Why Risk Evaluation Requires Structured Decision-Making
Identifying and analysing risks is only half the battle. The critical question that separates competent project managers from exceptional ones is: "Now that we understand this risk, what exactly are we going to do about it?"
Too often, project teams default to "mitigate" for every risk without considering whether avoidance, transfer, or acceptance might be more cost-effective. The Risk Evaluation Worksheet prevents this default-thinking trap by requiring explicit consideration of every available strategy.
What Is a Risk Evaluation Worksheet?
The worksheet is a single-risk, multi-strategy evaluation tool. For one identified risk, it presents all six standard risk treatment strategies (aligned with ISO 31000 and PMBOK), requires a feasibility and cost assessment for each, and calculates the Revised Risk Rating (RRR) that would result from each treatment approach.
The Six Risk Treatment Strategies
| Strategy | Definition | When to Use |
|---|---|---|
| Avoid | Eliminate the risk by removing the activity or condition that creates it | When the risk-creating activity is not essential to project objectives |
| Prevent or Reduce | Modify the activity to lower probability and/or impact | When the risk cannot be avoided but can be controlled through design, process, or training changes |
| Transfer or Share | Shift the negative impact to a third party (e.g., contractor, insurer) | When another party is better positioned to manage the risk |
| Spread | Distribute the risk across multiple parties or mechanisms (e.g., insurance) | When the financial impact can be absorbed through risk pooling |
| Share — Shift Part | Distribute partial responsibility through partnerships or joint ventures | When the risk is too large for one party but can be managed collectively |
| Accept | Acknowledge the risk and take no additional action | When the cost of treatment exceeds the potential impact, or when no viable treatment exists |
The Risk Evaluation Worksheet Template
Section 1: Risk Description
| THE RISK |
|---|
| [Full risk statement: Due to (cause), there is a risk that (event) may occur, resulting in (effect)] |
| Inherent Risk Rating: Low / Moderate / High / Substantial |
| Residual Risk Rating: Low / Moderate / High / Substantial |
Section 2: Treatment Strategy Evaluation
| Treatment Strategy | Description and Applicability | Project Y/N | Cost $ | Revised Risk Rating (RRR) |
|---|---|---|---|---|
| 1. AVOID THE RISK | Eliminate the risk-creating activity entirely. Is this activity essential to project objectives? If not, can it be removed from scope? | |||
| 2. PREVENT OR REDUCE | Modify the activity through design changes, additional supervision, safety equipment, training, or addressing known root causes. What specific modifications would reduce probability or impact? | |||
| 3. TRANSFER OR SHARE | Contract the risky activity to a specialist third party. Shift responsibility through contract terms, warranties, or performance guarantees. Who is better positioned to manage this risk? | |||
| 4. SPREAD (Insurance) | Transfer the financial impact through insurance coverage. What type of insurance applies? What is the premium versus the potential loss? | |||
| 5. SHARE — SHIFT PART | Distribute the risk across multiple participants through networks, partnerships, joint ventures, or consortium arrangements. Can the risk be divided? | |||
| 6. ACCEPT | Acknowledge the risk and take no additional action. Is the residual risk within the project's risk appetite? Is passive or active acceptance appropriate? | |||
| CONTROL CONSEQUENCES | After a loss has occurred, what strategies will minimise the resulting damage? (Emergency response, business continuity, crisis communications) |
Section 3: Sign-Off
| Prepared By: | Date: |
|---|
Worked Example — Supply Chain Single-Point-of-Failure in Defence Manufacturing
Section 1: Risk Description
| THE RISK |
|---|
| Due to reliance on a single overseas supplier for mission-critical titanium forgings, there is a risk that supply disruption (geopolitical, trade sanctions, supplier insolvency, or logistics failure) may occur, resulting in production line shutdown, 12–24 week schedule delay, and contract penalty clauses totalling AUD 3.8M. |
| Inherent Risk Rating: Substantial |
| Residual Risk Rating: High |
Section 2: Treatment Strategy Evaluation
| Strategy | Assessment | Project Y/N | Cost $ | RRR |
|---|---|---|---|---|
| AVOID | Cannot avoid — titanium forgings are essential to the hull structure and cannot be substituted with alternative materials without full re-qualification (18 months) | N | N/A | N/A |
| PREVENT OR REDUCE | Qualify a second supplier (domestic) for the same forging specification. Maintain 90-day buffer stock of critical forgings in bonded warehouse. | Y | AUD 420K (qualification) + AUD 180K (buffer stock) | Moderate |
| TRANSFER OR SHARE | Include liquidated damages clause in supplier contract for non-delivery. Require supplier to maintain business continuity plan and demonstrate supply chain resilience. | Y | AUD 15K (legal review) | High (partial reduction only) |
| SPREAD (Insurance) | Investigate supply chain disruption insurance (trade credit insurance + contingent business interruption). | Y | AUD 95K annual premium | High (financial impact reduced; schedule impact unchanged) |
| SHARE — SHIFT PART | Partner with another defence prime on a bulk purchase agreement for titanium forgings — shared inventory, shared qualification costs. | Y | AUD 210K (shared) | Moderate |
| ACCEPT | Not acceptable — the AUD 3.8M penalty exposure and schedule impact exceed risk appetite threshold | N | N/A | N/A |
| CONTROL CONSEQUENCES | Develop contingency manufacturing plan using alternative alloy with accelerated qualification pathway. Pre-negotiate expedited shipping agreements with logistics provider. | Y | AUD 85K | Reduces consequence from Substantial to High if event occurs |
Recommended Strategy
Combined approach: Prevent/Reduce (dual qualification + buffer stock) combined with Transfer (contractual protections) and Consequence Control (contingency manufacturing plan). Total investment: AUD 700K against a AUD 3.8M+ exposure.
How to Use the Worksheet Effectively
Compare strategies on cost-benefit, not just feasibility. A strategy might be feasible but not cost-effective. If insurance costs AUD 95K annually but only covers financial loss (not schedule), while dual-sourcing costs AUD 420K once but addresses both likelihood and consequence, the dual-sourcing investment offers better risk-adjusted value. Consider combined strategies. Real-world risk treatment rarely involves a single strategy in isolation. The most robust approaches layer multiple strategies — reduce the likelihood AND transfer the residual financial exposure AND prepare consequence controls as a final safety net. Document why strategies were rejected. The "Project Y/N" column is not just for the chosen strategy — it records the reasoning for rejection. This is valuable audit evidence and supports future decision-making when conditions change. Reassess the RRR honestly. The Revised Risk Rating should reflect realistic expectations, not optimistic assumptions. If dual-sourcing reduces the likelihood from "Probable" to "Possible" but the consequence remains "Major," the RRR should reflect that honestly.
Common Pitfalls
Defaulting to "mitigate" without evaluating alternatives. The most common error in risk response planning is jumping straight to risk reduction without considering whether avoidance, transfer, or even acceptance might be more appropriate. The worksheet structure forces you to at least consider all six options. Ignoring the "Control Consequences" row. Even with excellent proactive strategies, risks can still materialise. The consequence control row is your contingency plan — the safety net that limits damage when everything else fails. Skipping this row means you have no fallback. Treating insurance as a complete risk transfer. Insurance covers financial loss. It does not recover lost schedule time, restore damaged reputation, or prevent safety incidents. Insurance is always a partial treatment — it should be combined with other strategies, never relied upon alone. Failing to track the RRR back to the risk register. The revised risk rating from the evaluation worksheet must flow back into the risk register as the post-treatment expected risk level. If this feedback loop is broken, the register does not reflect the true risk picture.
Key Takeaways
- The Risk Evaluation Worksheet forces systematic evaluation of all six treatment strategies against a specific risk, preventing default-to-mitigate thinking
- Combined strategies (layering prevention, transfer, and consequence control) produce the most robust risk treatment plans
- The Revised Risk Rating (RRR) for each option enables cost-benefit comparison across strategies
- Document why strategies were rejected — this creates an audit trail and supports future reassessment
- Insurance is a partial treatment that covers financial loss but not schedule, safety, or reputational impacts
- The worksheet bridges the gap between risk analysis and actionable risk response planning