4 Risk Response Planning

Purpose and response choices

Risk response planning turns assessed uncertainty into practical decisions and actions. A good response fits the risk’s priority, is feasible within project constraints, has a responsible person assigned, and is monitored for its effects. Responses address both threats, which may cause harm, and opportunities, which may produce benefits.

Select a strategy

Select a strategy according to the risk’s likelihood and impact, the project’s objectives and risk tolerance, available resources, and the cost and side effects of acting. More than one strategy may be combined.

Responses to threats

• Avoid: Change the plan to remove the threat or protect the objective from its effect.

• Mitigate: Reduce the threat’s likelihood, impact, or both.

• Transfer: Shift some financial exposure or responsibility to another party, for example through insurance or a contract. The threat itself may remain.

• Accept: Take no proactive action beyond monitoring, or prepare a contingency to use if the threat occurs.

Responses to opportunities

• Exploit: Act to make the opportunity happen.

• Enhance: Increase the opportunity’s likelihood or beneficial impact.

• Share: Partner with a party better able to realize the opportunity and agree how responsibility or benefits will be shared.

• Accept: Be prepared to take advantage of the opportunity if it occurs, without investing in proactive action.

Some frameworks also use escalation when a risk is outside the project team’s authority or scope. Follow the organization’s terminology and escalation rules.

Apply strategies to project situations

For a supplier-delay threat—if the supplier misses the delivery date, integration testing may start late—the team could mitigate the risk by agreeing on interim delivery milestones and preparing a substitute component. The team could also accept the remaining schedule exposure and define a trigger, such as a missed milestone, that activates the substitute plan.

For an opportunity in which a compatible new cloud service could lower hosting costs, the team could enhance the opportunity by running an early compatibility test, or exploit it by committing to the service if the test meets agreed criteria. The choices should be checked against project constraints; switching services, for example, may raise security or training concerns.

Assign owners and define actions

A risk owner oversees a particular risk: they monitor it and ensure that an appropriate response is selected and carried out. An action owner performs a specific assigned task. Make the distinction clear, and assign people with the authority, expertise, and capacity to do the work rather than naming only a team or department.

For each planned response, specify:

• The action and the risk it addresses.

• The risk owner and any action owners.

• The due date, resources, and approvals needed.

• The trigger or conditions for starting the action or contingency.

• The expected effect on likelihood, impact, and project objectives.

• How completion and effectiveness will be checked.

For example, the integration lead, as action owner, will test the substitute component by 15 May, and the technical lead, as risk owner, will review the result. If the supplier misses the 10 May milestone, the project manager will authorize the contingency. A response plan should be actionable and timed, not a vague instruction such as “watch the supplier.”

Reassess exposure and side effects

A response changes risk exposure but does not necessarily eliminate uncertainty. Reassess residual risk by considering its likelihood and impact, then decide whether it falls within project tolerance, needs another response, or should be monitored or escalated.

A response may also create secondary risk. For example, a substitute component may reduce the risk of supplier delay but create a risk of incompatibility. Identify and assess that new risk like other project risks; it may need its own owner and response.

Consider whether the response adds cost, changes the schedule, creates dependencies, raises safety or security concerns, or affects other objectives. Compare its expected benefit with its cost and side effects. If residual or secondary exposure is unacceptable, revise the response, add safeguards, or seek a decision from the appropriate authority.

Record, monitor, and revise

Record the selected strategy, planned actions, owners, triggers, due dates, and assessments of residual and secondary risks in the risk register or a linked response plan. Review these details as the project changes.

Monitor triggers and action progress. Check whether responses are reducing threats or improving the chance of opportunities, and update the plan when assumptions or exposure change. Risk response planning is iterative: responses can create new risks, and a response that was once suitable may no longer fit the project.