Secondary Risk

A secondary risk is a risk created by the act of responding to another risk. If a project team decides to accelerate a critical-path activity to address schedule risk by adding extra labour resources, they may create a secondary risk: the site becomes congested, safety incidents increase, or productivity on adjacent activities falls because the additional workers are competing for the same working space. The original schedule risk has been reduced, but a new set of risks has been introduced by the response. Secondary risks must be identified, assessed, and managed alongside primary risks.

Secondary risks are easy to overlook because risk management processes typically focus on identifying and responding to primary risks and then move on. The follow-through step — asking 'what could go wrong as a result of what we just decided to do?' — is often skipped. This is a mistake, because secondary risks can be as significant as the primary risk they were introduced to address. A decision to novate a key subcontractor to address a procurement risk might create a secondary commercial risk if the novation terms are not carefully structured. Switching to a different construction methodology to manage ground risk might create new programme risk if the team has limited experience with the new method.

Tracking secondary risks requires a risk register structure that captures the relationship between the primary risk, the response action, and any secondary risks generated. Some risk management tools support this explicitly with parent-child links between risk entries. Where this is not possible, a notes field on the primary risk entry should record any secondary risks arising from the response, with a cross-reference to the relevant secondary risk entries. This linkage is important for completeness audits: if the primary risk is closed and the response action is implemented, the secondary risks should be transferred to active monitoring rather than disappearing along with the primary entry.