If you ask people which technique they use to identify risks, most will include brainstorming in the list, usually conducted as part of a facilitated workshop. Indeed for many, brainstorming is not just one technique among several; it’s the only one they use. Brainstorming is popular for a range of reasons:

• Everybody feels involved, with an opportunity to share their opinion openly
• It produces visible results quickly as the flipcharts fill up around the room
• It’s usually conducted in an atmosphere of fun away from the usual workplace
• It gives people the chance to be creative and “think outside the box”
• It encourages team-building and creates a sense of shared ownership of the output

But there are some drawbacks to brainstorming which can lead to it becoming ineffective, for example:

• It can be difficult to get the right people to attend, and if key stakeholder perspectives are not present, important risks may be missed.
• The way the group functions can be influenced by groupthink and other subconscious biases.
• Strong individuals can impose their view on the session and inhibit others from contributing.
• The creative non-critical approach often results in identification of other things which are not risks (such as problems, issues, worries etc).

These can be overcome by simple steps such as effective facilitation by someone skilled in managing group dynamics, good preparation by participants before attending the session, and commitment by all to honesty and mutual respect. But even with these in place, brainstorming can run into difficulties.

Part of the problem is that traditional brainstorming was not intended for identifying risks. The technique was originally developed for problem-solving, and has two key principles. First is deferred judgement. Idea generation must be separated from evaluation, otherwise the creative flow might be disrupted. Second is that quantity breeds quality. The first idea is rarely the best, so finding more ideas increases the chance of getting good ones. These two principles are expressed in the four rules of brainstorming:

1. Creativity and free thought are welcomed and encouraged, even if they appear unproductive
2. No criticism is allowed during the session, with judgement being deferred until later
3. Combination and improvement are sought, to produce better ideas by building upon
4. Quantity is required, since more ideas increase the chance of finding a solution

When brainstorming is used for risk identification, we need to be sure that we identify as many risks as possible from a wide range of sources across the project. Unfortunately the creative process can result in identification of things which are not risks. It is common for a brainstorm session to concentrate on areas where participants are comfortable, such as technical risks, ignoring other important areas such as commercial or external risks. It is also possible for a brainstorm session to go down a blind alley, with people being very “creative” about unrealistic risks (such as an alien invasion, everyone dying from a mystery disease, or the project manager becoming a millionaire).

To avoid these shortcomings, the rules of brainstorming need to be modified when it is used as a risk identification technique. For example it helps to have some evaluation of the ideas initially generated, in order to remove non-risks. Use of a standard risk description (or risk metalanguage) can help to ensure that only genuine risks are captured. It can also be helpful to structure the creativity in a risk identification brainstorm by using risk categories or a Risk Breakdown Structure, to be sure that all possible sources of risk are considered.

Everybody loves brainstorming, but it must be used carefully and intelligently for risk identification if it is to achieve its purpose of allowing key stakeholders to identify as many risks as possible in a creative and fun way.

如果你問人們用哪一種技術進行風險辨識，大部分人會提到腦力激盪，通常是以一種 便利的工作研討會形式執行。事實上，對許多人來說，腦力激盪不只是技術之一而是 他們所使用的唯一的技術。腦力激盪廣為接受是有一些原因的：

• 每個人都有參與感，有公開分享觀點的機會。
• 在活動掛圖掛滿整個房間的情況下快速產生可以看見的結果。
• 給人們創意及「跳脫框框思考」的機會。
• 鼓勵團隊創造及建立分享產出所有權的意識。

但是腦力激盪也有一些缺點使得它是無效的，例如：

• 可能很難找到正確的參與者，如果關鍵利害關係人未參與，重要的風險便可能會 遺漏掉。
• 團體運作的方式可能會受到團體思考及其他潛意識偏差的影響。
• 強勢的個人會在討論中強力主張其觀點並阻絕其他人的貢獻。
• 不得批判的規範通常會導致辨識出非風險的其他事項（如問題、議題、以及憂慮 等）

這些雖然可已經由一些簡單的步驟如找一個有管理團體動力技巧的人來主持、參與者 在參加會議前做良好的準備、以及所有人承諾要誠實並互相尊重等加以克服，但是即 使是這些都做到了，腦力激盪仍然會遇到困難。

部分的原因在於傳統的腦力激盪不是為了要做風險辨識，這種技術本來是為了解決問 題而發展的，並且有兩個關鍵原則：第一個是擱置判斷；構想的產生必須要跟評估分 開，否則創意的泉源將會被阻斷；第二個是數量孕育品質；第一個構想通常不會是最 好的，所以要尋找更多構想以便於增加找到好構想的機會，這兩個原則展現在腦力激 盪的四個規則中：

1. 有創意及不受拘束的想法是受到歡迎及鼓勵的，即使他們看來是不可行的。
2. 會議中不允許批判，裁決也必須擱置到較晚再進行。
3. 尋求合併及改進，經由利用他人構想以產生更佳的構想。
4. 大量是必須的，因為較多的構想增加找到解決方案的機會。

當腦力激盪用在風險辨識時，我們需要確定我們已經從專案中各種來源盡可能辨識出 風險，不幸的是創意的過程可能導致辨識出許多不是風險的事項，腦力激盪會議專注 在讓參與者感覺自在的領域、如技術風險，而忽略了更重要的領域、如商業或外部風 險，也是很常見的事。腦力激盪會議在人們過度創意於不實際的風險下，也可能會走 進死胡同（如外星人入侵、每個人當感染了神秘的疾病而瀕臨死亡、或專案經理成為 了百萬富豪等）。

要避免這些缺點，腦力激盪當作風險辨識技術使用時需要修訂其規則，例如當構想初 步產生時做一些評估是有幫助的，以便於排除非風險；使用標準風險描述（或風險推 理語法）有助於確定被找到的只有真正的風險；使用風險類別或風險分解結構使風險 辨識腦力激盪的創意是有結構的也會有助於確定所有可能的風來源都被考慮到了。

大家都喜歡腦力激盪，但如果要達到使關鍵利害關係人以有創意又有趣的方法盡可能 辨識出風險的目的，就必須謹慎且聰明地將它使用在風險辨識上。