Risk management reconceived : reconciling economic rationality with behavioural tendencies

Risk management practices as described in many leading texts feel counterintuitive to many practitioners and are frequently ignored, despite their being evidently logical and potentially valuable. Such practices are often conceived as a remedial post-planning, audit activity. This paper proposes an approach for dealing with project uncertainty and risk, grounded in economics and taking into account behavioural biases and heuristics. The proposed approach is argued to be an enhancement to conventional risk management practices and one that can serve organisations better while also aligning to experienced practitioners’ intuitive approaches. In particular, we argue: that the focus should be on adding economic value rather than reducing risk per se; that opportunity gain/loss is a superior metric for gauging potential impacts of risky events; and that creation of real options should be emphasised as part of the repertoire of generic response actions to risk. The approach also supports the integration and handling of uncertainty and risk as part of holistic project planning and control.


Introduction
Projects are a ubiquitous feature of organisational life, and are used to bring about a wide range of desired changes.They are unique and usually complicated undertakings that warrant a structured and disciplined approach.Over the years this approach to managing projects has evolved and been codified (Morris & Pinto 2004).Textbooks abound on the subject of project management (e.g.Turner 2007;Maylor 2005), and professional associations have drafted and updated bodies of knowledge and other guidance (APM 2006;PMI 2009;OGC 2009), which are used to steer practice and inform syllabi for professional accreditations.
Risk management is an important theme within project management practice and recognised as a key knowledge area in the professional bodies of knowledge.The unique nature of projects means that, while lessons can be learned, statistics collected and processes and practices standardised to some degree, they are not as replicable as operational processes.Greater uncertainty exists surrounding the realisation of project work and hence the outcome of the project itself.Project management standards and guidance are consistent in outlining the processes and practices that are deemed to be necessary to identify and proactively manage risks to achieve a project's objectives.These normative prescriptions claim, and support through well-argued logic, that project risk management is a critical success factor for project management (APM 2004;OGC 2007;Institute of Civil Engineers (RAMP)  Given the undoubted uncertainty involved in projects and the claims made for the efficacy of risk management approaches, we are continually surprised that many practitioners are unconvinced of the benefits of a collective, structured approach to risk management.They often rely upon intuitive, personally driven actions.In discussions with practitioners over many years we have heard a number of arguments to explain or justify this phenomenon.Some suggest that it is counterintuitive to spend time and money trying to prevent something that only "might happen".Others claim that "real" risk management happens intuitively, and that the formal process is administrative in nature and results in a "tick-box" mentality that detracts from the real, ongoing project work.Some senior practitioners argue that there is little evidence that risk management is a good investment for the organisation -risk management can feel like an "act of faith".At least in some cultures and organisations, rooted in the metaphor of the manager as heroic individual (Pearce & Conger 2003), the tendency is to value and reward reactive "fire-fighting" rather than proactive "fireprevention".
Despite efforts to focus project risk on both potential problems/threats and opportunities (Hillson 2002(Hillson , 2004)), current processes seem to be ineffective (Olsson 2007;Ward & Chapman 2003), and overall project risk management as typically practised is inefficient (Chapman & Ward 2004).The sustained exhortations from the guidance, techniques and methods offered by academics, professional bodies and leading practitioners appear to have had little widespread impact on practice.
Our contention is that current approaches to project risk management fail to resonate with practitioners' intuitive approaches to dealing with risk and uncertainty.We also argue that there are a number of positioning, conceptual and methodological shortcomings in project risk management processes as espoused in many practitioner texts and commonly applied in organisations.These shortcomings limit the benefits attainable and include the following: 1. Risk management is too often disconnected from planning and estimating processes, which often fail to recognise fully, address and document the inherent uncertainties.This creates an artificial divide and skews risk management towards being a remedial planning and audit activity rather than a decision support process.
2. Methods used to identify, prioritise and respond to risk are often systematically flawed, failing to focus on creating value, and accentuating rather than alleviating the heuristics and cognitive biases that are known to influence human perception of risk and skew decision making.
3. Response planning implicitly emphasises downside risk reduction and proactive actions (that alter the project schedule, budget and overall plan) and tends to neglect contingent actions and the creation of real options.
In the remainder of this paper, we argue that a new approach to dealing with the inherent uncertainty in projects is required that addresses and reconciles human behavioural tendencies with the desired economic rationality that underpins the maximisation of shareholder value or social welfare.We explore the potential causes of value destruction through project risk management.Drawing upon theories of economics and behavioural economics/risk psychology and our practical experience, we suggest an amended process that begins to address some of the problematical areas in current approaches.In particular, we argue that opportunity loss or gain are better metrics of risk event impact, and that options rather than response actions may provide superior economic strategies for addressing risk and uncertainty, and should be employed more frequently.

Lack of appreciation of the uncertainty embedded in estimates and plans
As individuals and organisations embark on a project they rarely do so from a position of no knowledge.If the knowledge and experience is not within the organisation, the initial stages tend to be marked by research and inquiry, the bringing in of outside expertise and tentative steps and exploration.If the project is a radically new undertaking, then analogies and related experience are sought, and learning processes such as prototyping and trial and error are employed.To do otherwise for anything other than trivial initiatives would be foolhardy.Such practices have been observed, and their merits analysed and evaluated in terms of real options theory.Activities that foster learning such as prototypes and pilots create real options and in doing so reduce risk and improve the value potential of the project or initiative.But, as Benaroch et al. (2006) found in one organisation, managers follow the logic of option-based risk management, but only at an intuitive level.
We argue that, in most cases, there is a basis of knowledge, often tacit, that is used in planning -the choice of methodology, technology, resources, infrastructure, equipment, etc, and the estimation of the time and effort required to accomplish the work of the project.Embedded within the choice of method, in the broadest terms, are judgements about relative performance (compared to other methods) and uncertainty, and personal and corporate attitudes towards risk (Hillson & Murray-Webster 2007;Murray-Webster & Hillson 2008).Plans reflect judgements between scope and quality, and time and cost, and typically the potential threats that would result in an increased duration or out-turn cost, or on reduced scope and quality in the face of immovable time and cost constraints.Provided the various factors have been adequately researched and considered, the resulting plan should represent a good way of undertaking the project.Such competent planning may, however, still present opportunities (Chapman & Ward 2004) or allow for improvements in expected outcome through subsequent analysis.
Competent practitioners know that there is inherent variability in estimates associated with myriad factors such as the expertise and motivation of the people, the suitability of tools or equipment, and the physical conditions.Even the application of standard times and effort to an activity -for example the 'reference class forecasting' approach proposed in Flyvbjerg (2006) -entails considering what variations exist between the activity in question and the 'standard' activity.Experienced practitioners do this intuitively.This thinking process and the planning assumptions made are often not fully captured, especially where the organisation's practice is to produce plans deterministically using single-point estimates.As a result, the uncertainty embedded within plans is hidden and predominantly ignored in subsequent formal discussions and decisions.
In more mature project-based organisations, practitioners are required to provide estimates in the form of a range: mode, maximum and minimum, and a PERT value is calculatedmaximum plus four times mode plus minimum all divided by six.Although some practitioners argue for the redundancy of PERT and the associated Critical Path Method as an optimal approach to project scheduling compared to 'lean' approaches, as a means of encouraging practitioners to consider a range of expected values it still has significant utility.A small number of organisations take this further, deploying Monte Carlo simulation techniques to model the effect of uncertainty and risk on project objectives such as duration, capital expenditure or net present value (NPV) of the investment (Kwak & Ingall 2007;Mulambya 2007;Ward & Chapman 2003;Hillson & Simon 2007).In such situations, Monte Carlo simulations are planning and decision-support tools as much as formal risk management tools.Adjustments are made where deemed necessary before integrated project plans are formally approved.Where probabilistic (using Monte Carlo simulation, or PERT values) rather than deterministic (single-point) approaches to planning are adopted, uncertainty is explicitly embedded in plans and estimates and decisions can be taken that acknowledge the 'amount' of chance the organisation wishes to take in pursuing the opportunity.In the most mature organisations, practitioners understand the difference between 'normal' variability in estimates (for example, those associated with unknowns about detailed resource availability or productivity at a particular time) and 'unusual' risk events where proactive action to manage is justified.
However, in the majority of organisations where planning processes are less mature, uncertainty remains implicit in plans and estimates and its causes are left unexplored.In such situations, decisions are taken with little understanding of the 'riskiness' of the venture other than individual managers' own, potentially biased judgements, barely spoken concerns or vague recollections.Estimates and plans can thus be construed as definitive, with significant implications for incentives and remuneration for individuals and organisations.Promises are made without reference to the inherent uncertainties upon which they are made.Failure to honour these un-caveated, and in some instances almost unachievable, commitments results in project members and organisations being punished by clients or other stakeholders.Significant value is destroyed, reputations are damaged and everyone involved suffers considerable grief and stress.
But, these failures are a result of shortcomings in the planning process.Unless the planning process is improved, formal risk management does not have a robust platform for value creation and is relegated to an ad-hoc, retrospective, remedial intervention.

Flaws in a post-planning approach to risk events
Predicting the future with any accuracy will always be problematic.The creation and protection of project value to shareholders and/or other stakeholders entails being mindful of overall uncertainty and of specific risk events.Any planning process is beset by individual and group biases, combined with the unseen influence of heuristics (Hillson & Murray-Webster 2007).Risk management processes are clearly important.But, where formal risk identification, assessment and management starts, after project plans have been substantially developed, this activity may be implicitly positioned or interpreted as an audit.This positioning potentially generates dysfunctional behaviour that serves to compound the lack of understanding of the risk embedded in estimates and the tendency for systematic bias.
Project managers may implicitly defend the robustness and integrity of the plan and hence their own competence, denying or ignoring risks (Kutsch 2008;Kutsch & Hall 2005).Alternatively, they may not attend to early planning with the same attention and mindfulness they would in the absence of a subsequent formal risk review, the "audit" process providing an illusion of knowledge and control (Hammond et al. 1998;Kutsch & Hall 2005).
Responsibility for project success is then viewed implicitly as joint, diffusing ultimate accountability.Moreover, it may be a reasonable conjecture that tendencies towards optimism bias (Flyvberg, 2008) are more prevalent in organisations with formal postplanning risk reviews, almost as a counter-balance to the perceived pessimism of the risk management process.
Risk management specialists may implicitly try to expose risks to justify and demonstrate the value of the process.While accentuating upside risks and lessening downside risks may be the intention of the formal process, human bias tends towards reducing downside risks.The term 'mitigation', derived from the Old English verb to 'soften' and defined in contemporary English language dictionaries (e.g.Merriam-Webster 2009) as "to reduce, make less severe or render less harsh or hostile", is commonly used when discussing the selection and implementation of response strategies to deal with priority risk events.Despite mainstream guidance that reduction of a threat (risk event with downside impact) is only one of a range of potential response actions, many practitioners focus on the single action of mitigation to reduce negative impacts and perceive this as "best practice".
Commonly adopted project risk management approaches also have limitations, frequently unrecognised by practitioners.Published standards and guides focus predominantly on a qualitative process focused on identifying and managing risk events.While looking at individual and groups of risk events is important, it is counterproductive to do this to the detriment of a focus on uncertainty in general, and particularly to those 'root cause' sources of uncertainty for the particular endeavour (Perminova et al. 2008;Ward & Chapman, 2003).This is a theme progressed by Cleden (2009), who argues that it is a mistake for projects to fall into the trap of only trying to identify and cope with quantifiable threats, and that embracing uncertainty requires "broader and more subtle approaches" (2009: xi).Another common technique advocated in most risk management methods is the use of risk matrices (often called the probability/impact matrix, risk assessment matrix or heat chart) to prioritise or rank risk events.Again, the pitfalls in relying on the risk matrix for prioritising risk events are well acknowledged in the literature (e.g.Hubbard 2009;Cox 2008;Seyedhoseini et al. 2009;Kwak & Ingall 2007;Chapman, 2006;Chapman & Ward 2004) and supported by empirical findings in organisations.Not only are subjective human assessments of the likelihood of project risk events occurring deeply flawed, but the approaches used draw upon theories of probability that assume randomness as in games of chance (Pender 2001) which are often untenable in project situations.Assessments of impact often fail to take account of "what matters most" (Hillson 2009), the relative priorities of objectives and the trade-offs between them, so the prioritisation of risk events is suboptimal.Some organisations choose to prioritise risk events using dimensions such as perceived manageability or temporal proximity.While these have some relevance, the potential for human judgement to be systematically biased to ignore important, but temporally distant, risk events that cannot be easily controlled is significant.
In seeking to address one set of biases, another set may be triggered.In applying what appears to be a rational process to the identification and management of risk events, a misguided illusion of control may be created.

Risk reduction, value destruction
The proactive avoidance or reduction of risk/uncertainty may, in many circumstances, result in the destruction of value.The economic value of the project, for instance, as measured by the incremental expected cash flows, both costs and benefits, appropriately discounted over the economic life of the project, can be calculated.In principle, the discount rate accounts for and compensates/rewards shareholders or society for the systematic or unavoidable risk (uncertainty) associated with the cash flows.Risk specific to the project can be diversified away (almost) without cost by shareholders (or members of society) by spreading their investments over a wide portfolio of businesses, ventures or projects (Brealey et al. 2007).Thus, incurring costs or delays (deferred benefits), and hence foregoing value at the project level to reduce uncertainty, is not, from a rational economic perspective, in the best interests of shareholders or society.In principle, shareholder value analysis could be extended to incorporate outcomes of value to a range of stakeholders whose interests and wellbeing the organisation wants to promote.Adherence to this rational economic perspective is not often observed in practice.
Agency theory suggests that the agendas, demands and expectations of managers and other stakeholder groups may be in conflict with those of the shareholders or society at large and assumes that agents are 'naturally' risk averse (Coffee 1988).Those individuals who plan and are expected to execute the project cannot diversify away the project-specific risk, for instance, to their reputations, career prospects or remuneration.Building on this, our experience suggests that the 'accept' or 'take' risk response strategy, in essence taking the chance that the risk event will not occur, is a response that is too often ignored.This results in uncertainty being eliminated or reduced at costs that appear irrational.
Beyond the economically unjustified costs, the creation of increased certainty or padding of plans often creates rigidities and thus the inability to seize opportunities.This then condemns the project almost exclusively to downside risk (Chapman & Ward 2004).The risk management process might fruitfully be targeted at increasing levels of uncertainty (without compromising the safety and wellbeing of the stakeholders involved), and ensuring that better than expected performance and circumstances are exploited.This approach would acknowledge and 'work with' uncertainty and risk, rather than attempting to eliminate it.
Despite efforts to focus project risk on both potential problems/threats and potential opportunities (Hillson 2002(Hillson , 2004)), current processes seem to be ineffective (Olsson 2007;Ward & Chapman, 2003).While the arguments for conceiving risk as opportunity are logical, and indeed wholly accepted by Eastern traditions, in predominantly Anglo-Saxon cultures the common perception of risk as threat is difficult to overcome.Hillson (2008) has argued, building on ideas from information science, that the 'risk as threat' meme has so far been more successful at replication than the 'risk as opportunity' meme and suggests the need for a memetically-seeded paradigm shift.
Our contention is that such a paradigm shift needs to talk about uncertainty rather than risk, value adding rather than reduction, and that the process must be intrinsically linked to planning and estimating, building on sound economic principles and leveraging practitioners' intuitive (almost innate) ways and experiences of dealing with uncertainty.

Adding value rather than managing risks
Provided the project has been planned with care and reflects available knowledge and experience, relatively small interventions should be required to fine-tune the project plan to achieve the best expected value within organisationally acceptable ranges of uncertainty (Ward & Chapman 2003).We argue that a more productive approach to assisting project practitioners -managers, sponsors, planners and others involved -is to surface the limits of knowledge, the degree of incorporation and applicability of past experience, the uncertainties accepted, and possible blind spots.The aim should be to generate value, rather than the more dubious goal of reducing risk, or the ambiguous task of having the appropriate level of risk in a project.This positioning itself can transform what is often seen as a bureaucratic, audit process into a more productive part of project planning and implementation.

Opportunity loss or gain
Risk events and the ranges of possible outcomes of key parameters need to be recognised and understood, along with their effects on project outcomes.The impact of risk events on objectives needs to be assessed.Most risk management approaches favour evaluating the impact in terms of what would happen in the absence of any action -the 'raw' or untreated risk event.This, however, is counterintuitive to experienced managers -doing nothing is irrational.From an economic perspective the occurrence of an adverse event would result in a loss -the difference between the intended outcome and the next best alternative available at that point in time.When assessing a risk event, experienced practitioners immediately think how they might address a situation should it occur, despite the formal risk process asking them not to at that stage.Considering next best alternatives is how they gauge the effect or impact of an uncertain event.For instance, if internal or planned resources were not to be available when they are needed, most experienced practitioners would know of and turn to sources of external or alternative resources, thus reducing the effects of this (presumably) adverse event.
When exploring the effects of uncertainty, we argue that it is better, in economic terms and in alignment with practitioners' instinctive behaviour, to frame this in terms of opportunity gains and opportunity losses (strictly speaking their present values).In more conventional terms, the assessment of impact needs to include the analysis of best contingent action or response expected to be available at that point in time.In line with the need to express risk events fully in terms of their antecedents and consequences, an explicit definition of the planned contingent response to the uncertain event is as important as an articulation of the event itself (see Hillson 2000).
At this point, and pragmatically starting from the uncertain events or parameters with the greatest opportunity gains or losses (Seyedhoseini et al. 2009), enhancing or reducing actions might be sought.The cost of the (economically most effective) action or response can then be compared to the (present value of) opportunity gain or loss to calculate a trigger probabilitythe absolute value of the cost of the reducing action divided by the absolute value of the opportunity loss, or, for upside risk -the cost of the enhancing action divided by the absolute value of the opportunity gain: Trigger Probability (Prt) = Cost of Reducing Action (CRA)/Opportunity Loss (OL) or (Prt) = Cost of Enhancing Action (CEA)/Opportunity Gain (OG) So, if the perceived probability of, for example, an adverse event occurring, based on available information and informed judgement, is greater than the trigger probability, then the action should be incorporated into the project plan.This presumes that the cost of the action is less than the absolute value of the opportunity loss or gain, and that the action is expected to secure fully the opportunity gain or eliminate completely the opportunity loss.
If the action does not eliminate the adverse event but reduces the scale of the opportunity loss, then the comparison is the cost of the action with the reduction in the loss.In the case of an opportunity, the same considerations apply.Taking the action presupposes that it either reduces the loss or enhances the gain.In this case, the trigger probability can be estimated (taking absolute values) as: (Prt) = CRA/Change in Opportunity Loss (COL) or (Prt) = CEA/Change in Opportunity Gain (COG) If the action reduces the probability of the opportunity loss occurring, then if the reducing action divided by the opportunity loss, or more generally the change in opportunity loss, is less than the perceived reduction in the probability of occurrence, then the action should be incorporated into the plan.In the case of an opportunity, the same considerations apply.So: Undertake/Incorporate into Plan Reducing Action (RA) if: Again, taking the action presupposes that the relevant action either reduces the probability of an adverse event or increases the probability of an opportunity or upside event.
Where no response is warranted the best contingent action expected to be available should be incorporated into the project plan as a contingent (or conditional) response (or branch).
The project plan thus incorporates, and documents, the intended course of action and the (best known) contingent course of action if something goes worse (or better) than expected.This helps to prepare for a range of possible outcomes without necessarily investing additional (perceived to be wasted) funds in proactive response actions.
This approach, rather than requiring an initial estimate of probabilities for uncertain events, instead focuses on assessing whether the probability is greater or smaller than a level at which response action is warranted from a rational economic perspective.While this does not overcome human limitations in assessing probabilities, it does focus efforts and attention on where it might make a difference.More importantly, this incremental approach focuses on adding (economic) value rather than a more abstract attempt at managing risk, or threat and opportunity.The conditional responses and their associated probability estimates can also be used as part of, or alongside, traditional Monte Carlo simulations to provide a richer and more informed understanding of the uncertainty associated with a project.This also provides a sounder basis for allocating contingency funding and assessing whether it has been used wisely.

Actions or options
The contingent action available at the outset may have disappeared a few months later.The impact of an uncertain event thus changes in relation to the contingent responses available over time up to the point the event occurs or does not occur.In some instances, the difference between the best (known) contingent response and the next best response may be significant.
In such circumstances, creating an option, if possible, may be the most effective approach.
Real options are arrangements or contracts put into place to increase the economic value of projects (investments) in conditions of uncertainty.Options enable the investing organisation to defer the launch of a project, stage the investments in the project, alter the scale of the project deliverable, abandon the project, switch inputs or outputs once the deliverable is in operation, create a platform for growth, and various combinations of these (Trigeorgis 1995;Kumar,2002).Depending on the prevailing circumstances, options are exercised or they lapse.For instance, an organisation may acquire an option to buy a plot of land at an agreed price at some specified point in the future.If land prices increase, the value of the option increases and the organisation may sell the option or exercise it -buy the land at the agreed price at the specified time.If land prices fall, the option has no value and is not exercised, since the organisation can buy a (similar) plot of land at a lower cost on the open market.
While the creation of real options is not excluded from conventional approaches to risk (threat and opportunity) management, and is increasingly discussed, it is not common practice, not mentioned in any of the mainstream guides and rarely considered systematically as a way of enhancing value (Benaroch et al. 2006;Benaroch & Goldstein 2009).Pender (2001) argues that, "since uncertainty and risk in projects is predominantly caused by incomplete knowledge (as opposed to randomness), responding to risk must acknowledge the temporal dimension and embrace an options approach.The plan then becomes a 'nexus of options ' " (2001: 85).This argument is also consistent with the work of Pich et al. (2002), who argue that normative approaches to project management in general are inadequate for dealing with ambiguity (epistemic uncertainty) and complexity, and that options-based, contingent plans are superior in ensuring project pay-off.
Options can create value by improving or securing contingent responses and hence enhancing opportunity gains or reducing opportunity losses.Among other things, real options can generate more valuable strategies than active response actions, since their costs reflect the probability that they will not be exercised.They can also lock in contingent responses rather than leave them to chance, and may create value if there is a significant difference between the best and next best contingency plan expected to be available at that point in time when the uncertain event occurs.Again, experienced practitioners instinctively, and often at no or minimal cost, create options by making provisional "bookings" of people, resources or equipment, and cancelling them, if not needed, before a firm commitment is required.
Cancellation costs are the price some pay to create management flexibility and keep the option open.Effort expended in developing detailed contingency plans to be implemented should a risk event occur can be considered as real options: the time and effort is traded off against a better and more timely response.
Options, then, should be incorporated into the project plan as a conditional course of action to be called upon if required.In most cases, options have a financial cost or effort associated with them as well as a budgetary impact.Our intention is not to provide a complete discussion on the use or pricing of options, but simply to advocate their more active consideration and use.More complete treatments of real options in project contexts are provided elsewhere, e.g.Huchzermeier & Loch (2001), Kumar (2002), Benaroch et al. (2006), Benaroch & Goldstein (2009).

Integrated monitoring and response
The incorporation of options and conditional or contingent responses within the main project plan creates a holistic view, highlighting the intended course of action, the uncertainties inherent in estimates and the realisation of the intended actions, and the responses to the (foreseen) risk events.Risk (threat and opportunity) management becomes an integral, not a bolt-on, part of project planning and implementation.Project monitoring and progress reviews therefore address the uncertainty surrounding projects.For instance, earned value analysis will provide indications (if variations are systematic) on whether factors such as future productivity or actual costs of future purchases will trigger conditional responses.Some events may be unpredictable, such as the weather, until (close to) the moment.In such cases, monitoring does not, or is unlikely to, generate new information, so no value is added.Changes in the project's context or organisational environment may warrant the creation of binding contingent arrangements.This use of real options to improve or secure responses may be an invaluable tool, especially where the perceived probability of an event increases or the range of contingent responses diminishes over time.
The separate monitoring of (all) identified risks that have not been eliminated, advocated in most approaches but rarely done systematically by practitioners, is subsumed within the overall (integrated) management of the project.Again, experienced practitioners do this routinely, and the updating of risk registers is often more for protecting their interests or for compliance purposes than for illuminating a situation.Where there are multiple, almost equivalent, contingent responses, monitoring the probability or the availability of contingent responses adds little expected value.Where no (further) proactive steps can be taken to influence the event, worry may be futile.From a rational economic perspective, practitioners rightly ignore many uncertain events and simply deal with them should they occur, and so avoiding expending time and effort on monitoring for little value.
Our key point here is that the theme of adding value can transform a predominantly passive stance of monitoring risks into a more proactive search for ways to protect or enhance value.
The question practitioners should be asking, and the best ones do ask, is: "What is changing in the project or its context that threatens the value expected or can be leveraged to create more value?"

Economically rational risk management
We have argued for a re-conception of risk management so it might demonstrably add value and become a more accepted and integrated part of project management.The argument, different from current 'best practices', builds on economic theory while at the same time following a path more in line with the intuitive thinking of experienced practitioners.Table 1 below compares and contrasts three positions -that of current documented 'best practice' as articulated in the mainstream guides, commonplace/conventional practice within organisations and our proposed approach.

Risk Descriptions
Meta-language that describes <cause> <risk event> <'raw' impact> Unclear descriptions that do not separate facts (causes) from uncertain events.
Amended meta-language where impact is described as the state following the implementation of the best contingent response expected to be available at the time (not the raw impact)

Risk Assessment and Response Planning
Subjective assessment of probability and raw impact used to prioritise, then a range of generic response options intended to enable the optimal choice of response for the situation -but with no guidance of how to choose.
Subjective process for assessment and choice of response actioninfluenced by individual and group risk attitudes.
Rational economic analysis focused on opportunity gain/loss based on informed probability assessment.

Response Actions
Intended to be incorporated into project plans as definite actions.
Either incorporated into plans as definite actions, or implemented randomly dependent on commitment of risk owner.
Real options or planned contingent actions incorporated into plans, unless the financial justification to secure certainty is demonstrated.

Monitoring and control
Intended to be focused on the whole risk register, but detached from core planning and decision-making processes.
Random, 'compliance focused' and often ineffective.A remedial activity detached from core planning and decision-making processes.
Integrated with planning and decision-making processes and focused on protecting/creating value.Only focuses on those risks where there is an opportunity to make a tangible difference in value.
Appendix 1 contains a very simple example intended to illustrate some of the differences in approaches.

Summary
For many experienced practitioners, there is nothing particularly new or radical in the approach we are proposing.It lines up with how they would intuitively deal with projects and their inherent uncertainty.We agree with these sentiments.
Our contribution is in highlighting how a more sophisticated economic approach than portrayed by some project risk management texts is theoretically more robust and better aligned to the intuitive practices of experienced practitioners.We have grounded the logic and aims of project risk management within extant financial economics theory, but explicitly recognised agency, behavioural and cognitive biases and limitations inherent in actually dealing with risk and uncertainty.While promoting the creation of real options, we do not argue for an approach as comprehensive or integrated as envisaged by Benaroch and Goldstein (2009), which may be theoretically more robust but suffers from project managers' and organisations' limited familiarity with the selection and evaluation of real options.We contend that the pragmatic approach to project risk management outlined in this paper is relatively easy to understand and so more likely to be implemented.From a behavioural perspective, rational economic evaluations of whether actions or real options add (expected) value 'anchor' the processes of addressing risk or uncertainty.Risk attitude and risk appetite will still, implicitly or explicitly, play a part in decision making through subjective assessments of probabilities or the perceived efficacy of actions or options.In this approach, however, these assessments are not disconnected from espoused economic rationality; indeed, there is the possibility of convergence in practice of the two perspectives: a form of rapprochement or reconciliation.
Our contention is that the proactive analysis and handling of uncertainty (threat and opportunity) has the potential to create value for organisations and society.This entails having estimating and planning processes that reflect and document embedded uncertainty, and distinguish between variability ('normal' risk) and unusual risk events.Without this in place, the need to meet deadlines and stay within budgets inevitably means that a formal risk management processes is required -a remedial and audit activity focused primarily on limiting downside exposure, even if at a certain loss.Such processes may help to identify systematic biases embedded in assumptions and plans, but are often perceived as bureaucratic and can trigger minimal compliance and other dysfunctional behaviours.With uncertainty exposed, a more productive, collaborative dialogue may be possible.The concept of opportunity loss or gain demands the articulation of contingent responses, and provides a better impact measure for determining appropriate actions.The use of real options, alongside planned actions and purely contingent responses, can generate more value than the use of the latter alone.The incorporation of planned actions, real options and contingent responses, or conditional actions, into a holistic plan facilitates the project's proactive management throughout its lifecycle.
The approach outlined above is not a panacea: it will not cope with the unknown unknowns, nor extreme complexity or ambiguity, nor will it remove the effects of heuristics and cognitive bias.Even large, mature organisations using sophisticated tools and methodologies find it hard to meet expected ("P50" or median estimate) expenditure across their total portfolio of projects.The approach outlined here is designed to avoid suboptimal solutions created either because managers fail to adopt the most efficient actions, or combination of actions due to cognitive limitations, or because the sequential approach proposed by the risk methodology does not provide them with the structure to plan actions based on value creation.We propose that the approach argued conceptually in this paper is worthy of empirical study focused on actual practice when planning to take account of risky situations.
Our approach offers a different way of talking about risk and uncertainty, moving practitioner discourses beyond common downside biased notions and purely subjective views of the right level of reduction.It also prompts academe to develop more holistic explanations and guidance to inform the enhancement of practice guidance and standards for the future.small, and the workshop participants would in such a case return to doing their normal work with only minimum loss of time or productivity.The workshop could be rescheduled a few months later and there would only be an opportunity loss in terms of expected improved performance over the interim period.If pressed, the human resource manager might agree to get the trainer to take an earlier flight the day before, and reluctantly pay for the trainer's dead time.It might be possible to persuade the trainer to accept penalty clauses for late or non-arrival, with or without some form of recompense.While agreeing formally to keep an eye on this risk, the HR manager might secretly think that monitoring the trainer's health or air traffic problems was a complete waste of time.
This outcome might well be improved upon, building upon the L&D manager's experience and judgement.The proposed approach, as argued by the L&D manager, would be adequate for most of the workshops, so cost could be saved.But, perhaps, the workshop scheduled in December in Helsinki at which many people from other offices are expected to attend might need a different approach.Apart from travel costs, the attendees from the other offices would find it more difficult simply to resume their routine work.The chances of travel problems might also be higher than for the other workshops, despite Helsinki's (if not UK airports') ability to deal with difficult weather conditions.Routine approaches and assumptions used for the other workshops would not be as applicable.
On this occasion, it might be worthwhile paying the trainer to arrive earlier, rescheduling or relocating the workshop -reducing the probability of an adverse event -a classic mitigation, but this response would sink funds into managing a situation that may never happen.Alternative actions might be to ask participants travelling to the workshop to bring work with them and ensure there would be space and equipment for them to work -reducing the loss.Or the L&D manager could get someone in the Helsinki office to prepare a related management development session to give to the workshop participants should the trainer not arrive -a real option.Formally asking, rather than simply presuming, the trainer to inform the L&D manager of potential delays would provide relevant and timely information to deal with a possible late or non-arrival of the trainer -an integrated rather than detached approach to monitoring and control.
has an MBA from Henley Management College and is conducting research into how organisational routines are intentionally changed for a DBA at Cranfield School of Management.She is an organisational change consultant and a Visiting Fellow at Cranfield School of Management.Her professional interests and experience centre on the competencies required for individuals to manage change and the culture of organisations as they seek to improve and advance.Ruth has a keen interest in how human factors influence risk management and her published work, co-authored with David Hillson, include Understanding and managing risk attitude and Managing group risk attitude, published by Gower in 2005 and 2008 respectively.Email: ruth@lucidusconsulting.com Dr Sergio Pellegrinelli has a BSc in Econometrics, and an MSc in Economics from the London School of Economics, an MBA from London Business School, and a PhD from Cranfield School of Management.He is an experienced consultant specialising in strategic management and organisational change, and is a Visiting Fellow at Cranfield School of Management.His consulting work ranges from analytical consulting interventions to tailored management development.Sergio has facilitated strategy formulation processes and has assisted project teams to design and implement complex strategic initiatives.Sergio has published research on strategy development and implementation, the role of consultants and programme management.His book Thinking and acting as a great programme manager was published by Palgrave Macmillan in 2008.