Back to all activities

Risk Modeling Using the Pre-Mortem Strategy

Summary

The pre-mortem strategy was devised to take participants out of a perspective of defending their plans and strategies and shielding themselves from flaws. They are given "a perspective where they [are] actively searching for flaws in their own plan." pre-mortum.

Considerations

    • Treat risk modeling data with the utmost security
    • Ensure that any physical notes/drawings are erased and destroyed once digitally recorded.
    • Ensure that any digital recordings of this process are kept secure and encrypted.

Walkthrough

    Prepare a flipchart / space on the white-board to keep track of process', threats, impacts, and adversaries that are identified during other activities. Participants can easily get ahead of the process as they explore individual ideas. Keeping a space for these "upcoming" activities will help re-center them on the activity at hand.

    Pre-Mortem Strategy: (30 Minutes) The pre-mortem strategy was devised to take participants out of a perspective of defending their plans and strategies and shielding themselves from flaws. They are given "a perspective where they [are] actively searching for flaws in their own plan." pre-mortum

    • Explain the pre-mortem activity. The participants are to imagine that it is months into the future and they have continued doing their work as normal. And something happened that left them entirely unable to function or functioning at a very poor level. "That is all they know; they have to explain what has happened." pre-mortum
    • Create a broad list of possible explanations for what has happened.
    • Identify the most likely explanations.
    • List the process' that would have to fail for those causes to take effect.
    • Identify two to three process' that are central to the failures and write them on a list of critical process'.

    Process/Interaction Mapping (30 minutes per process):

    • Pick a process from the list of critical processes identified above.
    • Clearly identify the process name on the whiteboard or flipchart.
    • Create a list of individuals who take part in the process.
    • Draw a symbol of the person.
    • Write a label describing their role or title.
    • Draw lines with arrows connecting individuals who interact with each other in this process.
    • Label the lines with words describing the interaction.
    • Write numbers on the interactions to show the order they occur in.
    • Continue this activity with the next critical process.

    NOTES:

    • You can add follow-on processes to examine if they are identified as critical by the participants during this activity. Specifically, the exercises in the Threat Assessment section pair well.

      • Put people on post-its to make them able to be moved around.
    • Verbally walk the participants through the completed process so you ensure you didn't miss anything.
    • Take quick notes to remind yourself of any key points not clearly marked on the map before they move on to the next activity.
    • After completing all the key events take a photo of the whiteboard / store the chart-paper for later documentation.

Recommendation

    This activity can lead to feelings of hopelessness as well as stir up direct fears or challenges that the staff face. It is important to remind the staff that any risk can be mitigated, and indeed it is the goal of an audit to identify the highest priority ones based on actual likelihood and provide guidance on mitigation.