Risk Management Strategies... and the misuse of "mitigate"

I frequently encounter people who tell me of risk management courses that they've been on and tell me of four (straight from Wikipedia) strategies for addressing a risk::

• Avoidance (eliminate)
• Reduction (mitigate)
• Transfer (outsource or insure)
• Retention (accept and budget)

I'm no risk management expert, but I've certainly got plenty of experience in it. I am a lover of language and words and immediately notice one small problem with this model - the use of the word "Mitigate".

"Mitigate" is a commonly misunderstood word. Many use it as a synonym for "reduce" but it actually has a special meaning:

to make something less harmful, unpleasant or bad -Cambridge Dictionary

There are two key things we can actually reduce - likelihood and impact. Mitigation is about reducing impact.

As an aside, you may have noticed that I've said "likelihood" and not "probability". There are specific mathematical connotations associated with the word "probability". I've never seen any project manager (on a software project) employ mathematical probability for risk analysis. More often I've seen softer perception-based approaches to determining risk likelihood. This is fine, but I find that using the word "probability" gives a false sense of security about the methods used.

My early training in risk-management (admittedly back in the 1990s) listed five distinct strategies:

• Mitigate - Reduce the severity of its impact
• Avoid - Don't do the thing that makes the risk possible
• Reduce - Make the risk less likely to happen
• Transfer - Move the impact of the problem to another party (e.g. insure such as paid insurance or outsource with penalties for failure)
• Accept - Do nothing or set aside budget to cope with the impact

The way I like to remember this is "MARTA".

"Reduction" and "Mitigation" can be applied individually or together. Furthermore, transferring the risk is essentially a form of mitigation.

I've used these approaches and have found that it encourages me to consider many more options than if I put reducing the likelihood and mitigation into one bucket as it seems they so often are.