Planning and implementing risk responses

Analysis tells the team which risks matter; response planning decides what to do about them. This lesson covers the strategies for threats and opportunities, how to choose among them using cost and residual exposure, contingency and fallback plans, residual and secondary risks, ownership, and the step many projects skip: actually implementing the agreed responses and building them into the plan, budget and schedule. Responses for Project Compass's main risks are developed along the way.

Response strategies

Responses should be appropriate to the significance of the risk, cost-effective, realistic within the project context, agreed by the relevant stakeholders and owned by a named person. There are five strategies for threats and five for opportunities. Two of them, escalate and accept, apply to both; the other three are mirror images.

Transfer deserves a closer look because candidates often overestimate it. Transferring a threat moves the financial consequence and the responsibility for managing it, but rarely removes the risk itself. If a contractor is responsible for delays under a fixed-price contract, the project still suffers if the contractor is late; it simply has a claim against the contractor. Transfer also costs money: insurance premiums, a higher price for a fixed-price contract or a risk premium in a warranty. Lessons 7 and 8 return to this when contract types are compared.

Escalation is appropriate when a risk sits outside the project's scope or the proposed response exceeds the project manager's authority. The escalated risk is then owned at program, portfolio or organizational level, and the project usually stops monitoring it in detail, though it records the escalation. On Project Compass, the team learned that the mall owner might sell the property, which could change lease terms for the branch for years to come. That is a matter for the library's facilities committee, not the fit-out project, so the project manager escalated it with a short note and removed it from active monitoring in the project register.

Choosing a response

For significant risks, the team compares options on the cost of the response, the residual exposure after the response, and side effects such as new risks or schedule changes. The cheapest option on paper is not always best, but a response that costs more than the risk it addresses needs a good non-financial reason.

# Choosing a response: compare residual exposure and response cost for three risks ($000)
# Each option: (description, response cost, new probability, new impact)
options = {
 "R05 one electrician crew (P 0.35, delay cost 90)": [
    ("Accept", 0, 0.35, 90),
    ("Mitigate: book a second crew for rough-in weeks", 14, 0.10, 60),
    ("Avoid: switch to prefabricated wiring harnesses", 38, 0.02, 40)],
 "R07 kiosk firmware failures (P 0.30, impact 45)": [
    ("Accept", 0, 0.30, 45),
    ("Transfer: on-site vendor support clause in contract", 6, 0.30, 12),
    ("Mitigate: four-week soak test before opening", 9, 0.12, 45)],
 "R09 joint tag order discount (P 0.50, benefit 18)": [
    ("Accept (take it if it happens)", 0, 0.50, 18),
    ("Share: joint order with the Northside branch", 2, 0.90, 18),
    ("Exploit: commit the order now with a partner", 4, 1.00, 15)],
}
for risk, opts in options.items():
    print(risk)
    sign = 1 if "benefit" in risk else -1
    for desc, cost, p, impact in opts:
        net = sign * p * impact - cost
        print(f"   {desc:52s} cost {cost:3d}  residual EMV {sign * p * impact:+6.1f}  net {net:+6.1f}")

R05 one electrician crew (P 0.35, delay cost 90)
   Accept                                               cost   0  residual EMV  -31.5  net  -31.5
   Mitigate: book a second crew for rough-in weeks      cost  14  residual EMV   -6.0  net  -20.0
   Avoid: switch to prefabricated wiring harnesses      cost  38  residual EMV   -0.8  net  -38.8
R07 kiosk firmware failures (P 0.30, impact 45)
   Accept                                               cost   0  residual EMV  -13.5  net  -13.5
   Transfer: on-site vendor support clause in contract  cost   6  residual EMV   -3.6  net   -9.6
   Mitigate: four-week soak test before opening         cost   9  residual EMV   -5.4  net  -14.4
R09 joint tag order discount (P 0.50, benefit 18)
   Accept (take it if it happens)                       cost   0  residual EMV   +9.0  net   +9.0
   Share: joint order with the Northside branch         cost   2  residual EMV  +16.2  net  +14.2
   Exploit: commit the order now with a partner         cost   4  residual EMV  +15.0  net  +11.0

For R05, the single electrician crew, accepting the risk leaves an expected exposure of $31,500. Booking a second crew for the rough-in weeks costs $14,000 and cuts the exposure to $6,000, a net of −$20,000, which is the best of the three. Switching to prefabricated wiring harnesses nearly eliminates the risk but costs more than it saves. The team chooses to mitigate.

For R07, kiosk firmware failures, a contract clause requiring the vendor to provide on-site support during opening week and to bear the cost of firmware defects costs about $6,000 in a higher price but reduces the library's exposure to $3,600. A soak test would also reduce the risk but costs more. The team chooses to transfer the financial impact through the contract, while noting that patrons would still notice a failing kiosk, which is why lesson 10 returns to this risk.

For R09, the joint tag order, sharing the opportunity with the Northside branch, which also needs tags, raises the chance of qualifying for the volume discount to about 90 % for $2,000 of coordination effort. Exploiting it by committing the whole order now with a partner guarantees the discount but at a lower value, because the order would have to be placed before the Eastgate quantities are firm. Sharing has the best expected net value, and the procurement lead owns it.

R03 shows that a response can be partial. The early fixed-price order protected against the supplier's own price increases, but the supplier's terms passed tariff surcharges through to the buyer, and the library accepted those terms. That residual exposure was recorded, and lesson 6 shows what happened when tariffs were imposed. Reading the contract terms carefully is part of judging whether a transfer response really transfers anything.

Contingency and fallback plans

Some responses are prepared in advance but carried out only if certain events occur. A contingency response (or contingency plan) is executed when a defined trigger occurs. The paid moving crew for R08 is an example: if fewer than 40 volunteers have confirmed two weeks before the move, the crew is called in. A fallback plan is used if the primary response, or the contingency plan, fails or proves inadequate. If the second electrician crew booked for R05 falls through, the fallback is to resequence work so that data cabling, which uses a different trade, proceeds first, accepting a smaller delay.

Triggers make contingency responses work. A good trigger is specific, observable and early enough to allow the response to take effect. "If the permit looks late" is not a trigger; "if the city has not issued comments by day 25 of the review" is. Triggers are recorded in the risk register with the response and the person who will act.

Residual and secondary risks

A residual risk is the risk that remains after a response has been implemented. Even with a second crew booked, R05 has a residual probability of about 10 %. Residual risks are recorded, and contingency is sized for them. A secondary risk is a new risk that arises directly from implementing a response. Booking a second electrician crew creates the secondary risk of two crews working in the same area and getting in each other's way, with safety and productivity effects; the fit-out lead plans separate zones and staggered shifts to manage it. Exam questions often describe a response and ask what to call a new risk it creates: that is a secondary risk.

Responses to overall project risk

Responses can also target overall project risk, the combined uncertainty that lesson 4 quantified. The same strategy names apply at a higher level. Avoiding overall risk might mean reducing scope substantially or, in extreme cases, cancelling the project. Exploiting overall opportunity might mean adding high-benefit scope. Transferring overall risk might mean changing the delivery model, for example to a design-build contract. Mitigating it might mean re-planning with more float, adding resources or using proven technology. Accepting it means proceeding with the current plan and an appropriate reserve. For Project Compass, the board accepted the overall cost risk with a 5 % management reserve and asked for early warning, and the project manager mitigated it by firming up the construction estimate, the largest driver identified by the tornado diagram, through a more detailed contractor price before the baseline was finalized.

Implementing responses

A risk register full of agreed responses that nobody carries out is common and useless. The task of implementing responses means that owners carry out what was agreed, at the right time, and that responses become part of the project plan. Responses that need work are added to the WBS, schedule and budget: the ceiling survey becomes an activity in the design phase with its own cost, and the second electrician crew is added to the resource plan. Responses that change contracts go into the procurement documents. Responses that change the baselines after they are approved go through integrated change control (lesson 11).

The project manager's role is to make sure that owners understand their responses, have the authority and resources to act, and report status. At each risk review, the question is not only "has anything changed?" but also "have the agreed actions been done?". On Project Compass, the pre-application meeting with the city happened on schedule, but the submission checklist was only half complete when the permit application went in; lesson 6 shows the consequence.