Community Champion
Guessing is not a strategy: How to build decision velocity with AI and real-time data
June 10, 2026 | Live Webinar
Categories: trends
This article is part three of my look into project risk management, and today we are continuing our look into trends and emerging practices, as determined by the PMBOK® Guide – Sixth Edition.
Read part 1 here: An introduction to risk management
Read part 2 here: Trends and Emerging Practices in Project Risk Management (Part A)
There are three risk-related trends that bear investigation. Last time I looked at non-event risks and today we’re covering project resilience and integrated risk management.
Project resilience
You know about personal resilience, right? I’ve seen a lot written about personal resilience, in particular to do with how we can support ourselves and our families through difficult times. A lot of factors go into personal resilience, from preparedness to mindset.
Projects can be resilient too.
The idea of project resilience relates to unknowable-unknowns – those things we never saw coming and couldn’t have prepared for (have there been any of those lately??). These are called emergent risks: risks you can only identify once they have happened. If your project is resilient, those issues are less problematic because you can deal with them. You can’t stop them, but your project can cope. Or at least, cope better than if you had made no effort to build resilience in the team at all.
Build resilience on your project through:
- Having the right level of budget and schedule contingency
- Maintaining a risk budget for the risks that you do know about
- Working with flexible processes that let you shift quickly if necessary and deal with change
- Empowering the team to make the right decisions, and trusting them to get on with it
- Reviewing the project regularly to spot early warning signs that something might be going wrong or coming
- Getting input from stakeholders for clarification to minimise the chance of scope or strategy being the cause of emergent risks.
Resilient projects are more likely to be able to weather the storm and bounce back, because they have space and process to do so. In other words, the better managed your project, the more likely it is that you are going to be able to recover from any curveballs thrown your way.
Integrated risk management
Integrated risk management is simply making sure all the risks from the project are integrated into a bigger picture. For example, your project could be part of a programme. On the last programme I ran, we consolidated risk from all the projects so we could assess the overall health of the programme, and that overall position was reported at the programme board monthly.
Integrated risk management processes mean that risk is owned and managed by the right people in the organisation, at the right level. So as a programme manager, I wasn’t reporting up every single risk those projects had, but the important ones. There is a level of professional judgement applied to back up the risk assessment process, so that the significant risks are escalated to the level they need to be known at.
Beyond projects and programmes, integrated risk management also looks at how project-level risk relates to the portfolio as a whole. This information is useful because it helps executives get a clear picture about the level of risk the business is taking with regards to delivering change. If too much change is going on, they might consider that too risky, and slow down or postpone some projects until other initiatives have completed.
Enterprise risk is the next level. You may have a corporate risk manager: their job is to aggregate risk from all over the business. They’ll be looking for input from each department but also projects and programmes, and the entire portfolio, and considering how that works with and affects operational risk too.
Basically, integrated risk management is the overall corporate governance structures and framework for managing enterprise risk. As a project manager, you need to know how you fit into that, but the whole thing isn’t your responsibility. You should carry on managing risk as you do, making sure the people who need to know about significant project risks, know.
Next time: I’ll look at tailoring risk management for your environment, because a one-size-fits-all approach doesn’t work.
Pin for later reading:
Posted on: July 15, 2020 07:00 AM |
Permalink