In the modern business environment with its many uncertainties, the need to develop a reliable cause-response framework for projects, resources, and long-term objectives becomes essential. All organisations are likely to face several risks, be they arising from financial constraints, operational inefficiencies, or external threats. However, it is not sufficient to just identify risks in order to achieve success; it is necessary to have a proactive response strategy. A risk response strategy that is well thought out is what most organisations employ in curtailing losses, taking advantage of opportunities, or maintaining business continuity even in adverse conditions. This guide takes you through the components of effective risk response strategy so that you are equipped with tools for informed decision-making and resilience in your organisation.
What Are Risk Responses?
It is an act that implies dealing with the actions of managing or addressing already identified project risks in the field of project management. After identifying a risk and analysing it, project teams get to prioritise it, analyse it, and design the appropriate strategies and actions to mitigate or maximise the possibility and impact of opportunities. The goal is to bring the project’s overall risk exposure to an acceptable level to increase the chances of meeting project objectives. The British Academy for Training and Development offers a course in Projects Risk Management – Objectives, Methods & Assessment to help you manage risk effectively and meet project goals with confidence.
Risk Response Strategies
The main risk response strategies for positive risk are listed below.
1. Avoid
Avoiding the action or not starting it altogether is one among the responses to a risk. By avoiding the risk, it denies a chance of being a risk for the enterprise. Executives and managers will choose this option for any risks that could get the company in major legal trouble or lead to someone getting killed.
The recent incident is that most offices in the country send their employees to work from homes to prevent them from contracting COVID-19. Most companies avoid the chance of their employees falling sick. By using this option, one can stop the production of certain goods, sell a division of the company, or decide against expansion.
At first glance, it does look like a very good option, but it may not always be practical or possible; more on this later in risk response strategy #5. If there is just no tolerance whatsoever for the risk in question, this becomes the appropriate response.
2. Transfer
As the name suggests, this is when you transfer or assign the work of overcoming project risk to a third party, such as by purchasing insurance, a warranty, or a guarantee. Risk transfer usually involves transferring the potential financial impact of a risk event to another entity. The risk is then assumed by the new party, who usually employs a formal agreement or some kind of contract to accept the risk.
Risk transfer is generally applied in situations where resources or expertise useful for managing the specific risk are insufficient. This aids project teams in focusing on the core objectives of the project without being distracted when risks are transferred.
3. Accept
There are other risks, highly likely outside your tolerance level, that would not be a match for any of the other modes of response since their probability and/or impact is so low that investing some resources in the effort to avoid, transfer, or reduce it just does not make sense.
In such cases, just accept the risk; do nothing...yes, you heard me right, do nothing! To lay it out plainly, risk acceptance is a passive choice and requires no further action. Other risks that can fall into this category include emerging risks, or ones that may pose some sort of threat in the distant future. If you want to be technical, everything except those you totally evade could come within the acceptable category.
Reducing a risk helps you to still accept the portion of your hunger. By transferring the risk via insurance, you nonetheless assume some of the risk as it pertains to your monthly premiums and deductible/retention. Your insurance only covers your losses when a covered occurrence surpasses this level. By default, unless you're completely avoiding risk, you are applying a mix of the reduce (mitigate), transfer, and/or acceptance risk response techniques.
4. Reduce
In ERM terminology, this calls for measures to minimise the possibility or effect of a loss. Reducing is a sensible approach to bring it down to within acceptable levels if the risk is just slightly above your appetite and tolerance level. Personally, we all use some form of risk reduction in our everyday lives. We fasten a seatbelt to lessen any possible consequences of a vehicle collision as we enter our automobile to go somewhere.
Note that this action does not lower the probability of an accident occurring; if that is your aim, you would simply need to stay at home. Too much money spent to lower a risk in business may be a waste of time and money... To demonstrate, I'm going to go back to my first job as a cashier at a supermarket.
One great duty for a cashier is to guarantee that your drawer is balanced at the conclusion of every shift. My store gave us some leeway, especially an "over/under" of up to $3; that is, if my drawer was short $1.80, the store would merely write it off. Knowing I had this cushion offered some relief, but the store would have grounds to be sceptical if it occurred all the time.
Let's next suppose there was a 2-cent over/under latitude. Paying someone their hourly rate to pursue down 50 cents or a dollar would make more sense than it would to simply accept that you lost a dollar. Spending too much time on insignificant issues is inefficient, as you should be able to observe from this illustration; therefore, bear that in mind while selecting this risk reaction.
5. Mitigate
Certain project hazards are unavoidable. Planning, creating, and putting into action strategies to lower the likelihood of a risk even happening is known as risk management. Rather than aiming to completely eradicate all risk, the aim is to bring it down to a more acceptable level. Usually applied when the danger cannot be totally eliminated or when the possible effects are great enough to justify action, risk mitigation helps one to reduce their exposure. It is also used when certain actions can help to lower the probability or degree of impact.
6. Monitor
Risk monitoring is the ongoing monitoring of discovered risks and the triggering circumstances. It seeks to address issues such as “How has the risk changed? Are there new risks that have emerged, or are the risk mitigation plans working as expected? Large, complicated projects benefit from risk monitoring or those with tight deadlines or budgets. It's also useful in projects employing new or unproven technologies.
7. Buffer
Adding more resources, such as time or money, to a project plan helps to absorb possible disturbances or adverse effects a risk produces under this approach. It forms a cushion that enables the project to remain on scope, schedule, and budget even if the risk manifests itself. This approach is particularly useful in projects characterised by great uncertainty or where the effects of potential risks may be considerably impactful. It is also applied when project timing and budgeting cannot be variable.
Risk Response Strategies for Positive Risks
The main risk response strategies for positive risks are listed below.
1. Exploit
You need to exploit a positive risk or an opportunity; you will need to put more activities in your project plan or change your project management plan to take advantage of it. This technique carries some risk, but often the risks are worth taking. Unlike strategies for negative risks meant to avoid or mitigate harm, exploit strategies exist to actively pursue opportunities. It is an ideal strategy to be taken when the positive risk promises to bring about very large benefits, and the cost and efforts involved in its exploitation are justified by the potential gains.
2. Enhance
Increases the likelihood that a positive risk, once triggered, will positively influence the objectives of the project. In other words, the strategy is like nurturing a potential opportunity to get the most upside for the project. Either increasing the likelihood of the opportunity to occur or increasing the positive benefits if it does become the target of this strategy. This strategy is ideal when the risk has significant potential benefits and the cost and effort to enhance the risk are justified by the potential benefits.
3. Share
Here you’ll share the risk response with other partners across various teams or projects. It means sharing a skilled team member across various projects. The rationale is that another entity may have better expertise, resources or capacity to capitalise on an opportunity or reduce the impact of a threat. It’s the preferred approach when another party has a clear advantage in managing the risk or sharing can lead to greater efficiency or effectiveness in capitalising on an opportunity.
4. Accept
The accepted risk response is choosing not to take any proactive action to pursue the opportunity. It’s often done when the opportunity has a low probability of occurring or the potential impact is small. Teams use this strategy when the likelihood of a positive risk materialising is very low or if there’s a high cost or effort to exploit the risk.