One of the more difficult project management concepts to understand and to put into practice is secondary risk. It’s often confused with residual risk. In simple terms, secondary risk that is caused by a risk response. Now, of course, risk can be positive (opportunity) or negative (threat). Here we’ll go to the dark side and focus on threat – most people consider risk and threat to be the same. You and I know that they are different, but to make the concept of residual risk clear, we’ll stay with threat.
So again, a secondary risk is a new threat that is caused by a response to the original threat.
We can all think of examples:
- An airbag (meant to prevent injuries) deployment causes injury to a driver or passengers.
- A poorly-packed parachute causes a sprained shoulder by deploying too quickly.
- A sprinkler system installed to prevent the threat of fire, causes damage to an expensive server farm on the floor below when the water leaks through the floor
- A tent erected for a party to prevent mosquito bites collapses and injures 2 guests.
- Hiring a subject matter expert (SME) for your project to reduce the risk of making a mistake results in that SME transferring intellectual property to a competitor.
- Here’s a timely one, based on the Colonial Gas pipeline hack: Stocking up on gas in plastic bags to mitigate the risk of a gas shortage results in (at a minimum) a smelly car when one of the bags leaks. At the end of the post, I encourage you to watch the video from a very, very, very angry firefighter who is rather, shall we say, emphatic, in his warnings about this particular secondary risk!
All of these examples speak to the idea of risk versus reward, but with a twist – it is really risk response versus punishment. This speaks to thinking carefully about the downsides of our risk treatments or responses. Could the cure be worse than the disease?
A recent story by the BBC on tree planting – traceable to an article from the research journal Global Change Biology - found that in some cases, planned tree planting does not increase carbon capture and can have negative effects. caught my attention, considering this idea of secondary risk. The BBC story starts with this bold statement:
Tree planting is a brilliant solution to tackle climate change and protect biodiversity, but the wrong tree in the wrong place can do more harm than good, say experts at the Royal Botanic Gardens, Kew.
From the abstract of the Global Change Biology Journal:
Urgent solutions to global climate change are needed. Ambitious tree‐planting initiatives, many already underway, aim to sequester enormous quantities of carbon to partly compensate for anthropogenic CO2 emissions, which are a major cause of rising global temperatures. However, tree planting that is poorly planned and executed could actually increase CO2 emissions and have long‐term, deleterious impacts on biodiversity, landscapes and livelihoods.
So the overall risk response (to climate change) is planting forests. It seems that there are indeed downsides to this – and are those downsides worth it? Are there ways to avoid those downsides? After all, our goal is have a net benefit when we put the risk response into place. Sure, an airbag may – in rare instances – cause injury, but that does that mean we should throw them all away? NO. Airbags save many lives and prevent injuries. We have to figure the downside of a failed airbag and do what we can to assure that they don’t introduce new risk, but we don’t just stop using them due to an instance of secondary risk.
Let’s start with the threat that’s causing us to plant forests.
Every year we lose one Denmark worth of tropical forest. Is that bad? Well, what do forests provide?
Well, they are home to three-quarters of the world's plants and animals. They absorb CO2, and provide humans with food, fuels and medicines. So, yes, I think we’d all agree, losing a Denmark (or three Connecticuts) of forest each year is a threat we cannot tolerate. And planting forests does work, if it’s done properly. Here’s what NOT to do, according to the article: don’t replace natural forests teeming with plants, animals and fungi with commercial plantations with row upon row of timber trees, which will be harvested after a few decades. That actually causes more damage than leaving the forests alone.
Turns out that there are 10 “golden rules” for reforestation that, if followed, can prevent those secondary risks:
10 Golden Rules for Restoring Forests (set out in detail below)
1. Protect existing forests first
2. Put local people at the heart of tree-planting projects
3. Maximize biodiversity recovery to meet multiple goals
4. Select the right area for reforestation
5. Use natural forest regrowth wherever possible
6. Select the right tree species that can maximize biodiversity
7. Make sure the trees are resilient to adapt to a changing climate
8. Plan ahead
9. Learn by doing
10. Make it pay
These are explained in detail in the Journal article, which has been made ‘open source’, so feel free to view it here.
So what is the takeaway for project managers?
First of all, in your Risk Registers, have a place to record Secondary Risks. Think not just about the risk response you propose, but what new threats (or opportunity) that threat response may initiate. Next, think of the ways in which you can respond to THOSE threats – those secondary threats, introduced by your risk response.
Secondly, avoid ‘throwing the baby out with the bathwater’. Instead, secure that baby and just throw out the bathwater. In other words, look at the equivalent of the above 10 Golden Rules for your risk response. It takes more work and more thinking through to what happens if your risk response does get activated. But it’s worth it. After all, you don’t want to be the one of the people this guy is talking about, do you?