Implement Risk Response

A response plan only has value once it's actually executed — this task is the hands-on follow-through on everything Domain IV's planning task produced. That means executing the risk response plans themselves, and separately executing contingency plans when a risk's trigger has actually occurred and the pre-planned backup response is now needed.

Implementation rarely goes exactly as scripted, so encouraging stakeholders to give feedback on how the response is actually landing keeps the team from executing a plan that's quietly failing. Every response action can also create new risk: a secondary risk is a new risk that arises directly as a result of implementing a response (the fix itself introduces a fresh problem), while a residual risk is what's left over after the response has been applied — the risk was reduced, not eliminated. Evaluating and reacting to both, improvising further when needed, closes the loop on response.

Study focus: secondary and residual risk are commonly confused. Secondary risk is caused by the response itself; residual risk is what remains of the original risk after the response has already been applied — one is new, the other is leftover.