HKSM

Carrying out agreed actions to address threats and opportunities, integrating them into project work, and adjusting plans through change control so that overall risk exposure stays within acceptable limits.

Purpose & When to Use

• Turn planned risk responses into action to reduce threats and maximize opportunities.
• Activate responses when triggers occur or when scheduled as proactive actions.
• Use throughout delivery once responses are approved, especially after risk reviews or new risk identification.
• Keep overall risk exposure aligned with organizational risk appetite and thresholds.

Mini Flow (How It’s Done)

• Confirm each risk's owner, chosen response strategy, trigger conditions, and success criteria.
• Break the response into executable tasks; add them to the schedule or backlog with clear due dates.
• Secure resources and funding; if baselines are impacted, submit a change request and obtain approval before execution.
• Update the risk register with actions, owners, triggers, costs, and measures of effectiveness.
• Communicate responsibilities and timing to the team and stakeholders; align with procurement and vendors if applicable.
• Execute the response when conditions are met or as planned; use reserves according to pre-approval rules.
• Track effectiveness with agreed metrics; adjust or implement fallback if the response underperforms.
• Identify and manage any secondary or residual risks created by the response.
• For realized risks, log as issues and coordinate workarounds while pursuing planned responses or change control as needed.
• Update artifacts and reports; close responses once objectives are met and capture lessons learned.

Quality & Acceptance Checklist

• Response owner is named and accountable.
• Entry trigger and exit criteria are documented and understood.
• Tasks are integrated into the schedule or backlog with dependencies and resources assigned.
• Budget, reserves, and procurement actions are confirmed and available.
• Required change requests are approved and baselines updated before execution.
• Stakeholders are informed about actions, timing, and impacts.
• Effectiveness measures are defined, monitored, and recorded as evidence.
• Residual risk is within agreed thresholds or a new plan is in place.
• Secondary risks are identified, evaluated, and assigned for action.
• Risk register, issue log, status reports, and lessons learned are updated.

Common Mistakes & Exam Traps

• Confusing implement, plan, and monitor activities; implementation is about doing the actions, not selecting them or reviewing them.
• Executing changes that affect baselines without going through change control.
• Treating realized risks as risks instead of logging them as issues and acting immediately.
• Focusing only on threats and ignoring opportunity responses such as exploit or enhance.
• Failing to define triggers and owners, leading to missed or late activation.
• Ignoring secondary and residual risks created by the response.
• Escalating to leadership without documenting the response or following governance.
• Overlooking supplier or contract updates when responses rely on external parties.
• Exam trap: choosing to “update the risk management plan” when the question asks what to do next during execution; the right move is to carry out the approved response or raise a change request if baselines are impacted.

PMP Example Question

A risk trigger has occurred. The approved response adds testing tasks not included in the current baseline. What should the project manager do next?

1. Add the tasks to the schedule and start work to avoid delay.
2. Submit a change request to update the schedule and budget, then implement the response after approval.
3. Update the risk register and wait for the next risk review meeting.
4. Escalate the risk to the sponsor for direction.

Correct Answer: B — Submit a change request to update the schedule and budget, then implement the response after approval.

Explanation: If a response changes baselines, follow change control before execution. Only pre-approved actions within reserves can proceed without additional approval.