Risk response is the process of addressing identified risks in order to control or mitigate their impact. It is an integral step in the risk management process and involves making decisions about how to address each identified risk. This planning and decision-making process involves stakeholders deciding on the most appropriate course of action for each risk.

Risk response can involve taking steps to eliminate the risk, reduce its likelihood or impact, transfer the risk to another party, or accept the risk. The chosen response should be based on an assessment of the potential costs and benefits of each option, as well as the organization’s risk tolerance and capacity. By effectively responding to identified risks, organizations can minimize the impact of potential negative events and maximize their chances of success. The following are the basic types of risk response.

Avoid
Change your strategy or plans to avoid the risk.

Mitigate
Take action to reduce the risk. For example, work procedures and equipment designed to reduce workplace safety risks.

Transfer
Transfer the risk to a third party. For example, purchase fire insurance for an unfinished building.

Accept
Decide to take the risk. Generally speaking, all strategies and plans involve some level of risk. Risk also has a relationship with reward whereby reducing risk towards zero can also reduce potential payback.

Share
Distributing the risk across multiple partners, teams or projects. For example, four projects each have a software architect and each identifies the risk that the software architect is a critical resource. They decide to share the risk by pooling the software architects into a team that provides a service to all four projects. If one architect quits, the service can be continued.

Contingency
Making plans to handle the risk if it occurs. For example, back-out procedures that can restore a system if a launch fails.

Enhance
Enhancement is a response for a positive risk. Project management methodologies may view finishing a task early or under budget as a positive risk. Enhancement is an action that is taken to increase the chance of the risk occurring.

Exploit
Another treatment for positive risks. Exploiting a risk is to make use of resources that become available if the risk occurs. For example, if a task finishes early, you plan to reassign the resource to more work.