Risk is a factor that cuts across all projects, and it is essential to have a basic understanding of what it is and what we can do to manage it.
In this article we present some basic concepts, which we will then use in many other articles.
Risk is uncertainty beyond our control,
and it is directly proportional to probability (P) and impact (I).
R = P x I
If the probability of something happening increases, the risk will be greater. If the impact is greater, the risk will also be greater.
Sometimes we talk about positive risks or opportunities, which are those where the impact is positive. Let’s leave this concept aside for now because, as far as project risk management goes, the focus is on avoiding negative impacts.
So what can we do to manage it?
Great question!
There are four types of measures we can take in relation to risk.
Let’s imagine, for example, that we want to drive from Lisbon to Madrid, and we know that there is a risk that the car will break down and we’ll be stranded on the road.
We can then adopt one of the following types of measures (or, of course, a combination of several):
Mitigate
This involves reducing the risk. To do this, we have to reduce the probability or impact.
In our example, we could choose a better, more reliable car that is well maintained and in good working order, thus reducing the likelihood of a breakdown.
We could also hire international travel assistance. In this case, the likelihood of a breakdown remains, but the impact will be smaller, since we will have someone to support and rescue us.
In both cases, we reduce/mitigate the risk.
Avoid
Avoidance involves adopting a process that reduces the probability to zero.
In our case, we can fly to Madrid, completely eliminating the scenario of being stranded in the middle of the road.
We’ve managed to avoid a specific risk, but we can’t avoid all risks. In this case, we’ve avoided the risk of being stranded on the road, but we now have other risks associated with travelling by plane.
Transfer
If we can send someone to Madrid in our place, we transfer the risk, assuming that the reason to go to Madrid is something that someone else can do for us.
We no longer have the risk of being stranded in the middle of the road, but whoever goes in our place is subject to it.
The expression “transferring the risk”, although common in risk management terminology, can be misleading. What we transfer is not really the risk, but some of its impacts.
In this case, we can transfer the impact of the hassle of being stranded on the road, with everything that goes with it. But the impact of the package arriving late in Madrid, assuming it is a package, still exists and is ours.
A classic example of risk transfer is insurance – when you buy an insurance, you transfer the risk to the insurer.
But once again, the expression can be misleading. What we transfer are some of the impacts. When you take out life insurance, you don’t transfer the risk of death to the insurer. What we transfer is some of the financial impact of a possible death.
Risk transfer is a common theme when negotiating contracts. There is a lot of talk about passing the risk on to the contracted organisation with a given contract. We emphasise: at best we transfer part of the impact, we don’t transfer the risk itself.
Accept
Finally, we can always accept the risk. We know it’s a risk, but we accept it and continue with the action in question.
We accept a lot of risks every day and we live with it, from crossing the street to taking the lift.
And we mustn’t forget, of course, that it’s essential to Saber. Fazer. Acontecer.
