The data-driven approach to project risk should be:
- Collecting better and more targeted data and information
- Developing a more accurate risk ranking system
- Establishing a stronger understanding of project risks
- Developing more relevant metrics, rather than using conventional metrics
- Implementing risk management strategies and assigning accountabilities
- Enhancing internal communications and responses to unknown risks
The linked advertisement is a wonderfully false set of presumptions designed to create failure.
The only type of risk this approach adequately deals with are the 'known-unknowns' factors such as variability in estimates and weather. In this limited sub-set of risk better data and analysis certainly generates a better probability of understanding the consequences of the uncertainties. But in most mature organizations people instinctively understand the issues and all risk management processes do is to assist in justifying the necessary expenditure to improve the probability of success. Immature organizations fail at points 1, 2, 3 and 4........
Risk management is a much wider function that also needs to be capable of dealing with 'black swans' and 'unknown-unknowns'. Most risk events that knock projects off the rails come out of this space. Real risk management looks at shifting as many risks as possible from the 'unknown-unknown' space into the 'known-unknowns' - this requires creativity and insight rather than process. It also looks at building resilience into organizations to allow them to respond quickly and effectively to emerging risks that aren't in the risk register. Process is useful, but it is less than half the job and is the easy half.
For papers on risk management see: https://mosaicprojects.com.au/PMKI-PBK-045.php