Risk Expedition: Practice the Four Risk Response Strategies

Risk Expedition
8 weeks, 4 responses, survive
Week1/8
Budget100
Trust100
Tokens10
Week 1 of 8 · New risk emerging

—

—

—

Probability
—
Cost if hit
—
Trust if hit
—
Where this risk sits
Impact →
Probability →
Hover a response to preview
Point at any of the four responses above to see what will happen if you pick it.

What are the four risk response strategies?

Every risk you identify on a project needs a plan for what to do about it. For negative risks (threats), the PMP framework names four responses. Avoid: change the plan so the risk can't happen at all, the most expensive option, reserved for risks that would be catastrophic. Transfer: shift the impact to a third party through insurance, a warranty, or a contract clause, useful only when a third party actually exists to take it on. Mitigate: reduce the probability, the impact, or both, the flexible middle option that leaves some residual risk. Accept: do nothing and absorb the hit if it lands, the right call when the risk is too small to justify spending on.

Positive risks (opportunities) get a parallel set of responses: exploit (make the opportunity certain), share (partner with someone better positioned to capture it), enhance (increase its probability or impact), and accept (take it if it comes, without chasing it).

The probability-impact matrix

Plot every risk on two axes: how likely it is (probability) and how bad it would be if it happened (impact). The matrix splits into four quadrants that map cleanly onto the four responses:

Low impact
High impact
Low prob
AcceptNot worth the prep cost.
TransferInsure or contract it away.
High prob
MitigateReduce probability and impact.
AvoidChange the plan to prevent it.

The response cost should match the risk's expected damage. Avoiding small risks burns budget and tokens you'll need for the big ones; accepting a high-probability, high-impact risk can sink a project.

Expected monetary value (EMV): the decision principle

EMV = probability x impact. It's the average loss you'd expect if the same risk played out many times, and it lets you compare risks with different odds and different price tags on the same scale.

Worked example: a vendor has a 25% chance of going bankrupt, which would cost $38,000 in disruption. EMV = 0.25 x $38,000 = $9,500. Compare that to a sponsor who has a 70% chance of adding scope worth $12,000 in rework. EMV = 0.70 x $12,000 = $8,400. The bankruptcy risk has lower probability but a higher EMV, so it deserves a response (transfer, if insurable) even though it feels less urgent day to day than the sponsor who keeps pinging you on Slack.

Frequently asked questions

What are the four risk response strategies in project management?

For negative risks (threats), the four responses are avoid (change the plan so the risk cannot occur), transfer (shift the impact to a third party through insurance or a contract), mitigate (reduce the probability, the impact, or both), and accept (take no action and absorb the impact if it happens). Positive risks (opportunities) have a parallel set: exploit, share, enhance, and accept.

When should you avoid vs mitigate a risk?

Avoid when a risk is both likely and severe enough that no amount of mitigation makes it acceptable: you change the plan so the risk cannot happen at all. Mitigate when the risk is worth reducing but not worth eliminating the underlying work: you cut probability, impact, or both, and accept whatever residual risk remains. Avoidance usually costs more upfront (a changed plan) but removes the risk entirely; mitigation is cheaper but leaves some exposure.

What is expected monetary value (EMV)?

EMV = probability x impact, expressed in dollars (or another cost unit). It is the average loss you would expect if the same risk played out many times. A 25% chance of a $40,000 hit has an EMV of $10,000; a 70% chance of a $12,000 hit has an EMV of $8,400. EMV lets you compare risks with different odds and different price tags on the same scale, and it is the principle behind deciding how much a response is worth spending.

Is risk management on the PMP exam?

Yes. Risk management is one of the PMP exam content domains, covering risk identification, the probability-impact matrix, the four negative and four positive response strategies, and expected monetary value calculations. Expect scenario questions that ask which response fits a given probability and impact, or that ask you to compute EMV for a decision.

Risk management is one exam domain out of many we drill in ThinkLouder's live online PMP prep: 35 hours, taught live by PMI Authorized Training Partner instructors, with a 100% money-back pass guarantee. See upcoming cohorts →
Want more practice? Try On the Spot, our earned value management game, or Telephone Tree, our communication channels game, or browse all practice games.
How to play
Risk Expedition

You're running an 8-week project. Every week a new risk shows up, and you've got 10 tokens to spend keeping the project alive.

1
Each risk shows its probability and its impact on budget and stakeholder trust, plotted on a probability-impact matrix.
2
Pick a response: Avoid (3 tokens, eliminates it), Transfer (2 tokens, caps damage if insurable), Mitigate (1 token, halves probability and impact), or Accept (free, take the full hit if it lands). Hover any response to preview its effect before you commit.
3
A dice roll decides whether the risk hits. Survive all 8 weeks with budget and trust both above zero.
The principle: the response should cost roughly what the risk is worth. Spend big tokens on big risks; don't waste them on small ones.