Determining the Most Appropriate Risk Response

As a project manager, you can use a risk response plan to ensure that you meet your project objectives. A risk response plan is a document that details an identified risk, its cause, probability of occurrence, potential impact, and proposed responses. An effective risk response plan will help you enhance risk opportunities and reduce risk threats.

A risk response plan, which is sometimes called a risk register, is comprised of a number of different components. A typical project's risk response plan includes the following components:

• a detailed list of all identified project risks
• the risk owners responsible for formulating and implementing one or more risk responses
• the results from the project's qualitative and quantitative risk analyses
• the established responses for each identified risk
• the expected level of residual risk
• the specific actions required to implement the chosen response
• the budget and timing for all risk responses
• a description of any contingency or fallback plans.

One of the most important components of a risk response plan is "the established responses for each identified risk." As a project manager, it is your job to select the most appropriate and effective response for managing that risk. Once this selection is made, the agreed-upon risk response is entered into the project's risk response plan.

How do you determine which risk response will be the most appropriate and effective for an identified project risk? There are three important questions that you should ask yourself when making this critical decision.

1. What are the potential risk responses?
   The first question that you should ask yourself when determining the most appropriate risk response for one of your identified project risks is: What are the potential risk responses? You should apply the four risk response strategies to your risk, discard those strategies that are either impossible or impractical to use, and formulate potential responses from the strategies that remain.
   
   
   • Avoidance - should be used when the level of risk is unacceptable, when the means for controlling the risk are not feasible or when there is a potential for harm. This risk response strategy involves changing the project plan to eliminate the risk or the condition causing the risk.
     
     
   • Transference - should be used when there is a potential for significant financial exposure. Risks can be transferred through insurance, performance bonds, warranties, and contracts. This strategy shifts the consequences of a risk to a third party, such as an insurance company.
     
     
   • Mitigation - should be used when there is an opportunity to significantly reduce the probability or consequences of an identified risk. Throughout a project's life cycle, it may be possible to perform risk mitigation by reducing both the risk probability and the risk consequences.
     
     
   • Acceptance - should be used when the probability and consequences of an identified risk are low. This strategy results in no changes to the project plan. It involves leaving a project team to deal with a risk when it occurs or forming a contingency plan to deal with the risk if it occurs.
     
     
2. What are the project constraints?
   The second question that you should ask yourself when determining an appropriate and effective risk response for an identified risk is: What are the project constraints? The PMBOK Guide defines a constraint as an "applicable restriction that will affect the performance of a project." No project is completely free of constraints. As a result, you will need to keep this in mind when selecting an appropriate risk response. Constraints will limit the choices available to you during risk response planning.
   
   For example, you may initially decide that avoiding a risk by changing the project scope is an appropriate response for a given risk. However, a careful examination of the constraints facing your project may indicate that avoidance is not possible or that it is unwise given your circumstances.
   
   During the life cycles of your projects, you may encounter many different types of constraints. However, there are some constraints that you will face more frequently than others. A few of these constraints are listed below.
   
   
   • An established project budget - An established project budget is one constraint that can affect your selection of risk responses. For example, if your project is restricted by a tight budget, any responses that require a vast amount of funding to implement will be deemed unwise and detrimental to project success.
     
     
   • A defined project schedule - A defined project schedule can also act as a constraint when determining the most appropriate response for an identified risk. For example, if your project's sponsors have established an inflexible schedule, the responses that will add time or cause delays to the project schedule will have to be rejected.
     
     
   • Contractual obligations - Another constraint is contractual obligations. Risk responses may need to be discarded if they have the potential to deviate from a signed contract. For example, you cannot reduce the risk of cost overruns by paying your contractor less than the amount agreed upon in the project contract.
     
     
   • Product specifications - The final constraint that can affect your selection of risk responses is product specifications. If project sponsors are expecting a particular product, they may be unwilling to approve any changes to the project scope. This decision can limit your options when responding to risk.
     
     
3. Which risk response will be the most appropriate for managing the risk?
   The final question that you need to ask yourself when determining an appropriate risk response for an identified project risk is: Which risk response will be the most appropriate for managing the risk? Once you have decided what the potential risk responses are and what constraints are facing your project, you can then determine the most appropriate and effective risk responses for your project risks.
   
   By eliminating those responses that are not feasible for your project or those that cannot be achieved due to certain constraints, you will be left with only the responses that are appropriate for the chosen risk. These responses will serve to protect the project from the risk's potential impact.
   

As a project manager, you can determine the most appropriate risk response for a given project risk by answering the following questions: what are the potential risk responses, what are the project constraints, and which risk response will be the most appropriate for managing the risk?

Once this determination is made, you can include your chosen risk response into your risk response plan. This plan will help you enhance risk opportunities and reduce risk threats to project objectives and overall project outcomes.

Four Ways to Transfer Risk

As a project manager, it is important for you to understand that the act of sharing can play a valuable role in your project's risk response planning process. Sometimes, the most efficient and effective way of dealing with project risks is to share the responsibility for their response with others.

Transference is a risk response strategy that does just that. It shifts the responsibility of a risk, or part of a risk, to a third party. Transference does not eliminate a risk or its potential consequences. This risk response strategy simply gives another party responsibility for the management of that risk.

Although a project will encounter many different types of risks, transferring risk liability is usually most effective when dealing with financial risk exposure.

Transference often involves the payment of a risk premium to the party taking on the risk. For example, a company will pay a monthly premium to its insurance provider as payment for the provider taking on one or more of the project's risks.

During your project's risk response planning process, you may decide that transference is the most appropriate strategy to use in order to effectively respond to one of your identified project risks. Once you make this decision, you must choose the transference method that will best address that risk. There are four methods available for you to use when transferring the responsibility for an identified risk.

1. Insurance
   Insurance is a transference method that shifts the responsibility of specified risks to an insurance company. Typically, insurance companies provide monetary coverage for losses that result from such things as legal liability, fire damage, theft, or vandalism.
   
   One of the most common methods of transferring risk and its potential consequences is to purchase insurance. As a project manager, you can share the responsibility of some of your project's identified risks by having an insurance company provide financial coverage for potential risk losses. During your project's risk response planning process, you should set aside risks that can be insured and transfer the responsibility for those risks to your company's insurance provider.
   
   Some of the most common insurable project risks are:
   
   • Direct Property Damage - to project equipment, project materials or a contractors' property.
   • Indirect Losses - such as equipment replacement and business interruption.
   • Legal Liability - such as public employee bodily injury, design errors, public property damage, and the failure of a product to perform as specified.
   • Personnel Issues - such as employee replacement costs.
   
   For project managers to transfer a project risk through the method of insurance, two conditions must be met. The first condition is that the potential risk loss must be due to chance. Insurance companies do not want to provide monetary coverage for risks that result from human error or poor project planning.
   
   The second condition that must be met in order for a risk to be eligible for insurance is that the potential risk loss must be measurable. This means that the risk loss must have an assigned monetary value. A project risk cannot be insured if the potential loss is expected to be personal or emotional.
   
   
2. Performance bonds
   Performance bonds shift the financial responsibility for poor performance back to the contractor. These bonds are usually issued by a financial institution, such as a bank, and force contractors to pay out a specified sum of money if their performance is unacceptable.
   
   Project managers obtain performance bonds to guarantee the satisfactory completion of contracted work. These bonds provide monetary compensation to a company if its contractor fails to achieve the proposed project work.
   
   
3. Warranties
   Warranties are written guarantees that purchased project equipment will be of good quality. This transference method shifts the cost and responsibility for repair or replacement of defective parts to the manufacturer.
   
   
4. Contracts
   A contract is a binding and legally enforceable agreement between two or more persons or parties. During risk response planning, project managers can use contracts to help eliminate or minimize the impact of identified project risks.
   
   In most cases, contracts are established between an organization and its contractors at the onset of a project. These contracts contain numerous details and clearly outline the contractor's responsibilities throughout the project. This transference method helps shift the potential cost and consequences of incomplete, tardy, or unsatisfactory work back to the contractor. A contract also protects the contractor, ensuring the company meets its obligations as well. This helps reduce the overall risk impact on the project.
   
   Another benefit of a contract is that you may not have sufficient expert resources within your company to perform all of the various project activities in an efficient and effective manner. Contracting some of your project work out to someone with superior knowledge and expertise in a particular area can reduce the risk of poor performance or unsatisfactory project design.
   

It is important to keep the four transference methods in mind when formulating responses to your project's identified risks. If your project requires a contractor, it is good to obtain a performance bond to ensure that expected performance levels are maintained. In addition, if your project materials are purchased from an external source, it is wise to have a warranty in place to protect your company against material defect risks.

If you decide to respond to some of your identified risks by purchasing insurance, you will be able to protect your company from costly, unexpected, and unpredictable risks, such as legal liability and personnel injuries. If you choose to establish a contract at the onset of your project, you will reduce the risk of project plan deviations and miscommunication. You must carefully consider each transference method and determine which one will be most effective in minimizing the impact of an identified project risk.

Insurance, performance bonds, warranties, and contracts are the four primary methods for transference. During the risk response planning process, project managers can use transference to help them reduce the impact of potential risks to project objectives and overall project outcomes.

As a project manager, you should examine all of your project's identified risks and set aside those that will benefit from transference. This will minimize your project's overall risk impact and promote a successful project completion.