Risk Mitigation Strategies

Once risks have been identified and prioritized (assessed), the Project Manager must decide exactly what to do about them. This phase is called Risk Response Planning.

For negative risks (threats), there are four primary strategies a project manager can employ: Avoid, Transfer, Mitigate, or Accept.

1. Risk Avoidance

Avoidance means changing the project plan to completely eliminate the threat entirely. You are deciding that the risk is simply not worth taking.

Scenario: A new, experimental API has a high risk of being unstable and crashing your app.
Avoidance Strategy: You decide to drop the feature entirely, or use an older, proven API instead. You have bypassed the risk completely.
When to use: For high-probability, high-impact risks where the project cannot survive if the risk occurs.

Transfer involves shifting the impact of a risk (and ownership of the response) to a third party. It does not eliminate the risk; it just makes it someone else's problem financially or operationally.

Scenario: There is a risk that user data could be stolen in a cyberattack, resulting in massive lawsuits.
Transfer Strategy: You purchase robust cybersecurity insurance, or you outsource the database hosting to AWS, shifting the liability.
When to use: Often used for financial risks or areas where the team lacks specialized expertise.

3. Risk Mitigation

Mitigation is the most common strategy. It implies taking proactive steps to reduce the probability of the risk occurring, or reducing its impact if it does occur (or both).

Scenario: There is a risk that the main server hardware will fail, taking the application offline (High Impact).
Mitigation Strategy: You cannot completely avoid hardware failure, but you can mitigate the impact by setting up a redundant backup server. If the main server fails, the backup takes over instantly.
When to use: For most standard project risks where avoidance is impossible and transfer is too expensive.

4. Risk Acceptance

Acceptance means acknowledging the risk but deciding not to take any proactive action. This is usually done when the cost of mitigating the risk is actually higher than the cost of the risk itself.

There are two types of acceptance:

Passive Acceptance: "If it happens, we'll deal with it then." No plans are made.
Active Acceptance: Establishing a Contingency Reserve (a budget or time buffer) just in case the risk occurs.
Scenario: There is a 5% chance it might rain on the day we are filming the promotional video. Renting an indoor studio as a backup costs $5,000.
Acceptance Strategy: The cost to mitigate ($5,000) is too high for a 5% probability. You accept the risk. If it rains, you will just delay the shoot.

Summary

When facing a project threat, you can:

Avoid: Change the plan to eliminate the risk.
Transfer: Give the risk to a third party (e.g., insurance).
Mitigate: Take steps to lower the probability or impact.
Accept: Do nothing proactively, usually for low-priority risks.

Assessed progress

Risk Mitigation Strategies

Risk Mitigation Strategies

1. Risk Avoidance

3. Risk Mitigation

4. Risk Acceptance

Summary

Key Concepts

Risk Mitigation

Risk Avoidance

Risk Transfer

Risk Acceptance

Quick Check

Software Project Management

Software Project Management

Assessed progress

Risk Mitigation Strategies

Risk Mitigation Strategies

1. Risk Avoidance

2. Risk Transfer (or Share)

3. Risk Mitigation

4. Risk Acceptance

Summary

Key Concepts

Risk Mitigation

Risk Avoidance

Risk Transfer

Risk Acceptance

Quick Check

Software Project Management

Software Project Management