Typical Risk Management Mistakes - Doug's Rants

Home > Writing > Doug’s Rants > The Typical Mistakes Teams Make Concerning Risk Management

The Typical Mistakes Teams Make Concerning Risk Management

by Doug Boebinger, MS, PMP^®, PMTA-CTP

Businessman walking on a tightrope held by two giant hands

I’ll warn you… Risk Management is one of my favorite subjects to discuss. Personally, I feel it is the difference between success and failure for organizations, teams and people. How well do you understand, plan for, and apply risk management techniques?

I want to discuss some of the common mistakes people make concerning risk management

Mistake #1: Not Considering Opportunities

9 out of 10 times – maybe 99 out of 100 times, I ask people for synonyms to the word risk I get responses like problems, issues, danger, disaster, threats, etc. I do not think this is because people are naturally pessimistic, but rather because people deal with these a vast majority of the time. Remember, risks are an event or condition that, if they occur, could have a positive (opportunity) or negative (threat) effect on one or more aspects of a project. So remember the opportunities.

Risk = Threats + Opportunities

Opportunities are events that could have a positive effect — cost savings, time savings, increased benefits, better utilization of resources, etc.

Mistake #2: Confusing Root Causes, Risk Events, and Effects

When people are identifying risks (both threats and opportunities) they are either too vague or only talk about the impact / effect. My suggestion is to use the following format in identifying / documenting risks:

As a result of (definitive cause), before/during/after (specific timing), (uncertain event) may occur which would/could/may lead to/result in (effect).

Definitive Cause: What is the trigger / cause of the risk? One cause of a tsunami is the occurrence of an earthquake somewhere in the ocean.
Specific Timing: The timing is key. Is it before the start of design, during design, or after the design is complete? The impact will change depending on the timing of the risk cause.
Uncertain Event: Back to the tsunami, that is the uncertain event that develops due to the definitive cause.
Effect: The effect is the impact of the event. In the case of the tsunami, it is wide spread destruction of property, loss of life, environmental contamination, etc. Understanding the effect will help in guiding you to developing risk responses.

Mistake #3: Underestimating Effects

We need to look at worst-case scenarios. By now, people should realize that the worst-case scenario is a real possibility and things can be much worse than what was originally thought. We need to learn this lesson in our organizations, teams, and ourselves.

Mistake #4: Not Building High Probability Threats into the Plan

Threats that have a high probability of occurring should be built into the plan as if they have a 100% chance of occurring. Then, a low-probability opportunity can be included in the risk management plan. In other words, if there is a very high probability that you will not receive funding approval on the first request, you should put into your plan a second request process to deal with the high probability that the first request will be rejected.

Mistake #5: Thinking Mitigation is the Only Risk Response

People jump to mitigation for risk responses as if it is mitigation is the only response. It may be the one that is used the most, but it is not the only response — and should not be considered as the first option either. Other risk responses that should be considered are avoidance (eliminating the threat), transferal (outsourcing to a supplier / vendor) and, if those are not applicable, then finally, mitigation (reducing the probability and/or impact). Oh, by the way, there should always be a contingency plan if you have a mitigation plan, as the threat may still occur.

In Conclusion

There are many other mistakes people make when it comes to risk management. These are just a few of the biggest. IPDI would be happy to do our very successful Assessing and Managing Project Risk Training Course for your organization so you can learn the proper approach and avoid these and other mistakes. The price of not performing risk management is much higher than the price of doing it and doing it right.