Business Environment · Topic 6 of 8
Risk Responses and Monitoring
Choose responses for threats and opportunities, use contingency plans, fallback plans and reserves, separate residual and secondary risk, and monitor risk.
- 4 min
- Includes a diagram
- Threat strategies: avoid, transfer, mitigate, accept and escalate.
- Opportunity strategies: exploit, enhance, share, accept and escalate.
- Transfer shifts impact to another party but does not remove the risk.
What it is
After risks are analyzed, the team decides what to do about them. A risk response is an agreed action that changes the exposure to a threat or opportunity. Monitoring then checks whether the responses work, whether new risks have appeared, and whether the risk picture has changed.
Responses must be proportional to the risk. The cost of a response should be less than the exposure it removes.
How it works
Strategies for threats
| Strategy | Meaning | Example |
|---|---|---|
| Avoid | Remove the threat or protect the project from it | Drop a risky feature, change the approach |
| Transfer | Shift the impact and ownership to a third party | Insurance, warranty, fixed price contract |
| Mitigate | Reduce probability or impact | Extra testing, prototype, redundancy |
| Accept | Take no action, now or later | Passive acceptance, or a contingency reserve (active) |
| Escalate | Hand to a higher level when outside the project's authority | Risk affecting several projects |
Transfer moves the burden but does not remove the risk. The transferred party usually charges a fee, such as an insurance premium.
Strategies for opportunities
| Strategy | Meaning | Example |
|---|---|---|
| Exploit | Make sure the opportunity happens | Assign the best people to finish early |
| Enhance | Raise the probability or impact | Add resources to a promising feature |
| Share | Partner with another party who can capture it | Joint venture |
| Accept | Be ready to benefit if it occurs | Take it if it happens, without chasing it |
| Escalate | Pass to a higher level | Benefit crosses project boundaries |
A memory aid is that the opportunity strategies mirror those for threats: exploit mirrors avoid, enhance mirrors mitigate and share mirrors transfer.
Contingency and fallback plans
A contingency plan is a response prepared for use if a trigger occurs. A trigger is an early warning sign, such as a supplier missing a milestone. A fallback plan is a backup that applies if the first response fails.
Contingency reserve in time or money pays for actions in these plans.
Residual and secondary risks
Residual risk is what remains after a response. Secondary risk is a new risk created by the response itself. Both are recorded in the register, assessed and, if needed, given their own responses.
For example, buying a warranty (transfer) may leave a residual risk that the claim is refused, and adding a second supplier (mitigate) may create a secondary risk of integration difficulty.
Owners and workaround
Each response needs a named risk owner and a clear action. If a risk occurs that nobody planned for, the team uses a workaround. If a risk occurs and was planned for, the contingency response is triggered.
Monitoring risks
Regular risk reviews check whether risks are still valid, whether triggers have appeared and whether responses work. Techniques include audits, reserve analysis, status meetings and technical performance measurement. The register is updated with new risks, closed risks and changed scores.
Agile and hybrid approaches
Agile teams handle risk through short feedback loops, early delivery of risky items and open discussion in planning and retrospectives. Responses often become backlog items. In hybrid projects, a project level register covers cost, contract and regulatory risks while teams manage technical risk in sprints.
Communicating about risk
Stakeholders need to know about the key risks, the owners and the planned responses. Report trends and new high priority risks, not just a list.
To find the right strategy, ask whether you want to eliminate, move, reduce or live with the threat. Those map to avoid, transfer, mitigate and accept.
What to remember for the exam
- Threat strategies: avoid, transfer, mitigate, accept and escalate.
- Opportunity strategies: exploit, enhance, share, accept and escalate.
- Transfer shifts impact to another party but does not remove the risk.
- A trigger is an early warning that a risk may occur.
- A contingency plan is used if a trigger occurs, and a fallback plan applies if the first response fails.
- Residual risk remains after a response, and secondary risk is created by the response.
- A workaround is unplanned and used for unplanned risks that occur.
- Contingency reserve pays for planned risk responses.
- Every risk needs an owner, and the register is reviewed regularly.
Common mistakes
Calling insurance mitigation. Insurance transfers the financial impact and does not reduce the probability.
Mixing up contingency and fallback. Contingency is the planned response, and fallback is the backup if it fails.
Forgetting secondary risks. Responses often introduce new problems.
Choosing a costly response for a minor risk. The response must be worth its cost.
Treating accept as ignore. Acceptance is a conscious decision, usually with a reserve.
Do not confuse residual and secondary risk, because residual risk is what is left over, while secondary risk is newly created by the response.
Check yourself
Which response shifts a threat's impact to a third party?
Transfer, such as insurance or a fixed price contract.
Name the opportunity strategy that mirrors avoid.
Exploit.
What is a secondary risk?
A new risk that arises as a direct result of implementing a risk response.
Topic 6 of 8 in Business Environment
Test yourself on Business Environment
The full PMI PMP question bank has 1,463 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by PMI. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.