Why "Mitigate" is the Most Overused Word in Project Risk Management

Choose the Right Risk Response with a Gated Framework

The way out is a fixed sequence of questions. In the five-step process, the treat step is where the response is chosen. Work through the risk register one risk at a time and ask the gates in a set order. The first gate that produces a viable answer determines the response. This framework is simple enough to use in a live risk workshop and structured enough to stop the reflex.

Gate 1: Can You Accept the Risk?

Some risks do not need an action plan. Risks with low probability or low impact, and especially risks that sit within the organization’s risk appetite, can be consciously accepted. Active acceptance is not a decision to ignore a risk. It is an explicit choice to tolerate it, recorded in the register, with a note about the conditions under which it should be reconsidered. If the risk sits beyond the risk appetite, acceptance is not appropriate and should not be used to avoid escalation.

Gate 2: Can You Avoid or Exploit the Risk?

Ask whether the plan can change so the risk no longer applies. Avoidance removes exposure to the threat entirely, and a risk that never materializes requires no further response resources. Teams often skip this gate because they have already attached to the current approach. Asking it first keeps that bias from closing off the cheapest protection available.

Gate 3: Can You Transfer, Share, or Escalate the Risk?

If the risk cannot be avoided cleanly, ask whether another party should own it.

A transfer response moves the risk, or the financial consequence of the risk, to a third party that is better positioned to handle it. Transfer can be accomplished through contractual, financial, or insurance arrangements. It works well when a suitable party exists and the cost of transfer is lower than the expected cost of mitigation. When transfer is chosen, the new owner and the limits of the arrangement should be documented clearly.

Share is when we have an opportunity risk that we want to share the benefits of the risk. This can also be within a contractual or financial arrangement. And it work well when you need both parties to ensure the risk will happen.

When a risk response sits outside the authority of the current level, the risk can be escalated to the next level. This is not to be used as a way to push the responsibility, but a way to put the risk at the risk at the right level for decisions and response planning.

Gate 4: Does Mitigation or Enhance Earn Its Place?

Mitigation is the right response when the first three gates do not produce a better answer.

At this point the risk is real, the project owns it, and active treatment is appropriate. Mitigation should take the form of a specific action that reduces probability, reduces impact, or does both.

A useful mitigation entry names the action, the owner, the timeline, and a measurable target. A general instruction to monitor is not mitigation.

Monitoring belongs with acceptance and with the ongoing review of the risk process.

Gate 5: Actively Accept the Residual

Sometimes, we need to accept the residuals of our risks.

Gate 5 means that we have looked at all the other options and probably even implemented some of them, but a residual amount of risk is left over. When this happens, we need to ensure we are actively prepared to respond to those risks by taking them back through the gates.

Occasionally, the residual we have left over is within our appetite, meaning we can now accept the risk, ensuring we keep all necessary reserves, triggers, and fallback plans in place in case the risk does materialize. 

This is not a failure of your work in Gates 1-4, but just what is left over from the actions you did at each gate and how you plan to respond against the residual.