Project management guidelines list many risk response strategies: avoid, mitigate, transfer, accept and escalate but they overlook perhaps the most popular strategy of all: risk dumping.
Risk dumping: the practice of adding a risk to the risk register, assigning it to someone else, and then behaving as though responsibility for the risk has disappeared.
Throughout my career, across many projects, programs and portfolios, I have observed the same behaviour repeatedly. A project manager identifies a risk, adds it to the risk register and informs senior management. Then something strange happens.
The project manager begins treating the risk as a collective responsibility. Because management has been informed, they believe their job is done.
The risk is documented.
The risk is visible.
The risk may even be discussed every risk review meeting, but nobody is actively managing it.
Documenting and communicating a risk are important parts of risk management, but awareness does not replace ownership. Escalating a risk does not automatically transfer responsibility for mitigating it.
A risk register is a management tool, not a responsibility-dumping ground.
A risk is not managed because it appears in a report. It is managed only when someone takes ownership, implements agreed actions and monitors whether those actions are actually reducing the exposure.
If the risk remains unchanged while the register is regularly updated, you are not managing risk. You are managing risk information.
How common is risk dumping in your organisation?
Alex Lyaschenko
PMO | Portfolio Planning & Delivery | PMP | P3O Practitioner | AgilePM Practitioner | Six Sigma
