Risk Response Strategies
Risk Response Strategies
Risk Response Strategies
Avoid. Risk can be avoided by removing the Exploit. The aim is to ensure that the opportunity
cause of the risk or executing the project in a is realized. This strategy seeks to eliminate the
different way while still aiming to achieve uncertainty associated with a particular upside
project objectives. Not all risks can be avoided risk by making the opportunity definitely happen.
or eliminated, and for others, this approach may Exploit is an aggressive response strategy, best
be too expensive or time‐consuming. However, reserved for those “golden opportunities” having
this should be the first strategy considered. high probability and impacts.
Transfer. Transferring risk involves finding Share. Allocate risk ownership of an opportunity
another party who is willing to take to another party who is best able to maximize its
responsibility for its management, and who will probability of occurrence and increase the
bear the liability of the risk should it occur. The potential benefits if it does occur. Transferring
aim is to ensure that the risk is owned and threats and sharing opportunities are similar in
managed by the party best able to deal with it that a third party is used. Those to whom threats
effectively. Risk transfer usually involves are transferred take on the liability and those to
payment of a premium, and the whom opportunities are allocated should be
cost‐effectiveness of this must be considered allowed to share in the potential benefits.
when deciding whether to adopt a transfer
strategy.
Mitigate. Risk mitigation reduces the Enhance. This response aims to modify the “size”
probability and/or impact of an adverse risk of the positive risk. The opportunity is enhanced
event to an acceptable threshold. Taking early by increasing its probability and/or impact,
action to reduce the probability and/or impact thereby maximizing benefits realized for the
of a risk is often more effective than trying to project. If the probability can be increased to 100
repair the percent, this is effectively an exploit response.
damage after the risk has occurred. Risk
mitigation may require resources or time and
thus presents a tradeoff between doing nothing
versus the cost of mitigating the risk.
Acceptance. This strategy is adopted when it is not possible or practical to respond to the risk by
the other strategies, or a response is not warranted by the importance of the risk. When the project
manager and the project team decide to accept a risk, they are agreeing to address the risk if and when
it occurs. A contingency plan, workaround plan and/or contingency reserve may be developed for that
eventuality.
Examples of Risk Responses
Table 6 repeats the example risk statements from Table 4 and shows a risk response for each.
1
Responding to Risks
Following identification and analysis of project risks, the PRMT takes action to improve the odds
in favor of project success. Ultimately, it is not possible to eliminate all threats or take advantage
of all opportunities – but they will be documented to provide awareness that they exist and have
been identified. Successful risk response will change the risk profile through the project life cycle,
and risk exposure will diminish.
Risk response involves:
The PRMT determining which risks warrant a response and identifying which strategy
is best for each risk.
Assigning an action to the Risk Owner to identify options for reducing the probability or
impacts of each risk. The Risk Owner takes the lead and can involve experts available to
the project.
Evaluating each option for potential reduction in the risk and cost of implementing the
option.
Selecting the best option for the project.
Requesting additional contingency, if needed.
Assigning an action to the Risk Owner to execute the selected response action. The Risk
Owner is the lead and may assign specific tasks to other resources to have the response
implemented and documented.
If the PRMT judges that a risk should be accepted, it may assign an action to the Risk Owner to
prepare a contingency plan if deemed necessary.
2
Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK Guide) – Fourth
Edition