Illustration: Louiza Karageorgiou for GIJN
Project Management: Risk Management and Security
Guide Resource
GIJN Guide to Project Management in Investigative Journalism
Chapter Guide Resource
Project Management: Collaborative Journalism
Chapter Guide Resource
Project Management: Team Dynamics and Collaboration
Chapter Guide Resource
Project Management: Planning and Timelines
Chapter Guide Resource
Project Management: Budgeting and Resource Management
Chapter Guide Resource
Project Management: Technology and Tools
Chapter Guide Resource
Project Management: Risk Management and Security
Chapter Guide Resource
Project Management: Evaluation and Post-Project Analysis
When reporters from different countries work together to investigate sensitive and often controversial issues, the importance of risk management cannot be overstated. Cross-border journalism exposes journalists to a range of risks, from legal and physical threats to digital vulnerabilities, that are unique to the international scope of their work. Working together mitigates several risks though: people with bad intentions cannot attack the whole team. Also, with the clever use of safe havens, a story can still be told about a politician in another country, for example, so that the local journalist is out of the line of fire.
Understanding the Importance of Risk Management
Project managers are responsible for ensuring that sufficient time and attention is given to risk assessment, both at the beginning and during the project. Good risk management can prevent many unpleasant and even life-threatening situations, not only for sources and the team, but for everyone involved, even the publisher.
Reasons Often Given to Avoid Risk Management
- It’s too complicated.
- It’s too much of an academic exercise.
- It’s time-consuming.
- Nobody cares.
- It feels like a scientific process that is too difficult to take part in.
- They don’t want to sound negative by talking about things that could go wrong.
- They are intimidated by it.
- Reporters might not want to share the risks they face because they’re embarrassed or don’t believe they’re in danger.
The reality is these are excuses, mostly based on incorrect assumptions and faulty logic. Although it may seem at first that you are investing a lot of time and energy in something that may or may not happen, in many cases the time needed to list the risks is relatively small compared to the project and the tasks of the project manager. In addition, good preparation in the long term is more valuable than whatever small amount of time and effort is saved by skipping this process in the short term.
Risk management can be boiled down to four key steps: inventorying risks, weighing and analyzing risks, taking mitigation measures, and controlling risks.
- Inventory: Start by taking stock of the risks that could occur and hinder the success of the project. Prepare an overview of the most common risks for the kick-off meeting, and let everyone in the team add risks they see, so that everyone’s knowledge and expertise is covered.
- Weighing and analyzing: The risks identified in the inventory can all be different in nature and impact. Weighing involves estimating the likelihood and impact of the risks and assigning them a relative importance. Use the risk matrix below to do this. In the analysis, look at the causes and consequences to identify next steps. Assign each risk to someone: create ownership. For example, if there is a data security risk, the data journalist should be the one monitoring that risk.
- Taking mitigation measures: Consider what can be done to prevent the risks, minimize the impact, or accept the consequences. These are the actions to be taken, and if they have an impact on the project, discuss with the team whether changes need to be made to the project itself.
- Managing risks: As the work progresses, the people assigned to the risk should monitor whether risks are occurring or growing, and whether the measures and provisions taken are sufficient to continue the project.
Note: Risk management is an ongoing process, just like planning. After all, circumstances are constantly changing. That is why risk management needs constant monitoring not just an initial focus and then set aside.
Do not economize on the time you need to determine the risks. If the team sees a lot of risks, it might need a separate meeting after the kick-off session.
Measures and Actions
Each risk may demand a different response or mitigation tactic:
- Accept.
- Prevent (reduce the chance).
- Limit damage (reduce the effect).
- Transfer (for example, insurance).
Sometimes there are multiple measures for a risk needed. Translate each measure into concrete actions. For example, to address the threat of legal action or a lawsuit, it might be necessary to look for extra funding to pay for legal counsel, by applying for additional grants or using resources available via the newsrooms of team members.
In addition to risks, also look at opportunities.
Risk Assessment Tools
The Journalist Security Assessment Tool
GIJN’s JSAT is a free, survey-based self-assessment tool that offers practical solutions tailored to each newsroom’s profile and vulnerabilities. The survey takes about an hour to complete and is followed by an instant diagnosis of an organization’s digital and physical security and resilience. It’s available in English, Arabic, French, German, Hindi, Indonesian, Portuguese, Russian, Spanish, Turkish, and Urdu.
EJC Risk assessment for freelancers
In this training session, Colin Pereira, Director of HP Risk Management, introduces the basic concepts, tips, techniques, and risk assessment tools for freelance journalists.
IJ4EU Risk assessment
This spreadsheet (with examples) is a risk assessment tool that explains the risk matrix in a slightly different way than the one we described above, but is very useful.
CPJ Assessing and Responding to Risk and CPJ Basic Preparedness
CPJ specializes in the security and safety of journalists around the world.
More to read or watch about risk assessments:
- In this video Can risk assessments keep journalists safer? IJF24 Maria Salazar Ferro (director newsroom safety and resilience at The New York Times) explains her basic setup regarding risk management: Safety is a three-legged stool, so that journalists can sit comfortably and not think about whether they’re going to wobble or fall. One leg is physical safety, like a helmet or a gas mask; the second is online safety, like encrypted communications and secure document sharing; and the third is psychological safety, like debriefing after a visit to a war zone.
Understanding Different Kinds of Risk
Risks may be divided into three categories.
- Team: Physical, Psychological safety, cultural and ethical risks.
- Resources and tools: Digital security, financial risks.
- External: Legal risks, natural conditions, and other risks that the team cannot control
Team — Physical Safety
Journalists investigating corruption, crime, or political malpractice in different countries may face physical danger. Threats can come from governments, criminal organizations, or corporations seeking to prevent the exposure of their actions. The risks are exacerbated in conflict zones or authoritarian regimes where press freedom is restricted and violence against journalists is common.
Risks
- Surveillance, harassment, and intimidation;
- Kidnapping, assault, or assassination;
- Injury or death in war zones or dangerous environments;
- Arbitrary arrest or detention.
Mitigation strategies
- Security training;
- Travel risk assessment;
- Use of secure communication channels;
- Buddy system;
- Emergency protocols.
Team — Psychological Safety
Especially in high-risk environments, work can take a psychological toll on journalists. Reporting on traumatic issues such as war crimes, human trafficking, or environmental disasters can lead to vicarious trauma, burnout, or depression. A project manager should be alert to signs of psychological distress and provide as much support as possible. Talking about the risk and how to mitigate it may encourage team members to talk about potential problems earlier.
Risks
- Vicarious trauma and emotional distress;
- Burnout due to prolonged investigations;
- Anxiety or fear related to personal safety.
Mitigation strategies
- Mental health support programs via newsroom or organization;
- Take turns in roles during long investigations, especially when working on traumatic content;
- Team debriefings.
Team — Cultural and Ethical Considerations
Cultural misunderstandings or ethical missteps can jeopardize an investigation, especially when collaborating across borders. Journalists may misinterpret their sources’ cultural nuances or inadvertently offend communities, leading to mistrust or uncooperative sources. Furthermore, ethical dilemmas can arise when working with sources in vulnerable situations or authoritarian environments.
Risks
- Mistrust or alienation of local communities or sources;
- Misinterpretation of cultural norms;
- Ethical dilemmas in source protection;
- Bias or misrepresentation of facts.
Mitigation strategies
- Collaborate with local journalists;
- Ethical guidelines;
- Source protection protocols.
More to read about protecting sources:
- CJP digital & physical safety: protecting confidential sources
- Source protection begins with your smartphone contacts
Resources and Tools — Digital Security
Digital security is one of the most critical concerns in cross-border journalism, as digital attacks can be launched remotely by malicious actors. Journalists often work with sensitive information, including whistleblower testimony, confidential documents, and unpublished data. Hackers, state actors, or corporate entities may attempt to breach communications to halt investigations, steal information, or discredit the team. By discussing these risks within the team, any in-house experts may identify key concerns and mitigation tactics that are especially important for the project and educate the team on digital security best practices. If those experts are not part of the team, hire them and put it in the budget.
Risks
- Hacking or phishing attacks;
- Surveillance of digital communications;
- Data theft or manipulation;
- Compromising journalistic sources.
Mitigation strategies
- Encryption;
- VPNs and firewalls;
- Two-factor authentication (2FA);
- Data storage and backups;
- Digital hygiene.
More to read about digital safety:
- Data Security & Encryption Tools for Journalists – Global Investigative Journalism Network (gijn.org)
- 6 Ways the Internet of Things Poses Security Threats to Journalists (GIJN)
- Protecting journalism in a digital age (UNESCO)
Resources and Tools — Financial Risks
Investigative journalism, particularly cross-border work, is resource-intensive and often underfunded. Journalists and their media organizations must manage limited budgets, while also securing the tools, travel arrangements, and support necessary for the investigation. Poor resource management can lead to incomplete investigations or personal financial risk for team members.
Risks
- Budget overruns;
- Resource depletion;
- Lack of funding for legal or security services.
Mitigation strategies
- Budget planning;
- Grant funding;
- Expense monitoring.
External — Legal Challenges
Project managers can’t know every country’s laws, but as a project manager, be aware of the risks your team members or the team as a whole face with regard to the relevant media laws, defamation regulation, and other legal challenges. Journalists working in different countries face different legal rules, with vast differences in how freedom of expression, defamation, privacy, and threats to national security are addressed. In some places, laws protect journalists, while in others, they risk censorship, lawsuits, or even jail time for reporting on sensitive or even mundane topics. Working with international teams can complicate matters further, as what is legal in one country may be illegal in another.
Risks
- Costly defamation lawsuits;
- Charges of espionage or sedition;
- Violations of data protection laws (e.g., GDPR in the EU);
- Risk of arrest or detention under local censorship or press regulations..
Mitigation strategies
- Legal advice and pre-publication review;
- Pre-emptive bulletproofing and fact-checking;
- Use of legal safe harbors;
- Insurance.
More to read about legal risks:
- A Journalist’s Guide to Avoiding Lawsuits and Other Legal Dangers – Global Investigative Journalism Network (gijn.org)
- Media Defense Guide for Investigative Journalists – Global Investigative Journalism Network (gijn.org)
- How Journalists Can Protect against Slapp Cases and Other Legal Threats (GIJN)
External — Project Safety
The absence of a team member (who is ultimately unable to contribute to the project) or the inability to acquire and verify essential information can significantly hinder the progress of the investigation. Also think of not having the proper documents for travel, waiting endlessly for a FOIA request result, or experiencing a budget shortfall.
The key is to collaborate with the team to plan for potential obstacles. Naturally, it’s impossible to anticipate and prevent every issue, but the goal is to strategize in advance about how to handle challenges before they arise, rather than reacting to them as they occur.
After identifying risks with the team, the subsequent step involves outlining the mitigating actions. It’s beneficial to discuss risk mitigation measures with the team beforehand, ensuring that when an unexpected situation arises, there’s no need to panic when considering how to respond or solve the problem. Decision-making in a high-pressure environment with a full team is inherently challenging.
Tips and Tricks
- Learn from previous projects, but do not reuse them: A new project means a new situation. If you simply copy the risk management process from a previous story there is a fair chance that you will miss risks that are unique to your current project.
- Risk management never ends, not even after publication: The risk log is a living document. In larger, complex, and therefore more risky projects, it is either a permanent agenda item at team meetings, or separate risk meetings are organized periodically. Do not only check whether new risks have emerged but also whether anything has changed in the risks you have already identified. Then ensure that the existing document is updated.
Coco Gubbels became aware of the need for and added value of project management in investigative journalism a few years ago. As a former freelance investigative journalist and practicing project manager in the corporate world, she noticed how collaborative journalism was maturing, but journalists were still lacking the necessary skills.
She now combines her passion for investigative journalism and her profession as a project manager in her one-woman organization PM-IJ: Project Management in Investigative Journalism. As a freelance project manager, she coordinates large international investigations, coaches and trains coordinators and mentors cross-border teams. She is the founder of a peer support group on LinkedIn to create a network of collaborative managers to learn and share experiences.