Almost every risk has a possible mitigation strategy and risks should be quantified assuming that these risk mitigation strategies would be successfully deployed. Further, the mitigation strategies assumed for this purpose should reflect what the public sector body would actually do to mitigate the risk, rather than what it could do.
For example, if scope change from stakeholders is a key risk, a mitigation strategy might be to implement a stakeholder working committee that will explain the PPP process, including an explanation of when and how stakeholders can affect scope changes. The risk this mitigation strategy is intended to address should be quantified assuming that the working committee is in effect.
In the case of geotechnical risk, on the other hand, this approach would not be appropriate if the mitigation strategy is to drill boreholes in the future to obtain new and/or better information. The geotechnical risk would need to be calculated pre-mitigation and then be re-quantified once the results of the boreholes has been obtained.