David Hillson has been fascinated by risk management since first discovering it in the early 1980s. He says his interest has been maintained by two factors:
1. Risk management works
2. Risk management is constantly developing
David’s career in consulting and training has been focused on the first of these, helping people understand and manage uncertainty wherever and however they encounter it. Alongside this, David has been committed to learning as much as possible about risk and how to manage it more effectively.
As part of his personal journey of discovery, David came across many areas where there was lack of clarity, or where existing approaches weren’t working well. This led him to develop new approaches and techniques, many of which have been adopted into mainstream risk management. Some of these innovations offer major new insights, while others may appear to be smaller developments. But they all share the same aim: To make risk management easier and more effective.
David Hillson’s contributions to the risk management discipline and profession over the years include the following:
In the late 1990s, David was among the first to recognise the importance of managing upside risk in an integrated risk process, and this has formed a major theme in his consulting, writing and speaking work. He also had a significant influence on international standards in risk management, most of which now explicitly include both threat and opportunity in their definition of risk. This double-sided nature of risk has also been widely adopted by leading organisations as a means of creating value and supporting innovation at both project and business levels.
Arising from the inclusion of opportunities in the risk process alongside threats, David proposed a range of risk process modifications, including a double-sided probability-impact matrix format that allowed prioritisation of both threats and opportunities in a single consistent technique. He also produced a set of defined opportunity response strategies for focusing action (exploit, share, enhance, accept), which mirrored the existing threat-based strategies (avoid, transfer, reduce, accept).
Until the late 1990s, no guidance was available to practitioners on how to respond to identified risks. The thinking was that as each risk is unique, so the responses to that risk would also be unique. David realised that risk responses could be grouped under a few generic headings, and that the same types of responses were being employed to tackle a wide range of risks. In 1999, David presented a conference paper proposing four risk response strategies: avoid, transfer, mitigate, accept. He suggested that for each identified risk, the first step was to select a suitable strategy, then design specific tailored actions to implement the chosen strategy for that risk. This approach simplified the risk response step, creating structure for this part of the risk process, and providing useful guidance to practitioners.
Many people confuse risks with their causes or their effects. In 2000, David published a seminal paper on risk metalanguage, providing a three-part generic risk description template that separates cause-risk-effect. This simple concept has proved powerful in focusing risk identification to enable real risks to be found and clearly described.
To be sure that organisations and teams consider all sources of risk, David developed the Risk Breakdown Structure (RBS) in 2002. This provides a framework for many aspects of the risk process, including risk identification, risk categorisation, risk ownership, risk reporting, and lessons learned. David’s generic RBS has been used as a basis to develop industry-specific versions, as well as RBS frameworks for use within particular organisations.
David has worked in partnership with Dr Ruth Murray-Webster since 2005, to provide unique insights into the important human aspects of managing risk, including defining the influence of the “triple strand” of conscious, subconscious and affective factors on risk perception and subsequent behaviour. Ground-breaking research into how groups make decisions perceived as risky and important led to development of a new behavioural literacy model for managing group behaviour (the Six A’s Model), using an extension of standard emotional intelligence theory.
When the term “risk appetite” was first used, David Hillson and Ruth Murray-Webster recognised significant confusion in its understanding and application. Starting from first principles, they created a consistent landscape that allowed senior decision-makers to define “how much risk was too much risk”, turning internal risk appetite into measurable risk thresholds. This approach has unlocked the use of risk appetite by boards to take the right amount of risk in order to achieve their strategic objectives.
Everyone knows that culture is important, as it shapes behaviour in overt and hidden ways. In 2012 the Institute of Risk Management (IRM) launched a thought-leadership research project to provide guidance on risk culture, and David was part of the core team. One of his main contributions was to provide a clear definition of risk culture (“the values, beliefs, knowledge and understanding about risk shared by a group of people with a common purpose”). He also developed the simple A-B-C Model, showing how Attitudes shape Behaviour, and repeated Behaviour forms Culture, with a feedback loop indicating how Culture influences both Attitudes and Behaviour. The risk culture definition and the A-B-C Model were both included in published IRM guidance.
Despite wide acceptance of the concept that risk includes both threat and opportunity, practical implementation of upside risk management was weak and inconsistent, with no clear guidelines. Working with Peter Simon in 2007, David developed the ATOM Methodology (Active Threat & Opportunity Management), providing a simple scaleable methodology that could be applied to projects of any size in any industry. ATOM includes templates, techniques, reporting formats, hints and guidelines, and has been widely adopted in many organisations, as well as being used by universities to structure their risk teaching.
The ATOM Methodology was updated in 2020 to reflect current good practice, as described in the book “Practical Project Risk Management: The ATOM Methodology” Third Edition
Early in David’s career as a risk consultant, he recognised the lack of an accepted framework for benchmarking organisational risk management capability. Drawing on existing models such as SEI-CMMI or EFQM, David developed the Risk Maturity Model (RMM) in 1997, the first model of its type to focus exclusively on risk management. Since its first publication, variants of RMM have been developed to focus on project risk, commercial risk, contract risk, etc., as well as specific versions aimed at particular industry sectors, the charity sector or government.
In parallel with development of RMM to assess organisational risk capability, David developed the PEAKS framework to define aspects of personal risk management competence in 2000, working with Dr Ruth Murray-Webster. The five PEAKS attributes cover Personal Characteristics, Experience, Attitudes, Knowledge and Skills, and each attribute has a set of defined diagnostic characteristics, allowing an individual to rate their competence against defined levels. PEAKS has been tailored to specific industries and job families, and has been used to support personal development, team formation, recruitment, training and education.
In 2002, David produced The Risk Management Professionalism Manifesto, providing ten criteria for defining a professional approach to risk management. These can be used for self-assessment by risk practitioners and risk consultants to ensure that they are operating ethically and professionally. They are also useful for organisations that use risk consultants to test whether they are receiving a professional service.
Working with Dr Ruth Murray-Webster in 2020, David developed a set of robust practical insights that support leaders who need to make good decisions in risky and important situations. Many factors influence decision-making, and things get more complicated when uncertainty is high. David & Ruth’s approach puts the decision-maker at the centre, and explains how to think and act differently to make better decisions more of the time.
Emergent risk is an increasing challenge, and standard approaches to resilience often prove inadequate. In 2023 David developed an approach called adaptive resilience that retains flexibility to respond appropriately to whatever the future brings.
Typical resilience frameworks aim to return the organisation to its prior state, while adaptive resilience goes further, seeking not only to ‘‘bounce back’’ but to ‘‘build back better’’. Practical implementation of adaptive resilience requires a number of enabling factors to be in place, including people, project, technical/contractual, and business/organisational.
Antifragility was first proposed by Taleb in 2012, but it has not been well understood or implemented to date. Seeing the potential of a new way to respond to stress that complements robustness and resilience, David used the power of metaphor to distinguish four distinct types of antifragility: innate, adaptive, rheopectic and emergent. His insights were published in 2023 in Continuity & Resilience Review, Vol 5 Issue 2.
For more details of any of these innovations, contact David Hillson