Strategies for threats and opportunities

Risk response strategies are the options for dealing with risks. PMBOK separates strategies for negative risks (threats) and for positive risks (opportunities); one strategy, accept, is common to both.

Strategies for negative risks (threats)

1. Avoid: change the plan or scope to eliminate the threat or protect objectives from its impact. Example: drop a high-risk feature, use proven technology, clarify requirements.
2. Transfer: shift the negative impact and ownership of response to a third party; the risk is not eliminated. Example: insurance, performance bonds, warranties, fixed-price contract for outsourcing.
3. Mitigate: reduce the probability or impact to an acceptable threshold. Example: more testing, prototypes, simpler design, backup systems, training.
4. Accept: acknowledge the risk and take no action unless it occurs. Passive: do nothing; active: establish a contingency reserve or plan.

Strategies for positive risks (opportunities)

1. Exploit: make sure the opportunity definitely happens. Example: assign the best people to finish early and gain a bonus.
2. Enhance: increase the probability or positive impact by influencing its causes. Example: add resources to finish earlier.
3. Share: allocate ownership to a third party best able to capture the opportunity. Example: joint venture, partnership.
4. Accept: be willing to take the benefit if it occurs but do not actively pursue it.

Other strategies

• Contingency response strategies: plan used only if a trigger occurs.
• Fallback plan if contingency fails.

Risk -> Threat?  Avoid/Transfer/Mitigate/Accept
     -> Opportunity? Exploit/Share/Enhance/Accept

Example: A supplier delay threat is mitigated by using two suppliers; an opportunity of early completion with a bonus is enhanced by adding two developers.