Risk Management: Mitigation vs. Response

To reiterate from our last post:

“It is better to mitigate a risk than attempt to survive an issue.”
(CJP Stoneman, 2010)

The purpose of mitigation with respect to proactive risk management is quite simply to undertake actions that will reduce the risk potential’s risk equivalent value (REV) which can be found through the following process:

1.    Constraint analysis: scope, time, cost, and quality (see our previous constraints mapping posts)
2.    Scoring assessment which draws its valuation from the constraints analysis
3.    Determine the risk potential’s REV which is the product of RCI * RPO (see previous post)
4.    Rank order the risks according to the organization’s or project’s prioritization profile
5.    Begin the task of mitigation planning on the highest order risks to conserve project resources

The above process provides several advantages to the project:

1.    Improvement in risk scoring assessment from the subjective to the objective,
2.    Efficient application and utilization of limited project resources, and
3.    Reducing the number of risk potentials for which mitigation planning is required.

As we have stated in prior posts, mitigation can only be applied to future events – one cannot mitigate the past or the present. In similar fashion, response can only be directed towards events that have become reality or triggered into reality. In risk management, one of the most important parameters tracked for each risk potential (in the risk register or database) is that of the risk’s triggers. These are future events associated with the risk potential that are monitored by the risk owner(s) indicating when a risk has transitioned from being an uncertain future event to an actuality or issue.

Thus, once a risk potential becomes an issue, it can no longer be mitigated as it has become reality and must now be managed to reduce its cost and burden to the project. Issues consume project resources that would otherwise be available to support the production of the project’s “fit-for-use” deliverables. This makes issue resolution a double cost to the project as it redirects funds from productive to reactive uses. In short, issues are parasitic distractions to the project’s resources and time allotments.

In closing, proactive risk management directs risk activities that seek to reduce a risk potential in both profile vectors: impact and probability (RCI and RPO). This lowers the overall REV so that if the risk does become reality through the advent of one of its triggers, the burden of the issue has been lightened through minimizing the expenditure of resources for its resolution. So as CJP Stoneman stated above, and we paraphrase, mitigation is better than resolution – it’s all about resource utilization.

Leave a Reply