Choose and monitor responses

What you will understand

• Distinguish the version 7 risk response categories.
• Explain residual risks and risks introduced by responses.
• Apply identify, assess, plan, implement and communicate as continuing activities.

The idea

A risk register filled with proposed actions is not evidence that risks are controlled. Someone must choose an appropriate response, obtain the required authority and resources, carry it out and monitor the result. The response should suit the uncertainty and the value at stake. Removing every risk is neither possible nor necessarily a sensible use of resources.

Avoiding a threat changes the situation so that the threat no longer applies. Reducing a threat changes its likelihood or negative impact without necessarily removing it. For opportunities, exploiting takes action to make the opportunity happen, while enhancing increases its likelihood or positive impact. Classify the response by what it actually changes, not by whether the plan sounds proactive. Paying for training that lowers error rates reduces a threat; it does not prove the threat has been avoided.

Transferring passes some aspect of the risk to another party through an appropriate arrangement. Insurance can transfer a defined financial consequence, but it cannot guarantee that a delayed service will open on time or that reputation is protected. Sharing uses an agreed arrangement in which parties share relevant gains or losses. Neither category means that the project’s overall accountability disappears or that an unsuitable commercial agreement should be accepted without assessment.

Accepting is a conscious decision to retain the uncertainty, with monitoring rather than a proactive action to change it. Version 7 uses accept for risks and includes preparing contingent plans as another response category. A contingent plan defines action to take if an agreed event or trigger occurs, rather than carrying out the response immediately. It needs an owner, a usable trigger and any necessary resources. Ignoring a risk without assessment or ownership is not informed acceptance.

Assess what remains after a response: this is residual risk. A response can also introduce secondary risks. Buying a spare machine may reduce the impact of breakdown while creating a storage or maintenance risk. Compare the cost and feasibility of the response with the changed exposure, consider effects across objectives and obtain appropriate funding, including any agreed risk budget. A planned response that itself forecasts a tolerance breach requires escalation rather than automatic implementation.

The risk technique links identifying context and risks, assessing them, planning responses and implementing those responses. Communication continues across the work rather than being postponed until all analysis is finished. Reassess after action and as evidence changes; include both individual risks and their combined effect. Encourage people to raise uncertainty early, challenge optimism and other biases, and use relevant data while acknowledging its limits. A response is complete only as an action; the risk may still need monitoring.

For recall, the risk technique connects identify, assess, plan and implement, with communicate continuing throughout. Identify includes understanding the context and recognising uncertainty. Assess examines individual risks and their combined effect. Plan chooses suitable responses; implement assigns and carries out agreed actions and checks their effect. Keep communicating as the position changes rather than treating communication as a single final message.

Match the response to the uncertainty

Points to remember

• Avoid and reduce concern threats; exploit and enhance concern opportunities.
• Version 7 also includes transfer, share, accept and prepare contingent plans.
• Communication and reassessment continue throughout risk management.

Your takeaway

Choose responses for their actual effect, assign and fund them, then evaluate the changed exposure. Distinguish informed acceptance from neglect and contingent preparation from an action that is carried out immediately.