risk response

Also called: avoid, transfer, reduce, accept, risk mitigation, risk responses

What the project decides to do about a risk: avoid it by changing the plan, transfer it to someone better placed (an insurer or a contract), reduce its probability or impact, accept it with a reserve, or escalate it to the sponsor when it is beyond the project's authority. A response that breaks the law, safety or data-protection rules is not an option.

A risk response is what the project decides to do about a risk before it happens. There are five useful moves. Avoid: change the plan so the risk can no longer happen (drop the dependency, choose another route). Transfer: move the impact to someone better placed to carry it, usually through a contract or insurance; note that transfer moves money, not lost days. Reduce: lower the probability or the impact, for example by starting earlier, adding a parallel check or preparing a fallback. Accept: live with it, often with a reserve of time or money set aside and a trigger to watch. Escalate: when the response needs authority the project lead does not have, hand it to the sponsor with a recommendation.

Each response has a cost, so the choice depends on the exposure and on how bad the worst case is. A cheap reduction is worth doing even for a medium risk; an expensive avoidance makes sense only when the risk could stop the project. Accepting is a legitimate choice when it is deliberate: written down, with a reserve and an owner who watches the trigger.

Opportunities, the uncertain events that would help, get the mirror moves: make them happen, make them more likely, share them with a partner who can use them better, or accept them if they come.

Some "responses" are never options. A response that breaks the law, labor rules, safety or data protection (a payment to someone at a partner company, letting people work before their contracts are signed, skipping consent for recordings) does not remove a risk; it creates a new and larger one for the people affected and for the organization.

Example

For Klasna's physics launch the team picks one response per top risk:

Risk	Response	Move
Illustrator late with diagrams	Vira draws the simple diagrams for topics 1–8 herself	Avoid (for those topics)
Final curriculum review slips	Two tutors read each topic in parallel with Vira	Reduce
Checkout contractor delivers late or broken	30 % of his fee is held back until checkout passes Danylo's test	Transfer (money, not days)
Ad prices rise in January	Keep 24,000 UAH aside, watch cost per booking weekly	Accept with a reserve
Payment provider holds the account	Ask Leo and Hanna to agree a second payment route	Escalate

The money risks have exposures of 24,000 UAH (80 % × 30,000) and 12,000 UAH (50 % × 24,000), 36,000 UAH in total, which fits inside the 50,000 UAH contingency reserve for known risks with 14,000 UAH to spare. An opportunity also turns up: two math tutors have physics degrees; inviting both to a demo lesson this week makes it more likely Klasna opens with ten vetted tutors instead of eight.

One suggestion is rejected outright: a "thank you" to an acquaintance at the payment provider to speed up the review. The legal route is to submit the documents early and ask for the provider's published review time in writing.

Common mistakes

Treating transfer as a schedule fix. A penalty or holdback moves money to the contractor; the lost days are still yours.
Accepting by default. "Accept" without a reserve, an owner and a trigger is just not deciding.
Over-paying for small risks. Compare the response's cost with the exposure and the worst case.
Keeping escalation for emergencies. If the response needs the sponsor's authority, escalate early with a recommendation, not when the trigger fires.
Considering unethical shortcuts. Bribes, unsigned contracts or skipped consent are never a response; they create bigger risks.

Learn it in the course

Risk responses, the pre-mortem and built-in quality · Choose a response for each risk (avoid, transfer, reduce, accept or escalate), use opportunities, find hidden risks with a pre-mortem, and check quality while the work is done, not at the end.