How to Craft a AAA Risk Response Strategy
Risk response strategies (aka risk treatments) are the systematic measures taken to handle identified risks. Some experts believe that the development of risk responses is the most critical step in the risk management process, and it is easy to see why. By crafting and executing well-planned risk responses, we can mitigate potential threats, leverage opportunities, and significantly increase the odds of project success.
But what does a good response look like? Following are the criteria that all risk response strategies should satisfy:
Appropriate. The response must fit the level of risk. If a realised risk is likely to cost $10,000, but the risk response costs $20,000, the strategy is not appropriate. In practice, "do nothing" (that is, accept the risk) is often the most appropriate response to a particular threat. Even where the response strategy costs less than the risk realisation, it must still fit within the overall budget. Any risk response that is unaffordable is inherently inappropriate.
Actionable. The response must also be feasible, both technically and logistically. Perhaps there is a risk that your off-the-shelf database won't meet performance requirements. If your risk response strategy is "Invent our own database," it is probably not an actionable plan for most teams. Any response we craft must also lie within our authority to execute. For example, planning to redeploy resources from another group is useless if you lack the power to do so.
Agreed. The risk response must be accepted and approved by all relevant stakeholders. If a cost is associated with the strategy, this should be included as a line item in the project contingency and signed off by project leadership. Each response must also have a single agreed owner who is responsible for implementing the plan when triggered.
If our proposed risk response meets all these criteria, it is a "Triple A" strategy and is much more likely to mitigate against potential threats—or realise potential opportunities.
Risk Register by ProjectBalm is a proven tool that helps you record and manage your risks.