Maryam Mirhadi, Ph.D., PMP, PSP
Project risks are uncertain events or conditions that may impact a project if they occur. It is important to note that this impact may be negative or positive. As such, project risk response strategies have to be used to deal with each of the project risks. Different risk response strategies may be used depending on whether the risk is negative or positive. Negative risks pose a threat; however, positive risks are to be treated as opportunities.
A Guide to the Project Management Body of Knowledge (PMBOK® Guide) –Sixth Edition, identifies the following as the five risk response strategies that can be used for managing negative project risks: avoidance, transference, mitigation, escalation, and acceptance strategies (PMI, 2017). The following table provides a short description and example for each of these risk response strategies:
Table 1. Risk-response strategies for managing negative risks
The PMBOK® Guide identifies the following as the five risk response strategies that can be used for managing positive project risks: exploiting, sharing, enhancing, escalation, and acceptance strategies (PMI, 2017). The following table provides a short description and example for each of these risk response strategies:
Table 2. Risk-response strategies for managing positive risks
Some of the common mistakes concerning project risks and risk response strategies include the following:
1- Risks are always negative: In fact, not all risks are negative. Although the word risk may have a negative connotation in conversations, risks are not always negative in project management. Risk is “any uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives” (PMI, 2017, p. 720). As such, risks may be negative (i.e., threats) or positive (i.e., opportunities).
2- All risks need to be mitigated: In fact, not all risks need to be mitigated. First, it is important to note that mitigating is a risks response strategy only for treating negative risks. This risk response strategy is not applicable to positive risks or opportunities. In addition, although risk mitigation is one of the main risk response strategies for treating negative risks, mitigation is not the only risk response strategy that can be used for treating negative risks. As shown in Table 1– Risk-response strategies for managing negative risks– aside from mitigation, four other risk response strategies also exist that may be used in response to negative risks.
3- Risks can be certain events or conditions: In fact, certain events or conditions for which no doubt or uncertainty exists should not be treated as risks. Definite, certain events are facts, not risks. For example, in case of “having inadequate time to complete the project”, if it is known that the time needed to complete the project is inadequate, this is not a project risk, instead, it is a fact. If uncertainty is not associated with an event or condition, it cannot be considered a risk anymore. To differentiate project risks from facts and to properly name project risks, it is recommended that project management practitioners always use the cause-risk- effect format to define risks. This format can be used as follows: [uncertain event or condition] may occur due to [the cause] which may result in [the effect]. Here is an example: The contractor may incur damages due to unforeseen site conditions which may result in project delays or disputes.
4- Other mistakes: The above-mentioned mistakes were some of the key mistakes made in defining risks or risk response strategies. However, other mistakes may also be made. Some examples include not accounting for contingency reserves or devising contingency plans as part of risk response plans, not assigning role and responsibilities in managing project risks, and not treating risk management as an ongoing process that needs to be performed throughout the project lifecycle.
In sum, many mistakes are made in defining project risks and identifying risk response strategies; however, the main ones include treating all project risks as negative events or conditions with an adverse effect on the project, treating mitigation as the only risk response strategy that can be imagined, and treating definite events or conditions as risks. A proper understanding of project risks and the strategies that can be used to manage project risks is necessary to ensure risks can successfully be managed. If project risks are left unmanaged, they have the potential to force the project to deviate from its plans or fail to reach its objectives.
Reference:
Project Management Institute [PMI]. (2017). A Guide to the Project Management Body of Knowledge (PMBOK ® Guide) (6th ed.). Newton Square, PA: PMI Publications.
—
Our posts to the Insights page share fresh insights and seasoned advice about many project and construction management topics. To have the Insights monthly newsletter delivered automatically to your email inbox, please subscribe here.