Concept · under Risks, issues and impediments
Risk response strategies on the PMP® exam
Risk response strategies come in two sets in PMI®'s terminology. For threats: escalate, avoid, transfer, mitigate and accept. For opportunities: escalate, exploit, share, enhance and accept. In a scenario the job is to tell them apart, and to know what happens once a risk stops being a possibility and starts happening.
- Exam
- PMP
- Domain
- Business Env.
- Domain weight
- 26%
- Packages
- 8
- Updated
- Oct 13, 2026
01Threat responses and their opportunity twins
| What the response does | Threat | Opportunity | Examples |
|---|---|---|---|
| Hands it to an owner above the project | Escalate | Escalate | An exchange-rate exposure that the company's treasury team manages, not the project |
| Removes the uncertainty | Avoid | Exploit | Threat: drop an unproven third-party integration from scope. Opportunity: book a second crew so an early-completion bonus is locked in |
| Gives ownership to a third party | Transfer | Share | Threat: a fixed-price subcontract for a module the team has never built. Opportunity: a joint bid with a partner that holds a certification you lack |
| Changes probability or impact | Mitigate | Enhance | Threat: cross-train a second engineer on a system only one person knows. Opportunity: add a reviewer to raise the odds of shipping before a supplier's price rise |
| Acknowledges it without changing it | Accept | Accept | Active: reserve and a written plan, ready in advance. Passive: note it and deal with it if it comes |
02Words that decide the answer
- Contingency plan
- A response prepared in advance for a specific identified risk, run when its trigger appears.
- Fallback plan
- The backup if the contingency plan fails or turns out to be too weak.
- Workaround
- An unplanned response to a problem nobody planned for. It is recorded in the issue log, and the risk register gets a second look afterward.
- Trigger
- The warning sign that a risk is about to occur or already has. It tells the risk owner when to act.
- Residual and secondary risk
- Residual risk is what remains after a response is in place. A secondary risk is a new one the response creates, such as the supplier dependency that comes with a transfer.
- Risk owner
- The person who watches the triggers and runs the response, often someone other than the project manager.
03From register to issue log
04Reading a risk scenario
Start with ownership. A risk that falls outside the project's scope or the project manager's authority is a candidate for escalation, and the remaining responses assume the project can act on it. PMI's 2026 Examination Content Outline (ECO) places risk planning, and recognizing when a risk becomes an issue, in the Business Environment domain, which carries 26% of the exam (PMI, PMP Examination Content Outline, as of October 2026). The wider topic is risks, issues and impediments.
Then check the direction. Exploit, enhance and share apply only to good news; avoid, transfer and mitigate only to bad news. An option such as “mitigate the opportunity” is wrong on vocabulary alone, before you weigh anything else.
Transfer is a contract move, so it overlaps procurement. Performance bonds, warranties and fixed-price terms shift the financial consequence to another party and rarely remove the risk itself; the contract types are compared in resources, procurement and contracts.
Choosing between mitigating and accepting is often a cost question. A response is worth buying when it removes more expected loss than it costs, which is what expected monetary value measures.
05Threats, opportunities and triggers
Good news or bad, and can the project act on it? Two questions to carry into each scenario.
Work packages 8
WP 01Compare insurance transfer versus mitigation. Net expected cost = residual EMV + response cost. Which option has the lowest net expected cost?
Option Premium/Limit Retained EMV Mitigation Cost Insurance $45k premium, $400k limit $30k - Mitigation - $60k $55k Debrief answer to open the notes
- A$45k is the premium alone; the retained $30k EMV still has to be added.
- BMitigation's net expected cost is $55k + $60k = $115k; $60k is only its retained EMV.
- CCorrect: insurance costs the $45k premium plus $30k retained EMV = $75k, against $115k for mitigation.
- D$90k double-counts the premium; the net expected cost is premium plus retained EMV, $75k.
WP 02A project manager needs to determine how to handle an identified project risk. The risk has a high probability and significant impact, but cannot be avoided or transferred. Which risk response strategy would be MOST appropriate?
Debrief answer to open the notes
- AAccepting a high-probability, high-impact threat leaves the project exposed when an active response is still possible.
- BEnhancement is an opportunity response that increases probability or impact, so it does not apply to a threat.
- CCorrect: When a serious threat cannot be avoided or transferred, mitigation lowers its probability or impact to a tolerable level.
- DSharing is an opportunity response that allocates ownership to a partner best placed to capture the benefit.
WP 03A project manager is developing a risk response plan for a high-impact risk identified in a construction project. Which of the following would be categorized as a MITIGATION strategy?
Debrief answer to open the notes
- ACorrect: Extra soil testing lowers the chance of a foundation problem before work begins, which is mitigation.
- BA contingency fund is active acceptance: it covers the cost if the risk occurs but does not reduce it.
- CInsurance shifts the financial impact to an insurer, which is transfer.
- DChanging the location to remove the risk entirely is avoidance.
WP 04Sam is the project manager for a construction project. Due to sudden changes in environmental regulations, the project is now facing severe budget overruns. To prevent further financial loss, Sam proposes halting the project. This action is an example of:
Debrief answer to open the notes
- AAcceptance would mean continuing and absorbing the losses, not halting to stop them.
- BMitigation reduces probability or impact while continuing; halting the project eliminates further exposure instead.
- CTransfer shifts the impact to another party, and halting the project hands nothing to anyone.
- DCorrect: Avoidance removes the threat by changing the plan, and stopping the project entirely eliminates exposure to further losses.
WP 05During the planning of an outdoor event, Alex identifies potential weather disruptions as a risk and documents it in the risk register. Just days before the event, a severe storm is forecasted. What should Alex do, given they had a pre-arranged agreement with vendors to move the event indoors?
Debrief answer to open the notes
- AA new mitigation strategy is unnecessary; a planned response already exists for this exact risk.
- BThe risk was already assessed when it was registered; the forecast is the trigger, not a reason to restart analysis.
- CCorrect: The forecast is the trigger for an identified risk, so the planned response, moving indoors under the vendor agreement, is put into action.
- DIgnoring the forecast wastes the planning already done and exposes the event to a known threat.
WP 06A high-probability, high-impact adoption risk has EMV of $180k. Which response and trigger set is optimal?
Debrief answer to open the notes
- AAccepting a high-probability, high-impact threat with no contingency leaves an expected $180,000 exposure unmanaged.
- BCorrect: A likely, costly threat calls for active mitigation, and a defined trigger such as adoption falling to 60% tells the team when to switch to contingency.
- CDelaying the whole rollout six months is a costly overreaction when the risk can be reduced directly.
- DAdoption depends on the organization's own people, so a vendor cannot realistically take that risk on.
WP 07A software vendor offers a 15% discount on licenses if the order is placed before the end of the quarter, which falls well within the project's procurement window. The team wants to make sure the project captures the savings. Which response should the project manager choose?
Debrief answer to open the notes
- AEnhance raises the probability or impact of an opportunity; here the team can make the discount certain, which is exploit.
- BCorrect: Exploit removes the uncertainty so the opportunity definitely occurs, which is exactly what placing the order now does.
- CShare gives part of the benefit to a party better able to capture it; the project can capture this discount itself.
- DAcceptance takes no action, so the project might miss a discount it could easily secure.
WP 08A logistics project plans to hire four drivers next quarter. The parent company announces that its executive committee is considering a group-wide hiring freeze that would affect several divisions. Nobody on the project can influence whether the freeze is approved. Which risk response should the project manager choose?
Debrief answer to open the notes
- ARemoving the driver roles reshapes the project to dodge a decision that may never be made; avoidance is out of proportion while the freeze is only under review.
- BCorrect: the freeze is decided above the project, so the risk goes to the body that owns it, through the sponsor, and the register shows it as escalated.
- CA contract clause cannot make the freeze less likely, and holding a customer liable for the company's own hiring policy would not stand.
- DWaiting quietly leaves the people who own the decision unaware of its effect on this project; a risk owned above the project should be escalated.
Open a row to answer. Keys: 1–4 or A–D answer, N opens the next row.