Risk Response Implementation
Choosing, agreeing, and actually doing it
Response planning selects a strategy per risk, then converts it into funded, scheduled, owned action. Threat strategies: avoid (change the plan to eliminate the threat), transfer (shift financial consequence, e.g., insurance, warranty, fixed-price contract), mitigate (reduce probability or impact), accept (active acceptance funds a contingency; passive acceptance monitors), and escalate (the risk sits outside the project's authority). Opportunity strategies mirror these: exploit, share, enhance, accept, escalate.
Every accepted response needs an owner who agrees to it, an action plan, a trigger, and a place in the schedule or budget. Contingency and fallback plans are written before the trigger fires. Responses often spawn secondary risks (new risks created by the response) and leave residual risks (what remains after the response) - both return to the register for analysis.
Traps: assuming transfer eliminates the risk (reputation and schedule exposure usually remain); confusing active with passive acceptance; escalating a risk that is within the project's authority; costing a response that exceeds the exposure it removes; treating a documented response as implemented when no one has been assigned or funded.
Rule of thumb: a response is real only when it has an owner, a date, and a funding source.
Worked example: integration failure risk, 40% x $80,000 = $32,000 EMV. A prototype costing $8,000 cuts probability to 15%: new EMV $12,000. Net benefit is $32,000 - $12,000 - $8,000 = $12,000, so mitigation is justified.