AACE DRMP common mistakes
AACE DRMP · Understand the traps and how to avoid them.
Selecting a preferred alternative before writing the decision objectives and evaluation criteria, then using the analysis to justify that choice.
The proposed solution is usually the most vivid option, so anchoring on it feels efficient and avoids the discomfort of reopening scope or strategy.
What to do instead
Build the objectives hierarchy and measurable criteria first, confirm them with stakeholders, and only then score alternatives; keep a written record showing criteria were fixed before scoring.
Evaluating a decision with a single-point business case and ignoring ranges, probabilities, and the organization's risk attitude.
Deterministic NPV or cost estimates are easier to present and compare, and uncertainty analysis can feel like extra work after the ''answer'' is already known.
What to do instead
Replace point estimates with ranges or distributions for key drivers, state the decision criteria explicitly, and show how the preferred option changes under different risk tolerances and scenarios.
Using a weighted scoring model with overlapping criteria, unnormalized weights, or weights that were adjusted after seeing the scores.
Templates are often reused without checking whether criteria are mutually exclusive, and adjusting weights late can make an inconvenient result disappear.
What to do instead
Make criteria MECE, normalize weights to 100%, document the weighting rationale before scoring, and run sensitivity tests to show whether the ranking is robust to reasonable weight changes.
Omitting the do-nothing or baseline alternative and ignoring opportunity cost when comparing options.
Teams focus on the proposed project or solution and treat ''no action'' as unrealistic or uninteresting, so foregone benefits and locked-in costs never enter the comparison.
What to do instead
Always include a do-nothing or status-quo baseline, quantify opportunity cost and deferred benefits, and compare every alternative against the same baseline assumptions.
Making a decision without recording assumptions, alternatives considered, rationale, and review triggers, then treating the decision as permanent.
The pressure to move to execution makes documentation feel administrative, and teams assume conditions will remain stable.
What to do instead
Produce a decision record with assumptions, rejected alternatives, rationale, owner, and explicit triggers for reconsideration; review it at decision gates or when triggers occur.
Recording only threats in the risk register and treating opportunities as separate ''upside'' that does not need identification, analysis, or response planning.
Many practitioners learned risk as loss prevention, so opportunity management feels like benefits realization rather than risk management.
What to do instead
Use one risk identification process for both threats and opportunities, assign owners and triggers to both, and analyze opportunities with the same probability-impact discipline used for threats.
Using the risk register as an issue log, listing problems that have already occurred alongside future uncertain events.
Teams want one place to track all concerns, and the distinction between a current issue and a future risk is easy to blur during busy project reviews.
What to do instead
Classify each entry explicitly: an issue is a current condition requiring action; a risk is an uncertain future event with probability and impact. Maintain separate logs and transfer issues to action management.
Ranking risks by expected value alone and failing to examine low-probability, high-impact tail risks against risk tolerance.
Expected value compresses asymmetric outcomes into one number and makes rare severe events look small or negligible.
What to do instead
Supplement expected value with distributions, scenario analysis, stress tests, and risk-appetite thresholds; escalate tail risks that exceed tolerance even when their expected value is low.
Reporting a Monte Carlo P50 result as ''the'' cost or schedule without stating the confidence level or decision context.
A simulation produces many outputs, and P50 is easy to quote because it sounds like a single forecast rather than a chosen confidence point.
What to do instead
Report several confidence levels such as P50, P80, and P90, explain what each means, and select the reporting basis according to decision criteria, risk appetite, and contingency policy.
Treating contingency and management reserve as interchangeable padding, or allowing contingency to be used for scope changes.
Reserve concepts are often taught as percentages, so teams lose the distinction between known-unknown risk exposure and unknown-unknown management reserve.
What to do instead
Define contingency for identified risks and management reserve for unidentified risks; set drawdown authority, document the basis of estimate, and prohibit use for scope changes or baseline omissions.