Making Risk Management Work

In the department of defense, risk management typically focuses on precisely defining a risk statement, evaluating its probability of occurrence and severity of consequence, and identifying and planning mitigation steps. This simplistic approach to risk management often becomes difficult to implement in a way that provides useful insight to the Program Manager. This paper will discuss the shortfalls of this approach to risk and will discuss issues such as the importance of understanding the impact of time (when a risk is realized) on the consequences, differentiating risks based on knowledge gaps from those on uncertainties, effective risk mitigation planning, incorporating the cost of risk in program cost estimates, the issues associated rolling up multiple lower level risks into higher level risks, and the relationship between risk management and set-based design.