Open your last risk register and read down the response column. If you are like most project managers, you will see the same word again and again: mitigate.

Mitigate.

Monitor.

Mitigate.

Some registers are 80 percent one word.

It feels like risk management. It is not. It is a reflex.

Here is the uncomfortable part. “Mitigate” is usually the word we reach for when we have not actually decided anything. It sounds productive, it is politically safe, and no one has ever been criticized for saying they will reduce a risk. So we say it in the meeting, write it down, file the register, and move on.

Leadership does the same thing from the other direction: “what are we doing to mitigate this?”… choosing the response before anyone has analyzed the risk.

And when we are not over-mitigating, we are doing something quieter and more dangerous: accepting risks by neglect. We look at a risk, feel the effort of dealing with it, and simply do not. No owner. No trigger. No plan. That is not acceptance. That is hope. And hope is not a risk strategy.

Both of these look like risk management. Neither one is a decision.

You are probably defaulting if:

• Your response column is mostly one word
• Your “accepts” have no reserve, no trigger, and no fallback
• You have zero opportunities logged — as if upside were not also a risk
• You could not answer a sponsor who asked, “Why mitigate, and not avoid?”

You Have a Menu. You Are Ordering One Dish.

PMI gives you a full set of response strategies, five for threats and five for opportunities. Avoid, transfer, mitigate, escalate, and accept on the threat side. Exploit, share, enhance, escalate, and accept on the opportunity side.

Most registers use one of them, on the threat side only.

The point of naming the whole menu is not to make you memorize it. You already know it. The point is that “mitigate” is supposed to be a verdict you reach after ruling out the other options, not the box you tick to look busy.

In a sound decision, it sits near the end, not the front. When you start there, you skip every question that would have told you a better answer was available.

Take acceptance, since it is also one of the most abused strategy on the list. There is a world of difference between accepting a risk on purpose and accepting one by neglect. A real, active acceptance has three parts: a reserve set aside in case it hits, a trigger that tells you it is happening, and a plan for what you will do when that trigger trips. That is a decision you can stand behind. Everything else is a gap wearing the word “accept.”

I learned to take response selection seriously in a place where the residual was not a schedule slip — it was whether everyone came home. Running convoys in Afghanistan, the wrong response to a threat, or a missed opportunity, carried consequences no spreadsheet captures. The discipline is identical on your projects. Only the stakes look different.

Interested in Learning More?

In my upcoming MPUG session, Why Your Risk Responses Are Probably Wrong, I go past the list and into the part nobody teaches: how to actually choose. I will walk through a simple decision sequence for selecting the right response to any threat or opportunity, how to assign ownership so risks do not stall, and how to document your reasoning so it holds up when senior leadership starts asking questions.

You will leave able to defend every response on your register with a straight face, and with a Monday-morning test to make sure “mitigate” is never your default again.

Register for the Wednesday, July 29 session here.

About the Author: Russ Parker is a retired US Marine turned PMP® and PMI-RMP®. He is the owner of Forty-Four Risk PM, LLC, a PMI-Authorized Training Partner, where he teaches project management, risk management, and leadership skills for project managers. Through his YouTube channel, The Bearded Risk PM, Russ is quickly becoming a recognized voice in the risk management space, breaking down complex PMI frameworks into practical, actionable guidance that practitioners can put to work immediately. Whether you are preparing for the PMP® or PMI-RMP® exam or looking to sharpen your risk management skills on the job, you will find a growing library of courses, templates, and free resources available at 44riskpm.com to help you get started right away.