Risk management doesn’t address “unknown unknowns” –and that’s exactly what will bring down your project. No matter how much time you spend on your risk management plan, it’s not capable of addressing the issues and risks that aren’t identified, according to Michelle Symonds, and that’s the biggest problem with risk management.
It comes down to a simple process of deduction: if risk management can accurately enable a project manager to understand likely contingencies, they can likewise create tasks that handle those contingencies. This makes risk management little more than a template for creating allowances of time to address likely risks—making them less like risks and more like “inherent uncertainties” as Symonds expresses. However, risk management is rarely designed to address risks and issues that are not expected, so it’s not really risk management as much as it is part of the process.
Symonds closes with this interesting challenge: run a project without risk management. Simply account for “risks” (likely problems that are expected) with additional time and tasks, but don’t waste time through building a risk management plan. Just a change in semantics? Perhaps, but how many people are willing to say they don’t have a risk management plan to their bosses?