4.2Selecting risk response strategies

Once risk analysis is complete, the PM's work is not done. What comes next is choosing the optimal response strategy according to each risk's nature (probability, impact, response cost), and anticipating whether that response creates new risk or how to handle risk that remains after the response. Threats and opportunities call for strategies pointed in opposite directions to begin with, and even the same-sounding idea of "reducing" a risk means something different for a threat versus an opportunity (enhancing it). This section covers choosing among response strategies with cost-effectiveness as the central judgment axis, and preparing for the secondary risk a response can introduce.

4.2.1The four threat response strategies

• Avoid removes the cause of the risk itself, reducing the probability of the threat occurring to zero (for example, dropping a high-risk task from the plan, or switching to a certain alternative procurement route). It offers the highest certainty but often comes with scope reduction or substitution cost. Transfer shifts responsibility for the risk's impact to a third party (for example, an insurance contract, a contract with warranty clauses, or outsourcing); note that the risk itself does not disappear—only the party bearing it changes.
• Mitigate lowers the probability or impact to an acceptable level (for example, prototype validation, adding redundancy, or strengthening the test phase)—a balanced option that is less certain than avoidance but reduces the risk to a manageable level while holding down cost. Accept takes on the impact if the risk materializes, without spending on a response, and splits into active acceptance (setting aside a contingency reserve in advance) and passive acceptance (dealing with it as it arises, case by case).

4.2.2The four opportunity response strategies

• Exploit drives the probability of the opportunity occurring as close to certain (100%) as possible, mirroring "avoid" on the threat side (for example, securing top talent to reliably finish ahead of schedule). Share allocates ownership of the opportunity to a third party better positioned to capture it, splitting the benefit, mirroring "transfer" on the threat side (for example, partnering with a technically strong company and dividing the resulting gains).
• Enhance increases the probability of the opportunity occurring, or the size of its favorable impact, mirroring "mitigate" on the threat side (for example, adding resources to raise the likelihood of finishing ahead of schedule). Accept (opportunity) takes the benefit if the opportunity materializes without spending on actively pursuing it, mirroring "accept" on the threat side. The key point is that threats and opportunities merely point in opposite directions—the response strategies map one-to-one between the two.

4.2.3Secondary risk, residual risk, and contingency plans

• Secondary risk is a new risk that arises as a result of implementing a response to an original threat (for example, transferring work via outsourcing can introduce a new risk of inadequate quality control at the vendor). When choosing a response, the PM must evaluate not only how well it mitigates the original risk but also whether the response itself introduces a secondary risk. Residual risk is the risk that remains within an acceptable range even after a response has been implemented.
• A contingency plan is a pre-prepared response that is activated only when a specific, predefined risk event (a trigger condition) actually occurs. Clarifying the trigger condition in advance lets the team respond immediately and without hesitation once the risk materializes. The budget set aside for contingency plans is the contingency reserve, held for known risks whose individual response is not yet finalized (a separate pool from the management reserve, held for unknown risks).

Suppose a PM is weighing a response to the threat that only one staff member is proficient in the project's primary development language, and development would halt if that person left (probability: medium, impact: severe). Three candidates: Option 1 outsources the development entirely to an external vendor (transfer); Option 2 trains up an additional staff member to distribute the knowledge (mitigate); Option 3 does nothing and, if the person leaves, scrambles to hire mid-career (accept). Examining Option 1 first: the in-house staffing risk indeed shifts to a third party, but the risk itself does not disappear—the vendor's own staff carry a similar attrition risk—and new secondary risks of contract management and quality assurance arise. Option 3 incurs no response cost, but if the departure actually occurs, the impact (a halt to development) is severe, emergency hiring is not guaranteed to succeed, and the response arrives too late. Option 2 costs money to train the additional staff member, but it lowers the probability itself by distributing knowledge across multiple people, and its secondary risk is small—the best choice on a cost-effectiveness basis. What matters further in practice is that even after implementing Option 2, a residual risk remains (for example, the period during which the trainee has not yet reached a fully substitutable level), and a contingency plan should be separately prepared with a concrete trigger condition (for example, "if the key staff member actually announces intent to leave, immediately secure a handover period and bring in outside expertise on an interim basis"). Choosing a response strategy and preparing a contingency plan are not mutually exclusive alternatives—the standard practice is to choose a primary strategy (mitigate) while layering a contingency plan as insurance against the residual risk that remains.

4.2.4Section summary

• Threat = avoid/transfer/mitigate/accept, opportunity = exploit/share/enhance/accept, mapped one-to-one and chosen on cost-effectiveness
• Transfer only changes who bears the risk—the risk itself remains—so the PM must evaluate whether the response introduces a new secondary risk
• The residual risk remaining after the primary strategy is layered with a trigger-based contingency plan as further preparation