Risk Management Guidelines- Mitigate Risks

8/4/2019 Risk Management Guidelines- Mitigate Risks

1/5

PADCO|AECOM Navi Mumbai SEZ Phase IJai Towers, Plot No. 68, Sector 15CBD Belapur, Navi Mumbai 400 614Maharashtra, India

Mitigating Risks

Having identifiedand analysedthe risks to the project, it is necessary to decidewhat to do about them. This process is termed Mitigation. The word itself means

to soften, to make less severe or less painful. Thus, risk mitigation seeks toidentify and prepare for implementation ways in which the severity is reduced if

the risk becomes an event.

Identification of Stakeholders:

As previously discussed, all risks can potentially become events. If they do, allof those entities involved in controlling conditions that brought about the event (if,

of course they couldbe controlled) have some responsibility to bear for its havingoccurred. They were, collectively, in a position to avoid or otherwise mitigate the

severity of the event. There are also entities which, although they may have nocontrol over the risk, are affected should it become an event. These entities arecalled stakeholders, since they each have a stake in, and some have a degreeof control over, the outcome.

Mitigation Alternatives:

There are five alternative means of mitigation commonly recognized:

Avoidance

Reduction

Retention

Transfer

Sharing

Each of these has advantages and disadvantages. It is useful to explore these for

each of the alternatives in turn.

Avoidance:

Avoidance is the result of taking a formulated action which renders the Probabilityof Occurrence of the risk to a value of 0.00, or avoiding the possibility of the risk

ever becoming an event. This is, perhaps, the most effective means of riskmitigation, since it effectively eradicates the risk altogether.


2/5

Mitigating Risks October 10, 2006Page 2 of 5

Not all risks are amenable to such action, either because there are no actions

possible that will have the effect of removing the risk or because all such actions

are not economically feasible, costing significantly more than the Consequences ofthe risk should it become an event.

In the formulation of measures designed to avoid the risk, one must carefully

assess the impacts of those measures. It may be that the mitigation for avoidanceitselfcarries risks- either to the success of avoiding the event or in the possible

spawning ofotherrisks which require mitigation as well.

As an absurdly simple example, consider the risk that a small community may beinundated by storm surge during a typhoon. An avoidance mitigation is formulated

to surround the city with an impregnable reinforced concrete wall 12 meters high.

This has effectively removed the risk, since even the strongest typhoons on recordhave resulted in storm surges approximately three-quarters that high. But the

presence of the wall now renders it impossible to get into and out of thecommunity and a gate for that purpose, if built, would have to withstand the

hydrodynamic loads of the surge and there is no assurance that the gate would beclosed at the time the storm struck. The risks inherent in the avoidance

mitigation, therefore, themselves require mitigation in order to be effective inremoving the risk altogether.

Reduction:

Reduction seeks to literally mitigate or soften the impact of the risk becoming anevent. It examines the Consequences of the event and examines means bywhich those Consequences can be reduced in either Delay, in Cost, or both.

Reduction occurs during the search for Avoidance, when the conclusion is drawnthat complete Avoidance is impossible, either due to the impossibility of avoiding

it or the economical limitations of those measures that wouldavoid it. In ourcommunity example above, it may be that a decision is reached to reduce the

height of the wall to 6 meters on the landward sides, using the savings in concreteto build a viaduct over the wall at two locations, giving access to the community

without resorting to a gate. This seeks to reduce the impact of the typhoon bymaintaining the original wall height on the seaward sides to reduce the impact of

the storm surge while providing access over a lower wall on the landward sides.There would still be inundation, but the dynamic effect of the storm surge would

be mitigated considerably.

As in the case of avoidance, Reduction measures must be examined for their

consequential risks, as well.


3/5


Retention:

After examination of the Consequences that ensue should a risk become an event,

it may be concluded that the risk must merely be assumed (or accepted). This is arational and prudent decision if one of the following two conditions applies:

The Probability-Impact Value is small, rendering the Risk as BLACK (SeeAnalysing Risks, page 6)

The Probability-Impact Value is significant (more than 1% of Schedule orBudget) but no other mitigation means are available. In this event, the

Consequences should be covered by insurance.

It may be that residual risk (that remaining after other mitigation efforts are in

place) may still present a threat that meets one of the two criteria above andrequires either insured or uninsured assumption, according to its residual

Probability-Impact Value.

Transfer:

Transfer of risk means, quite simply, the process of transferring the consequencesof the event onto another party (usually a stakeholder), thereby transferring the

risk of this event to that other party. An example would be the requirement that

a contractor complete his work by a certain date or be required to pay liquidateddamages in consequence of his failure to do so. The risk of delay, theoretically,becomes his to deal with.

While this means of mitigation does theoretically transfer the responsibilityfor therisk to another party, one is prompted to inquire if it does, in fact, effectively

mitigate it. Control over the risk is passed from the principal to the subordinateentity but the effects of the event, should the risk be manifest, are felt by all of

the stakeholders and the failure of one to effectively plan for or avoid theseeffects impacts all to some degree. The entity to which the risk has been assigned

may enact his own mitigation measures which are the least expensive and whichwill effectively protect his own interests to the greatest degree. Such measuresmay not have the effect of protecting the interests of the other stakeholders tothe same degree that they protect his own.

The insurance against the Consequences of a risk becoming an event, whileperhaps a form of transfer, is generally considered to be Assumption (discussed

below), since the insurance company has little control over the conditions whichbrought about the event and cannot, therefore, be considered a stakeholder.


4/5


Sharing:

Considering that the number of stakeholders to a risk almost always involves

more than one entity, Sharing becomes a useful and productive means ofmitigating the risks either to any individual stakeholder or to them all collectively.

If each of several stakeholders can act to Reduce, or Assume a portion of therisk, its impact is at least softened. If several act to Reduce the risk, the

Probability of Occurrence may be reduced to the point where the risk assumes aBLACK Probability-Impact Value and can be safely Assumed as an uninsured

risk.

Proactive Actions and Contingency Actions- The Mitigation Plan:

Each one of the Mitigation Alternatives,

Avoidance

Reduction

Retention

Transfer

Sharing

involves actions that must be taken by one or more of the stakeholders in orderto effect the Mitigation. Some of these actions will be takenpriorto the risk

becoming an event to either avoid or reduce its impact. These are calledProactive Actions and must be implemented as soon as possible after the risk

has been identified and the actions planned. Other actions will be taken only afterthe risk has become an event. These actions are called Contingency Actions and

have been planned ahead of time to swiftly deal with the event and reduce itsimpact on both schedule and cost. Both types, Proactive and Contingency, may becombinedin some instances to deal with the impact of a risk manifestation.

Since a complex project may involve hundreds of risks, it is necessary to recordthe mitigation actions to be taken to deal with each risk and assure that all of thestakeholders are aware of the measures being planned and their role in making

the plan work. This is called a Mitigation Plan and is prepared for each identifiedrisk, communicated to the stakeholders, and their agreement memorialized in

some form of signed Memorandum of Agreement. The Memorandum sets forth thedescription of the risk, its Probability of Occurrence, its Consequences of

Occurrence, its Time Horizon (position on the schedule), and a statement of theMitigation Plan for dealing with it. The described Mitigation Plan should set forththe Proactive and Contingency Actions, the dates that those actions must be


5/5


taken, and the specific identities of those responsible for implementing them. The

Memorandum should be endorsed by all parties to it and maintained by the Risk

Management Team. A means of electronic endorsement may be devised so thatthe process may be facilitated by email.

Monitoring and Controlling Risk:

At this point in the Risk Management Planning process, one has Identified therisks to the successful on-time and on-budget completion of the project,

Analysed those risks to determine their probability, impact, and priority, andestablished plans agreed to by all stakeholders that will Mitigate the impactshould any of the risks become events.

Not bad! But it is important to realize that Risk is a ubiquitous and dynamic foe.As the circumstances of the project change, risk is an ever-present skeleton readyto confound those not alert to conditions which give it life.

Previously identified risks must be monitored for change to assure that themitigation measures in place will still have the anticipated softening effect.

Changes in the identity of stakeholders must be likewise monitored toassure that the mitigation plan is still viable.

Changes in the project scope, sequencing, schedule, or task listing may all

introduce either changes to identified risks or the introduction ofnewrisksthat require identification, analysis, mitigation, and monitoring.

Although these tasks, as described, seem quite daunting, there are fortunatelyworksheets and graphical means available which simplify the monitoring processand help to keep the Risk Management Team on top of circumstances as they

evolve. These tools are described in the following section, Risk Monitoring: TheRisk Management Worksheet.

Documents

Risk Management Guidelines- Mitigate Risks