Risk un-management?
Perhaps the largest task within risk management, and requiring the greatest judgment, is "risk un-management"
Perhaps the largest task within risk management, and requiring the greatest judgment, is "risk un-management"
On any project there are going to be dozens, perhaps hundreds, of unmanaged risks. These comprise the population to be un-managed.
I doubt this is news to anyone, but these are, as a group, more numerous than those selected for the usual risk management paradigm. Among the un-managed:
- Weaknesses that are Low-Low on the risk register's probability-impact matrix, maybe even all the way to High-Low (p-I)
- Threat events or their effects that are off baseline, not in the project plan, and range from Low-Low to High-Low, perhaps even Low-High also (p-I)
So, you've not put the unmanaged event or its effects in the project plan, but probably you have identified some of them and put them below the line of those risks that you will actively manage. Other un-managed will pop up along the way, to be thought about, but then cast aside for active management.
Four strategies, but only one applies
Among the four big strategies--accept, avoid, mitigate, and transfer--which one is being used in this management scenario?
If you picked "accept", you get the risk manager's prize for this posting. Indeed, this is 'acceptance' of risks that are below the line and not being managed.
What could possibly go wrong?
Frankly, for many, the idea that we're going to sit back and accept risk is an uncomfortable position to take. But it happens all the time. When my risk management students lament that their organization has no risk management process or strategy and just deals with risk as they come along, I respond:
Four strategies, but only one applies
Among the four big strategies--accept, avoid, mitigate, and transfer--which one is being used in this management scenario?
If you picked "accept", you get the risk manager's prize for this posting. Indeed, this is 'acceptance' of risks that are below the line and not being managed.
What could possibly go wrong?
Frankly, for many, the idea that we're going to sit back and accept risk is an uncomfortable position to take. But it happens all the time. When my risk management students lament that their organization has no risk management process or strategy and just deals with risk as they come along, I respond:
"No strategy" is a strategy of sorts in the sense that you've embraced "accept" as your risk response plan. In that event, the need to actually do a lot of work up front to identify risks is really not too productive.
If the organization is risk-seeking in attitude, this may be just fine.
After all, you're just going to accept whatever comes along and deal with it.
Buy them at any online book retailer!
