Most project managers think they have risk management figured out. Risk identification, risk response strategies.
They identify risks, log them in a register, and respond to them. The problem? They’re usually doing one response the same way every time — and that single blind spot is quietly killing their projects.
Here’s the thing: I didn’t learn this lesson from a textbook or a PMI exam prep course. I learned it from a Marvel TV show. Stay with me.
In Loki, the Time Variance Authority, the TVA, runs what looks like a masterclass in risk monitoring. They’ve got sophisticated tracking systems, enormous amounts of data, and an entire organization dedicated to identifying timeline deviations. By every surface-level measure, they look like a risk management powerhouse.
But they had one massive, fatal flaw: the only risk response strategy they knew was to prune the threat out of existence.
That’s it. One threat. One response. Every time.
Sound familiar?
In this post, I’m going to break down what the TVA got wrong, why it mirrors one of the most common mistakes real project managers make, and how understanding PMI’s eight risk response strategies can be the missing link between a reactive team and a truly risk-intelligent one.
I’ve been a certified PMI-RMP and PMP for years, and before that, I was a Marine Corps officer who learned the hard way that copying someone else’s risk approach without thinking it through is a recipe for disaster. This lesson runs deeper than fiction.
The TVA's Real Problem Wasn't Loki — It Was Their Risk Response Strategy
Let’s be specific about what went wrong. The TVA didn’t lack information. They didn’t lack monitoring. What they lacked was strategic variety.
Every time a nexus event (a risk) appeared on their radar, the answer was the same: eliminate it. Prune the variant. Reset the timeline.
- Zero nuance.
- Zero analysis of probability or impact.
- Zero consideration of whether this particular risk might be worth a different approach.
PMI identifies eight risk response strategies across threats and opportunities. For threats alone, you’ve got avoidance, transfer, mitigation, acceptance, and escalation. For opportunities, there’s exploit, enhance, share, and acceptance. Each one exists because different risks require different thinking.
The TVA never considered any of that. Their entire risk management framework was built on a single response — which means it wasn’t really a framework at all. It was a reflex.
And reflexes, no matter how fast, aren’t strategy.
Here’s where it gets real for your projects: most teams fall into the exact same trap. They default to mitigation, reduce the probability, reduce the impact, for almost every risk they encounter. Maybe they add a contingency reserve. Maybe they add time to the schedule. But they rarely stop to ask, “Is this actually the right response for this specific risk?”
That gap, the failure to match the right strategy to the right risk, is the missing link in most project risk management programs.
Why One-Size Risk Response Always Fails
Let me tell you something that happened to me early in my military career that cemented this lesson in a way no manual ever could.
I was preparing a range order, essentially an operational plan, for a training exercise. A fellow officer had written a solid range order the week before, so I did what felt efficient at the time: I copied the structure and filled in my specific details. It seemed like good risk mitigation.
Save time, use a proven format, reduce the chance of missing something.
What I missed was that his exercise had completely different conditions, terrain, and personnel considerations than mine. I had transferred a response without doing the underlying analysis. The risk profile was different, but my approach treated it as identical.
That experience taught me something the TVA never learned: a risk response is only as good as the analysis that precedes it. The strategy has to fit the risk, not the other way around.
For project managers, this shows up constantly. A low-probability, high-impact risk probably warrants a transfer strategy, think insurance, contracts, or a third-party vendor absorbing that exposure. A low-probability, low-impact risk might just need acceptance, with a documented contingency if it triggers. A high-probability risk with manageable impact? That’s where mitigation earns its place.
Slapping mitigation on every risk because it feels “active” and “responsible” isn’t risk management. It’s risk theater.
The Missing Link: Matching Strategy to Risk Profile
Here’s what actually changes the game…. and what separates project managers who struggle through their PMI-RMP exam from those who think like true risk practitioners:
You have to analyze before you respond.
The TVA skipped this entirely. They saw a variance, and they pruned it.
- No probability assessment.
- No impact analysis.
- No consideration of whether the risk carried an opportunity hidden inside it. (Spoiler: Loki himself was an opportunity they destroyed over and over again.)
In your projects, the analysis step means: running your risks through a probability and impact matrix, understanding which risks need immediate active response versus passive monitoring, identifying risks that might actually carry upside if you respond with an opportunity strategy rather than a threat strategy, and escalating the risks that genuinely exceed your authority or risk threshold to sponsors or stakeholders who can act on them.
This isn’t a slow, bureaucratic process. On well-run projects, it takes minutes per risk once you’ve internalized the framework. The PMI-RMP exam tests whether you’ve internalized this thinking — not whether you’ve memorized definitions.
The Sylvie Contrast: What Informed Decision-Making Looks Like
There’s a moment near the end of the first season of Loki that’s worth calling out. Sylvie, who has lived her entire life as a variant, hunted by the TVA, doesn’t react to her final confrontation with panic or a reflexive response.
She analyzes and then she weighs her options against what she knows, what she believes, and what the consequences of each path would be.
She makes an informed decision.
That’s the model.
Not impulsive or a single strategy. And definetly not defaulting to the first response available. A deliberate evaluation of the situation, the options, and the likely outcomes.
That’s what PMI wants from you on the exam. And it’s what your projects demand from you in the field.
When your sponsor springs a new constraint on you mid-project, the response isn’t to immediately mitigate. When a vendor relationship starts showing signs of instability, the response isn’t to immediately transfer. The response is to analyze — to understand the probability and impact of what you’re facing — and then select the strategy that fits.
How to Start Applying This Today
You don’t need to overhaul your entire risk management process to fix this. Here’s where to start:
When you’re reviewing your risk register this week, look at the response column. If you see mitigation listed for every single risk, that’s a flag. Pick three risks and ask: is mitigation actually the right fit here, or did we default to it? Would transfer make more sense given the expertise required? Would acceptance with a contingency reserve be more cost-effective for a low-probability risk we’ve been actively managing?
That audit takes less than 30 minutes. The insight it produces can change how your whole team approaches risk.
What the TVA Can Teach You That Your PMP Course Didn't
The TVA wasn’t incompetent. They were rigid. They had capability and completely lacked adaptability. That distinction matters, because most struggling project risk managers aren’t unintelligent — they’re undertrained in strategic variety.
The PMI-RMP certification exists precisely to close that gap. It’s not just another credential. It’s a signal that you’ve moved beyond reactive risk identification into genuine risk strategy — the ability to look at a threat or opportunity, assess it accurately, and deploy the right response with confidence.
The candidates who pass the RMP exam aren’t the ones who memorized eight strategy names. They’re the ones who can read a scenario, identify what’s actually being asked, and apply the right thinking — even when the answer feels counterintuitive.
That’s the mindset. And it’s the one the TVA never developed.
Ready to Think Like a Risk Practitioner?
If you’ve been managing risks the way the TVA did, flagging, responding, moving on, same strategy every time — you now know what the missing link is.
- It’s the analysis step.
- It’s the strategic matching.
- It’s treating your eight response strategies as a toolkit, not a one-button solution.
The good news is this is a learnable skill, not a personality trait. And the PMI-RMP framework gives you the structure to develop it.
If you’re serious about earning your PMI-RMP certification and building the risk management thinking that goes with it, the RMP Exam Prep Course is where that work happens. The next cohort is open now — and it’s built around developing exactly this kind of strategic, scenario-based thinking.
Explore the RMP Exam Prep Course
About 44Risk PM, LLC
This analysis was prepared by 44Risk PM LLC, specializing in PMI-RMP® and PMP® certification training with a focus on practical, real-world risk management.
Contact:
Russ Parker
PMP®, PMI-RMP®, PMI-ACP®
PMI-ATP Instructor – PMP® & PMI-RMP®
Owner, Forty-Four Risk PM, LLC
An Approved PMI-Authorized Training Partner
Connect with me on Linkedin
Subscribe to my YouTube
Find me on Substack
“Stay Proactive Over Reactive”
“The PMI-Authorized Training Partner seal, PMP®, PMI-RMP®, and PMI-ACP® are registered marks of the Project Management Institute, Inc.”
