Gold\nStephen Gold joined CVS Health in July 2012, and is the company\u2019s Executive Vice President of Business and Technology Operations and Chief Information Officer. In this role, Stephen is the company\u2019s senior technology executive and has responsibility for all information systems and technology operations, including information technology strategy, application development, technology infrastructure, and business and technology operations. Before coming to CVS Health, he was Senior Vice President and CIO for Avaya. Prior to that, Stephen was EVP, CIO and Global CTO with GSI Commerce, and VP and CIO with Merck. He has an undergraduate degree in computer science from Saint John\u2019s University, and currently serves as a member of their advisory board.\nAbout CVS Health\nCVS Health (NYSE: CVS) is a pharmacy innovation company helping people on their path to better health. Through its 7,800 retail drugstores, nearly 1,000 walk-in medical clinics, a leading pharmacy benefits manager with more than 70 million plan members, and expanding specialty pharmacy services, the company enables people, businesses and communities to manage health in more affordable, effective ways. This unique integrated model increases access to quality care, delivers better health outcomes and lowers overall health care costs. Find more information about how CVS Health is shaping the future of health at\u00a0www.cvshealth.com.