Risk Accept Avoid Mitigate Transfer

How to Manage Project Risks

Strategies for Threats:

Here's the scenario. You just bought a brand new car! It's the car you've been wanting for years and there it is, tucked safely away in your garage. It will be fun to show everyone at work the next morning. At the thought of parking at work, you become concerned about the paint getting scratched. What options do you have in dealing with this risk?

Escalate
Escalation is appropriate when the project team or the project sponsor agrees that a threat/opportunity is outside the scope of the project or that the proposed response would exceed the project manager’s authority. Escalated risks are managed at the program level, portfolio level, or other relevant part of the organization, and not on the project level.


Avoid
(Remove Probability; Used for Critical Risks)

Adopted if you the need is to completely remove the Probability of a Project Threat. This is an absolute risk response strategy eliminates the uncertainty (Probability) associated with the Negative Risk Event. By adopting this strategy, you make sure that the Threat event will not occur. This usually involves changing the project plan to eliminate the Project Threat entirely.

Examples:
Extend the Project Schedule to ensure timely completion
Reduce Project Scope to isolate the threat
As an extreme case terminate the Project

Don't like the idea of accepting the risk? Another choice is to avoid the risk altogether. You can do this by not going back to work, and keeping the car in the garage. Never letting your car see the light of day will nearly guarantee that your car won't be scratched.

Mitigate
(Reduce the Probability &/or Impact; Used for Critical Risks)

Adopted to reduce the Probability (reduce the uncertainty) or the Impact or both associated with a Negative Risk Event.

Examples
Developing prototype early to reduce rework
Assigning work to more skilled person to reduce duration
Regularly take feedback from customer to reduce chances of rejection

If avoiding risk is not an option, you could just lessen the chances of the risk occurring. Rather than leave your house when the traffic is the heaviest, you could leave an hour later to put more space between you and the cars around you. When you do make it to work, you could also park WAY over in the corner about a mile from the office where nobody else parks. Both steps would greatly reduce the risk of your new car being scratched.

Transfer
(Transfer the management of Response/Impact to external agency; Used for non Critical Risks like financial risk.)

Adopted if the Project Team does not have the capability or capacity to deal with a Project Threat. Complete or part of the Impact is shifted to an external organization. Only the management of impact is transferred, the probability of risk occurrence does not change . The responsibility and the Ownership of the response is transferred to the external organization. It is important to note that the external organization just takes the Management responsibility for the Threat – the Threat itself is not eliminated. This transfer is usually associated with paying of risk premium to the external organization that is assuming the Threat. As a result of this strategy, the Impact of the Negative Risk Event is Transferred but the Probability might not change.

Examples
Buying insurance and transferring the cost impact to insurance company
Hiring a sub-contractor
Warranty, Guarantee, Performance Bond.

A final choice is to put someone else's car at risk of being scratched. That's right, call a taxi! You can pay someone else to remove the risk to your new car, and transfer it to someone else. They can decide how they want to handle the risk.

Accept
(Do nothing to Probability &/or Impact; Deal with Risk when it happens or Do nothing till Risk happens. Used for non critical Risks.)

Adopted if the Project Manager does not want to actively deal with a Project Threat. This is really a “Do Nothing” Strategy. The Impact of the Negative Risk Event is Accepted if and when it comes. By employing this strategy project plan is not changed and no change happens to either Probability or Impact of the Negative Risk Event.

An obvious response is just to accept the risk. It won't change what time you go to work or where you park. You will just hope that nobody parks too close or rubs up against your brand new car. In the event that somebody does scratch it, you'll cross that bridge when you come to it. Before that, you're not even going to think about it.

Strategies for Opportunities:

EscalateEscalation is appropriate when the project team or the project sponsor agrees that a threat/opportunity is outside the scope of the project or that the proposed response would exceed the project manager’s authority. Escalated risks are managed at the program level, portfolio level, or other relevant part of the organization, and not on the project level.


Exploit

(Ensure full Probability of risk to happen; Used for Critical Risks)

This strategy is adopted if you want to definitely attain a Project Opportunity. This is an absolute risk management strategy that removes the all uncertainty (Probability) associated with the Positive Risk Event and making sure that the risk event occurs. By adopting this strategy, you make sure that the Project Opportunity is realized – you take steps to make the Probability of the Positive Risk Event.

Examples
+ An example could be a situation where the seller will pay an incentive fee if work is completed a week ahead of the completion deadline. Ordinarily there is a probability that the work might get completed earlier, but if we plan to exploit this situation, we will plan to complete the work a week ahead to turn this uncertainty into a certain event.
+ Buying an off-the-shelf product (instead of developing) and delivering it to the customer to save time
+Using a new technology to reduce cost of development


Enhance
(Enhance the Probability &/or Impact; Used for Critical Risks)

Strategy to increase the Probability (reduce the uncertainty) or the Impact or both associated with a Positive Risk Event. By employing this strategy one of the following 3 things might happen:
– Probability of the Positive Risk Event increases
– Impact of the Positive Risk Event increases
– Both Probability and Impact of the Positive Risk Event increase

Examples
Adding more resources to reduce time
Training people to improve quality
Equivalent Strategy for Threats


Share
(Share the management of Response/Impact in this case Opportunity with external agency to attain shared benefits; Used for non Critical Risks.)

Adopted, if the Project Team does not have the ample capability or capacity to avail a Project Opportunity. In this strategy complete or part of the Ownership of the Project Opportunity is Shared with an external organization. Usually, the chosen organization has objectives similar to the Project Team. Together the organization and the Project Team make an attempt to avail the Opportunity. In this strategy, the Project Team and the external organization may share Cost, Resources, Knowledge etc. in order to avail the Opportunity. If the Opportunity is realized, the benefits (Impact of the Positive Risk Event) are also Shared.

Examples
Forming a technology partnerships
Establishing new companies jointly
Launching new products jointly

Suppose your competitor is set to launch a new product six months from now, and you identify the opportunity that by launching a similar product a month before your competitor’s launch you can wrest the market away. In this particular scenario the situation becomes complicated because you have all the resources to launch your product in five months except a portion requiring device driver and hardware level programming. You can launch a joint venture with another company specializing in device driver programming to share the opportunity


Accept
(Do nothing to Probability &/or Impact; Accept the benefits of the Risk if & whenever it happens or Do nothing till Risk happens. Used for non critical Risks.)

This strategy is adopted if the Project Manager does not want to actively pursue a Project Opportunity. This is really a “Do Nothing” Strategy. The benefits of the Opportunity (Impact of the Positive Risk Event) are Accepted if and when they come. By employing this strategy the project plan is not changed and no change happens to either Probability or Impact of the Positive Risk Event.