Plan Risk Response

Response planning puts a concrete plan behind every risk that's been identified and analyzed. For threats, the named strategies are avoid (eliminate the cause entirely), mitigate (reduce probability or impact), transfer (shift the risk to a third party, such as through insurance or a different contract structure), and accept (take no proactive action, sometimes backed by a contingency reserve). For opportunities, the mirror strategies are exploit (make the opportunity happen), enhance (increase its probability or impact), share (partner with a third party to help capture it), and accept.

Choosing a strategy isn't the end of the task — response actions need to be time-bound, with a clear owner assigned, and their likely effectiveness assessed against both the original strategy and the actual impact on project objectives like cost, schedule, or environment. PMI names specific tools for illustrating and communicating that effectiveness — a risk burndown chart (tracking how total risk exposure decreases over time) and dot plots. When a planned response genuinely won't work in the moment, determining a workaround — an unplanned, improvised response to an emerging issue — and re-evaluating organizational risk as new information comes in are also part of this task.

Study focus: a workaround is explicitly unplanned — it's what gets improvised when a predetermined response doesn't fit the situation as it's actually unfolding. Don't confuse it with a contingency plan, which is prepared in advance for a known risk that has triggered.