Risk response strategies for threats and opportunities, with examples

Risk response strategies for threats

Strategy	What it does	Example
Avoid	Removes the threat by changing the plan, scope or approach	Drop an untested technology and use a proven one
Transfer	Shifts the financial impact to a third party	Insurance, a fixed-price subcontract, a performance bond
Mitigate	Reduces probability, impact or both	Prototype early, add a second supplier, extra testing
Accept	Takes the risk knowingly; active acceptance funds a reserve, passive does nothing until it happens	Hold contingency for minor weather delays
Escalate	Passes the risk to the level that owns it, outside the project's authority	A regulatory change affecting several projects goes to the portfolio board

Transfer moves the money, not the risk itself. If the subcontractor fails, your schedule still slips. That is why transfer often needs a mitigation alongside it.

Risk response strategies for opportunities

Strategy	What it does	Example
Exploit	Makes sure the opportunity happens	Assign your most experienced team to finish a phase early and claim an early-completion bonus
Share	Partners with a party better able to capture it	A joint venture or a gain-share clause with a supplier
Enhance	Raises probability, benefit or both	Align order dates with another project to qualify for a bulk discount
Accept	Takes the benefit if it comes, without effort	Note a possible exchange-rate gain and move on
Escalate	Passes it to the level that can use it	A reusable component that another programme could adopt

The strategies mirror each other: exploit matches avoid, share matches transfer, enhance matches mitigate. The PMBOK Guide uses these names; PRINCE2 uses similar ones, such as reduce for mitigate and prepare contingent plans as a separate response.

Worked examples: is the response worth it?

A response is worth funding when the change in expected value it buys exceeds its cost. Use EMV = P × I before and after.

Mitigate a threat

A key supplier may fail to deliver: 40% chance, $50,000 impact. EMV before = 0.40 × $50,000 = $20,000. Qualifying a second supplier costs $6,000 and cuts the probability to 10%. EMV after = 0.10 × $50,000 = $5,000. Reduction = $20,000 − $5,000 = $15,000. Net benefit = $15,000 − $6,000 = $9,000. Fund it.

Transfer a threat

A 5% chance of $100,000 equipment damage has an EMV of $5,000. Insurance costs $3,000 with a $10,000 deductible. What you still carry is 0.05 × $10,000 = $500, so the total expected cost with insurance is $3,000 + $500 = $3,500, against $5,000 without. Insurance saves $1,500 in expected terms and, more importantly, removes a loss the project could not absorb.

Enhance an opportunity

A design simplification has a 30% chance of saving $20,000: expected benefit 0.30 × $20,000 = $6,000. Spending $2,000 on an early value engineering workshop raises the chance to 60%: expected benefit $12,000. Gain = $12,000 − $6,000 = $6,000. Net = $6,000 − $2,000 = $4,000. Fund it.

Expected value is not the only test. A response can be worth paying for even when its net EMV is negative, if it removes an outcome the project or organisation cannot survive.

How to choose between strategies

A simple order of questions works for most risks:

• Is the risk outside the project's authority? Escalate it, and confirm someone above has accepted it.
• Can a reasonable change to the plan remove it? Avoid it (or exploit, for an opportunity), as long as the change does not cost more than the risk.
• Is someone else better placed to carry the money? Transfer it (or share, for an opportunity), and check what remains with you.
• Can you cheaply cut probability or impact? Mitigate (or enhance), if the EMV reduction exceeds the cost.
• None of the above is worth it? Accept it, actively with a reserve and a fallback plan for larger risks, passively for small ones.

Strategies combine. A large threat might be partly transferred through a fixed-price subcontract, mitigated with early inspections, and the remainder accepted against contingency.

How to write a response that gets done

1. Name the strategy and the action. "Mitigate: qualify a second cable supplier", not "monitor closely".
2. Give it one owner and a due date. The action owner may differ from the risk owner.
3. Fund it. Put the response cost in the budget or draw it from contingency.
4. Define a trigger. The early warning that tells you a risk is about to occur, such as a missed factory slot.
5. Plan a fallback for high risks, in case the response fails.
6. Re-score the residual risk once the response is in place, and list any secondary risks the response creates (a second supplier brings its own quality risk).
7. Put the actions in the schedule so they compete for time like any other work.

Common mistakes

• "Monitor" as the default response. Monitoring is part of passive acceptance; say so honestly, or pick an action.
• Spending more than the risk is worth. Run the before and after EMV, as in the examples.
• Ignoring opportunities. Teams that only manage threats leave savings on the table.
• Treating transfer as removal. Contracts and insurance move money; schedule and reputation stay with you.
• Forgetting to escalate. If the project cannot act on a risk, holding it in the register only hides it.

For the wider process, from identification to monitoring, see the project risk management guide.

How to do this in Critova

In Critova every threat and opportunity in the risk register has an owner, a response and a due date, so open actions show up in the list, on the board by status and on the 5×5 matrix. Cost and schedule exposure with EMV sit on the same risk, which makes the before and after comparison easy to record. When a response changes the budget or the finish date, raise it as a change request so it is approved or rejected on the record. You can check any EMV first with the free risk score and EMV calculator.