6 Planning Responses to Project Risks

Understand the purpose of response planning

Risk response planning turns assessed uncertainty into practical decisions and work. A Threat could harm project objectives, while an Opportunity could improve them. A good response is proportionate to the risk, addresses its causes where possible, and is feasible within the project’s authority, schedule, and budget.

A response may reduce exposure without eliminating it. Record and monitor the remaining exposure rather than assuming the response removes the risk.

Choose a response strategy

Choose a strategy by considering the risk’s likelihood, potential effect, timing, urgency, and the cost and side effects of acting. Compare the response’s cost and impact with the consequences of the risk. A single risk may need several actions or strategies.

Threat strategies

• Avoid: Change the approach, scope, or plan so the threat can no longer affect the project.

• Mitigate: Reduce the likelihood of the threat, its impact, or both.

• Transfer or share: Arrange for another party to carry or share part of the exposure, for example through insurance or a contract. The project may still retain some risk.

• Accept: Take no proactive action beyond monitoring, or prepare a contingency response if the threat occurs. Acceptance is a deliberate choice, not an omission.

Opportunity strategies

• Exploit: Act to make the opportunity happen.

• Enhance: Increase the likelihood of the opportunity or the benefit it would provide.

• Share: Partner with a party that can help realize the opportunity, agreeing how benefits and responsibilities are shared.

• Accept: Take no proactive action while remaining alert to the opportunity.

Some frameworks also use escalation when a risk is outside the project’s authority or scope. Raise it to the appropriate organizational level for a decision. Terminology varies across standards, so choose and define the response categories used by the project.

Define actions, owners, and triggers

For each priority risk, document the chosen strategy and the concrete actions needed to carry it out. Identify a risk owner to monitor the risk and coordinate the response. Where appropriate, name a separate action owner for each task, assign a due date, and define how the team will tell whether the action worked.

The risk owner should have enough authority and access to resources to act, or know when and how to escalate. A response plan should also specify:

• Trigger: A measurable sign or event that calls for a planned action, such as a test failure or a supplier missing a milestone.

• Contingency: The fallback action if the threat occurs, or the action to capture an opportunity if its trigger appears.

• Residual risk: The exposure left after the planned response; assess it and assign an owner.

• Secondary risks: New risks the response itself may create; record and assess them too.

Apply responses to project risks

A project depends on migrating customer records to a new system. The team identifies a threat that poor-quality legacy data could cause migration failures. It chooses mitigation: profile a sample early, correct data defects, and run a trial migration. The data lead owns the risk, while a data analyst owns the profiling action, which is due before the trial. A failed quality threshold triggers further cleansing and a schedule fallback. After the trial, the team reassesses any remaining failure risk.

The team also identifies an opportunity: early access to a supplier’s testing environment could allow integration testing to start sooner. It pursues the opportunity by requesting access and preparing test cases in advance. The integration lead owns the opportunity, and the plan records the expected schedule benefit and the date by which access is needed.

Integrate responses into plans and budgets

A response is not complete until its work is planned and resourced. Add approved actions to the relevant work packages, schedule, and team assignments. Estimate their labor, materials, procurement, and duration, and include the costs and activities in the appropriate project baselines or plans, following organizational approval and change-control rules.

Check dependencies and effects on scope, quality, and other objectives. Account for both the cost of acting and the potential cost of leaving the exposure untreated.

Where project budgeting rules allow, set aside a contingency reserve for uncertainty associated with identified risks. Define who may authorize its use and how use is recorded. A reserve does not replace planning actions, and it should not be counted twice as both ordinary planned work and contingency funding. If a response changes an approved baseline or exceeds delegated authority, obtain the required approval before incorporating the change.

Record and review the response plan

Record the strategy, actions, owners, triggers, contingency, estimated time and cost, and residual exposure in the risk register or an equivalent record. Review these items regularly: reassess risks, verify that actions are complete and effective, revise plans and estimates when circumstances change, and escalate decisions beyond the project’s authority.