“Opportunities multiply as they are seized but so do risks when ignored.” – Sun Tzu
“If you don’t invest in risk management, it doesn’t matter what business you’re in, it’s a risky business.” – Gary Cohn
As I was studying for the PMI Construction Professional (PMI-CP) certification, I came across PMI’s updated narrative on risk management. It made me pause and reflect. While it introduces some fresh perspectives, it also redefines a few concepts in a way that might feel less straightforward to those of us familiar with traditional PMI practices. Here’s a breakdown of what’s new and how it differs from the classic approach.
Traditional PMI Risk Management: Clear and Straightforward
In the traditional PMI framework, negative risk responses were distinct and easy to grasp. Each term had a specific focus:
Avoidance: Eliminate the risk entirely by changing the scope or approach.
Mitigation: Reduce the likelihood or impact of the risk.
Transfer: Shift the risk to a third party, such as through contracts or insurance.
Acceptance: Take no action other than monitoring or preparing for the risk.
This clarity made it easier for practitioners to categorize and communicate their risk strategies without confusion.
PMI’s Updated Narrative: Broader and More Iterative
In their updated language for the PMI-CP certification, PMI introduces a more contextualized and iterative approach. They group all risk response strategies under the broader term “mitigation.” The narrative now includes:
Risk Avoidance: Still focused on eliminating risks.
Risk Retention or Acceptance: Acknowledging the risk, either actively (with contingency reserves) or passively (monitoring without action).
Risk Control or Reduction: Minimizing the likelihood or impact of a risk, a concept overlapping with traditional “mitigation.”
Risk Transfer or Deflection: Shifting the risk’s impact to another party.
Contingency: Explicitly adding resources (time, money, or buffers) to address potential risks.
The narrative also emphasizes that risk management is an iterative process. It accounts for changes in the project’s risk profile due to actions taken, unintended consequences, and external events beyond the project team’s control.
The Added Complexity
While this expanded framework provides a richer view of risk management, it also introduces potential challenges:
Blurred Lines: Using “mitigation” as an umbrella term diminishes its precision. Traditionally, it referred only to reducing risks, but now it covers all responses.
Overlapping Terms: Concepts like “control/reduction” and “retention/acceptance” can feel redundant, making it harder for practitioners to differentiate and apply them.
Teaching Challenges: For those new to project management, the broader terminology may slow down understanding and adoption.
Why PMI Might Be Doing This
I’d like to believe this is a deliberate decision rather than the result of different teams working independently. The true answer will likely become clear when we see an updated Risk Management Professional curriculum. If this shift was indeed intentional, PMI’s decision could be driven by:
Alignment with ISO 31000: The broader term “treatment” aligns with international risk management standards.
Customization for Construction: The construction industry faces unique, evolving risks that require a more dynamic framework.
Reflecting Real-World Practices: Risk management isn’t static, and PMI’s narrative underscores the need for ongoing adaptation.
The Bottom Line
The updated approach introduces greater nuance but also brings added complexity and inconsistency within the risk management domain. For certification candidates, this serves as a reminder that prior knowledge from earlier PMI certifications may not be sufficient. It’s essential to thoroughly review the new content and stay alert for any updates or changes.
Have you encountered this updated language in PMI’s materials? I’d love to hear your thoughts on whether it’s a step forward or an unnecessary complication.
Coda
When is change truly beneficial, and when is it merely change for its own sake? While I maintained a neutral tone in my analysis, this appears to be another instance where PMI implements changes without fully considering their broader impact. Ideally, any updates related to risk management should begin with the certification that specifically addresses risk—the PMI-ACP. From there, changes could be thoughtfully integrated across other certifications. After all, risk is risk, whether you’re managing a construction project or developing a website. Why introduce unnecessary ambiguity?