There’s a moment, in many projects, when the team already knows something isn’t right. A dependency slipping, an overly optimistic estimate, a supplier not answering. The risk is there, visible to those doing the work.
And yet the project status in the reports stays green. Or amber at most, with a few reassuring notes.
The journey of a risk
Between the moment the team recognises a risk and the moment decision-makers hear about it, days can pass. Sometimes weeks. In between there are recovery attempts, “let’s try to fix it first”, informal chats with the sponsor, waiting for the next status meeting.
Every day of that journey is one day less to consider alternatives.
What “red” really means
If a critical status is read as someone’s fault — the project manager’s, the team’s, whoever made the estimates — it’s perfectly reasonable for whoever updates the project to try fixing things first and reporting later. It isn’t a lack of transparency: it’s self-defence.
The result, though, is that the problem reaches the table when there are fewer options left.
Flagging a risk shouldn’t take courage. It should be the most normal thing in the world.
Governance should make it easy to say
For flagging to become normal you need:
- clear criteria on which conditions change a project’s status;
- defined responsibilities on who can (and must) flag them;
- a discussion that is triggered automatically and focused on decisions — scope, time, resources, accepted risk — not on finding someone to blame.
Consistency first
Watch out for the opposite too: a risk doesn’t automatically mean red. You need criteria proportionate to the context, applied the same way every time. If the same situation is reported differently depending on who’s involved, it’s worth looking at how communication works, even before looking at the project.
A simple check
Take a recent project that ran into trouble and compare two dates: when the team recognised the risk, and when the organisation was able to decide how to deal with it.
The gap between those two dates will tell you a lot about criteria, responsibilities and how often you meet. Much more than any dashboard.
(I also write about it in Deliver or Die — where, I assure you, risks not reported in time have rather more… definitive consequences. 😉)
The situations described are illustrative and do not refer to any single client.