Several small risks share the same cause. How do we manage them?
Correlated risk exposureLook for common causes and combined consequences rather than assessing every entry in isolation. A shared dependency can make several apparently modest risks occur together.
What to do now
- Group risks by common causes
- Assess combined effects on outcomes
- Prioritize controls at the shared cause
- Monitor both individual and aggregate exposure
When to escalate
Escalate when
The combined effect exceeds tolerance even when each risk appears acceptable.
Who decides
The accountable risk owner
Example
One overloaded specialist creates linked risks across design, testing, and training deliverables.
Mistake to avoid
Adding independent estimates when the risks are strongly connected.
Prevent a repeat
Review whether response tasks and trigger conditions remain appropriate as the project changes.
Suggested ApprovedFlow setup
- Documents
- Tasks
- Approvals
Store the risk assessment as a controlled project document and assign response tasks; do not assume a native risk engine is enabled. See the platform
Related cases
- We discover the same risk in every project. How do we stop repeating it?Uncorrected systemic risk
- People confuse risks with problems that already exist. How do we separate them?Risk-issue confusion
- We are closing with residual risks. What must be transferred?Unowned residual risk exposure
- How do we manage equipment shared by several projects?Nonhuman resource conflict