Mitigation and Enhancement Strategies for Overall Project Risk

PMBOK v8 Definition

Mitigation and enhancement are risk response strategies applied to overall project risk. The risk mitigation strategy is used when overall project risk is negative, and risk enhancement applies when it is positive. Examples of mitigation or enhancement strategies include replanning the project, changing the scope and boundaries of the project, modifying project priority, changing resource allocations, adjusting delivery times, etc. These strategies are part of the Plan Risk Responses process within the Risk Management Knowledge Area (Planning Process Group).

Why It Matters for the Exam

The PMI exam frequently tests your ability to distinguish between strategies for individual project risks versus strategies for overall project risk. Questions often present a scenario where the entire project's risk exposure is unacceptable (too negative or too positive) and ask you to identify the appropriate response. You will also see questions that require differentiating mitigation (negative risk) from enhancement (positive risk) at the overall project level.

Key Points to Remember (for the exam)

Overall vs. Individual: Mitigation/enhancement strategies address overall project risk (the effect of uncertainty on the project as a whole), not individual risks.
Direction Matters: Use mitigation when overall project risk is negative (threats dominate). Use enhancement when overall project risk is positive (opportunities dominate).
Core Examples (memorize these five): Replanning the project, changing scope and boundaries, modifying project priority, changing resource allocations, adjusting delivery times.
No Proactive Response Possible: If no mitigation/enhancement strategy is feasible, the organization may accept the risk—either actively or passively.
Acceptance is Separate: Risk acceptance is a distinct strategy for overall project risk, not a form of mitigation or enhancement.
Scope Change is a Strategy: Changing the project's scope and boundaries is explicitly listed as a valid mitigation/enhancement technique—this is often tested.
Priority Modification: Modifying project priority (e.g., elevating or reducing the project's importance) is a legitimate overall risk response.

Typical PMI Exam Example

A project manager is leading a high-priority initiative where the combined effect of identified threats could cause significant schedule delays. The project sponsor agrees that the overall risk exposure is too high. The project manager decides to reduce the project's scope boundaries and allocate additional resources to critical path activities. This is an example of which strategy?

Answer: Mitigation strategy for overall project risk (negative risk).

PMI Exam Traps

Trap: Confusing mitigation (overall risk) with mitigate (individual threat). Reality: "Mitigate" for individual threats reduces probability/impact of a specific risk. "Mitigation" for overall risk changes the entire project approach (replanning, scope change, etc.).
Trap: Thinking enhancement only applies to positive individual risks. Reality: Enhancement at the overall project level targets positive overall project risk—when the project as a whole has more opportunities than threats.
Trap: Selecting "avoid" or "transfer" for overall project risk. Reality: Avoid and transfer are strategies for individual threats, not overall project risk. For overall risk, the options are: mitigate, enhance, or accept.
Trap: Believing scope changes cannot be a risk response. Reality: Changing scope and boundaries is explicitly listed as a valid mitigation/enhancement strategy for overall project risk.

Important PMI Connections

Related Concept	Relationship Type	Exam Attention Point
Individual Risk Strategies (Threats)	Different level of application	Individual: avoid, mitigate, transfer, accept, escalate. Overall: mitigate, enhance, accept. Do not mix.
Risk Acceptance (Overall)	Alternative when no proactive response possible	Acceptance can be active (contingency reserves) or passive (no action). Tested when mitigation/enhancement is not feasible.
Risk Escalation (Individual)	Different scope of authority	Escalation is for individual risks outside PM authority. Overall risk mitigation/enhancement stays within project.
Project Governance	Influences strategy selection	Governance framework determines if modifying priority or changing scope is permissible. Questions may test authority limits.

Quick Review Questions

A project has more opportunities than threats, and the overall risk exposure is lower than desired. Which strategy should the project manager apply?
What are the three possible strategies for addressing overall project risk?
A project manager decides to reduce the project's delivery timeline to decrease overall negative risk exposure. Is this mitigation or enhancement?
When no proactive risk response strategy is possible for overall project risk, what option remains?
Is "changing resource allocations" a valid example of a mitigation or enhancement strategy for overall project risk?

PMBOK v8 Reference

Section 5 – Tools and Techniques (Risk Management) "Strategies for Overall Project Risk" subsection