For purposes of our simulation we have divided risks by their source and type. Scope risks are covered in the scope area. Risks from errors and poor team performance is handled in the rework and quality area. That leaves one type of risk unaccounted for -- the risk of an activity failing to produce its intended deliverable. The use of a new material or design in construction projects is a good example. The new material and design may have worked fine in lab tests and computer simulations but when subjected to real world conditions they simply do not perform as expected. Some work must be done to fix the problem when it crops up.

Many organizations find that they get very good at reacting to this type of risk and they develop a culture of problem solving their way out of risks. This is the "dependence on the quick fix" loop in the diagram and it is self-reinforcing. The more dependent your organization becomes on the quick fix (reaction to risk), the less time you will have to deal with the fundamental solutions (time for risk mgmt and consequently risk identification efforts and risk mitigation efforts), causing additional problems which require more quick fixes (reaction to risk). Organizations with a reactive culture spend a lot of the project time on problem solving and don't believe they have time for true risk management. Risk management (the lower loop) gets at the root of the problem which is understanding the risk sources and eliminating or minimizing the likelihood or consequence of risky activities.