HKSM

Select and agree on actions to address prioritized risks (threats and opportunities), assign owners, define triggers and budgets, and integrate those actions into the project plan and backlog.

Purpose & When to Use

• Decide how to address each prioritized risk so threats are reduced and opportunities are increased.
• Assign a clear risk owner and define specific actions, triggers, timelines, and success criteria.
• Integrate response actions into scope, schedule, cost, quality, procurement, and backlog plans.
• Use after risk analysis and whenever new risks appear, during iteration planning, phase gates, and major change requests.
• Apply in predictive, hybrid, and adaptive approaches; update iteratively as risk exposure changes.

Mini Flow (How It’s Done)

• Review prioritized risks and analysis results, including exposure, drivers, and interdependencies.
• Select a response strategy for each risk: for threats use avoid, mitigate, transfer, accept, or escalate; for opportunities use exploit, enhance, share, accept, or escalate.
• Define actionable tasks with owners, due dates, triggers, success measures, and any fallback or contingency plans.
• Estimate effort, cost, and schedule impact; compare options using cost–benefit or expected value.
• Plan reserves and buffers as needed, and prepare change requests to update baselines when required.
• Address secondary and residual risks created by the chosen responses and update the risk register or log.
• Integrate responses into the plan and backlog, update contracts or supplier terms if applicable, and align communications.
• Gain approvals per governance, communicate assignments, and set up monitoring indicators and review cadence.

Quality & Acceptance Checklist

• Each high-priority risk has a named owner, selected strategy, and specific actions.
• Triggers, monitoring indicators, and criteria for success are clear and measurable.
• Actions are scheduled, budgeted, and reflected in the plan, backlog, and reserves.
• Dependencies, secondary risks, and residual risks are identified and documented.
• Fallback or contingency plans exist for high-exposure risks, with activation conditions.
• Required approvals are obtained; change requests to baselines are submitted as needed.
• Procurement, contracting, and supplier terms are updated when responses rely on external parties.
• Stakeholder risk thresholds are respected and communication needs are addressed.
• Response effectiveness metrics and review cadence are defined.
• All updates are captured in the risk register and relevant plan components.

Common Mistakes & Exam Traps

• Ignoring opportunities; the process handles upside risks too.
• Not assigning a risk owner; without ownership, actions often do not happen.
• Confusing strategies: transfer is for threats, share is for opportunities; accept can be active (with contingency) or passive.
• Planning “workarounds” before a risk occurs; workarounds are for realized issues, not planned responses.
• Selecting escalation when the team has authority to act; escalate only when outside the project’s scope or control.
• Failing to integrate response actions into schedule, budget, contracts, and backlog, leaving them unfunded or unscheduled.
• Over-relying on insurance as “transfer” for non-insurable risks or non-financial impacts.
• Missing triggers and success criteria, making it hard to know when to execute or assess effectiveness.
• Not reassessing secondary and residual risks created by the selected responses.
• Skipping approvals for reserve or baseline changes required to implement responses.

PMP Example Question

After quantitative analysis, a supplier delay risk shows high exposure. The project manager wants to lower its likelihood and impact. What is the best response?

1. Qualify two suppliers and place an early order milestone with checks for lead-time variances.
2. Buy schedule delay insurance to cover potential liquidated damages.
3. Accept the risk and add it to the watchlist for ongoing observation.
4. Plan a workaround to be used if the supplier actually causes a delay.

Correct Answer: A — Qualify two suppliers and place an early order milestone with checks for lead-time variances.

Explanation: This is a mitigation approach that reduces probability and impact. Insurance (transfer) may not reduce delay, acceptance does not act, and workarounds address realized issues rather than planned responses.