CHAPTER 12
IDENTIFYING, ASSESSING, AND RESPONDING TO RISKS
In the next tweets I will discuss one of the areas that has received maybe more attention than others in the last couple of years: risk management.
The management of uncertainty has increasingly become more and more essential in everything we plan and do. We have to be sure that the plans we are developing are compatible with the risks we are willing to take.
In this case, the fundamental matter lies upon two basic things: uncertainty and tolerance. Uncertainty is what gives us the doubt about the inherent benefits and costs to do or not do something in order to avoid or leverage any given risk, which up to a period of time, exists only in our minds. Tolerance delimits how much loss we accept from a threat or even a gain from an opportunity.
Anyway, we must be aware that projects are usually riskier than routine. Projects are usually a relevant component of innovation, and that already puts them in a different level of risk when compared to business as usual. We have to be prepared for that. Whoever doesn't want to take risks, well, is not fit to work with projects!
“You want a valve that doesn't leak and you try everything possible to develop one. But the real world provides you with a leaky valve. You have to determine how much leaking you can tolerate.”
Obituary of Arthur Rudolph - Saturn 5 Rocket Scientist 
QUOTE
You have to be careful, real life does not happen in NTP (Normal Temperature and Pressure) situations. Be prepared to adapt, change, and adjust your project to the different scenarios and risks.
Risk management is a PROACTIVE task. Project success is dependent on the proactivity of the project team while anticipating unexpected events and coming up with ways to deal with them.
The whole risk management process should be executed as a team effort, preferably a multidisciplinary one. This minimizes the impacts of the individual perceptions that might be extreme.
Risks are events that may or may not occur, causing a positive or negative impact in the work to be done. Negative risks are usually known as threats, whereas positive risks are known as opportunities.
Risk exposure is a direct function of the amount of money that is at stake when compared to the available resources. An exposure of $1,000 might be huge for some, but irrelevant to others.
The tolerance of organizations and people to a given risk influences its perception. Something that might be perceived as an extreme risk to some might be an irrelevant risk to others. The first step to understanding the risks is to understand the inherent tolerances.
Risk identification and analysis have a clear goal: to develop the possible responses that must be implemented. The classic responses to threats are: avoid, accept, mitigate, and transfer.
The main processes to manage risks are: identify the risks, analyze the risks (along with their probabilities of occurrence and impacts), plan the risk responses, and monitor them.
Mitigate a risk means reducing its probability of occurrence and/or impact of its threat. Example: Install a new door lock in your home.
To transfer a risk means that we mitigate it by transferring its impact to a thirdparty. Example: to buy insurance for your car.
