The risk management literature separates between mitigative actions or strategies and contingent actions or strategies. It is important to keep these two perspectives apart. Why? Because risk management needs to address both sides of the risk: what lies behind the risk (source) and what lies in front of it (consequences). Here is my attempt at defining these two terms and explaining the differences, at least the way I see it, based on Asbjørnslett (2008), Tomlin (2006) and Jüttner et al. (2003).
What is risk?
There are many many many definitions of risk in the literature, and will not attempt to list them all. Suffice it to say that I define risk as follows:
Risk is the exposure to circumstances with potentially damaging effects arising from an event that is not handled appropriately.
Risk management needs to address both sides of an accidental event, the sources leading up to it and the consequences arising from it. In figurative terms, “barriers” are put in place on both sides aimed at stopping a circumstance from evolving into an event, or aimed at stopping an event from developing disastrous consequences. Example: In a production facility running machinery that can overheat, a fire would be the accidental event, a heat detector would be a source barrier, while a fire sprinkler would be a consequence barrier.
The missing link
The idea for this post came while looking at Jütner, U., Peck, H., & Christopher, M. (2003) Supply Chain Risk Management: Outlining an Agenda for Future Research, where the authors look at risk sources, risk drivers and risk consequences. Here, risk mitigation is backward looking at sources and drivers, that is correct, but the contingent actions addressing the consequences are not fully embedded into their model. In the figure below I have attempted to illustrate how this can be done in a better way.

Risk sources need risk drivers to create risk impacts. Risk impacts are addressed by using mitigative strategies aimed towards eliminating the source or the driver, or contingent strategies, aimed towards eliminating the impacts.
Money matters
In On the value of Mitigation and Contingency Strategies for Managing Supply Chain Disruption Risks (Tomlin, 2006) there is a distinct difference between contingent and mitigative actions. Contingency action are actions taken in the event of a disruption, mitigation actions are actions taken in advance of a disruption. While the latter will incur a cost regardless of disruption, contingent actions will incur costs mainly in their preparation stage, and the again of course, if, but only if, they need to be taken.
Barriers, barrier, barriers
In Assessing the vulnerability of your production system (Asbjørnslett,1997), and later in Assessing the Vulnerability of Supply Chains (Asbjørnslett, 2008) there is a figure that excellently illustrates the difference between mitigation and contingency.

The figure above is my extension of the figure used in A.bjørnslett (1997) and Asbjørnslett (2008), capturing both contingent strategies and mitigative strategies. Here it is clearly seen that risk management needs to address both sides of the risk: what lies behind the risk (source) and what lies in front of it (consequences).
Conclusion
Hopefully this little discourse has clarified the difference between mitigative and contingent strategies. To understand concepts I find it most helpful to draw what I read, as I have with the two papers cited today. Well, actually, I did not draw everything entirely, I just expanded already existing figures. This (above) is how I view risk management, as an effort not just to reduce risk sources, but also as an effort to reduce risk impacts.
Reference
Bjørn Egil Asbjørnslett (2008). Assessing the Vulnerability of Supply Chains In G. A. Zsidisin & B. Ritchie (Eds.), Supply Chain Risk: A Handbook of Assessment, Management and Performance. New York, NY: Springer. DOI: 10.1007/978-0-387-79934-6_2
Asbjørnslett, B. E., & Rausand, M. (1997). Assess the vulnerability of your production system (Report No. 97018): Norwegian University of Science and Technology, Trondheim, Norway.
Jüttner, U., Peck, H., & Christopher, M. (2003). Supply chain risk management: outlining an agenda for future research International Journal of Logistics, 6 (4), 197-210 DOI: 10.1080/13675560310001627016
Tomlin, B. (2006). On the Value of Mitigation and Contingency Strategies for Managing Supply Chain Disruption Risks Management Science, 52 (5), 639-657 DOI: 10.1287/mnsc.1060.0515
Author links
- hslu.ch: Prof Dr Uta Jüttner
- cranfield.ac.uk: Professor Emeritus Martin Christopher
- cranfield.ac.uk: Dr Helen Peck
- ntnu.no: Bjørn Egil Asbjørnslett
- ntnu.no: Marvin Rausand
- dartmouth.edu: Professor Brian Tomlin
Related
- Assess the vulnerability of your production system
- A Future research Agenda for Supply Chain Risk Management
- Ericsson versus Nokia – the now classic case of supply chain disruption
More from husdal.com
When Manuj and Mentzer (2008) wrote their article titled Global Supply Chain Risk Management, t ...
Classic risk management literature acknowledges four ways of dealing with risk after establishin ...
So far I have reviewed "international" literature and web sites, and it is only fitting that now ...
Several “buzzwords” have been linked to supply chain risk management (SCRM) in various ways: ro ...
Opposites attract and in the supply chain world, "lean" and "agile" appear to be opposites. Both ...





















2010/09/02: Book Review: Risk Modeling, Assessment, and Management
2010/08/28: Importance and Exposure – Measures of Road Network Vulnerability?
2010/08/27: Logipi – why you should listen to it
2010/08/26: The ISCRIM Newsletter 1/2010
2010/08/25: Blog Supply Chain Risk: Writer’s Block
2010/08/24: Next time in China: Guanxi
2010/08/23: Supply Chain Risk: Culture Shock
2010/08/04: Book Review: Humanitarian Logistics
2010/07/11: WCTR 2010
“Risk is the exposure to circumstances with potentially damaging effects arising from an event that is not handled appropriately.”
Well this is a rather limited risk concept which doesn’t distinguish between what is predictable and what is not. What is not is the “real” risk:
As obvious example, take the stock the market. The VAR (value at risk) which supposedly forecast risk is a flaw because it does take into account only variations which are under control that are not real risk in the sense of John Maynard or Deming.
Interesting…THAT is a completely different concept of risk: only what is NOT predictable is a the “real” risk. I am not familiar with Maynard or Deming, but I will certainly look them up.
I agree that MY definition may be limited to and only related to the downside, not the upside and not looking at predictability. Predictability again, however, is always associated with some degree of uncertainty, isn’t it? Anyway, financial risk, which you are referring to, is inherently different from technical risk, and a risk definition probably only makes sense within the context of its usage. I don’t think there is one universally agreed upon definition of risk.
Hi Jan,
You mentioned “mitigative strategies aimed towards eliminating the source”. Do mean that mitigative actions aims to reduce probability of risk? And contingent actions aim to deal with negative impact?
Juttner 2003, 206 divide SC risk management strategies to:
-avoidance (i see it mitigative action, because it relates to causes of risk)
-Control (contigent action, eg. buffers, excess capacity)
Co-operation (avoidance and control in collaboration)
-Flexibility ( i think this is contingent action)
Some other author use other terms SC risk handling:
-risk bearing (company tries to reduce impact of risk)
-risk avoidance (company tries to reduce probability of occurence)
-risk transfer (company tries to either use avoidance or bear risk in collaboration)
Looking forward your answer :)
Hi Jukka, and sorry for the late reply.
Yes, the way I see it there are two principle ways to deal with risks or unwanted events. One is is to reduce the probability of an unwanted event, going after the source, which is what I call mitigative actions. Two is to reduce the impact of an unwanted event, going after the consequences, which is what I call contingent actions.
As to risk handling, I like to use the classic four: accept, transfer, reduce and avoid, where “risk bearing” as I see it would be equivalent to risk acceptance.
Not sure this helps, but those are my thoughts on the subject.