To put this question in perspective, it is simply stated by a very recent quotation we came across:
“It is better to mitigate a risk than attempt to survive an issue.”
(CJP Stoneman, 2010)
What Mr. Stoneman is attempting to articulate is that in the practice of project risk management the cost of risk mitigation (reduction of a risk potential’s risk equivalent value or REV) is usually much lower than the cost of issue resolution. The basis for this concept is that once a risk potential has triggered into reality, i.e., has become an issue; the project team is now playing the old game of wasted resources called “catch-up.” An issue is not managed, scheduled, or planned – it is simply resolved in the shortest possible time for least expenditure of project resources. Why? Issues are a distraction or impediment to the over-arching objective of every project:
the production of “fit-for-use” deliverables on-time and on-budget.
Therefore, to be proactive in the project risk management discipline means to spend more time attempting to mitigate risk potentials than to deal with them after they have triggered into reality thereby causing a drain on project resources and funds.
An ancillary question may now be:
How does a project team mitigate a risk potential?
With the recent growth in certification for project managers, there are many answers to this question, but many do not stop and think about the words or phrases they are using to define risk mitigation. In common terms, risk mitigation is the process by which project risk potentials are dissected, understood, and evaluated for the express purpose of reducing their risk equivalent value (REV). A risk potential’s REV is the product of the potential’s risk cost of impact (RCI) and its risk potential of occurrence (RPO). Thus the formula for a risk potential’s REV is:
Usually the value of REV is given in terms of cost when RCI is in a monetary currency and the RPO is enumerated as a percentage. The product or REV is thus expressed as the product of cost impact weighted by the probability that the risk potential will occur.
An example would be, say, the RCI or cost of a severe hurricane hitting your data center could be $1,000,000.00 units, and the RPO or probability occurrence is 0.01 or 1% chance of happening given your location, propensity for hurricane activity, soundness of data center structure, and many other factors. The REV would then be the product of RCI * RPO which is $10,000.00 units. The REV now allows the risk management team to prioritize the risk potentials thereby expending the limited risk mitigation funds and resources on those risk potentials with highest REV. The added benefit is that the risk potentials with the highest REVs are the candidates for the largest reduction value versus mitigation resources expended.
In closing, being proactive therefore is primarily focused on mitigation and not on response. Reducing the possible impact (REV) of a risk potential instead of responding to a risk that has triggered, i.e., an issue, is most often, we have found, the best approach and most cost efficient given today’s economic landscape.