To select strategies and define actions for addressing individual risks and overall project risk.
It answers:
What should we do about each risk?
Who will take ownership?
When and how will responses be implemented?
Risk Register (prioritized risks)
Risk Report (overall project risk)
Risk Management Plan
Project Documents:
Assumptions log
Cost and schedule estimates
Enterprise Environmental Factors (EEF)
Organizational Process Assets (OPA)
1. Strategies for Threats (Negative Risks)
Avoid
Eliminate the risk entirely
Example: Change scope or approach
Mitigate
Reduce probability or impact
Example: Add testing, improve design
Transfer
Shift risk to a third party
Example: Insurance, outsourcing, fixed-price contracts
Accept
Take no immediate action (active or passive)
Example: Use contingency reserves
2. Strategies for Opportunities (Positive Risks)
Exploit
Ensure the opportunity occurs
Example: Assign best resources
Enhance
Increase probability or impact
Example: Improve conditions for success
Share
Partner with others to realize opportunity
Example: Joint ventures
Accept
Take advantage if it occurs
Strategies for Overall Project Risk
Adjust project strategy
Rebalance scope, schedule, or cost
Increase contingency reserves
Change execution approach (e.g., agile vs predictive)
Expert Judgment - Input from experienced professionals
Data Gathering
Interviews
Brainstorming
Decision-Making Techniques
Cost-benefit analysis
Multi-criteria decision analysis
Interpersonal & Team Skills
Facilitation
Negotiation
Updated Risk Register
Includes:
Selected response strategies
Specific response actions
Risk owners
Trigger conditions (early warning signs)
Risk Response Plan
Detailed action plan for implementing responses
Change Requests
If responses require:
Scope changes
Schedule updates
Budget adjustments
Project Document Updates
Assumptions log
Lessons learned register
Project schedule and cost baseline