Tender · risk workshop
Sam is on the invite list, and brings the information risks to Priya's workshop.
Sam's journey · Winning the work (tender) · Lesson 7
What could go wrong?
Before you start
In the story
Every information risk came true. None of them was on the register.
Back to the story
The right way
Tender
Each information risk gets an owner, an action and a date, like any other risk, and the bid prices the ones worth pricing.
DesignDesign: Month three…
Month three
A risk comes true. It has an owner and a plan. It's a Tuesday, not a crisis.
"IT failure"One line on the register, and every real risk came true without an owner.
Written downEvery information risk with an owner, an action and a date.
Think like Sam
Information risks are project risks. Write yours the way everyone else writes theirs: what could happen, how likely it is, who owns it and what we'll do. Then take them to the workshop yourself. If you're not invited, invite yourself.
Continue Sam's journey
Story 8: Signed, sealed
The contract is signed. Twelve subcontracts are signed. The information requirements are in one of them: ours.
The right way, explained
Every town plans for floods. Hardly any plan for the post office going missing. Information risks are ordinary risks; someone just has to write them down.
If you're the client
Share the risks you already know about: old records, sensitive assets, systems the contractor must use. Keeping them quiet doesn't make them the contractor's problem. It makes them everyone's.
In the town See it in the town: five warning signs, and one with nobody's name on it.
Sam's view: a warning sign for every risk on the road ahead, each with someone's name on it.
- 1 A warning sign for every information risk on the road ahead, written like any other project risk, each with a named owner and something being done about it.
- 2 The old register's only sign. Faded, vague, and nobody's name on it.
This is the Risk Register!
What could stop information arriving, and who owns each one.
For the audit What the auditor will ask
- Show me the information risks and who owns them.
- What did you do when one of them happened?
For the audit What good evidence looks like
- Information risks on the main register, each with an owner and an action.
- Updates over time, not one entry from the bid.
ISO 19650 Information risks
ISO 19650 expects the delivery team to keep a register of risks to delivering the information, and to manage them like any other risk.
| Typical risks | For example |
|---|---|
| Assumptions | Documents we haven't seen, things we priced on a guess |
| Timescales | Information due before the people or systems are ready |
| Capability | A firm that can't yet do what's asked |
| Standards and methods | Rules that clash, or that nobody's tested |
| Security | Sensitive information shared too widely |
Based on the ISO 19650 series: the ideas come from the standard; the plain-English wording, examples and advice are InfoTown's. ISO 19650 is © ISO and BSI. You'll hear the same language across the industry. Read more for free in the Information Management Initiative (IMI) Framework guidance from BSI and nima. For the full requirements, use the standard itself.