Certified Associate in Project Management (CAPM)
Risk response strategies: avoid, share, retain or reduce
Once a risk has been evaluated against risk appetite, the Orange Book lists the options: avoid it, take or increase it to pursue an opportunity, retain it by informed decision, change its likelihood, change its consequences, or share it. The chosen treatment is then implemented, monitored and reassessed if the remaining risk is still too high.
The options
Avoiding the risk means deciding not to start or continue the activity that gives rise to it. Sharing the risk passes part of it to another party, for example through a commercial contract. Retaining the risk is an informed decision to keep it. Taking or increasing a risk is done to pursue an opportunity.
Changing the likelihood reduces the chance of the event. Changing the consequences reduces its effect, and the Orange Book places planning contingency activities under this option. A team that keeps an activity going and plans what to do if a supplier fails is changing the consequences, not the likelihood.
Choosing and planning a treatment
Choosing a treatment balances the benefit to objectives against the cost, effort or disadvantages of the action. The Orange Book says the plan should record why the option was chosen, the actions, who is accountable, the resources needed including contingencies, the performance and early-warning indicators, the constraints, the timing and how it will be reported.
Where appropriate, contingency, crisis, incident and continuity arrangements should be prepared and communicated in advance, so the organization can recover if the risk occurs.
When controls are not enough
Treatment is iterative. Plan and implement controls, assess how well they work, and decide whether the remaining risk is acceptable. If it is not, reassess the options and take further action.
Controls can fail to work as intended, and they can introduce new risks of their own. A second supplier added as a control may bring a new data-handling exposure; that exposure is managed as a new risk.
Monitoring runs before, during and after treatment. It should show whether and how the risk profile is changing and whether controls are working as intended.
Where the exam catches people
- Believing contingency planning reduces the likelihood of a risk: the Orange Book places it under changing the consequences.
- Believing avoiding a risk means ignoring it: avoidance means not starting or not continuing the activity that causes it.
- Believing remaining risk outside appetite is simply accepted: the team reassesses the options and takes further action.
- Believing a control cannot create risk: controls can introduce new risks that need to be managed.
- Believing sharing a risk removes it entirely: sharing, such as through a contract, passes part of the risk to another party.