Comments on Risk Mitigation Strategies



30 September 2022

Ref: Hopkinson, M. (2022). Pre and Post Mitigation Risk Estimates: A brief guide, Practical Project Risk Management, series article, PM World Journal, Vol. XI, Issue IX, September. Available online at https://pmworldlibrary.net/wp-content/uploads/2022/09/pmwj121-Sep2022-Hopkinson-pre-and-post-mitigation-risk-estimates-series-article.pdf

To the Editor, PM World Journal


I would like to submit a few remarks in response to Hopkinson, M. (2022). Pre and Post Mitigation Risk Estimates: A brief guide, Practical Project Risk Management, series article, PM World Journal, Vol. XI, Issue IX, September.

First, a remark on the use of the term “mitigation” which is generally defined to mean: “action of reducing the severity, seriousness, or painfulness of something”. Use of this term would therefore imply that the only actions we are considering are associated with threats, since opportunities do not cause pain and should, in any case, be enhanced rather than reduced. However, for a complete analysis of the risk situation, opportunities should be taken into account at the same time as threats, and the term “risk response[1]” would therefore be preferable to “mitigation”[2].

Now a remark about the stated purposes of the process described in the article which proposes to “estimate the effect of risk mitigation plans on individual risks, and potentially, quantify the overall value added to a project as a consequence of its risk mitigation plans”. I believe that this approach could be improved upon.

The weakness of the proposed approach is due to the fact that the impacts of individual responses to threats and opportunities can affect several success criteria at once, while interactions between response actions can enhance the effectiveness of some of them while making others less effective or even counterproductive. The value of the resulting effect is therefore not equal to the sum of the individual effects. For this reason, the following algorithm is proposed:

1. Baseline plan: Create a response-complete baseline plan including all of the proposed responses, taking into account the costs of implementing each of the responses.

2. Simulation: Run a simulation on the baseline plan to obtain the probability curve of the results to be achieved (e.g., increased value, reduced time and/or cost over-runs, etc.).

a. This will give a more realistic forecast of the resultant outcome.

b. However, a plan including all of the selected responses may be too complicated to manage effectively[3]. If this is the case, continue with the following step.

3. Simplification: Identify the response that provides the lowest contribution, as follows:

i. for each of the responses in turn, remove it from the current baseline and carry out the simulation on the resulting plan.

ii. Using the results of those simulations, identify the potential response whose removal had the lowest undesirable impact with respect to the current baseline. This will indicate the best choice of response to eliminate[4].


Crispin (“Kik”) Piney

South of France

To read entire Letter to the Editor, click here

How to cite this work: Piney, C.  (2022). Comments on Risk Mitigation Strategies, Letter to the Editor, PM World Journal, Vol. XI, Issue X, October. Available online at https://pmworldlibrary.net/wp-content/uploads/2022/10/pmwj122-Oct2022-Piney-comments-on-risk-mitigation-strategies-Letter-to-Editor.pdf

[1] I am referring in this context to proactive responses to identified risks, as opposed to reactive responses to risk events that have occurred.
[2] And there are then two categories of responses: “mitigation” (for threats) and “enhancement” (for opportunities)
[3] This is a negative risk in its own right.
[4] Because its inclusion makes the lowest improvement to the situation.