Learn Response Strategies for Negative Risks

chess king wood
••• ATU Images / Getty Images

Risk management on a project centers on being able to identify what might go wrong. These are the negative risks, otherwise known as threats to your project. It’s important to identify them and record them in your risk register so you know what might be coming round the corner to interfere with your chances of completing your project successfully.

But identifying them is only the beginning. Once you have done that, you also need to work out what to do about them. You do have options. There are four strategies for responding to negative risks: Avoid, Transfer, Mitigate and Accept. Let’s look at those now.


When you avoid a risk, you stop it happening totally. Worried that a particular feature on your software won’t go down well in the international market? Switch it off. That’s an example of avoiding a risk completely: you put a plan in place to make sure that it could never happen. You can’t do this with all risks, but it’s a handy approach to shutting down trouble before it happens where you can.


Transferring a risk means shifting the responsibility for it on to someone else. The best example of this is an insurance policy. When you buy an insurance policy, you shift some of the impact of the risk on to the insurance firm, and they would be liable if the risk did happen.

You can also write ‘transfer of risk’ clauses into your contracts with suppliers. Get legal advice, though, before you do this so that you are sure that you are transferring the right risk and that you’ll be getting the outcome you want. Find out more about appropriate contracting.


Mitigation is probably the most common risk response strategy. It is where you come up with actions to make the risk less of a problem if it does happen.

For example, if you have a project risk around the testing phase taking too long, you can add more testers to your resource pool. The risk still might happen, but at least you’ve done something to lessen the potential fallout.


Your final option for dealing with a negative risk is to simply accept it. Sometimes problems happen, and you’ve analyzed this one and decided that you aren’t going to do anything about it. Being able to adapt (if it does happen) is one of the top skills for project managers.

Accepting that a risk might happen is not the same as not making a decision or putting your head in the sand. You are actively, and with the support of your project sponsor and senior management, making the decision to do nothing. It’s the riskiest, in many respects, but you can take that calculated risk based on what it would cost you in terms of time and effort to put a different kind of risk response strategy in place.

It may be far too costly to implement any other kind of risk management strategy, given the impact that this risk would have. If the chance of a risk happening is tiny, or the impact it will have if it does happen is very small, then doing nothing is a perfectly acceptable solution.

These four options span a wide spectrum of risk response so you should be able to find an approach here that suits the level of risk that you are prepared to take as a project team. The most important thing is to put together your action plan and work through the steps you identify. Then if the risk does happen, you have your Plan B already sorted out, and you can navigate through the problem easily.