Unknowable-unknowns Vs. Unknown-unknowns in Risk Management with Emergent Risks and Novel Risks

Want to master Risk Management? Become a RMP, a specialized PMI certification.

Course at a very low cost: RMP Live Lessons Course - Guaranteed Pass or Money Back  [samples]

The guarantee has no hidden T&Cs—just take the exam!

The free article follows. 

--

As I frequently interact with project and risk management practitioners, the below two questions on unknowable-unknowns and unknown-unknowns come up. They are quite confusing for many. The existing literature doesn’t help as they are written with complicated language and/or complex explanations. The questions are:

• What are the differences between Unknowable-unknowns and Unknown-unknowns? 
• Where does emergent risk actually fit in (in the above context)?

To understand, let’s simplify. 

The Fundamentals

First, let’s understand, what is the difference between unknowable and unknown?

• Unknown: You really don’t know. It’s definitive. 
• Unknowable: You are not likely (or unlikely) to know. It’s probabilistic. 

When we say definitive, it’s certain that you don’t know. For example, it’s possible you don’t know some new technologies, design or frameworks.

When we say probabilistic, a chance factor comes in. There is a chance (usually high) that you don’t know. For example, when disruptive technologies start to pervade, you are unlikely to know the impact. 

Simply put:

• When we say unknown, it means there is a lack of knowledge or untapped knowledge.
• When we say unknowable, it means there is not only lack of knowledge, but also exploration is not probable. In this case, it’s untappable knowledge. 

Now, let’s see what are emergent risks and novel risks? 

Emergent Risks

As per PMI’s Standard for Risks in Portfolios, Programs and Projects, this is the definition of emergent risks:

“A risk that arises which could not have been identified earlier on.”

I agree with this definition, but not the subsequent explanation of PMI on emergent risks in the context of the unknowable, though I’ve adopted them in my books and courses. In this case, one can say these risks could not be identified because they were unknown at that time, but later on, the risks emerged.

When one says “emerge”, a pattern is forming, but not clear. It’ll emerge. 

Novel Risks

I provide this definition for novel risks:

“A risk that arises which was not probable (improbable) to be identified earlier on.”

Here you can say, these risks were improbable to be determined and later it came-up unexpectedly, hence the term “novel” or completely new – not emerging! 

When one says “novel”, there is no pattern formation at all. It is completely new. 

Also, did you notice the distinction in the definitions?

For an emergent risk, we could not have identified earlier, which can be due to many factors such as lack of knowledge, understanding or considering various scenarios. 

For a novel risk, we have a probability factor coming into play. It was improbable to be identified earlier because exploration of such a risk was improbable. 

Unknown-unknowns Vs. Unknowable-unknowns

Now, let’s see the difference between these two:

• Unknown-unknowns: You don’t know that you don’t know. This is pure ignorance. Knowledge wise, it’s untapped knowledge. It’s part of the Complex domain.
• Unknowable-unknowns: You are unlikely to know that you don’t know. This is not pure ignorance. Knowledge wise, it’s untappable knowledge. It’s part of the Chaos domain.

The emergent risks are actually unknown-unknown risks or simply unknown risks, whereas novel risks are actually unknowable-unknown risks or simply unknowable risks. Again, do note that my explanation differs from many, including PMI. The figurative representation is shown below.

I’d also strongly recommend that, you read the followings articles:

Cynefin Framework, Risks and Agile: Known-unknowns, Unknown-unknowns, and Unknowable-unknowns

Risk Classification: Known-knowns, Known-unknowns, Unknown-unknowns, and Unknown-unknowns

Conclusion

Combining all that I've explained:

• Known-known is conscious knowledge or facts. You know that you know.
• Known-unknown is conscious ignorance. You know that you don't know.
• Unknown-unknown means unconscious ignorance. You don't know that you don't know.
• Unknowable-unknown means unexplorable and unconscious ignorance. You are unlikely know that you don't know.

Another question that comes-up is this: How about Black Swans? Is it related to unknowable-unknowns or unknown-unknowns? To a certain extent, black swans are unknowable-unknowns. Because these result in chaos. More specifically, black swans are distinguisged with their very low probabilities, but catastrphic impact. In other words, black-swans comes with a chance factor (very low), but with tremendous effect (very very high).

If you have understood so far in this article, then you have understood the difference between unknowable-unknowns, unknown-unknowns and the associated risks such as emergent risks and novel risks. 

References: 

[1] RMP Live Lessons - Guaranteed Pass or Your Money Back, by Satya Narayan Dash

[2] RMP 30 Contact Hours, with Full Money Back Guarantee, by Satya Narayan Dash

[3] Book - I Want To Be A RMP: The Plain and Simple Way To Be A RMP, Second Edition, by Satya Narayan Dash 

[4] The Standard for Risk Management in Portfolios, Programs and Projects, by Project Management Institute

Risk Register and Risk Report: What Are The Differences?

  

Risk Register and Risk Report are two key artifacts in Risk Management. Risk Report has been introduced for the first time in the PMBOK Guide, 6th edition and continues to be there in the PMBOK Guide, 7th edition. Also, the Risk Register will be used in projects, programs and portfolios as well as in Agile management.

In fact, in the latest PMBOK Guide, 7th edition, Risk Report is informed to be one of the commonly (and frequently, emphasis mine) used reports, if you are really doing risk management. The commonly used reports noted in the PMBOK 7th edition are:

• Risk Report, 
• Quality Report, and 
• Status Report. 

Needless to say, reporting is an important aspect of management.

Also, if you are preparing for the Project Management Professional (PMP) exam or Risk Management Professional (RMP) exam, you have to clearly know the contents of both the register and report. Specifically for the RMP exam, from 2022, the PMBOK Guide 7th edition (and tacitly 6th edition) will be one of your reference sources. 

In this article, we will see the differences between these two key project and risk management artifacts in an exercise format. We will also see in which processes the content of these two project documents are populated. 

Content of this article have been taken from the following video courses, where in-depth explanation and guidance are available:

• RMP Live Lessons – Guaranteed Pass or Your Moneyback
• PMP Live Lessons – Guaranteed Pass or Your Moneyback

Now, let’s start with the differences between Risk Register and Risk Report. 

Differences (Exercise): Risk Register and Risk Report

As shown below, we have a table with Risk Register in the second column and Risk Report in the third column. Try to note down the differences between the Risk Register and Risk Report on your own first, before checking the answers. 

Were you able to find out at least five differences?

Scroll down to see the answers.

. . .

. . .

. . . 

In the below table, we have the differences noted.

Next, let’s try another exercise. 

Processes (Exercise): Risk Register and Risk Report

In this exercise, we have the Process Name(s) noted in the third column. You have to inform in which process (or processes), the content of the Risk Register and Risk Report are noted.

Following are the processes in Risk Management:

• Plan Risk Management
• Identify Risks
• Perform Qualitative Risk Analysis (Perform QLRA)
• Perform Quantitative Risk Analysis (Perform QTRA)
• Plan Risk Responses
• Implement Risk Responses
• Monitor Risks

I believe you have tried it first on your own, before checking the answers.

Scroll down to see the answers.

. . .

. . .

. . . 

In the below table, we have the process names noted for the contents of the Risk Register and Risk Report.

A Sample Risk Register

Below is a sample of a real risk register.

As shown above, in the Risk Register, we have Risk ID, Risk SWOT value (threats or opportunities), Risk Title, Risk Pre-mitigation parameters such as probability, impact on schedule, cost, performance etc., and risk score.

A Sample Risk Report

Below is a sample of a real risk report.

As shown above, in the Risk Report, we have information about overall project risk, the project chances of success with respect to schedule and cost with probabilistic analysis, sensitivity analysis, summary information about individual project risks, risk audit information and a summary conclusion.

You can learn more on the flow of risk register and risk reports, and how they are populated as they pass through the risk management processes in the following article.

Fundamentals of Project Risk Management Framework

Conclusion

In my interactions, few managers, who understand the value of risk management, use Risk Register! On the other hand, Risk Report is almost unheard of, because organizations don’t take risks seriously. It creates problems later with many change requests (CRs) or issues overwhelming the projects, programs or portfolios. Do also note that issues are risks, which have already occurred. I’ve seen many such instances and projects running into real trouble. 

When you clearly know the content of these two project artifacts and know how they are prepared, it’ll help you immensely in not only managing the risks, but also scope management, schedule management and cost management aspects of a project. 

PMP Live Lessons and RMP Live Lessons:

• PMP Live Lessons - Guaranteed Pass or Your Money Back
• RMP Live Lessons – Guaranteed Pass or Your Money Back

PMP 35 Contact Hours and RMP 30 Contact Hours:

• PMP 35 Contact Hours Online Course - Full Money Back Guarantee
• RMP 30 Contact Hours Online Course - Full Money Back Guarantee

PMP Book and RMP Book:

• Book: I Want To Be A PMP, The Plain and Simple Way, Second Edition
• Book: I Want To Be A RMP, The Plain and Simple Way, Second Edition

Strategizing for Project Threats and Opportunities in Risk Management

 

Over a decade ago, I was put in charge of a group of projects. One of the projects had been running for almost a year, but had never seen a single live release to the customer! I realized there were too many unresolved risks, and asked the concerned project manager to put risk management, a new concept in the organization, as a top priority. Post identification and qualification of risks, any risk above the risk threshold value had to be brought down. If that was not done, I advised him no one should be allowed to work on the concerned project tasks.

This touched a raw-nerve.

One day a senior executive dropped by and asked about the guidance I had given to the project manager. In his mind, risk identification, qualification, and addition of reserves et al are sufficient, and I should not have stopped people from working on tasks.

My response was: “When you know a cyclone is going to hit in five days, do you wait to act on the fifth day or do you start immediately working to mitigate the expected impact?”

To elaborate a bit more, if a cyclone is about to hit, will risk identification help? Will risk qualification help? You know it won’t do much, though needed. How about quantification and adding reserves – say various cyclone shelters, food stock, etc. – will those help? Yes, but not fully. What is most needed in such a situation is risk mitigation. We can’t change the probability of the cyclone, but the first act of mitigation would be the evacuation of people. Risk mitigation is one risk response strategy.

In this article, I’d like to explore various such strategies.
At this stage, it’s important to note that risk response strategies are applicable in cases of both negative risks (threats) and positive risks (opportunities). You can learn more on individual project threats and opportunities here.

Risk Response Planning
The Project Management Body of Knowledge (PMBOK®) guide from the Project Management Institute (PMI®) has a specific process to develop various risk response strategies. It’s called Plan Risk Responses, and it’s defined as follows:

Plan Risk Responses is the process of developing options, selecting strategies, and agreeing on actions to address overall project risk exposure, as well as to treat individual project risks.

The goal here is to develop risk response options, strategies, and actions for both individual project risks and overall project risk. In other words, you are planning to minimize the threats (negative risks) and enhance opportunities (positive risks). With this process, the project manager allocates resources and inserts items and activities within the documents and the project management plan, in order to address said risks.

Obviously, both the Risk Register and Risk Reports are needed as inputs to address such risks (along with the Risk Management Plan). Remember, we are addressing both individual risks and overall project risk. See this depicted in the below flow diagram, with the highlighted process of Plan Risk Responses.

As shown, once you have the risk response strategies and associated actions, both the Risk Register and Risk Report have to be updated. You can learn more about the above flow diagram in this article on risk management framework.

Risk Response Strategies – What Happens?
In the Plan Risk Responses process, for the negative risks, we are trying to move the High Probability and High Impact risks to be of Low Probability and Low Impact, by taking response actions. The reverse is also true.

I’ve explained this in the below video [duration: 3m: 53s], the content of which has been taken from RMP Live Lessons, Guaranteed Pass. For the best experience, you may want to go full-screen in HD mode and plug-in your earphones.

Risk Response Strategies for Threats
Now, let’s look at various response strategies for individual negative risks or threats.

Escalate Response Strategy

The escalate response strategy is used when the project team or the project sponsor agrees that:

• The threat is outside the scope of the project.
• The project manager does not have the authority for the proposed response.

At this point, the risk is escalated to a program or portfolio or other suitable level. The project manager determines who should be notified. The escalated entity should be notified and the entity should also accept it. After escalation, the risk is not monitored by the team, but may be recorded in the Risk Register.

Example: A risk occurring in another project is impacting your project, so you escalate it to the level of a program or a portfolio.

Avoid Response Strategy
This response strategy is usually used for high priority risks, i.e., risks with high probability and a big negative impact. We can do two things here, either:

• Eliminate the risk completely, or,
• Protect the project from its impact.

Most of the time, the first (avoidance or elimination) is taken by changing the project management plan.

Example: You use a reliable technology platform for your project, instead of an unreliable, but cutting edge one.

Transfer Response Strategy *** UPDATED ***
Transfer of a risk is done by shifting the impact to a 3rd party, who will own the response. This method is usually best used for low impact risks. A risk premium has to be paid to the 3rd party.

Example: You go for an incentivized contract, such as Cost Plus Incentive Fee (CPIF), to transfer the risks to the buyer.

For more information about incentivized contracts, go to these articles of point of total assumption and range of incentive effectiveness. While the former is for Fixed Price Incentive Fee (FPIF) contract, the latter is for CPIF contracts. Do note that by transferring the risks, they are not gone! Rather, they will be addressed by the entity to which risks have been transferred.

Mitigate Response Strategy *** UPDATED ***
With a mitigate response strategy, you try to reduce the probability and/or impact of the risk. This is used for high priority risks (with high P and high I values). After reduction, the risk score should be within an acceptable threshold limit. You can learn more about the usage of risk threshold in this article on end-to-end risk management.

Example: You first build a prototype for a highly scalable product before going for full-fledged development.

Where mitigation is not possible due to probability, it’s best to look for mitigation responses which pull down the impact.

Accept Response Strategy *** UPDATED ***
In risk acceptance, no action is taken unless the risk occurs. Like transfer strategy, it’s used for low priority threats or used when it’s not possible to have a cost-effective solution which addresses the threat. The Project Management Plan is usually not changed in this case. A common risk acceptance strategy is to use contingency reserve.

Example: If there are frequent climate changes, you may accept such as a risk for your project.

Risk Response Strategies for Opportunities
Like threats, there also can be a number of risk response strategies for individual positive risks or opportunities.

Escalate Response Strategy
It’s very similar to the one we have seen earlier for negative risks, except that in this case it is for positive risks or opportunities. It’s used when the project team or the project sponsor agrees that the threat is outside the scope of the project and the project manager does not have the authority for proposed response.

Again, after escalation, the risk is not monitored by the team, but may be recorded in the Risk Register. This is another key distinction for this strategy compared to other strategies.

Example: A benefit occurring in another project has implications for your project and you escalate such to the level of a program.

Exploit Response Strategy
With this risk response strategy, you seek to eliminate uncertainty by ensuring that the opportunity is realized or that it definitely happens. It’s used for high priority opportunities.  A payment of a risk premium can be involved for the party taking on the opportunity.

Example: Using talented resources to complete work early with less cost.

Share Response Strategy
In this case, you allocate some or all of ownership of the opportunity to a third party. Because it’s a share response strategy, both sides benefit – the first owner and also the sharing owner. It can be considered the “mirror” part of transfer response strategy, which we have seen earlier for individual negative risks.

Unlike transfer, it is not completely handed over to another party. It is shared; however, risk sharing, like transfer response strategy, often involves premium payment.

Example: Your organization forms a joint venture or partnership with another organization to execute the project considering the benefits involved for both.

Enhance Response Strategy
With this response strategy, you increase the probability and/or the impact of an opportunity. Early enhancement is considered more effective. If you cannot increase the probability, try to increase the impact.

Example: You add more features to a product to sell more products.

Accept Response Strategy *** UPDATED ***
In this case, if the opportunity arises, it will be taken advantage of, but not actively pursued. It’s usually considered for low priority opportunities or if no cost-effective solution is available.

Example: A new project will takes advantage of a tax break, if an expected legislation is passed.

A Real-World Example and Exercise
Now that we have reviewed various risk response strategies, let’s do an exercise.

Scenario: You are driving to reach your office and become aware of possible heavy traffic on your traveling route through a radio warning or via global positioning system (GPS). Regardless, you have to reach your destination to attend an important meeting. You have the following options available, outlined in the below table.

   

Can you tell, based on the situation presented, which risk response strategy will best fit? Do note that the scenarios presented are for negative risks, and your response should be one of the strategies for each question.
 
I would suggest that you try this exercise on your own first before checking the solution, but I’ve explained in the below video [duration: 7m: 20s], taken from my RMP Live Lessons course what I advise. This clip also addresses an additional question related to contingency reserve and how it’s used in our scenario.




Comparison
As we reach the end of this article, I’d like to draw a comparison between the risk response strategies for threats vs. opportunities in the below table:
  
   
 
Finally, it’s not that an individual threat will have a single response strategy. If a threat can’t be avoided, then a project manager can mitigate to a level where it becomes viable to accept or transfer it. Similarly, if an opportunity can’t be fully exploited, it can be enhanced to a level where it can be viable to accept or share it.

--

This article was first published by MPUG.com on 3rd May, 2022. This is an updated and refined version.

References:
[1] Course: RMP Live Lessons, Guaranteed Pass or Your Money Back, by Satya Narayan Dash, CIPSA, CHAMP

[2] Course: RMP 30 Contact Hours with Money Back Guarantee, by Satya Narayan Dash, CIPSA, CHAMP

[3] Book: I Want To Be A RMP, The Plain and Simple Way, Second Edition, by Satya Narayan Dash, CIPSA, CHAMP