Risk management is not project management

>A 10 on likelihood is "this is certainly going to happen", a 1 is "it very probably won't, but it could".

If something is guaranteed to happen it's no longer a risk, it's an issue, and then needs to be actively addressed to resolve it, starting by adding it to the Issues List. That effort is in contrast to efforts involved in mitigating the likelihood of a risk happening or its impact. E.g. it would likely justify reallocating resources to resolve the issue where, depending on the score of a particular risk, it might not. Also, in terms of reporting, issues are almost always reported to upper management regularly, whereas risks may not be.

Again, really good approach. I don't see risks managed explicitly enough, and I've been managing projects professionally for over 20 years.

In big companies, it's rarely the success of the project. Usually it's a combination of keeping your job and growing your career.

Most big companies provide limited upside for success, and the downside risk is higher for the people. Consider:

1. The project is successful. You get a nice little bonus at the end, if anything. Maybe a promotion a year later.

2. The project is a failure and people can point part that you were responsible for. You get nothing, or worse, you're fired.

3. The project is a failure, but people can't point at you as the reponsible party. You keep your job, even get a small raise because you did your part.

Part of this is inevitable in my opinion, but organizations should really ask themselves what behavior they're incentivizing and rewarding, especially in a repeated fashion. If your people swing for the fences and miss -- what happens, and how does that compare to the people who bunt or stay on the bench?

RACI is an acronym derived from the four key responsibilities most typically used: responsible, accountable, consulted, and informed. It is used for clarifying and defining roles and responsibilities in cross-functional or departmental projects and processes.

I wish more people briefly defined acronyms at first usage in a document.

Real risk management identifies risk and defines mitigations to bring the risk down to an acceptable level. Passing the buck doesn't address the true risk; it only addresses the risk of who is accountable.

Imagine a scenario where you need a new water heater in your home. One of the risks is that a bad installation is that the water heater overpressurizes and blows up. Saying, "I hired a contractor to install it" doesn't mitigate that risk directly. The appropriate mitigation is installing a pressure-relief valve. Hiring a competent contractor can be a means to this end, but it's not a direct mitigation. If you hire a licensed contractor you may pass off the accountability risk but you aren't addressing the over-pressure risk. The client (and author) in this article are confusing what risks are being addressed.

It's a matter of definitions, but something that is certain to happen being a "risk" seems reasonable.