Lessons · Project management · risk responses: escalate, avoid, mitigate, transfer, accept
Five things you can do about a threat
A threat can be escalated (it is outside this project's scope or your authority, so somebody above the project owns it and your team stops managing it), avoided (change the plan so it cannot happen), mitigated (make it less likely or less painful), transferred (make it someone else's to pay for, usually for a fee), or accepted (do nothing now, hold reserve).
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by an experienced project manager. Practice material, not professional advice. What that means.
What it is for
We should insure the equipment, we should hire a second vendor, and we should just carry the risk are three different responses with three different prices. Naming which one you are proposing is how the sponsor can compare them. Escalate is the one people leave out, and it is the one that matters when a risk is genuinely not yours: a project manager who quietly carries a risk they have no authority to act on has taken responsibility for an outcome they cannot change.
How to think about it
For each top risk, cost each response and compare it with the EMV. A mitigation that costs more than the EMV it removes is not worth doing. Accepting is a decision, written down, with a reserve behind it, not the absence of one.
Worked example
Risk: 40% chance of a $100,000 rework. EMV = −$40,000The size of the problem.
Avoid: use the proven model instead. Costs $20,000 more, risk goneRemoves $40,000 of EMV for $20,000. Worth it.
Mitigate: a prototype for $15,000 cuts the probability to 10%. New EMV −$10,000Removes $30,000 of EMV for $15,000. Also worth it, and keeps the new model.
Transfer: a fixed-price contract for $12,000 more, so the vendor carries the reworkThe risk still exists; the bill is theirs.
Accept: hold $40,000 in contingency and watchRight for small risks, written down as a choice.
Escalate: the risk is a company-wide supplier failure, not this project'sHanded to the programme or portfolio level. Recorded, and no longer managed by this team.
Your turn
Write the response that hands the risk to someone else for a fee.
: an insurance policy or a fixed-price contract
Solve one, graded on the server
The trap
Confusing transfer with avoidance. Insurance pays after the fire; it does not stop the fire. Only avoidance removes the event. The other confusion is escalate with accept: accepting keeps the risk and holds reserve against it, while escalating hands ownership upward and your team stops managing it. Escalating and then continuing to carry it in your register is doing neither.