Stage 2 · Win the work · Stop 9 of 11 · The right way

What could go wrong?

The back alley's bill so far: 39 weeks · See the bill

← Back to the wrong way

The right way

Win the workWin the work: The risk workshop…
The workshop

Ground, weather, steel. Then Sam, the firm's information manager, adds four: old versions on site, sensitive drawings getting out, records lost at handover, and the new system nobody knows.

Sam: Can I add a few?

Owners

Each warning sign gets an owner and an action, on the project's risk register with everything else. Old copies come down when a new one goes up.

BuildBuild: Month eight…
Caught

The old-version action works. The van's windscreen is clear.

IT failureOne information risk, owned by IT, and two surprises.
The warning signsFour risks, four owners, four actions.

Now there is: The warning signs on the project's risk register (information risks), owned and actioned.

What's going on here

Information risks are project risks. A wrong version on site or a drawing in the wrong hands costs as much as bad ground. Putting them on the same register, with owners, means somebody is watching them.

New at this stop

The warning signs
Things that could go wrong with the information, written on the risk register like any other risk.
In the town See it in the town: what could go wrong with the information?

So far the information has travelled from Client Town to the bid room, and is heading for the Site Office. Every hop is a chance for it to go wrong: an old version on site, a sensitive drawing in the wrong inbox, records lost at handover. The warning signs put those on the same risk register as the ground and the weather, each with an owner who is watching.

Fix it Only "IT failure" on the register? Add the real ones.
  1. Add the old-version, wrong-hands, lost-records and new-system risks.
  2. Give each one a named owner and an action.
  3. Check old copies come down whenever a new one goes up.

A note for the information manager: An information risk owned by "IT" is usually owned by nobody, so put a person's name next to it.

From the standard
ISO 19650 From one vague risk to the warning signs
ISO 19650 saysMeansIn the town
Risk registerThe record of risks to the job and how they'll be managed, which includes the risks to delivering informationThe project's risk register, with the warning signs added
Information delivery risksThings that could stop the right information arriving on time and in good orderOld versions on site, records lost at handover, a system nobody knows
Security-minded approachAssessing and managing the risk of sensitive information getting into the wrong handsThe sensitive drawing that mustn't reach the wrong inbox

Based on the ISO 19650 series: the ideas come from the standard; the plain-English wording, examples and advice are InfoTown's. ISO 19650 and its UK National Annex are © ISO and BSI. You'll hear the same language across the industry. Read more for free in the Information Management Initiative (IMI) Framework guidance from BSI and nima. For the full requirements, use the standard itself.