Mitigating project risks just may be the wrong strategy. With the release of the latest version of the PMBOK® Guide from the Project Management Institute (PMI®) comes a change to the response strategies that have been in use since risk was introduced as a knowledge area in the 1996 First Edition.
Throughout the last five releases, these strategies had remained the same, while most people still did not comprehend how to properly put them to use and tended to favor one above all the rest. We will attempt to demystify a bit around the risk resolution strategies that are available, going beyond mitigation.
Ask anyone, “What are you going to do about this risk if it were to occur?” and most will tell you that they will mitigate the risk. In my experience, during the process of planning for risk responses, mitigation is, in fact, the risk response strategy used over 80% of the time, wrongly or not.
Teaching risk management at a college level, I hear it all the time in a variety of forms.
- Where can I find a mitigation plan?
- How do I mitigate this or that risk?
My favorite one? The fact that we see a mitigation column in the risk register and not a response strategy column.
According to the PMBOK® Guide (6th Edition), there are five risk strategies for dealing with each threats and opportunities in risk management. In an article to follow in the near future, I will discuss the issue for most people with threat and opportunity recognition but for the time being, let’s look at threats and how mitigation fits in predominantly.
Mitigating risks could be the wrong strategy
Why? In dealing with risks that are a threat to your project, you could be missing these four other possible response strategies.
Escalate has been added to this list with this new edition of the PMBOK® Guide and basically deals with risks that are out of the normal control of a project manager. This might have a greater impact than just to the project itself. This response was needed for risks that need to be escalated outside of the project, potentially beyond even the sponsor. Think of risks that could impact an entire organization stemming from a project having to be resolved or examined from a different perspective. This response strategy has become necessary as there is much more riding on projects now then there used to be, and the connection to the nervous system of an organization is often exposed. Think of privacy risks, reputational risks, and operational risks whereby they are not within a project manager’s role to make the decision. Escalation can be used in cases of both threats or opportunities.
Sylvie Edwards, PMP, MCPM, STDC, CMP has 25 years of project management experience spanning various industries and is the owner of SRE Solutions, catering to clients in need of project management course development, education, project risk management, PMO setup/evaluation or recovery services. She has worked with one of the top five consulting firm, where she led projects in the information technology, banking, government, and securities sectors as well as being a manager in the risk management practice. Sylvie writes about risk management, communication, and PMO.