Use One of Five Strategies for the Risk Response

You should create a risk response for all “high” risks. There are a number of options that the project manager should consider for responses.

• Leave it.
  In this approach, the project manager looks at a high risk and decides to do nothing. This can happen for one of two reasons. First, the project manager may feel that the risk should be managed, but that the cost and effort of managing the risk is more than the impact of the risk event itself. In this case you would rather deal with the costs of the risk occurring that the cost of trying to manage the risk. The risk event has some probability of occurrence, which means that it is possible the event will not happen anyway.

• Second, there may not be any reasonable and practical activities available to manage the risk.
  This is different from the prior reason where the cost was more than the benefit. In this case, there is no practical way to manage the risk, even if the risk has been identified as high. For instance, it is possible that there is a risk of your sponsor leaving and a new sponsor canceling the project. However, you may not be in a position to do much about it as long as the current sponsor is in place, and you may just need to leave it and see how events play out.

• Monitor the risk.
  In this case, the project manager does not proactively manage the risk, but monitors it to see whether it is more or less likely to occur as time goes on. If it looks more likely to occur later in the project, the team must formulate a different response at a later time. This is a good approach if you have identified a risk that should be managed, but the risk event is far off in the future. For instance, if your risk event is nine months in the future, it may not make sense to spend resources to manage the risk at this time. A better approach might be to monitor the risk on a monthly basis. It is possible that over time the risk will go away because of other circumstances. However, if it does not go away, the team will still need to manage the risk in the coming months.

• Avoid the risk.
  Avoiding the risk means that the condition that is causing the problem is eliminated. For example, if you find that a part of the project has high risk associated with it, that whole part of the project can be eliminated. The risks associated with a particular vendor, for instance, might be avoided if another vendor is used instead. This is a very effective way to eliminate risks but obviously can be used only in certain unique circumstances. In another example, you may have a project risk associated with implementing a solution in multiple locations. Once the risk is identified, the sponsor may change the scope of the project to only implement in one location. In this way, the risk of implementing at multiple locations has been avoided.

• Move the risk.
  In some instances, the responsibility for managing a risk can be removed from the project by assigning the risk to another entity or third party. For instance, you may identify a risk associated with a new technology. Outsourcing the function to a third party might eliminate that risk for the project team. The risk event is still there, but now some other entity is dealing with it. The third party might have particular expertise that allows them to do the work without the risk. Even if the risk is still present, it now is up to another party to resolve.

• Mitigate the risk.
  In most cases, this is the approach to take. Mitigating the risk means that you put in place a set of proactive steps to minimize the likelihood that the risk will occur. If possible you could eliminate the risk by minimizing the likelihood down to zero percent. Another purpose of mitigation is to ensure that if the risk occurs, the negative impact of the risk is minimized. In many cases it may not be possible to totally eliminate a risk event, but given that you have time to prepare, you should be able to minimize the probability of the event occurring, or minimize the impact to the project if the risk event does occur.

These are typical risk responses for negative risks.

Think of Positive Risk as a Way Gain Benefit

Risk is usually associated with potential events that have a negative impact on the project. However, there is also a concept of opportunity risk or positive risk. In these instances, the project manager or project team may introduce risk to try to gain a benefit. For instance, a team may decide to utilize a new technology on its project because they think it will result in dramatic effort and cost savings. Of course, there is also a chance the new technology will not work. However, the team introduces the risk because the potential for gain. This is an example of intelligent risk taking or positive risk.