Risk management is often treated as a defensive discipline: identify what might go wrong, assess the consequences, and take action to prevent or reduce harm.
That is only half the picture.
Uncertainty can also produce beneficial outcomes. A project may finish earlier than expected. A supplier may deliver a better solution than anticipated. A regulatory change may create demand for a new service. A technical improvement may reduce both cost and delivery time.
These favourable uncertainties are commonly called upside risks, positive risks, or opportunities.
A mature risk-management process considers both threats and opportunities. It protects objectives from adverse events while also helping teams recognise and exploit favourable conditions.
What is upside risk?
An upside risk is an uncertain event or condition that, if it occurs, would have a positive effect on one or more objectives.
This distinguishes it from a threat:
- A threat may delay, damage, or prevent the achievement of an objective.
- An opportunity may improve, accelerate, or increase the achievement of an objective.
For example, a software-development task might take longer than planned, creating a schedule threat. It might also take significantly less time than planned, creating an opportunity to bring forward other work or include an additional feature in the release.
Both outcomes are uncertain. Both may affect the project. The difference is whether the effect is adverse or beneficial.
Can risk be positive?
The meaning of the word risk is debated.
In everyday usage, risk usually implies danger, loss, or harm. Many organisations therefore use risk for negative uncertainty and opportunity for positive uncertainty.
Other frameworks use risk as a neutral term that covers any uncertainty affecting objectives, whether positively or negatively.
The terminology matters less than the practice. Whatever language an organisation adopts, it should have a deliberate way to:
- identify favourable uncertainties;
- assess their likelihood and potential value;
- assign ownership;
- choose an appropriate response;
- monitor relevant indicators; and
- act quickly when the opportunity becomes available.
An organisation that records threats but ignores opportunities is managing only part of its uncertainty.
Upside risk examples
Upside risks can affect schedule, cost, quality, scope, resources, technology, market conditions, and strategic objectives.
Schedule opportunity
A regulatory approval expected to take ten weeks may be granted in four weeks, allowing the organisation to launch earlier.
Cost opportunity
A supplier may offer a volume discount that reduces procurement costs below the approved budget.
Resource opportunity
A specialist may become available earlier than expected, enabling critical work to begin ahead of schedule.
Technology opportunity
A new automation tool may substantially reduce testing effort while improving consistency.
Market opportunity
A competitor may postpone its product launch, creating a temporary opening to gain customers or market share.
Quality opportunity
A design improvement discovered during prototyping may increase reliability without increasing cost.
Delivery opportunity
A project task may finish early, freeing people to complete deferred work or reduce pressure on later milestones.
Strategic opportunity
A regulatory change may create demand for a product or service the organisation can deliver with relatively little additional investment.
Opportunity versus benefit
An opportunity is not the same as a guaranteed benefit.
A benefit is a favourable outcome that has been achieved or is expected as part of the approved plan. An opportunity is uncertain.
For example:
- “The new system will reduce processing time by 20%” may be a planned benefit.
- “The new system may allow the organisation to enter an additional market” is an opportunity if that outcome remains uncertain.
This distinction matters because opportunities should be assessed and managed rather than counted as certain gains.
Four ways to identify upside risks
People are often better at imagining failure than unexpected success. Teams therefore need deliberate techniques for identifying favourable uncertainty.
1. Examine what happens if an anticipated threat does not occur
A threat that fails to materialise may create more than simple relief. It can create additional capacity, time, money, or strategic freedom.
Ask:
- What becomes possible if this delay does not occur?
- What could we do if the contingency budget is not needed?
- What advantage would arise if the competitor does not launch?
- How could we use capacity released by an avoided problem?
Example
A competitor is expected to launch a similar product before your organisation. Its launch is delayed. Your organisation may now have an opportunity to run a targeted campaign, strengthen customer relationships, or establish a stronger market position.
The absence of the threat creates an opening that should be actively exploited rather than merely noted.
2. Look for positive secondary effects of risk treatments
Treating a threat can create new uncertainty. These secondary risks are often discussed as additional threats, but treatments can also create beneficial effects.
Ask:
- Could this control improve efficiency as well as reduce risk?
- Could this contingency create reusable capability?
- Could this training produce benefits outside the original project?
- Could this supplier arrangement open access to other services or markets?
Example
An organisation strengthens its infrastructure in response to cybersecurity concerns. The new architecture not only reduces security exposure but also improves performance, reliability, and customer confidence.
Those additional benefits may justify further investment or create opportunities elsewhere in the organisation.
3. Invert quantifiable threats
Some uncertainties can move in either direction along a measurable scale.
Examples include:
- schedule duration;
- cost;
- demand;
- resource availability;
- productivity;
- exchange rates;
- approval time; and
- system performance.
When analysing a possible adverse deviation, deliberately examine the opposite outcome.
Ask:
- What if the task takes less time rather than more?
- What if demand exceeds the forecast?
- What if the exchange rate moves in our favour?
- What if adoption is faster than expected?
- What if performance exceeds the requirement?
Example
A project allows ten weeks for regulatory approval because the responsible agency is often slow. If approval arrives in four weeks, the organisation may be able to launch earlier, reduce holding costs, or reassign resources to another priority.
The opportunity exists only if the team has already considered how to use the gained time.
4. Search for pure opportunities
Not every opportunity is the opposite of a threat. Some positive events arise independently.
These may result from:
- a new partnership;
- a favourable regulatory change;
- unexpected customer interest;
- an emerging technology;
- competitor withdrawal;
- access to new expertise;
- a new funding source; or
- an unplanned reuse of project outputs.
Ask:
- What external change could improve our position?
- What new capability might emerge from this work?
- Where could the project create value beyond its original scope?
- What would become possible if demand, funding, or capacity increased?
- What adjacent market or use case could benefit from the project?
Example
A regulatory change creates unexpected demand for a product in another country. The organisation can localise the product quickly and enter the market ahead of competitors.
Pure opportunities are difficult to predict, but teams that actively scan for them are more likely to recognise and exploit them.
Techniques for finding positive risks
The same techniques used to identify threats can be adapted to opportunities.
Opportunity workshop
Run a workshop that asks only positive questions:
- What might go better than planned?
- Where could we save time or money?
- What favourable external events could occur?
- What capabilities could this project create?
- Which assumptions might prove conservative?
- What would success beyond the current plan look like?
Separating opportunity identification from threat identification can help teams escape an exclusively defensive mindset.
SWOT analysis
The opportunities section of a SWOT analysis can provide useful inputs, particularly for strategic and market-related uncertainties.
Convert broad observations into specific uncertain events with identifiable effects on objectives.
Scenario analysis
Develop favourable as well as adverse scenarios.
For example:
- expected demand;
- lower-than-expected demand;
- higher-than-expected demand.
Then identify the actions required to benefit from the favourable scenario.
Assumption analysis
Review project assumptions and ask what happens if reality is more favourable than assumed.
A conservative assumption about delivery time, customer demand, recruitment, cost, or performance may conceal an opportunity.
Lessons learned and retrospectives
Past projects often contain overlooked positive events:
- early approvals;
- unused contingency;
- unexpectedly strong adoption;
- supplier innovation;
- reusable assets;
- successful process improvements.
Reviewing these outcomes can reveal opportunities worth planning for in future work.
Stakeholder interviews
Customers, suppliers, technical specialists, and operational teams may see favourable possibilities that the core project team misses.
Ask stakeholders what additional value the project could generate and what external changes could improve its outcome.
How to assess an upside risk
Opportunities should be assessed with the same discipline used for threats.
Record:
- the uncertain event;
- the cause or conditions that may produce it;
- the objectives it may improve;
- the likelihood of occurrence;
- the scale of the potential benefit;
- the time window in which it can be exploited;
- the opportunity owner; and
- the actions required to realise the benefit.
A simple opportunity statement can use this structure:
Because of cause or condition, there is an opportunity that uncertain event may occur, resulting in positive effect on objectives.
Example
Because the delivery team has completed the integration prototype earlier than expected, there is an opportunity to begin system testing ahead of schedule, resulting in an earlier release or additional time for quality assurance.
Avoid vague statements such as:
There is an opportunity to improve the project.
The statement should identify a real uncertainty and a specific potential benefit.
How to respond to upside risk
Threat responses are commonly described as avoid, mitigate, transfer, and accept. Opportunities require a different set of strategies.
The four common opportunity responses are:
- Exploit
- Enhance
- Share
- Accept
Exploit the opportunity
Exploitation aims to ensure that the opportunity occurs.
Possible actions include:
- assigning the best available people;
- changing scope or priority;
- investing additional resources;
- accelerating a decision;
- removing barriers; or
- adopting a technology that enables the benefit.
Example
A project discovers that a reusable component could reduce delivery time across several workstreams. The organisation assigns a specialist team to complete and deploy the component, making the benefit more certain.
Enhance the opportunity
Enhancement aims to increase the probability or positive impact of the opportunity.
Possible actions include:
- increasing marketing activity;
- running an early pilot;
- improving stakeholder engagement;
- building extra capacity;
- strengthening a favourable condition; or
- extending the opportunity window.
Example
Early customer feedback suggests unusually strong demand. The organisation increases promotional activity and prepares additional support capacity to increase the potential benefit.
Share the opportunity
Sharing assigns some ownership to a party better able to realise the opportunity.
This may involve:
- joint ventures;
- partnerships;
- revenue-sharing arrangements;
- specialist suppliers;
- distributors; or
- collaborative research.
Example
An organisation identifies a new market but lacks local distribution capability. It partners with a regional firm and shares the resulting revenue.
Sharing differs from transferring a threat. The purpose is to combine capabilities so that both parties can realise a benefit.
Accept the opportunity
Acceptance means taking no proactive action beyond monitoring and being prepared to respond if the opportunity occurs.
This may be appropriate when:
- the opportunity is minor;
- proactive action is too expensive;
- the organisation has limited influence over the event;
- the potential benefit does not justify dedicated resources; or
- other priorities are more important.
Acceptance should still be deliberate. The organisation may establish trigger conditions or a contingency plan so that it can act quickly if the opportunity emerges.
Choosing an opportunity response
Consider:
- How valuable is the potential benefit?
- How likely is the opportunity?
- How long will the opportunity remain available?
- Can the organisation influence its occurrence?
- What investment is required?
- What threats might the response introduce?
- Does the organisation have the capacity to act?
- Who is accountable for monitoring and response?
- Is the opportunity aligned with strategic objectives?
A valuable opportunity with a narrow time window may justify active exploitation. A low-value opportunity outside the organisation’s control may simply be accepted.
More than one response can be used. A team might enhance an opportunity through early preparation and share it with a partner that has complementary expertise.
Managing opportunities in a risk register
Positive risks should not remain as informal ideas. Record them in the risk register or opportunity register with enough detail to support action.
Useful fields include:
| Field | What to record |
|---|---|
| Opportunity statement | Cause, uncertain event, and positive consequence |
| Category | Schedule, cost, market, technology, resource, or another category |
| Probability | How likely the opportunity is to occur |
| Positive impact | The potential value or improvement |
| Owner | The person accountable for monitoring and response |
| Response strategy | Exploit, enhance, share, or accept |
| Actions | The work required to realise the opportunity |
| Trigger | The event or threshold that activates action |
| Time window | When the opportunity can be realised |
| Status | Open, monitoring, active, realised, expired, or closed |
| Realised benefit | The value actually achieved |
Opportunities should be reviewed regularly. An opportunity may become more or less likely, increase or decrease in value, expire, or develop into a planned benefit.
Tracking upside risks in Jira
Opportunities are easier to manage when they are connected to the work required to realise them.
With Risk Register by ProjectBalm, teams can record positive and negative risks in Jira, assess their probability and impact, assign ownership, and connect response actions to Jira work items.
This allows opportunities to be monitored alongside project delivery rather than stored in a separate spreadsheet or forgotten after a workshop.
Learn more about risk management in Jira
Explore Risk Register features
Try Risk Register on the Atlassian Marketplace
Frequently asked questions
What is an upside risk?
An upside risk is an uncertain event or condition that may have a positive effect on objectives. It is also commonly called a positive risk or opportunity.
What is an example of an upside risk?
A project task may finish earlier than planned, creating an opportunity to bring forward later work, improve quality, or release sooner.
Is an opportunity the same as a benefit?
No. An opportunity is uncertain. A benefit is a favourable outcome that has been achieved or is expected as part of the approved plan.
What are the four opportunity-response strategies?
The four common strategies are exploit, enhance, share, and accept.
How do you identify positive risks?
Useful methods include examining absent threats, looking for positive secondary effects, inverting quantifiable threats, searching for pure opportunities, reviewing assumptions, and analysing favourable scenarios.
Should upside risks be recorded in the risk register?
Yes. Recording opportunities gives them ownership, assessment, response actions, trigger conditions, and review dates, making it more likely that the potential benefit will be realised.
Reference
Hillson, D. (2008), Why “Risk” Includes Opportunity, Risk Doctor Briefing Note #38. Available from Risk Doctor Briefings.