Strategies for Overall Project Risk

Risk technique · See it on the map

Runnable here

Responding to a project's risk as one combined whole, not just risk by risk.

When to use it

At key decision points (major milestones, gate reviews, before committing to a firm deadline or price) when the question isn't 'what do we do about risk #14' but 'given everything we know is uncertain, how exposed is this project, and should we change course.'

When to avoid it

As a substitute for individual risk response — a project-level judgment that 'overall risk is moderate' doesn't tell anyone what to do about the specific vendor risk or the specific technical risk sitting in the register. Use both; neither replaces the other.

Steps

1. Step back from the individual register entries and ask what could most affect the project's overall cost, schedule, or objectives if several things went wrong together, not just one risk in isolation.
2. Consider whether the project's overall risk exposure warrants a strategy at the project level: avoid (change the approach to remove a whole class of risk), exploit (restructure to capture a project-wide opportunity), transfer/share (restructure the commercial arrangement), or accept (proceed as planned, eyes open).
3. Where the answer is to change course, make that change at the plan level — re-baseline, renegotiate scope, change the delivery approach — not by adding one more line to the risk register.
4. Communicate the overall risk posture to sponsors and stakeholders separately from the register detail; they usually need the summary judgment, not the itemized list.

What it produces

• A stated judgment of overall project risk exposure at a point in time.
• A decision on whether the project's approach itself needs to change in response, distinct from any individual risk's response plan.
• A summary suitable for a sponsor conversation, separate from the detailed register.

Common pitfalls

• Confusing this with 'sum up the register's exposure column and report the total' — that's an aggregate of individual risks, not an assessment of the project's overall risk, which includes effects (schedule compression, morale, dependency chains) that don't show up as line items at all. Driftless has no field or rollup that computes this for you; it stays a judgment call the PM makes and writes down.
• Making the overall-risk judgment once at kickoff and never revisiting it as the register itself changes shape over the project.
• Presenting the overall judgment as more rigorous than it is — it is a considered opinion, not a calculation, and should be labeled as such.

Worked example

A construction PM reviews a register with eleven individually 'medium' risks and no single 'high' one, and could report the project as broadly healthy. Stepping back, four of those eleven risks share a dependency on the same crane subcontractor's schedule; if that subcontractor slips, four risks fire together. The PM reports overall project risk as elevated despite no individual entry crossing the 'high' threshold, and pulls forward a conversation about a backup crane arrangement.

Source

• PMBOK-6 §11.5.2.7

Where it comes from: this technique is named by the PMBOK Guide, 6th edition.