Risk Response Planning and Treatment
Response strategies for threats
- Avoid – change the plan to eliminate the threat (e.g. choose a proven technology).
- Reduce/Mitigate – lower probability and/or impact (e.g. prototype testing, dual sourcing).
- Transfer – shift financial consequence to a third party (insurance, fixed-price contract, warranty). Note: transfer does not remove the risk, only the financial exposure.
- Accept – acknowledge and retain, either actively (with a contingency plan) or passively (no action).
- Escalate – outside the project's authority or tolerance; pass to a higher level.
Response strategies for opportunities
Exploit (ensure it happens), Enhance (increase probability/impact), Share (partner to realise it), Accept, and Escalate.
Planning and ownership
Each response needs a risk owner, actions, timing, and residual risk assessment (what remains after the response) and possibly secondary risk (a new risk created by the response). Responses should be proportionate, cost-effective and feasible - the cost of treatment should not exceed the expected benefit. Contingency plans and fallback plans cover what happens if the risk occurs or the response fails.
Traps
- Believing transfer removes risk entirely.
- Confusing mitigation (reduces likelihood/impact) with avoidance (removes the threat).
- Forgetting residual and secondary risk.
- Choosing a response that costs more than the exposure it addresses.
Worked example
A key supplier may go bankrupt (30% likelihood, £200k impact, EMV £60k). Reduce by dual-sourcing (cost £15k), then transfer residual financial exposure via contract terms. Residual risk is assessed after both actions; the £15k treatment is justified against £60k expected exposure.
Rule of thumb
Match the strategy to the risk: remove if you can, reduce if you must, transfer the financial part, accept the small remainder - and always reassess what is left.