A new project's risk is not only the uncertainty inside the project; it is the change the project creates in the enterprise's total exposure.
Investment decisions are often analysed one proposal at a time.
The project team estimates cost, schedule and benefits. Risks are identified. NPV or other financial metrics are calculated. The business case is reviewed. The project is then approved or rejected.
This process can be rigorous and still produce the wrong portfolio.
Why? Because the project may be judged without first understanding the risks the enterprise already carries.
The supplied McKinsey capital-project material begins from the opposite direction. It argues that managers should assess how much current performance is already at risk before evaluating the incremental effect of a new investment. The Hargitay material likewise treats risk-return characteristics in the context of other assets and the portfolio rather than only as isolated investments.
That is the correct strategic starting point.
The Strategic Context
A project may look attractive on its own while worsening the enterprise's overall risk profile.
Consider a hypothetical mining company with strong capabilities in one commodity. Another project in the same commodity may offer an attractive standalone return. But if the company's revenue, cash flow, debt capacity and growth plans are already heavily exposed to the same price cycle, the project increases concentration.
The same logic applies elsewhere.
A manufacturer may approve several automation projects that all depend on one control-system supplier.
A bank may fund multiple digital programs using the same scarce data specialists.
A government department may approve several reforms that rely on the same legislation or implementation partner.
A technology company may invest repeatedly in one customer segment or one cloud platform.
Each initiative can be sensible alone.
Together, they can create a portfolio whose failure modes are highly correlated.
Portfolio risk therefore cannot be reduced to the sum of project risk registers.
What Leaders Commonly Misread
The first misreading is that diversification simply means having many projects.
A portfolio of twenty projects can still be highly concentrated if they depend on the same market, technology, assumption or resource.
The second misreading is that the safest project is always the best addition to the portfolio.
A project with moderate standalone risk may improve the total portfolio if its outcomes are weakly correlated with existing exposures.
The third misreading is that familiar projects are necessarily safer.
Familiarity often improves execution capability, but repeatedly investing in familiar domains can increase concentration. The organisation becomes very good at one type of exposure.
The fourth misreading is that capital constraints are separate from risk.
They are connected. A project that performs worse than expected may require additional capital at the same time that other projects or the core business also need funding.
The McKinsey material makes this particularly visible by examining cash-flow distributions against capital requirements rather than relying solely on expected values.
Reframing the Issue
Portfolio risk should be reframed as enterprise exposure under multiple possible futures.
Before asking whether a new project is attractive, leaders should ask:
- What risks are already embedded in the current business and active portfolio?
- Which of those risks are correlated?
- What new exposure does the proposed investment add?
- What happens to funding requirements if several adverse events occur together?
- Does the project diversify the portfolio or deepen concentration?
- Is the resulting exposure consistent with the organisation's risk appetite?
This is materially different from asking whether the project's individual risk score is acceptable.
Related article: Project Control Cannot Rescue a Bad Portfolio Bet
Existing Performance at Risk
The supplied McKinsey example describes managers who quantified existing exposure to commodity prices, transport constraints and regulation before assessing a proposed investment.
The strategic lesson is more important than the case numbers.
A new investment does not start from a neutral balance sheet.
It enters an organisation already exposed to uncertainty.
That existing exposure may include:
- demand volatility;
- financing risk;
- customer concentration;
- foreign exchange;
- regulation;
- commodity prices;
- technology obsolescence;
- supply-chain constraints;
- operational reliability;
- and workforce scarcity.
A new project should therefore be evaluated on an incremental risk basis.
The question is not merely, “How risky is this project?”
It is, “How does this project change the distribution of enterprise outcomes?”
Risk-Adjusted Comparison Across Projects
The McKinsey source proposes a standardised approach that combines project economics with explicit risk information.
The broader principle is sound: projects should be assessed on a comparable basis.
If one project uses optimistic assumptions while another uses conservative ones, ranking them is misleading.
If one project includes contingency and another hides uncertainty inside a discount rate, the comparison is not transparent.
A robust portfolio process therefore standardises:
- economic assumptions;
- risk categories;
- scenario treatment;
- confidence levels;
- capital requirements;
- and decision metrics.
This does not mean every project should be forced into the same business model.
It means the organisation should create enough consistency to compare unlike opportunities without pretending they are identical.
Correlation Changes the Portfolio
Hargitay's treatment of investment risk highlights correlation between cash flows.
This is strategically important because risk is not additive in a simple way.
If two projects are both exposed to the same external condition, their downside may occur together.
If their drivers differ, one may remain strong when the other weakens.
For a project portfolio, the relevant correlation may not be statistical in the financial-market sense. It may be operational.
Examples include:
- dependence on the same supplier;
- reliance on the same regulatory approval;
- competition for the same specialists;
- exposure to the same customer segment;
- reliance on the same technology platform;
- or sensitivity to the same macroeconomic variable.
These common dependencies create portfolio concentration even if projects look diverse on paper.
The Capital-at-Risk Question
Portfolio risk becomes most consequential when adverse outcomes require additional funding.
A project that overruns by 10 per cent may be manageable alone.
Five projects overrunning at the same time may breach the organisation's capital capacity.
This is why expected project cost is not enough.
Leadership needs to understand:
- likely additional capital under adverse scenarios;
- when that capital may be required;
- which projects could be paused;
- which commitments are irreversible;
- and how much liquidity or borrowing capacity remains.
Related article: Profitability Does Not Protect Solvency: The Cash-Flow Risk Inside Projects
Decision Framework
A portfolio-risk review should evaluate proposed investments through seven lenses.
| Lens | Executive question |
|---|---|
| Existing exposure | What major risks already threaten enterprise cash flow or strategic performance? |
| Incremental exposure | Which risks does this project add or amplify? |
| Correlation | Which existing investments fail under the same conditions? |
| Capital at risk | How much additional funding could be required under adverse outcomes? |
| Diversification | Does the project introduce different sources of value or simply add concentration? |
| Reversibility | Which commitments can be stopped or staged if conditions deteriorate? |
| Risk appetite | Is the combined portfolio still within the exposure leadership is willing and able to carry? |
No single score should replace judgement.
The purpose is to make the combined risk visible.
From Strategy to Execution
Immediate action
Require investment papers to state how each project changes existing enterprise exposure.
Add a simple concentration map showing common dependencies across major projects.
Identify projects that could require additional capital under the same adverse scenario.
Medium-term capability building
Develop a portfolio-level risk model rather than relying only on individual project registers.
Standardise core assumptions so projects can be compared consistently.
Introduce capital-at-risk and liquidity views alongside expected cost and NPV.
Long-term strategic positioning
Use risk as a portfolio design variable.
The goal is not to minimise risk. Excessive risk avoidance can destroy growth.
The goal is to hold a deliberate combination of risks that the enterprise understands, can finance and is capable of managing.
That may mean accepting a lower-return project because it diversifies the portfolio.
It may also mean rejecting an attractive project because it deepens a concentration the enterprise can no longer afford.
Signals to Monitor
Portfolio concentration is increasing when:
- several projects depend on the same uncertain external assumption;
- the same supplier or technology becomes critical across multiple programs;
- project teams independently assume access to the same scarce specialists;
- positive-NPV projects are approved despite worsening balance-sheet resilience;
- adverse scenarios consistently require capital beyond available headroom;
- or leaders describe every new project as strategically necessary despite growing exposure to one market or business model.
Questions for the Leadership Team
- What risks are already embedded in our portfolio before we approve anything new?
- Which projects would deteriorate together under the same scenario?
- Where are we mistaking familiarity for diversification?
- How much additional capital could the portfolio require if multiple projects underperform simultaneously?
- Which investments improve the portfolio even if their standalone return is not the highest?
- What exposure would we refuse to increase, regardless of the attractiveness of the next project?
Closing Perspective
Project risk starts with the project.
Portfolio risk starts earlier.
It begins with the exposures the enterprise already carries and the relationships among them.
A disciplined investment process therefore does not ask only whether the next project is acceptable.
It asks whether the enterprise becomes stronger or more fragile after the project is added.
That is the difference between approving projects and designing a portfolio.