I'll Get Those Priorities to You Tomorrow... But First...
By Carl Pritchard, PMP
By Carl Pritchard, PMP
Priorities. What comes first? Really? In project portfolio management, the first priorities are supposedly those that are the most important to the organization. That lasts until the first fires begin. In teaching a Managing Multiple Projects course for the Project Management Institute® (on-line), we talk a lot about how to establish both formal and informal priorities and what it would take for issues to supercede those priorities.
I got a taste of my own medicine last week when a friend told me to check out the front page of my corporate website (emphasizing that he hadn't done it). Expecting to see my own smiling visage, I was instead surprised to find the words "YOU'VE BEEN HACKED" staring up at me, along with some pretty threatening language. Depressing stuff. The article I was working on? Forgotten. The proposal due to a client the next day? Secondary. What suddenly became the one and only thing that I had to do was to report, clean out, and restore my office website. Nowhere on my priorities list had I included "Website Crises" as an issue or even a weight, but suddenly it had taken the front burner (and most of the rest of the stove).
Now that life is back to a relative sense of normalcy, thanks to my webmaster (Chris), I've been trying to figure out how I could have put that on my priority radar without overemphasizing what I hope was a one-time event. Crises do belong on the radar, but it gets down to ensuring we aren't saving the bathwater while the baby gets away.
Crisis Prioritization
All organizational and personal prioritization scales differ, so it's impossible to ascribe a single set of one-size-fits-all numbers to any process of this ilk. What is possible, however, is to define the way in which crisis priorities can be integrated with standard organizational priorities to validate, yet again, if we're working on the right things first.
For crises, there are two basic considerations:
I got a taste of my own medicine last week when a friend told me to check out the front page of my corporate website (emphasizing that he hadn't done it). Expecting to see my own smiling visage, I was instead surprised to find the words "YOU'VE BEEN HACKED" staring up at me, along with some pretty threatening language. Depressing stuff. The article I was working on? Forgotten. The proposal due to a client the next day? Secondary. What suddenly became the one and only thing that I had to do was to report, clean out, and restore my office website. Nowhere on my priorities list had I included "Website Crises" as an issue or even a weight, but suddenly it had taken the front burner (and most of the rest of the stove).
Now that life is back to a relative sense of normalcy, thanks to my webmaster (Chris), I've been trying to figure out how I could have put that on my priority radar without overemphasizing what I hope was a one-time event. Crises do belong on the radar, but it gets down to ensuring we aren't saving the bathwater while the baby gets away.
Crisis Prioritization
All organizational and personal prioritization scales differ, so it's impossible to ascribe a single set of one-size-fits-all numbers to any process of this ilk. What is possible, however, is to define the way in which crisis priorities can be integrated with standard organizational priorities to validate, yet again, if we're working on the right things first.
For crises, there are two basic considerations:
- urgency
- impact
How quickly will this become a major disaster? How much of a "major" disaster does this crisis constitute? The impact to my business of a single day of website loss is nominal. The impact of a week or more could become a serious blot on my client image. A month or more could cost long-term business. Note that the urgency is really not there for a first-day fix. But if allowed to continue, this problem escalates dramatically over time, undermining confidence in the organization. So how quickly does it have to be fixed?
Most clients will understand a one- or two-day outage on a corporate web site. As such, the first triage that was done after the crisis arose should have indicated that any other pressing deadlines (like the proposal due the following day) should have taken priority. But because crises loom large and seem insurmountable, they often shove more pressing work out of the way.
One student's organization prioritizes their projects as 1-, 2-, and 3-class, with 3-class being the most important and pressing. Since crises exist on a different plane of reality (sudden, immediate, unplanned), I might suggest that crises should be on the half-scales at .5, 1.5, 2.5, 3.5. That identifies clearly which projects must occur before the crisis is resolved and which must wait. It also affirms that we (as project managers) don't have to make the call between project and crisis without some guidance.
For that scale, let me offer my thoughts on the gradient levels-
Most clients will understand a one- or two-day outage on a corporate web site. As such, the first triage that was done after the crisis arose should have indicated that any other pressing deadlines (like the proposal due the following day) should have taken priority. But because crises loom large and seem insurmountable, they often shove more pressing work out of the way.
One student's organization prioritizes their projects as 1-, 2-, and 3-class, with 3-class being the most important and pressing. Since crises exist on a different plane of reality (sudden, immediate, unplanned), I might suggest that crises should be on the half-scales at .5, 1.5, 2.5, 3.5. That identifies clearly which projects must occur before the crisis is resolved and which must wait. It also affirms that we (as project managers) don't have to make the call between project and crisis without some guidance.
For that scale, let me offer my thoughts on the gradient levels-
3.5 - Urgent and high impactIdeally, the impact scales would mirror those laid out for a risk qualification scheme, but if not, these would include those that involve direct impact to human life, loss of standing as a corporation or organization, or permanent damage to the corporate entityUrgent would be defined at those crises that, if not resolved immediately will exacerbate the impact, or the full brunt of the impact is already in force.
2.5 - Urgent and moderate impact or Pressing and high impactWhile the high impact scale would remain the same, moderate impact are those that would be visible to the customer base and paint the organization in a significantly less favorable light.
Pressing would be defined as those crises that may not suffer from a one- or two-day lapse in correction, but any long-term delay will exacerbate the situation.
1.5 - Non-urgent with high impact, Pressing with moderate impact or Urgent with low impactHere, the only change is that low impact issues are those that are felt internally, but are not readily visible outside the organization.
Non-urgent indicates that a significant amount of time may lapse before the situation begins to escalate (which makes you wonder if it was a crisis to begin with).
.5 - Non-urgent or pressing with low impact
Normally, these "crises" exist only in the eyes of those who identify them.
When I first discovered the hacker's handiwork, I was in four-alarm, call-out-the-trucks mode. I was on the phone with the State Police cybercrimes unit and spent a significant chunk of my day discussing strategy with some individuals I considered web-savvy. A critical, time-sensitive proposal on my desktop would have to wait. While that proposal was a "3" as a business priority, the urgency of the hack pushed it off my projects list temporarily.
In retrospect, the crisis I faced was, at worst, a 2.5 on this crisis scale, and as such, I should have taken stock and invested my afternoon in the proposal, where I belonged. Yes, the web site is an important component of business, but no, it was not more important than that particular project.
If the same thing happened to my personal web pages, the crisis scale might drop to 1.5, despite my frustration with the experience. If the same thing happened to Amazon or E-Bay, it would definitely qualify as a 3.5 "all-hands-on-deck" kind of experience.
All too often prioritization models do not take crises into account, assuming that the models will speak for themselves in terms of identifying which work has to come first. Without the capacity to address crisis priorities, most of the prioritization models that exist will come up short in the intense glare of the next short-term disaster... waiting in the wings.
In retrospect, the crisis I faced was, at worst, a 2.5 on this crisis scale, and as such, I should have taken stock and invested my afternoon in the proposal, where I belonged. Yes, the web site is an important component of business, but no, it was not more important than that particular project.
If the same thing happened to my personal web pages, the crisis scale might drop to 1.5, despite my frustration with the experience. If the same thing happened to Amazon or E-Bay, it would definitely qualify as a 3.5 "all-hands-on-deck" kind of experience.
All too often prioritization models do not take crises into account, assuming that the models will speak for themselves in terms of identifying which work has to come first. Without the capacity to address crisis priorities, most of the prioritization models that exist will come up short in the intense glare of the next short-term disaster... waiting in the wings.
No comments:
Post a Comment