Risk Identification and Mitigation
Risk management is about uncertainty that matters: identified early, owned, and answered with a planned response.
Core rules
- A risk is an uncertain event that may affect objectives; an issue is a risk that has already happened. Risks include threats and opportunities.
- Process: plan risk management, identify, analyze qualitatively, analyze quantitatively where warranted, plan responses, implement, monitor.
- Identification techniques: brainstorming, interviews, Delphi, checklists, prompt lists, SWOT, assumption analysis.
- Qualitative analysis uses a probability and impact matrix plus data quality and detectability. Quantitative analysis uses expected monetary value, decision trees, Monte Carlo simulation, sensitivity analysis.
- Threat responses: avoid, transfer, mitigate, accept, escalate. Opportunity responses: exploit, share, enhance, accept, escalate.
- Every risk gets an owner, a trigger, and a review date. Contingency reserve covers identified risks; management reserve covers unknown ones. Transfer moves financial consequence, not accountability.
Worked example
Risk A: 20 percent probability times 50,000 impact = 10,000 EMV. Risk B: 40 percent times minus 8,000 = minus 3,200. Combined EMV = 6,800, which supports roughly 6,800 of contingency for these two risks. Reasoning: EMV compares exposures and sizes reserves; it does not remove the need to plan a response for the highest-impact risk even when its EMV is modest.
Traps
- Listing risks with no owner, trigger, or response.
- Writing mitigate when the action actually avoids the risk.
- Still calling an occurring risk a risk instead of an issue.
- Ignoring secondary and residual risks created by the response itself.