ISO 42001 AI Management Framework

---

Late in 2023 ISO published ISO 42001-2023 "Information technology Artificial intelligence Management System"

To quote ISO:

ISO/IEC 42001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations.

It is designed for entities providing or utilizing AI-based products or services, ensuring responsible development and use of AI systems.

For project offices and project managers, there are some points that bear directly on project objectives:

• The standard addresses the unique challenges AI poses, which may need to be in your project's requirements deck, such as properties or functionality that addresses ethical considerations, transparency, and continuous learning. 
• For organizations and projects, the standard sets out a structured way to manage risks and opportunities associated with AI, balancing innovation with governance.

Learn More
Of course, with something like this, to learn more about this you need not go further than the ISO website (more here) for relevant PDFs and FAQs. But, of course, you can also find myriad training seminars, which for a price, will give you more detail.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Efficient product quality design

---

I'm borrowing shamelessly from an essay by D. Miessler about efficiency in security design for user products by generalizing to the quality -- in the broadest sense -- of a product. That is to say: quality as evaluated by a user (quality is in the eye of the beholder, as it were)

And, I might observe that the principle explained below corresponds closely with the Agile idea of "enough, but not more than enough"

The Efficient Quality Principle

1. The quality baseline of an offering or system faces continuous downward pressure [i.e. less quality demanded] coming from customer excitement about, or reliance on, the offering in question.

2. The baseline for an offering’s quality will be set at the point at which people will not stop using the offering because it’s quality is not pristine.

3. The better the offering is, the lower the quality baseline can be without losing customers.

In other words, the way we know something has the “right” amount of quality built in is when people just keep using it. People use these offerings or systems because the value they provide massively outweighs the quality lapses  in user's minds.

The moment enough people stop using something due to quality being too bad, the baseline goes up. And not before.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Mary and John on the Critical Path

---

In project management school, the lesson on Critical Path includes this rule:

Apply resources first to the critical path, and subordinate demands of other paths to ensure the critical path is never starved.

Beware this hazard: Resources may be real people:

The problem of applying resources arises when we move from the abstract of 'headcount' to the real world of 'Mary' and 'John'. 

Alas! The "resources" are not interchangeable. Mary and John are unique. Consequently, consideration must be given not only to the generic staffing profile for a task but also to the actual capabilities of real people.

Considering Mary and John uniquely

Take a look at the following figure: There are two tasks that are planned in parallel. If not for the unique situation that Mary and John can't be applied to two paths simultaneously, these tasks could be completely simultaneous.

In fact, the critical path could be as short as 50 days -- the length of Task 1. Task 2, as you can see, is only 20 days duration. But for the assignment of Mary and John pushes Task 2 to the right.

But with only Mary and John as resources, the schedule plan stretches out to 65 as shown.

 Here's an idea:

Reorganize the network logic to take into account unique staffing applied to schedule tasks.

Now the schedule plan is shorter, though not as short as it could be if there were resources other than Mary and John. 

And that is actually the embedded lesson learned: With only Mary and John, the two tasks are no longer independent. 

And with a lack of independence, there is a "co-dependency" that is a phenomenon that has to be scheduled also. Thus, we form the rule that interdependency always stretches the plan!

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Black diamond risk management

---

If you snow ski, you understand the risk of a Black Diamond run: it's a moniker or label for a path that is  risk all the way, and you take it (for the challenge? the thrill? the war story bragging rights?) even though there may be a lesser risk on another way down.

So it is in projects sometimes: In my experience, a lot of projects operate more or less on the edge of risk, with no real plan beyond common sense and a bit of past experience to muddle through if things go wrong.

Problematic, as a process, but to paraphrase the late Donald Rumsfeld: 

You do the project with the resources and plan you have, not the resources or plan you want

You may want a robust risk plan, but you may not have the resources to research it and put it together.

You may not have the resources for a second opinion

You may not have the resources to maintain the plan. 

And, you may not have the resources to act upon the mitigation tactics that might be in the plan.

Oh, woe is me!

Well, you probably do what almost every other PM has done since we moved past cottage industries: You live with it and work consequences when they happen. Obviously, this approach is not in any RM textbook, briefing, or consulting pitch. But it's reality for a lot of PMs.

Too much at stake
Of course, if there is safety at stake for users and developers, as there is in many construction projects; and if there is really significant OPM invested that is 'bet the business' in scope; and if there are consequences so significant for an error moved into production that lives and livelihoods are at stake, then the RM plan has to move to the 'must have'.  

A plan with no action

And then we have this phenomenon: You actually do invest in a RM plan; you actually do train for risk avoidance; and then you actually do nothing during the project. I see this all the time in construction projects where risk avoidance is clearly known; the tools are present; and the whole thing is ignored.

Show me the math

But then of course because risk is an uncertainty, subject to the vagaries of Random Numbers and with their attendant distributions and statistics, there are these problems:

• It's easy to lie, or mislead, with 'averages' and more broadly with a raft of other statistics. See: How to Lie with Statistics (many authors) 
• Bayes is a more practical way for one-off projects to approach uncertainty than frequency-of-occurrence methods that require big data sets for valid statistics, but few PM really understand the power of Bayes. 
• Coincidence, correlation, and causation: Few understand one from the other; and for that very reason, many can be led by the few to the wrong fork in the road. Don't believe in coincidence? Then, of course, there must be a correlation or causation!

The upshot?

Risk, but no plan.

Or plan, and no action

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Make the maximum cost minimal

---

Full disclosure: I wrote this posting myself, but I did ask ChatGPT for some ideas to include. 

It's always a PMO objective to minimize cost if scope and quality and schedule are constant. But they never are. So, those parameters are usually intertwined and mutually dependent variables along with cost. 

But suppose for discussion that scope and quality are held constant (not to be traded off to save cost or schedule), and the primary objective is minimization of cost. Here are a few ideas.

Labor-dominant projects

I'm talking about projects where labor is 60% or more of the cost. Many software projects fall in this box, but many other intellectual content (IC) projects do as well: HR, finance, marketing, just to name a few.

Productivity

Assuming competence is not in question, the first order of business is productivity, which is always a ratio: output valued by the customer per unit of labor required for achievement. As in all ratios, the PMO can work on the maximizing numerator and minimizing the the denominator. 

Getting the numerator right the first time minimizes the cost of waste and rework and minimizes schedule mishaps. The skill required: good communications with the people who establish the value proposition. 

Minimize the "marching army" cost

But the numerator is also about finding useful outcomes for the "white space" that crops up: you have staff in place, you can't afford to let them scatter when there is downtime, so you have to have a ready backlog of useful second tier stuff. Staff you can't afford to lose, but may have downtime nonetheless, is often labeled the "marching army"

The denominator is sensitive to organizational stability and predictability, personal skills, tools, interferences, teamwork, and remote working. Anything that PMO can do about the first five is more or less mainstream PMO tasking. 

Remote working:

But the issue of large scale remote working is somewhat new since the Covid thing. Loosely coupled to that is greater emphasis on work-life balance rather than "do what ever it takes" and often for no overtime pay. 

Such has then spawned more of the "do the minimum not to get fired" mindset. All that has cast a shadow on remote working.

Cost-free synergism.

Consequently, the pendulum has swung in the direction of minimizing remote working in order to get the synergistic production (at nearly cost free) from casual contacts with other experts and innovators, to say nothing of problem avoidance and thereby waste and rework avoidance.

Risk management and scheduling

When it comes to labor, the first risk is dependable and predictable availability, particularly if the staff are so-called gig workers. Many PMOs limit W9s to less than 25% of the workforce for just this reason.

One anecdote is loose coupling on schedule tasks to allow for the occasional misstep in staffing. After all, even W2s have matters that interfere.

Material-dominant projects

Here is where a lot of construction projects, hardware development, and critical (or scarce) material projects come in.

Material impacts are largely mitigated by the usual strategies of earliest possible order, acceptance of interim and partial shipments, incentives for faster delivery, and strategic stockpiles of frequently used items.

The workforce for many of these type projects is often contracted by specific trades who have licenses to work on specific work. It's typical that these contactors operate in a matrix management environment of multiple and independent customers vying for a scarce and technical workforce. The impact is uncertainty of schedule and availability, and a cascade of dependencies that have to be reworked.

The customary approach to scarcity is cost incentives to direct resources to your need. 

The mitigation for cascading dependencies is schedule as loosely as possible so that slack among tasks forms risk management buffers to a slipping schedule.

  

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Wanted: AI Tokens

---

12 trillion

The estimated number of tokens used to train OpenAI’s GPT-4, according to Pablo Villalobos, who studies AI for research institute Epoch. He thinks a newer model like GPT-5 would need up to 100 trillion tokens for training if researchers follow the current growth trajectory. OpenAI doesn’t disclose details of the training material for GPT-4.

Attribution: Conor Grant, WSJ 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Slack is the last thing to schedule

---

Slack, aka 'buffer', aka 'white space', aka 'early finish', is the last thing to schedule. 

After all the other stuff is scheduled.

Why?

Because slack should be used (applied) last as a way of making space for schedule extension risk.

Has to be in the baseline

But in order for it to be applied properly, slack has to be in the baseline schedule to start with. In other words a schedule without slack is not a real schedule, but rather just a hopeful schedule.

What can you do with slack?

It seems that scheduling slack is just scheduling free time and unnecessarily extending the schedule. 

Not so.

Here are things you can do with slack that are value-adding:

• Protect the critical path: There are probably a lot of tasks that join the critical path, feeding partial product into the final outcomes. If those dependencies are late, so might the CP be late if it is not buffered to absorb those problems. "Critical Chain" scheduling theory is a good example of how the CP is protected with slack.

• Relieve constraints: Sometimes there is a constraint in the workflow and stuff isn't flowing as it should. Using Theory of Constraint techniques, other elements of the workflow are usually rescheduled, changed in scope, or new tools and training is applied. To make room for these new or changed activities, slack is required. 
  
  
• Protect a milestone: Even if a milestone is not on the CP it needs to be respected for its intended finish date. If there are more than one activity that contributes to the milestone completion criteria, then slack on the various joins to the milestone will protect its date.

Latest start is a no-no

The one thing to avoid is "latest-start" scheduling. Latest-start is, in effect, putting the slack first rather than last and using the slack before any risk appears. A total waste of resources!
  

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

"Transformative Trinity" -- Military Projects

---

Are you working in military projects? U.S., NATO, or the so-called 'Five Eyes'?

You may run across this concept in military systems design:

"Transformative Trinity"

And so what is that?

The “Transformative Trinity” in military contexts refers to the integration of new technologies like drones, the democratization of higher-quality information, and collaboration with commercial firms to enhance military capabilities

Generals Mick Ryan and Clint Hinote

So we are talking big project picture here, strategy if you will, with three elements: 

1. an uncrewed device -- a drone --whether on land, air, or sea (we'll leave space out if for this discussion); 
2. the flow-down and flow-across of ISR to the warfighters and joint planners, and 
3. a partnership with industry (we project guys), to include the off-the-shelf-stuff, albeit perhaps modified for the battlefield (See: Ukraine)

The idea of course is to use the "transformative trinity" to transform warfare, less touch except by remote. And tech projects are going to be right in the midst of it!

So add it to your dictionary: the military systems "transformative trinity"

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Why software remains insecure

---

I like a lot of the stuff Daniel Miessler thinks about. 

He has an interesting essay about "why software remains insecure". By insecure, he means released software with known functional and technical bugs at release, and even far beyond release 1.0 and 2.0 and on and on.

Why should this be?

Miessler opines: 

"... the existence of insecure software has so far helped society far more than it has harmed it".

"Basically, software remains vulnerable because the benefits created by insecure products far outweigh the downsides. Once that changes, software security will improve—but not a moment before".

And if you buy that idea, then you probably understand his point that there is no real business or user incentive to repair things to a higher standard of quality. Users put up with it; projects are bound to the clock.

This process will do nicely: Develop, quickly test, release, rinse, repeat.

Domain sensitive

Of course, there are significant and manifestly important project domains where such slack in quality would not be tolerated -- could not be tolerated -- or even understood. Think: space launches of all sorts; command and control systems that are kinetically fatal in outcome; even self-driving systems.

It's not SEI Level 5!

Without a maturity model as a regulatory tool for systemic quality, other priorities dominate.

The cart and horse are in a mixed order: release, measure the temperature of users and regulators, and then fix it -- just enough. Sort of Agile that way: do enough, just enough, to pass the sprint test and move on.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Budget wisdom

---

"Priorities aren't redal unless budgets reflect them"

CIA Director Burns

Of course, Director Burn's assertion is spot-on and another version of "show me the money", or perhaps sticking with the intelligence domain: "follow the money".

This whole idea is the bane of strategic planning in which long-term plans outrun the budget authority and even outrun the budget planning, in other words: a floating apex, unsupported by a pyramid of budgets.

Nonetheless, lightening could strike. Having an idea on the shelf is not all bad. But if it's technology, it has a half life measured in a year or two. So, a constant dusting to keep current is required. Who knows: the money might show up.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

AI-squared ... a testing paradigm

---

AI-squared. What's that?

Is this something Project Managers need to know about?

Actually, yes, PMs need to know that there are entirely new test protocols coming that more or less challenge some system test paradigms that are at the heart of PM best practice.

AI-squared

That's using an AI device (program, app, etc.) to validate another AI device, sometimes a version difference of itself! Like GPT-2 validating -- or supervising, which is a term of art -- GPT-4. (Is that even feasible? Read on.)

As reported by Matteo Wong, all the AI firms, to include OpenAI, Microsoft, Google, and others are working on some version of "recursive self-improvement (Sam Altman), or as OpenAI researchers put it: the "alignment" problem which includes the "supervision problem", to use some of the industry jargon. 

From a project development viewpoint, these techniques are close to what we traditionally think of as verification that results comport with the prompt, and validation that results are accurate. 

But in the vernacular of model V&V, and particularly AI "models" like GPT-X, the words are 'alignment' and 'supervision'

• Alignment is the idea of not inventing new physics when asked for a solution. Whatever the model's answer to a prompt is, the prompted answer has to "align" with the known facts, or a departure has to be justified. One wonders if Einstein (relativity) and Planck (quantum theory) were properly "aligned" in their day. 
  
  
• 'Supervision is the act of conducting V&V on model results. The question arises: who is "smarter": the supervisor or the supervised? In the AI world, this is not trivial. In the traditional PM world, a lot of deference is paid to the 'grey beards' or very-senior tech staff as the font of trustworthy knowledge. This may be about to change.

And now: "Unlearning"!

After spending all that project money on training and testing, you are now told to have your project model "unlearn" stuff. Why?

Let's say you have an AI engine for kitchen recipes, apple pie, etc. What other recipes might it know about? Ones with fertilizer and diesel? Those are to be "unlearned"

One technique along this line is to have true professional experts in the domains to be forgotten ask nuanced questions (not training questions) to ascertain latent knowledge. If discovered, then the model is 'taught to forget'. Does this technique work? Some say yes.

 

What to think of his?

Obviously, my first thought was "mutual reinforcement" or positive feedback ... you don't want the checker reinforcing the errors of the checked.  Independence of the developers by the testers has been a pillar of best-practices project process since anyone can remember.

OpenAI has a partial answer to my thoughts in this interesting research paper.

But there is the other issue: so-called "weak supervision" described by the OpenAI reseachers. Human developers and checkers are categorized as "weak" supervisors of what AI devices can produce. 

Weakness arises by limited by time, by overwhelming complexity, and by enormous scope that is economically out of reach for human validation. And, humans are susceptible to biases and judgments that machines would not be. This has been the bane of project testing all along: humans are just not consistent or objective in every test situation, and perhaps from day to day.

Corollary: AI can be, or should be, a "strong supervisor" of other AI. Only more research will tell the tale on that one.

My second thought was: "Why do this (AI checking AI)? Why take a chance on reinforcement?" 

The answer comes back: Stronger supervision is imperative. Better timeliness, better scope, and improved consistency of testing, as compared to human checking, even with algorithmic support to the human. 

And of course, AI testing takes the labor cost out of the checking process for the device. And reduced labor cost could translate into few jobs for AI developers and checkers.

Is there enough data?

And now it's reported that most of the low hanging data sources have been exploited for AI training. 

Is it still possible to verify and validate ever more complex models like it was possible (to some degree) to validate what we have so far?

Unintelligible intelligence

Question: Is AI-squared enough, or does the exponent go higher as "supervision" requirements grow because more exotic and even less-understood AI capabilities come onto the scene?

• Will artificial intelligence be intelligible? 
• Will the so-called intelligence of machine devices be so advanced that even weak supervision -- by humans -- is not up to the task? 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Senior Leadership

---

"I don’t think you can be good at these jobs unless you’re willing to lose them. You have to get your mind at a stage in your life and career where the best move to make could put yourself in jeopardy to losing your job, but it’s the best move to make"

Paul D. Ryan

In many respects Ryan's "put yourself out there" advice for successful senior leadership is a great discriminator between leadership and managership, and certainly is a "lean into it" risk attitude.

Who said compromise?
Possibly hidden behind the words, though Ryan didn't say it, is a willingness for pragmatic compromise that is not long-term in violation of principles. In other words: strategic consistency while also entertaining agile tactics.

We need managers also
But I'm the first to say it takes all kinds to make a project team, and everyone can't be on the edge, thereby putting stability, predictability, and reliability at stake, all the time, on everything. 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

X-37B on the way

---

Some projects just look really swell. 

• Falcon Heavy with X-37B (mission 7) Orbital Test Vehicle on-board. MORE
• An award wining photograph, shot by professional photographer Pascal Fouquet
• From 14 miles out from the launch pad.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Heat Batteries

---

Does your project need green energy for development purposes, or is your project incorporating green energy in a deliverable?

Perhaps a Heat Battery fits your need.

As reported by the WSJ:

".... researchers are developing heat batteries—also called thermal batteries—that store renewable energy as heat and then release it on demand to power industrial processes.

Traditional batteries store and release power by moving lithium ions through a liquid from the cathode to the anode, and back again. They are great when space is at a premium, as is the case inside EVs. But they are relatively expensive and typically can only discharge energy for a few hours, limiting their industrial applications.

Heat batteries, on the other hand, work by passing current through a resistor to heat some type of material that can stay hot for days—such as bricks, rocks or molten salt. These materials can store energy generated from intermittent renewable sources as heat—and then release it on demand whenever it’s needed"

There are companies in various stages of readiness on heat batteries. Some actually delivering product, and others are still researching the opportunity. 

This may be a "hot" topic in the future!

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

From soda straws to 'constant stare'

---

Does your project have proprietary or other intellectual property that is, of necessity, our of doors?

Specialized antennas, telescopes, and other sensors?

Unique infrastructure or private facilities?

Proprietary ground or air or even space and underwater vehicles, or vehicle performance?

New, competitive installations?

In the past, you could keep the wraps on by simply hiding the location, or restricting access and observation from the ground.

There were a handful of earth-observing satellites, mostly run by governments, that had a 'soda-straw' look at any point on earth, and then often only for a short time. Revisit rates varied from a couple of hours to perhaps a geo-stationary stare until some other mission had to be satisfied.

With predictable orbits and observation parameters, the ground target could take countermeasures.

Then came drones, with long time-over-target durations, but nonetheless limited by fuel and other mission assignments. But drones are not altogether stealthy, as yet, and so there are countermeasures that can be employed by the target.

Constant stare: 

Now comes 'constant stare', the conception being 24x7 global real time observation of anywhere. Tried and true countermeasures go out the window.

To get to constant stare, perhaps thousands of satellites, about the size of a loaf of bread are to be deployed. And for the most part this capability is provided by civilian reconnaissance companies whose objective is to monetize this service.

A recent essay by David Zikusoka makes this observation:

"..... AI has enabled the teaming of humans and machines, with computer algorithms rapidly sifting through data and identifying relevant pieces of information for analysts. 

Private satellite-launching companies such as SpaceX and Rocket Lab have leveraged these technologies to build what are termed “megaconstellations,” in which hundreds of satellites work together to provide intelligence to the public, businesses, and nongovernmental organizations. These companies are updating open-source, planet-scale databases multiple times per day. Some of these companies can deliver fresh intelligence from nearly any point on the globe within 30 minutes of a request."

On the risk register

This stuff needs to get on the risk register.

So, first balloons, then the occasional overflight, more recently drones, and soon to come 'constant stare'. 

When constructing the risk register, and considering the time-sensitivity of proprietary project information, take into account that others may be observing, measuring, and analyzing right along side your project team.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Help coming: IT Risk Management

---

Risk Management in IT projects 

For years (a lot of years) IT companies have been paying bounties to hackers to find vulnerabilities in target IT systems and report them to bug fixers before they become a business hazard. This bounty system has worked for the most part, but it's a QC (find after the fact) rather than QA (quality built-in) approach, somewhat of necessity given the complexity of IT software systems. 

Enter AI agents

Now, of course, there is a new sheriff in town that aims more at QA than QC: AI bug detectors based on the large language models (LLM) that can be deployed to seek out the bug risks earlier in the development and beta cycles.

For a deep dive, you can read this paper from researchers at Cornell University.

But the idea is summarized by Daniel Miessler this way:

The way forward on automated hacking is this: 1) teams of agents, 2) extremely detailed capture of human tester thought processes, lots of real-world examples, and time. I suspect that in 2-5 years, agent-based web hacking will be able to get 90% of the bugs we normally see submitted in web bug bounties. But they’ll be faster. And the reports will be better. That last 10% will remain elusive until those agents are at AGI level.

Zero Trust

CISA, the nation's cyber-defense agency, is continuing its 'zero trust' IT systems imitative, now with an office dedicated to the program. Some of the program details are found here, including information about the Zero Trust Security Model.

 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Redesigning the "Meeting"

---

From Connor Grant at the WSJ:

The traditional business meeting is changing; the 'pandemic' made me do it!

Here is Grant's reporting -- somewhat abridged -- on changes now in place and expected to come:

1. More office meeting rooms will have high-tech equipment such as holograms, virtual reality and other immersive technologies that allow remote workers to feel like they are in the same room as their in-office colleagues ....

2. Employers will conduct walk-and-talk meetings outside, reducing the amount of time spent looking at—or being distracted by—screens. 

3. Managers will "pregame" meetings by asking workers to add thoughts, ideas or feedback to a shared meeting document at least a week in advance. 

4. Some companies will have once-a-quarter retreats at hotels or co-working spaces

5. Businesses will use mixed-reality tools to supercharge premeeting preparation ... [and] receive real-time feedback when they practice presentations or conversations.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Some Big Words about the Risk Register

---

Every PMO plan includes some form of risk management, and a favorite way to communicate risk to your team, sponsors, and other stakeholders is the (ageless) risk register.

So much has been written about the ubiquitous risk register, it's a wonder there is anything more to be said. But here goes:

In simplest terms, the risk register is a matrix of rows and columns showing the elements of expected value:

• Rows identify the risk impact and give it some weight or value, which can be as simple as high, medium, or low. But if you have information -- or at least an informed guess -- about dollar value, then that's another way to weight the risk impact value.
  
  
• Columns identify the probability of the impact actually occurring. Again, with little calibrated information, an informed guess of high, medium, or low will get you started. 
  
  
• The field of column-row intersections is where the expected value is expressed. If you're just applying labels, then an intersection might be "high-medium" row by column. Statistically you can't calculate anything based on uncalibrated labels, but nonetheless the "low-low" are not usually actively managed, and thus the management workload is lessened.

But, there is more to be said (Big words start here)

Consider having more than one matrix, each matrix aligned with the nature of the risk and the quality of the information.

White noise register: One class of risks are the so-called "white noise" risks which are variously called stochastic or aleatory risks; they have three main characteristics:

1. They are utterly random in the moment, but not necessarily uniformly or bell shaped in their distributions.
2. They have a deterministic -- that is, not particularly random and not necessarily linear -- long-term trend or value. Regression methods can often times discover a "best fit" trend line.
3. Other than observe the randomness to get a feel for the long term trend and to sort the range of the "tails", or less frequently occurring values, there's not much you can do about the random effects of "white noise"

Aleatory risks are said to be "irreducible", meaning there is nothing about the nature of the risk that can be mitigated with more information. There are no information dependencies.

Epistemic risks are those with information dependencies. Epistemic risks could have their own risk register which identifies and characterizes the dependencies:

• Epistemic risks are "reducible" with more information, approaching -- in the limit -- something akin to a stochastic irreducible risk. 
• An epistemic risk register would identify the information-acquisition tasks necessary to manage the risks. 

Situationally sensitive Idiosyncratic risk register: Idiosyncratic risks are those that are a peculiar and unique subset of a more general class. Idiosyncratic risks are unique to a situation, and might behave differently and be managed differently if the situation changed.  And so the risk register would identify the situational dependency so that management actions might shift as the situation shifts.

Hypothesis or experiment driven risks are methodologically unique. When you think about it, a really large proportion of the risks attendant to projects fall into this category. 

With these types of risks we get into Bayesian methods of estimating and considering conditional risks where the risk is dependent on conditions and evidence which are updated as new observations and measurements are made.

These risks certainly belong on their own register with action plans in accord with the methodology below.  The general methodology goes like this:

• Hypothesize an outcome (risk event) and 
• Then make a first estimate of the probability of the hypothesized event, with and without conditions.
• Make observations or measurements to confirm the hypothesis
• If unconfirmed, adjust the estimate of conditions, and repeat until conditions are sufficiently defined to confirm the hypothesis
• If no conditions suffice, then the hypothesis is false. Adjust the hypothesis, and repeat all. 

Pseudo-chaotic risks: These are the one-off, or nearly so, very aperiodic upsets or events that are not stochastic in the sense of having a predictable observable distribution and calculable trend. Some are known knowns like unplanned absences of key personnel. 

Anti-fragile methods: Designing the project to be anti-fragile is one way to immunize the project from the pseudo-chaotic risks. See my posts on anti-fragile for more.

Bottom line: take advantage of the flexibility of a generic risk register to give yourself more specificity in what you are to manage.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Responding to an RFP .... Steps1 and 2

---

Are you a proposal leader tasked with responding to a competitive RFP?

• An RFP from a private sector customer or from the public sector?
• And if from the public sector, local, state, or federal?
• And if from the federals, defense or non-defense?

Every one of those customer groups will have their own style, culture, and constraining rules, regulations, and statutes. But even so, there are two steps, everyone must follow:

Step 1, Read the RFP

Step 1 is to read the entire RFP, but most particularly read the "instructions to offerors", or words to that effect. This seems like such an obvious first step that it does not bear mentioning, but actually it does because the devil is in the detail. 

Follow instructions

If you can't follow instructions as simple as how to submit the proposal, or worse: you are too lazy or arrogant to read and follow the instructions, then you've made an unforced error which could cast a pawl over you whole proposal. 

Take note of Customer dictates

Many submission requirements require "click to sign" certifications (which brings workflow and signature authority into the frame), and they require online submissions of content segmented by "attach here" this or that. Consequently, you may need a tool or submission facility that is not your norm. Action required to get the tools the customer uses!

Avoid disqualification.

Or, worst case, if you don't follow instructions, including "don't be late", you could be disqualified for an unresponsive submission. 

Step 2, Have an Answer for everything

Step 2 is build a tracking matrix (or table, or several tables by category) for every little thing that is in the RFP. Use the tracking matrix (or table) to organize and direct where in your proposal the customer is going to find answers. 

Don't disdain a customer's laundry list which looks like the customer just threw mud at the wall. Everything goes in a tracking matrix. Some of that mud has may have an influential sponsor; you won't really know who's looking for an answer, so answer everything. 

There are two objectives to be satisfied with these tracking tables:

1. Assure completeness, which is part and parcel to your first demonstration to the customer of your appreciation of quality assurance.
   The customer will notice omissions more readily than inclusions.
   That is simple utility theory which posits asymmetry of value: the missing is more grievous than the satisfaction of inclusions.
   
   
2. Make it easy for the customer to find the answers. A frustrated customer, looking here and there but not finding, or not finding easily, will take it out on your score.
   Making it easy are the easiest evaluation points you can earn. Don't give them away. 
   
   Remember this: If the customer can't find what they want in your proposal, it's not their fault!  (Corollary: If it's not their fault, then it must be yours!) You can't admonish them for not being able to read and easily digest your responses.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Chief A.I. Officer

---

So it didn't take long. 

AI has invaded the C-Suite, the latest title being Chief A.I. Officer, aka CAIO.

The job description is partly directed at technology, partly directed at culture, and partly directed at functional impacts, like HR, recruiting, and intellectual property.

What does it mean to project management?

In the PMO, the CAIO is going to be there to help you! (I'm from HQ, and I'm here to help)

• Safety and security: Every project's use or application of AI has safety and security on the project risk register or project agenda. Safety insofar as user's experiences are concerned re exposure to unintended content or performance or functionality. Security insofar as exposing user's to security holes for what seems like an ever expanding range of attacks.
  
  
• HR effects: Predictions are that AI tools will be more threatening to white collar college educated professionals than Joe-the-plumber and other hands-on trades which are not robotic. So will you be under pressure to replace your favorite project professionals with an AI device?
  
  
• Recruiting: What do you tell recruits about your project and enterprise culture re the oncoming AI thing? The fact is: whatever you say today is open to changes tomorrow. Stability and predictability in the job description is going to be a chancy thing.
  
  
• Intellectual property: IP is the source of a lot of enterprise value. But in the AI world, who owns what, especially derivatives from "fair use". And, of course, the patent mess, and the local, state, and federal statutory baseline (admittedly, slow moving, but moving nonetheless; got to keep up!) 

Suffice to say: It's not your father's PMO anymore!

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

3 E's drive success

---

Lee Cockerell, a retired Disney executive and author of several successful business books, says this about the people you want on your project: 

• Hire and retain people who value "reliability" in commitments and relationships, and 
• Hire and retain people who value the "3 E's" (or maybe it's 4 E's)

Education + Exposure + Experience = Excellence

Cockerell's points should be self evident:

• People who are committed to their task, organization, or even to their colleagues and supervisors show that commitment by deed, to wit: they show up, on time in the right place, in a state of readiness to do the work of the day. And they make an effort to be a reliable, contributing partner during the work process.
  
  
• Education (and the related professional credentials) are not enough. It's also not enough to work (and even live) in the same company, job, and location for a career. Of course, who does that anymore? Exposure to other lifestyles, culture, work environments ... foreign and domestic ... in combination with the experience of actually doing the job is that leads to "excellence".
  
  
• And the most successful among us are those who place great importance and value on "excellence". And so continuing education ... formal and informal ... purposeful exposure, and time-over-target (experience) are the 'work-on-everyday' elements of achieving excellence.

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

10,000 project interns

---

David Miessiler has this idea about AI tools that are "good enough" to make a real project impact. He says, in part:

 

To me .... in both offensive and defensive security use cases, the main advantage of AI will not be its exceptional (superhuman) capabilities, but rather the ability to apply pretty-good-intern or moderate-SME level expertise to billions more analysis points than before.

In large companies or government/military applications, we often don’t need AGI [artificial general intelligence]. What we need is 10, 100, or 100,000 extra interns.

Talk about job elimination! It could happen. 

But the impact on testing, especially those rare use cases that nobody wants to test for because there's never enough time and money for the 6-sigma outcomes, will be profound! Quality should go up faster than the cost of quality (which is, of course, "free") 

---

Like this blog? You'll like my books also! Buy them at any online book retailer!

Andreessen opines AI

---

When Marc Andreessen speaks, it's worth your time to listen. He says this about AI

[A] short description of what AI is: The application of mathematics and software code to teach computers how to understand, synthesize, and generate knowledge in ways similar to how people do it.

AI is a computer program like any other – it runs, takes input, processes, and generates output. AI’s output is useful across a wide range of fields, ranging from coding to medicine to law to the creative arts.

It is owned by people and controlled by people, like any other technology.

An even shorter description of what AI could be:
A way to make everything we care about better.

He goes on:
The most validated core conclusion of social science across many decades and thousands of studies is that human intelligence makes a very broad range of life outcomes better..... 

 Further, human intelligence is the lever that we have used for millennia to create the world we live in today: science, technology, math, physics, chemistry, medicine, energy, construction, transportation, communication, art, music, culture, philosophy, ethics, morality..... 

 What AI offers us is the opportunity to profoundly augment human intelligence to make all of these outcomes of intelligence – and many others .... much, much better from here.

Doing a bit of strategy

---

Consider this military wit, and put it in the context of a PMO.  

"There is an old—and misleading—bit of conventional military wisdom which holds that “amateurs study tactics, while professionals study logistics.”

The truth is that amateurs study only tactics or logistics, while professionals study both simultaneously.

The most brilliant tactics ever devised are pointless when the supplies needed to execute them do not exist, while all the supplies in the world are useless when a commanding officer has no idea how to effectively employ them."

Quote from "Field Marshal: The Life and Death of Erwin Rommel"

by Daniel Allen Butler

Are you the professional or the amateur?

Consider what are "logistics" in the project domain:

• Supplies and materials, of course
• Utilities, communications, and facilities (you gotta sit somewhere)
• Tools and training
• Supporting activity from Finance and Accounting (they have the money!) 
• Supporting activity from purchasing, inventory management, and receiving (they have the goods!)
• Supporting activities from the various "ilities"

If you can get that wagon train all connected and working for you, then of course there is the small matter of strategy:

• How strategic are you? Anything less than a year probably qualifies as tactics. Anything over three years and you should build in some tolerance for some business instability.
• What is the lay-line to your strategic goal, and of course, what is your goal?
• How much deviation from the lay-line can you tolerate for agile tactics (zig and zag along the lay-line)
• Can you be strategic on some elements of the 'balanced scorecard' and simultaneously tactical on others(*)?

Got all of the above together? 

Good. Now(!) you can entertain tactical moves, knowing the support is there.

_________________________

(*) Balanced scorecard: Finance, Customer, Product, and Operating Efficiency