Risk Response Plans

Now that we've identified and prioritized the project risks, it's time to build response plans, these plans are proactive measures to try and do the following:

• Avoid the risk
• Mitigate the risk's impact or probability
• Transfer it to a 3rd party.

there may also be risks that have such a low RPN/Probability/Impact that we may choose to just accept or there just may be no way to avoid, mitigate or transfer the risk and we have to accept it.

Risks with negative impact

1. Accept: by accepting a risk we decide not to take an preventative action; accepted risks are monitored throughout the project in status updates. accepting risk is not the same as ignoring risk
2. Mitigate: try to adjust the budget, scope, or schedule to reduce the likelihood of the impact and/or probability of risks
3. Avoid: Take preventative actions to eliminate the chance of the risk occurring.
4. Transfer: this does not eliminate the risk, but moves it to a 3rd party that is better equipped to deal with the risk.

Commonly 

• Low priority risks are accepted
• Medium & High priority risks are mitigated 
• Ideally Medium & High priority risks are avoided
• however avoiding a risk may not be feasible or the cost outweighs the impact

Risks with positive Impact

1. Accept:the risk is observed in status meeting and if occurs will be happily accepted, but no proactive measures will be taken to insight the risk
2. Enhance: implement proactive measure to try and insight the risk
3. Exploit: try to ensure the risk will occur.
4. Share: try to share the risk occurrence with a 3rd party

once the risk response plans are established the project scope, schedule and budget must be updated to ensure that these risk response plans are available should the need arise.