Risk Response Strategies: Avoid, Mitigate, Transfer, Accept

Responding to Threats on the PMP Exam

Every identified risk on a project needs a response — or a deliberate decision not to respond. The PMP exam tests four strategies for responding to negative risks (threats): avoid, mitigate, transfer, and accept. Knowing the definition of each is not enough; the exam presents scenarios and asks which strategy best fits the situation. This guide covers each strategy with examples and decision criteria.

Avoid: Eliminate the Threat Entirely

Risk avoidance changes the project plan to eliminate the threat or protect the project from its impact. The risk ceases to exist because the condition that would cause it is removed.

Examples

• Removing a risky feature from the project scope.
• Extending the schedule to avoid resource conflicts during a known high-risk period.
• Choosing a proven technology over an experimental one.
• Clarifying ambiguous requirements to eliminate the risk of misinterpretation.

When to Use

Avoidance is appropriate for high-probability, high-impact risks where the project can be restructured without unacceptable trade-offs. It is the most aggressive strategy — the risk disappears — but it often requires scope, schedule, or budget changes.

Mitigate: Reduce Probability or Impact

Risk mitigation takes action to reduce either the probability that the risk will occur or the impact if it does — or both. Unlike avoidance, the risk still exists, but its expected value is lower.

Examples

• Adding redundancy to a critical system to reduce the impact of a component failure.
• Conducting additional testing cycles to reduce the probability of defects in production.
• Prototyping a complex design early to reduce technical uncertainty.
• Cross-training team members to reduce the impact of a key person leaving.

When to Use

Mitigation is the most common strategy. It works when the risk cannot be eliminated but can be managed to an acceptable level. The cost of mitigation actions must be weighed against the expected reduction in risk exposure.

Transfer: Shift the Impact to a Third Party

Risk transfer moves the financial consequence of a risk to another party. It does not eliminate the risk — it shifts who pays if the risk occurs.

Examples

• Purchasing insurance (the classic transfer mechanism).
• Using fixed-price contracts to transfer cost overrun risk to the seller.
• Performance bonds, warranties, and guarantees.
• Outsourcing a risky component to a specialist vendor.

When to Use

Transfer is most appropriate for financial risks and risks where another party is better positioned to manage the exposure. Transfer always has a cost — insurance premiums, higher contract prices, or fees — which represents the risk premium paid for protection.

Accept: Acknowledge and Live with the Risk

Risk acceptance means the project team has decided not to change the project plan to deal with the risk. There are two forms:

• Active acceptance: The team develops a contingency plan and sets aside contingency reserves. They do nothing proactively but are prepared to act if the risk occurs.
• Passive acceptance: The team simply acknowledges the risk and decides to deal with it if it happens, with no specific contingency plan. This is appropriate only for low-priority risks.

When to Use

Acceptance is appropriate when the cost of any other response exceeds the expected impact of the risk, or when the risk is low-priority and does not warrant the investment of a proactive strategy.

Escalate: The Fifth Strategy

The PMBOK Sixth Edition added escalation as a strategy: when a risk is outside the project's scope or authority, it is escalated to program, portfolio, or organizational management. The project team documents the risk but does not own the response. Be aware of this on the exam — if a risk affects multiple projects or requires executive decisions, escalation may be the correct answer.

PMP Exam Decision Framework

1. Can we eliminate the cause? → Avoid
2. Can we reduce probability or impact to an acceptable level? → Mitigate
3. Is this a financial risk another party can absorb? → Transfer
4. Is the cost of response greater than the risk exposure? → Accept
5. Is the risk outside our authority? → Escalate

Practice applying these strategies in realistic scenarios. Start your free trial for risk management practice questions, or review our risk response cheat sheet for a quick decision tree.