5 Strategies for Dealing with Threats

 

A threat is a risk with a negative impact on the project – so this article isn’t about dealing with bullying behaviour at work or anything like that. We often talk about risk as if all risks are the same, but they aren’t. There are ‘negative’ risks i.e. threats and ‘positive’ risks i.e. opportunities. The way we respond to each is different because you want a different outcome each time. With threats, you want the risk to go away. With opportunities, you want the risk to happen so you get the benefit.

In this article I’m talking about your options for responding to risks that are perceived to be a threat to the project.

There are 5 responses:

1. Escalate
2. Avoid
3. Transfer
4. Mitigate
5. Accept.

Let’s look at each of those in turn.

1.Escalate

Escalating means passing the risk up to someone else to deal with, because the team and/or the project sponsor believe it’s something that is outside of the scope of the project. Often projects will uncover risk or issues that are actually nothing to do with the scope of their work. In my experience, sometimes that means my project gets extended to also deal with whatever problem we’ve found, but sometimes the right thing to do is escalate to the PMO and let someone else deal with it.

This is also an appropriate strategy if the risk response you’re considering would need more than the level of authority you have within the team.

Basically, you’re passing the risk up to the programme or portfolio management team and while you’ll input to the response, it’s no longer your risk to track and manage.

I don’t remember this being an option when I first learned project management on an internal course my employer ran. I think it’s definitely a valid option and one we’ve used on my projects.

2.Avoid

You can avoid a risk if you change your plans so it couldn’t possibly happen. For example: there’s a risk of getting wet if you go out because it’s raining. You remove the risk and don’t get wet because you don’t go out that day.

Sometimes you can make this happen with project risk but often avoiding a risk is expensive and time-consuming so it might not be worth it.

However, some risks can be avoided simply by gathering more information like getting clearer requirements, hiring someone with particular skills who would know what to do or being better at stakeholder engagement.

3.Transfer

Transferring risk means passing it over to another party to manage and the example typically given is insurance. You can transfer the risk (in exchange for a fee) over to an insurance company who then take the risk on your behalf.

A similar thing happens when you write warranties and guarantees into contracts – the other party carries the risk in exchange for some kind of consideration on your part.

4.Mitigate

This is what we normally think of when it comes to risk management, and often internally – at least in my teams – we talk about risk mitigation instead of risk management because it’s what we do most often.

Mitigation is about reducing the impact and likelihood or a risk so that if it does happen it’s easier to manage the situation. We take steps to make the risk less likely to happen and less of a problem if it does.

For example, we might do more testing, add more resources to a project task, review more thoroughly, subject a process to internal audit or peer review and so on. We create back up plans, policies and build redundancy into the system so if something does go wrong, it’s easier to cope and get the project back on track without a major interruption.

5.Accept

Finally, you can choose to do nothing. This is an appropriate response to small, low level risks. It’s also a temporary response to risks that are likely to happen far into the future where it’s not necessary to spend time preparing a response yet.

You can put aside time or money to prepare for dealing with the risk as a minimum if you can’t do anything else. However, it’s important to monitor the risks where you have chosen acceptance as a strategy, because something might change in the future that makes it a less attractive option. Keep these risks under review and adapt your strategy as necessary to ensure you’re still doing the right thing for the project.

All risk responses could be combined if it’s appropriate to take two or three actions. You can even have different people responsible for taking different actions, although I’d stick with having one risk owner so that someone has a complete picture of what is going on.

Prioritise managing the most risky risks first and then invest the appropriate amount of time, resource and budget into reviewing and acting on the others.

Next month I’ll be looking at 5 strategies for dealing with opportunities – those positive risks we want to encourage.

Pin for later reading