Rarely will you need to use all four risk management techniques for a particular risk. That leads to the obvious next question: which technique should you employ for a given risk? While there is no specific right or wrong answer, there are some time-tested questions and guidelines that can help you decide.

What kind of risk are you trying to mitigate?Are there traditional methods (see the next section) that may work better for the application than other methods?

Do you have the correct problem statement? Are you treating the cause rather than the symptom? What risk or risks are you trying to address?

Are the risks the same type—or of more than one type? Do you need to consider different types of treatment strategies if you are facing multiple types of risk?

After you’ve answered these questions, conduct an analysis to make sure that the right risks and issues have been identified. Prescribe the most appropriate type of mitigation. Certain traditional mitigation methods work better for corresponding types of risk. We discuss some of these in greater detail in other chapters. A brief overview follows.

Choosing the right risk management and mitigation tools for your particular risk management issue is a matter of careful evaluation.

To start with, conduct a cost-benefit analysis. Ideally, make it both quantitative and qualitative, since each set of findings may be equally important. These findings may play out over multiple time periods. In these evaluations, take both direct and indirect benefits and costs into account. The direct and indirect benefits may have varying levels of uncertainty and need to be evaluated as separate issues. These may have different probability distribution curves. There may also be drivers such as social expectations and legal and regulatory issues. Those requirements and expectations may weigh heavily in your choice of options.

Another thing to consider: some approaches may not be considered satisfactory to the company. This happens occasionally when a mitigation approach has been tried before and failed. (The reason for failure may not even be rational; maybe the project manager became ill and the initiative never took off.) A conflict of corporate values can also create disagreement over approaches. A good example is the use of financial derivatives. Many organizations shun this technique or don’t have the financial capabilities to support it.

When treatment options have been identified and implemented, the risks that remain behind are called residual risks. It is important that stakeholders and decision-makers be aware of their nature and extent. The residual risk should be documented and routinely monitored and reviewed—just like any other risk.

One of the most important pieces of information in the mitigation and management of risk is a cost-benefit analysis. You will be evaluating both hard and soft categories—impacts measurable in dollars as well as impacts that are more difficult to quantify—to determine and rank the importance and size of your risks relative to one another. Quantifiable cost-benefit analysis involves adding up the costs and the benefits and comparing the two. This is often done as a ratio of costs to benefits. It is a form of return equation.

If the return (or benefit) of an option is greater than its cost (or another predetermined figure), then the option is worth pursuing.

An ideal approach to cost-benefit analysis and implementation is as follows:

Another complication lies in the potential uncertainty in the values assigned to costs and benefits. You will want to establish what the variance is for each cost-benefit assumption and establish a distribution of results, as described in Chapter 8. A probability weighting can also be employed on each line item. More sophisticated assessments, particularly when big money is at stake, often include a Monte Carlo analysis (discussed in Chapter 10) to factor in the variance around every line item.

Choosing the right cost-benefit option isn’t always a straightforward process. It is often the case that there is no single best option or that the optimum solution is prohibitively expensive. Some options may have incremental benefit, depending on how much is spent on the implementation. Or a company may consider trading off between an implementation’s benefit and cost.

Other realistic options include the following:

Believe it or not, doing little or nothing is often a real option, particularly if the solution is being applied for regulatory compliance purposes.

If you want to see how costs and benefits will be realized over a year or longer, you may need to employ a net present value analysis. This analysis examines the costs and benefits for each year that the solution takes effect. Next, it “discounts” the effect, which takes into account cash flows that occur over multiple points in time. Those cash flows are “discounted” by a percentage rate that takes into account the minimum value of the cash flow or alternative investment. This method will allow you to take into account the time value of money.

Finally, the plan must be implemented and managed. This will usually include the following steps:

Be sure to include a mechanism for assessing and monitoring the effectiveness of the solution.