Strategies for Risk Response: 5 Threat Responses and 5 Opportunity Responses

This guide defines each strategy, shows when to use it, and explains how to choose, document, and track the response.

What Are the Risk Response Strategies in Project Management?

The PMBOK Guide Sixth Edition lists 5 threat responses (escalate, avoid, transfer, mitigate, accept) and 5 opportunity responses (escalate, exploit, share, enhance, accept). Escalate and accept apply to both, so project managers choose from 8 distinct strategies on every project.

PMI defines a risk as an uncertain event or condition that has a positive or negative effect on a project objective. A negative risk is a threat. A positive risk is an opportunity. The response strategy depends on which one the team faces.

What Does Mitigate Risk Mean?

To mitigate a risk means to reduce its probability of occurring, its impact if it occurs, or both. Mitigation does not remove the risk. It lowers the risk exposure to a level the organization accepts. The leftover exposure is called residual risk.

Mitigation works through 2 levers. Probability-reducing actions include prototype development, added testing, and supplier pre-qualification. Impact-reducing actions include redundant systems, backup suppliers, and phased rollouts.

Mitigation fits threats that the team cannot eliminate and does not want to transfer. It carries a cost, so the response must cost less than the exposure it removes. The selection section below shows the calculation.

How Do the 5 Threat Response Strategies Work?

The 5 threat responses are escalate, avoid, transfer, mitigate, and accept. Escalate hands the risk to a higher authority. Avoid removes it. Transfer shifts the impact to a third party. Mitigate reduces it. Accept leaves it in place.

Escalate

Use escalation when the threat sits outside the project’s scope or the response exceeds the project manager’s authority. The receiving party, such as a program manager or a portfolio board, takes ownership of the risk. Record the escalation in the risk register so the handoff stays visible.

Avoid

Avoidance changes the project plan so the threat cannot occur. Typical moves include clarifying an ambiguous requirement, extending the schedule, removing a risky feature from scope, and choosing a proven vendor. Avoidance is the strongest response and the most expensive in scope or schedule.

Transfer

Transfer moves the financial impact and ownership of a threat to a third party. The main tools are insurance, warranties, performance bonds, and contract type. A fixed-price contract places cost risk on the seller. A cost-reimbursable contract leaves it with the buyer. Transfer does not remove the threat. The project still pays a premium, and a failed vendor sends the risk back.

Mitigate

Mitigation lowers probability, impact, or both. Choose it when avoidance costs too much and the residual exposure sits inside the risk threshold. Example: a software team hires an outside security firm to test a payment module before launch. The test lowers the probability of a breach. It does not remove the possibility.

Accept

Acceptance has 2 forms. Passive acceptance takes no action and documents the risk. Active acceptance funds a contingency reserve or writes a contingency plan for use if the risk occurs. Accept low-priority threats and any threat where the response costs more than the exposure.

How Do the 5 Opportunity Response Strategies Work?

The 5 opportunity responses are escalate, exploit, share, enhance, and accept. Exploit makes the opportunity certain. Share gives ownership to a partner. Enhance raises probability or impact. Escalate and accept work as they do for threats, and each needs an owner.

Opportunities receive less attention than threats in most risk registers. A registered opportunity earns the same owner, action, and date as a threat.

• Exploit the opportunity by removing all uncertainty. Example: a team discovers that a shared testing environment cuts 2 weeks from the schedule when booked early, and the project manager books it for the full window.
• Share the opportunity with a partner who captures the benefit better than the project team. Example: a joint venture with a regional distributor opens a market that the project cannot reach alone.
• Enhance the opportunity by raising its probability, its impact, or both. Example: a supplier volume discount grows when the team consolidates orders across 3 projects.
• Escalate an opportunity that lies beyond the project’s authority, such as a reusable component that benefits the whole portfolio.
• Accept an opportunity without pursuing it when the effort costs more than the benefit.

How Do You Choose the Right Risk Response Strategy?

Choose a response with 3 tests: authority, cost, and tolerance. If the response exceeds the project manager’s authority, escalate. If the response costs more than the risk exposure, accept. If exposure exceeds the risk threshold, avoid, transfer, or mitigate.

Start with the probability and impact rating. This guide’s selection table maps the 4 quadrants of a probability and impact matrix to a default strategy:

Then run the cost test. PMTI’s guide What is Expected Monetary Value in Project Management? explains the calculation. Expected monetary value (EMV) equals probability times impact. A response earns its cost when it reduces EMV by more than it costs.

Example: a risk has a 30% probability and a $60,000 impact. EMV is $18,000. A $7,000 mitigation action lowers the probability to 10%. The new EMV is $6,000. The reduction is $12,000. The net benefit is $12,000 minus $7,000, or $5,000. Run the mitigation.

The third test compares the residual exposure with the risk threshold in the risk management plan. Exposure above the threshold needs a stronger response or an escalation to the sponsor.

How Do You Write a Risk Response Plan?

A risk response plan records, for each risk, the chosen strategy, the action steps, the owner, the trigger, the cost and schedule impact, and the fallback. Write it in the risk register and update the project management plan for any approved response.

Follow 6 steps:

1. Rank the risks by score and start with the highest.
2. Select a strategy for each risk using the 3 tests.
3. Define the actions, and give each action a due date and a budget.
4. Assign a named risk owner who carries out the response.
5. Set a trigger for every contingent response, such as a supplier missing a milestone by 5 days.
6. List the residual and secondary risks the response creates.

The risk register holds these fields. PMTI’s guide What is a Risk Register in Project Management? covers the register layout. Example row:

Any response that changes scope, schedule, or cost needs a change request. Route it through the project’s change control process.

What Are Contingency Plans, Fallback Plans, and Residual and Secondary Risks?

A contingency plan lists actions to take if a risk trigger occurs. A fallback plan lists actions to take if the primary response fails. Residual risk remains after a response. Secondary risk is a new risk that the response itself creates.

Reserves fund the responses. A contingency reserve covers identified risks and sits inside the cost baseline. A management reserve covers unidentified risks and sits outside the cost baseline but inside the total project budget. The project manager draws on the contingency reserve directly. The management reserve needs approval.

What Are the Strategies for Overall Project Risk?

Overall project risk is the combined effect of all individual risks and other uncertainty on the whole project. The same strategies apply at that level: avoid a significantly negative project, exploit a significantly positive one, and hold an overall contingency reserve.

Individual risks sum into a project-level exposure. When that exposure crosses the threshold in the risk management plan, the response moves from single risks to the project itself.

• Avoid by re-scoping, re-phasing, or canceling a project whose overall risk is significantly negative.
• Exploit by protecting the benefits of a project whose overall risk is significantly positive.
• Transfer or share exposure through project-level contracts, such as a fixed-price agreement or a joint venture.
• Mitigate or enhance by changing the project strategy, not a single work package.
• Accept actively with an overall contingency reserve, or passively by reviewing the overall risk level at set intervals.

Who Owns Risk Response and How Do You Track It?

A named risk owner carries out each response. The PMBOK Guide Sixth Edition places planning in the Plan Risk Responses process, execution in Implement Risk Responses, and tracking in Monitor Risks. The owner reports status at every risk review.

Follow 4 steps after planning:

1. Assign each response action to its risk owner with a due date.
2. Watch each trigger at every status meeting.
3. Reassess probability and impact after the response runs.
4. Update the risk register and the risk report, and close risks that no longer apply.

Track 3 measures of response quality: the residual risk score against the planned score, the percentage of response actions completed on time, and the count of new secondary risks. A response that leaves the score unchanged failed, regardless of how many actions it completed.

How Do Risk Response Strategies Work in Agile and Hybrid Projects?

Agile and hybrid projects use the same 8 strategies on a shorter cycle. Teams mitigate with spikes and prototypes, escalate through impediments, and review risk every iteration. A risk burndown chart replaces the static, once-a-month register review.

• Run a spike, a short time-boxed investigation, to mitigate a technical unknown before committing to a story.
• Log impediments the team cannot remove and escalate them to the Scrum Master or product owner.
• Add risk items to the product backlog, and rank them beside features.
• Review the top risks in every sprint planning and retrospective.
• Reserve sprint capacity or a release buffer as an active acceptance response.

Approximately 60% of the July 2026 PMP exam targets agile or hybrid approaches, so exam scenarios pair these practices with predictive ones.

How Do the Risk Response Strategies Appear on the PMP Exam?

PMP scenario questions test whether the candidate matches the situation to the correct strategy. Insurance and contracts signal transfer. Prototypes and added testing signal mitigate. A response beyond the manager’s authority signals escalate. A reserve with no other action signals active acceptance.

Use this cue table:

Third-party summaries of the 2026 exam outline place risk tasks in the Business Environment domain, which carries 26% of the exam.

PMTI’s Project Risk Management Course (24 PDUs) covers project risk management in depth for middle and upper management. Max Wideman, a PMI Fellow who led the first PMBOK Guide effort, designed the course and delivers it online.