Mitigation That Changes Something

Part of Clinical Project Management (PM) Training: Finding the Risk That Matters.

About 1 minutes. Free, in your language, no account needed.

A mitigation is an action, with an owner and a date

"Monitor closely" is not a mitigation. "Escalate if it worsens" is not a mitigation. Both describe watching.

A mitigation changes the probability or the impact. Training a second coordinator changes the impact of losing the first. Splitting a manufacturing batch changes the impact of a failed release test. Adding a second laboratory changes the impact of one closing.

Detection is a legitimate control, if it is specified

Sometimes you cannot reduce the probability of something, and the right control is finding it quickly. That is a valid mitigation only when you have said what will be looked at, how often, and what value triggers action.

Detection without a threshold is the same as watching.

Accepting a risk is a decision, not a failure

Some risks are not worth mitigating. Say so explicitly, record who accepted it and why, and review it when circumstances change.

An accepted risk on the record is a defensible position. The same risk unrecorded looks, in hindsight, like one nobody thought about.

The review is where the value is

A risk register written once is a document. One reviewed on a schedule, with risks closed when they pass and new ones added when the trial changes, is a management tool.

The most useful question at each review is not "has this got worse" but "is this still the right list". The risks that matter in month two are rarely the risks that matter in month twenty.