What are the four 4 categories of risk response?

How to select a Risk Response Strategy? How to implement it in your risk management plan? Sounds complicated…

But let me simplify it for you in this article.

Risk Response Strategy is an action plan on what you will do a Risk on your project. The main risk response strategies for threats are Mitigate, Avoid, Transfer, Actively Accept, Passively Accept, and Escalate a Risk.

(Risk Response Strategy or Risk Response Plan is the same thing in essence. You can use terms interchangeably.)

Below you will find examples of risk responses for both threats and opportunities.

Chapter 1: Risk Response Strategies For Threats

First, you need to identify risks and log them into the Risk Register. Then, you need to conduct a Qualitative Risk Analysis. For the most severe threats, you’ll decide what Risk Response Strategy to select.

The main Risk Response Strategies are:

• Avoid Risk
• Mitigate Impact/Probability of a Risk
• Transfer Risk
• Actively Accept Risk
• Passively Accept Risk
• Escalate Risk

1. Avoid Risk Response Strategy

Avoid Risk Response Strategy means you need to do something to eliminate the cause of the threat.

#1.1 Example of Risk Avoidance in Scope Management

Clients and other stakeholders provide requirements for the project. Usually, they think that these requirements will help to achieve project’s business objectives.

Quite often, these requirements will pile up. Your project scope will bloat up, and you get beyond the constraints of time and budget.

When you get far beyond constraints, it’s obvious that you need to descope something or move deadlines. But sometimes you’ll find yourself in a situation when you barely fit into the constraints.

That’s when you need to log a risk that you don’t have any free reserves of time or budget (read buffer). If something goes wrong, you may fail to deliver on time.

At this point, you can develop a risk response strategy to remove a piece of the project scope. It will happen if, for example, you get behind schedule for more than ten days.

As you understand, this will help you control expectations. You warn stakeholders that risk may happen. They accept the action-plan. It will be easier to descope a requirement if something goes wrong.

#1.2 Example of Risk Avoidance in Leadership and Stakeholder Management

As a project manager and leader, you need to ensure that your team members are happy, motivated, and engaged in the project.

For sure, you can’t always get people who perfectly match with one another. Moreover, constructive conflicts within a team is a good thing.

However, sometimes conflicts may get beyond professional behavior. People may feel dissatisfied with the organization in general.

The problem is that negative behavior is both destructive and demotivating for other team members.

As much as possible, you need to try to mitigate the impact from conflicting team members. But sometimes nothing helps, and you go beyond the point of no return in your relationships.

In this case, you want to avoid Risks of further demotivation of the whole team by removing a conflicting person.

Likewise, you may have an authoritative stakeholder who conflicts with team members or with you. In this case, you’ll need to take measures to isolate the person as much as possible.

In most cases, it means you need to get into internal politics and find leverage through your leadership or policies.

#1.3 Example of Risk Avoidance that Impacts the Whole Project

Before I become a project manager, I was a sailor. I worked on a big container vessel once.

We were unloading in Amsterdam when the rain started. In a few minutes, we heard over the radio that someone fell from the fourth tier container (12 yards) on the deck.

Port authorities stopped the unloading. We called a helicopter to get this person to a hospital. In the end, unfortunately, the person died.

For sure, if something like this happens on your project, it will be a terrible hit. You must do whatever it takes to avoid such risks. In most cases, delays and extra costs are neglectable compared to the possible impact of a threat.

That’s why many industries forbid any work in bad weather to avoid the risk that someone gets hurt.

Risk Management Plan Template

(For Software Projects)

Most software project managers don’t know what goes into a Risk Management Plan. So, they simply don’t write it out. Unfortunately, this often leads to problems.
Get my template and use it as a starting point. In addition, you get access to all related risk management resources I have.
This template will eliminate the guesswork for you. With minor adjustments, you’ll be proud to present your risk management plan to the team and stakeholders.

Get The Template

2. Mitigate Impact/Probability of Risks

Mitigate Risk Response Strategy means you do something to reduce the impact or the probability of a threat.

#2.1 Example of Mitigation of Uncertainty

In the IT industry, we often create solutions that no one did before using technologies no one used this way before. Therefore, there’s a lot of uncertainty in such projects.

Is it even feasible to achieve the project’s objectives?

You don’t want to start full-blown development to discover that the cornerstone technology can’t provide the required functionality. To mitigate the risk such risk, we begin with a Prototype or a Proof of Concept.

It’s a Risk Response Strategy where we do a mini-project to:

• Create a minimal viable product.
• To test out the compatibility of different solutions.
• Check capabilities of new technologies.

This way, we try to guarantee the feasibility of at least 80% of the requirements.

It’s a quick and dirty implementation. It’s just a fraction of the budget and resources. And sometimes, we may need to do several POCs to select the most efficient approach. But still, it’s worth the investment.

This way we can also get early feedback from clients and adjust the requirement to the capabilities of the technologies we want to use.

#2.2 Example of Risk Mitigation in Procurement

Whenever you have a Third Party involved in a project – it’s a RISK.

There are many sources of risks here:

• The third party has a different project management approach.
• They have different quality standards.
• Their team is not in sync with your team.
• There’s a hard dependency on their deliverables.

And that’s just the tip of the iceberg.

You need to mitigate ALL possible risks from their side. But usually, you don’t have direct control over them.

That’s why here you need a mitigation Risk Response Strategy that provides you more information from the third party. You can request or even state it in the contract that:

1. They need to provide a weekly progress report.
2. Managers should participate in daily or weekly sync up meetings.
3. You can visit them at any time to audit the work.

This way, you can get early warnings about problems they have.

#2.3 Example of Risk Mitigation via Education

You can’t identify all the risks. But you should try to mitigate the possibility of an unexpected severe risk in the middle of the project.

The most efficient way to achieve it is by educating your project team and stakeholders in proper risk management activities.

Also, you need to create an environment where people are not afraid to report new risks as soon as possible even if they committed to finishing the work on time.

It’s much easier to avoid or mitigate a risk when you know about it in advance. Not when it already happened.

Examples of Negative Risks Responses in a Risk Register

You can learn more about Risk Register and get a templated in this in-depth guide:

Risk Register Example and All You Need to Know About It (+Template)

3. Transfer Risk Response Strategy

Transfer Risk Response Strategy means that you need to take action to make another party responsible for the risk.

#3.1 Example of Transferring Risks via Outsourcing

Imagine you work in a company that produces furniture. Your leadership decides that we need an e-commerce website and mobile applications to sell products. You were assigned to the project.

Now you are an IT Project Manager. Right away, there are huge sources of risks:

• You don’t have the expertise and engineers to start the project.
• There’s no infrastructure and practices to run a software development project.
• Your recruiters don’t have expertise in hiring developers, QAs, etc.

That is why many companies decide to transfer such risks to vendors with expertise, infrastructure, and human resources.

It doesn’t eliminate all related risks and often introduces new types of risks: procurement, third parties, etc. But most probably you have experience dealing with these types of risks.

We’ll talk about secondary risks below.

#3.2 Example of Transferring Cost Risks

Sometimes projects depend on a piece of costly machinery. Or you rent some equipment. Or you need to purchase and store lots of materials.

The risk is that you can’t afford to buy a new piece of machinery, equipment, or materials if something goes unexpectedly wrong.

Like in everyday life, you want to transfer such risks for a relatively small sum and buy insurance or extra technical support.

#3.3 Example of Transferring Risks Related to the Lack of Expertise

Sometimes you may get a project that goes into the knowledge domain where neither you nor your organization has enough expertise.

It’s not like you need to outsource a big part of the project. But you want to avoid risks related to procurement, accounting, or recruiting, for example.

In this case, you can try to transfer these risks to part-time or full-time experts. Hiring freelancers or a web design studio is an example of a transfer risk response strategy.

4. Actively Accept Risk Response Strategy

Actively Accept Risk Response Strategy means that you need to develop a (contingency) plan and make reserves for a risk. However, you will only act if and when the risk happens.

Feel the difference:

You don’t actively fight a risk. You react to it if it happens. But still, you prepare in advance.

In the real world you apply this type of response plan more often than other types.

But here’s the catch:

You can use the allocated reserves of time or money ONLY if the dedicated risk happens. If the risk doesn’t happen, you need to release the reserves and switch to the next set of tasks.

Why?

Thanks to Parkinson’s Law, work will always fill in all allocated time. Moreover, you want to control how accurate your risk analysis is. It may provide you insights into the risks that are yet to come.

#4.1 Example of Actively Accepting Risk with Reserve of Time

If you lead a long project, you always get through cold seasons when people catch a cold more often.

If you see that some critical due days fall into such seasons, you want to plan accordingly.

The simplest way is to allocate a week or two of time reserve to your schedule. Just put a buffer on the milestone.

#4.2 Example of Actively Accepting Risk with Reserves of Budget

Sometimes requirements are not clear, and dedicating more time to business analysis doesn’t help. So, if you have ambiguity in requirements but deadlines are set in stone – that’s a risk.

In this case, you want to get feedback from clients on want you created as soon as possible. For sure, feedback means changes in the requirements and some rework.

You may actively accept such a risk and reserve an additional budget for overtime for the team to make the required changes on time.

5. Passively Accept Risk Response Strategy

Passively Accept Risk Response Strategy means you’ll do really nothing. If a risk happens, you will need to decide if there is a workaround. Or you would simply soak up the impact.

#5.1 Example of Passively Accepting a Risk and Workaround

In the same example, when we have expensive machinery, we can proactively purchase insurance. In the case of passive acceptance, we won’t do that.

We may decide that if machinery breaks, we will either try to carry on without it. Yes, it may take more time and some manual labor. But it is possible that’s an acceptable workaround.

Likewise, we may decide to find funds to make repairs. It’s additional costs and will delay the work but, again, it might be OK.

6. Escalate Risks as a Risk Response Strategy

Escalate Risk Response Strategy means do something to get engagement from a stakeholder who can eliminate or mitigate risk.

There is a group of risks that you can’t handle.

However, there is a person who relatively easy can. So, you just need to reach him and get some of his attention.

Risk Management Plan Template

(For Software Projects)

Most software project managers don’t know what goes into a Risk Management Plan. So, they simply don’t write it out. Unfortunately, this often leads to problems.
Get my template and use it as a starting point. In addition, you get access to all related risk management resources I have.
This template will eliminate the guesswork for you. With minor adjustments, you’ll be proud to present your risk management plan to the team and stakeholders.

Get The Template

Chapter 2: Examples of Positive Risk Response Strategies (Opportunities)

Exploit – Do some extra work or change the project plan to make an opportunity happen:

1. Plan risky work packages for the most experienced team members.
2. Suggest a better approach to reduce the required efforts.
3. Suggest a solution to get a new contract from the client.
4. Finish the current project earlier to get another project.

Enhance – Do something to increase the chances or impact of an opportunity:

1. Buy the equipment beforehand when the price is lower.
2. Negotiate the transfer of exceptional expert to your team as early as possible.
3. Promise incentives to the team to finish a project beforehand to start a new one.

Share – Share benefits with another party for an opportunity to happen for both of you.

• Create a partnership with a third party to achieve your goals.

You can Actively and Passively Accept opportunities as well as threats.

Chapter 3: All You Need to Know About Risk Responses on a Project

Should You Create Risk Response Plans for All Known Risks?

Should we really do something with each risk?

No, you cannot eliminate all the risks. It is barely possible, and for sure it is unpractical.

You do need to operate within your constraints of budget, time, and scope.

You may have a specific budget for risk management.

What is a Risk Response in Your Project Management Plan?

You need to understand this:

Your risk management efforts are a part of your project.

It is not something standalone.

Risk Response Plans may require:

1. Updating Project Scope: adding or removing deliverables, work packages, tasks.
2. Updating Project Budget: adding reserves, allocating money for additional work, resources, expertise.
3. Updating Schedule: starting work on specific dates, adding reserves of time to critical tasks.
4. Introduce new processes and workflows.
5. Hiring a particular expert, consultants.
6. Outsourcing part of the Project Scope to a third party.

Here’s the catch:

You plan risk responses later during project planning.

But!

So, you do need to update the required areas of the Project Management Plan with the planned responses.

It should be clearly depicted in your plan.

Every Risk Response Has Consequences

Here is another important concept. Every action has consequences. Therefore, by eliminating one risk quite often, you can introduce new ones.

There are two types of risks you need to be aware of:

1. Secondary Risks – any new risks created by the implementation of a risk response plan.
2. Residual Risks – these are the risks that remain after implementation of all risk response plans. They should be appropriately documented and communicated to stakeholders. Since you will do nothing with these risks.

How to Implement a Risk Response Strategy?

First of all, you need to identify the top risks that warrant a response.

Next, you need to work with your team and stakeholders to develop possible options for risk responses for each risk.

It means that each risk will require either some extra work, some action or decision, or reserves of time and money.

It will help you to know risk tolerance and thresholds to develop the most appropriate responses.

Then you need to communicate these options to sponsor, customer, and some key stakeholders. You may need to get their approval. At least you must inform them.

Once everyone agrees to the suggested risk response plans, make them a part of your project management plan.

“The key benefit of this process is that it addresses the risks by their priority, inserting resources and activities in budget, schedule and project management plan as need.” – PMBOK Guide.

Now you need to review the plan and identify secondary and residual risks.

You may need to repeat the whole risk management process several times until you get a satisfactory plan.

What is a Risk Owner’s Role in the Risk Response Plan?

Remember this:

You don’t control all Risk Response Plans personally.

You must assign an Owner to each risk.

You actually put the owner’s name (and contacts) into the Risk Register.

This person should monitor the risk.

Sometimes the risk may start impacting your project sooner than you anticipated. Sometimes you may underestimate the risk in general.

So, the owner keeps the assigned risk at the top of the mind.

When the time comes, the owner implements or controls the implementation of a Risk Response Plan. To some degree, you do it as well – but on a higher level.

He or she also controls and reports to you the efficiency of the strategy. If something goes wrong, these problems should be escalated to you.

It’s totally fine if one person owns several risks. But ensure that all those risks don’t happen at the same time. Otherwise, the person will be overwhelmed.

Conclusion

That is all for today. It was not too hard, I believe.

This approach gives a limited number of options. Nevertheless, it provides a robust framework to deal with risks. So you don’t need to invent the wheel.

I Also Recommend Reading:

• Featured Article: Risk Management Process Explained (+resources, templates)
• Next in the series: Risk Identification (What is it, techniques and examples)
• Previous in the series: How to Perform Qualitative Risk Analysis for the First Time

Risk Management Plan Template

(For Software Projects)

Most software project managers don’t know what goes into a Risk Management Plan. So, they simply don’t write it out. Unfortunately, this often leads to problems.
Get my template and use it as a starting point. In addition, you get access to all related risk management resources I have.
This template will eliminate the guesswork for you. With minor adjustments, you’ll be proud to present your risk management plan to the team and stakeholders.

Get The Template