Why mitigation is important in project risk management