Blogging AllianceDave GordonProject ManagementRisk Management

Risk Response Strategies: Transfer or Avoid the Danger


As I’ve noted in other articles, a risk is an uncertainty that matters. Some event has a significant probability of occurring, and there will be a significant consequence if it does. A risk represents a threat, and a wise project team endeavors to identify project threats and analyze them for effective strategies, so that the probability of occurrence can be reduced or the consequences reduced. Or both.

Of Mice and Risk Management

Consider the following proverb:

The early bird gets the worm, but the second mouse gets the cheese. – David Jakovac

Mr. Jakovac is correct only if the cheese is in a trap; otherwise, the Second Mouse goes hungry while the First Mouse eats his dinner. Thus, the Wise Mouse looks at the context, seeking potential threats and assessing her exposure to them. If the cheese is indeed in a trap, waiting to be triggered, then she has four potential risk management strategies to consider:

  • Mitigate: try to either trigger the trap from a safe distance or find a way to survive the snap
  • Accept: in effect, volunteer to be the First Mouse
  • Transfer: recruit a First Mouse (or possibly a whole tribe of mice)
  • Avoid: look for another food source

After considering the technical limits of the alternatives available for mitigation (little chance of reducing the probability of occurrence) and the fatal consequences of triggering the snap (little ability to reduce the cost of the event), the Wise Mouse will abandon the first two strategies as unworkable. At this point, Ms. Mouse needs to consider the economics of the transfer and avoid strategies.


Generally, a risk is transferred using one of two mechanisms: pooling or delegating. In pooling, a number of parties at risk contribute funds to finance recovery from an event experienced by a member of the pool. If that sounds like an insurance policy, it is. Surety bonds are also a form of risk transfer, commonly used to absorb the impact of non-performance. Currency exchange rates can be a risk, and appropriate financial derivatives are used to partially absorb a loss. In most cases, pooling is about reducing the financial impact of an event, at some initial fixed cost.

The Wise Mouse is considering a delegation strategy. Delegation can take many forms—from sub-contracting to an experienced performing agency to engaging an expert contingent worker. Crowd-sourcing is a delegation strategy, as is the use of open-source software. Delegation to someone with more expertise or more availability is intended to reduce the likelihood of the event, again at some cost. Other times, as in the case of the recruited First Mouse, delegation is about transferring the consequences.


We avoid a risk by accepting the opportunity cost of not doing something. In projects, this can range from taking something out of scope to adjusting the project delivery schedule. Depending on the goals of the project and the nature of the risk, we may determine that the remaining value of all but this one thing still exceeds the adjusted cost, so we may proceed without it.

Of course, if the value no longer exceeds the cost, it may be better to abandon the project. The Wise Mouse is considering exactly that approach.

Certainty Is for People with No Imagination

Leadership requires a willingness to make decisions under conditions of uncertainty. Risk management is about improving the quality of decisions made under conditions of uncertainty. It is unrealistic to demand certainty before taking action and foolish to assume that all will go well simply because you need it to. Identifying and analyzing risks may help reduce uncertainty to acceptable levels, or it may lead to cancellation of a doomed project. In either case, analysis of the risk and alternative strategies provides a rational basis for decision-making.


For more brilliant insights, check out Dave’s blog: The Practicing IT Project Manager

Are you involved in a data conversion project? Then check out Dave’s indispensable book: The Data Conversion Cycle

Show More


  1. The usual high quality content here from Dave. One point of clarification or addition to the definition “As I’ve noted in other articles, a risk is an uncertainty that matters” – surely it only MATTERS if it is relevant to one of the stated Project objectives.
    For example, world peace MATTERS, but an uncertainty to a resolution to latest hotspot is not a risk to my ERP project, per se. (Although one could probably argue it IS a risk at a high level to all project, maybe that’s a bed example.
    To pick another, it MATTERS that I remove the toast from under the grill in my kitchen when cooking breakfast, but it’s is not a risk on my ERP project…..

Leave a Reply


We use cookies on our website

We use cookies to give you the best user experience. Please confirm, if you accept our tracking cookies. You can also decline the tracking, so you can continue to visit our website without any data sent to third party services.