Skip to content
FR

Plan and Manage Risk

Step 50 of 57

Respond to, Monitor, and Communicate Risks

Introduction

This lesson covers the second half of task 5 of the Business Environment domain in the July 2026 PMP Examination Content Outline: planning and executing risk responses, preparing contingency and fallback plans, monitoring and controlling risks, and communicating risk status and impact. Business Environment carries 26% of the exam. The outline mentions executing the risk management plan for security and sustainability risks, so expect scenarios that include them.

A risk list has no value until someone acts on it. The exam tests situations such as: a high-ranked threat needs the best response among four; a response creates a new risk; a trigger fires and a contingency plan must be launched; the reserve is nearly spent; the sponsor wants a clear statement of the risk exposure. After this lesson you will be able to select and justify responses, assign owners, run risk reviews, and report exposure in a way that supports decisions.

Learning objectives

  • Select response strategies for threats, opportunities, and overall project risk.
  • Plan contingency and fallback responses, triggers, and reserves.
  • Identify residual and secondary risks.
  • Execute and monitor the risk response plan, including security and sustainability risks.
  • Perform risk reviews, audits, reserve analysis, and technical performance measurement.
  • Communicate risk status and impact to stakeholders in the right form.
  • Apply risk practices in agile and hybrid projects.

1. Planning risk responses

For each risk that needs action, the team chooses a response, an owner, and the resources. The response should be appropriate to the significance of the risk, cost-effective, realistic, agreed by the parties, and owned by one person.

Strategies for threats

Strategy Meaning Example
Escalate The threat is outside the project's scope or authority, so it goes to a higher level A change in company policy that the project cannot influence is passed to the program board
Avoid Change the plan to remove the threat or protect objectives from it Drop an unproven technology and use a proven one
Transfer Shift the impact and responsibility to a third party, usually with a fee; the risk does not disappear Insurance, a fixed-price contract, warranties, performance bonds
Mitigate Reduce the probability or impact Build a prototype, add testing, train staff, add redundancy
Accept Acknowledge the risk and take no action unless it occurs; passive acceptance records it, active acceptance sets aside a contingency reserve or a fallback Accept a small probability of minor delay

Strategies for opportunities

Strategy Meaning Example
Escalate The opportunity is beyond the project's authority A reusable solution could help other programs
Exploit Make sure the opportunity happens Assign the best engineers to shorten a task
Share Partner with a third party to capture the benefit A joint venture with a specialist
Enhance Increase the probability or the impact Add resources to finish early and earn a bonus
Accept Take advantage if it occurs, without pursuing it Benefit from a falling price if it happens

Overall project risk responses

The same families of strategies apply to overall project risk: avoid (cancel or restructure a project that is too risky), exploit, transfer or share, mitigate or enhance, and accept. Examples: add contingency to the whole project, or set a stage gate to confirm assumptions before more money is committed.

Contingency and fallback

  • Contingency plan: a response prepared in advance and used only if a trigger event occurs. It is stored with the risk, with triggers and the person who decides.
  • Fallback plan: an alternative to be used if the first response is not effective.
  • Workaround: an unplanned response to a risk that has occurred and had no plan.
  • Contingency reserve: money or time for identified risks, in the baselines.
  • Management reserve: for unidentified risks, held outside the baselines and released through change control.

Residual and secondary risks

Every response should be examined for two things. Residual risk is what remains after the response; if it is still above the threshold, plan more action or accept it explicitly with the sponsor. Secondary risk is a new risk created by the response, for example outsourcing a task to reduce technical risk adds vendor performance risk. Add both to the register with their own owner and response.

Worked example: choosing a response

Scenario. A renewable-energy company builds a monitoring portal over 9 months with a budget of 900,000. Risk R-07: the single available specialist in a niche protocol may be reassigned to another project (probability 40%). If she leaves, the schedule slips by 6 weeks and the rework costs 60,000. EMV = 0.40 x 60,000 = 24,000. Options:

a. Do nothing and accept. b. Pay a retention bonus of 8,000 and agree her allocation with her manager (mitigate: reduces probability to 10%). c. Train a second engineer for 15,000 (mitigate: reduces impact to 10,000). d. Contract a consultancy for the protocol work at 70,000 (transfer). e. Change the design to use a standard protocol, with extra design cost of 20,000 (avoid).

Step 1: compute the total exposure of each response. (a) 24,000. (b) 0.10 x 60,000 = 6,000 residual plus 8,000 cost = 14,000. (c) 0.40 x 10,000 = 4,000 plus 15,000 = 19,000. (d) Mostly transferred, but at a cost of 70,000, far above the exposure. (e) 20,000 for avoidance, plus new design risk.

Step 2: compare. Option b has the lowest total exposure (14,000 against 24,000 for doing nothing). Option c gives resilience and knowledge transfer. Option d costs more than the exposure.

Step 3: check residual and secondary risks. For b, a 10% residual risk remains and the bonus may create resentment in the team. For c, the second engineer's time is taken from other tasks.

Step 4: decide and document. Choose b, and add c as an action triggered if "manager requests her reassignment" appears. Name an owner (the resource manager), the trigger, the budget (8,000 from the contingency reserve), the date, and the review frequency.

Why not the others? A response that costs more than the exposure is not cost-effective; accepting a 24,000 exposure without action may conflict with a risk-averse sponsor; avoidance may create new design risks.

2. Executing the risk response plan

Execution means carrying out the agreed actions and updating the project accordingly.

  • Implement preventive responses early: mitigation, avoidance, and transfer are done before the risk occurs, so they become tasks in the schedule or backlog with owners, effort, and dates.
  • Watch for triggers and launch contingency or fallback plans when they occur.
  • Use the reserves according to the policy. Record each use; if the contingency reserve for a risk is insufficient, ask for more through change control or the management reserve.
  • Coordinate with other plans: a response may need a change request, a procurement action, a communication, or a stakeholder meeting.
  • Update the register and the baselines after each action and each occurrence.
  • Include the team: each risk owner reports status, and team members raise new risks as they work.

Security and sustainability in execution

For security risks, responses are technical and organizational: patch management, access control, encryption, third-party assessments, incident response rehearsals, and vendor security clauses. For sustainability risks: energy-efficient design, supplier criteria, recycling and disposal planning, and measurement of the environmental indicators in the success metrics. Treat these as normal risk responses with owners, costs, and triggers, linked to the compliance requirements covered in the compliance lesson.

Risks in agile projects

  • Risky items go early in the backlog so that uncertainty is reduced sooner (risk-based prioritization).
  • Spikes are time-boxed experiments to learn about an unknown.
  • Short iterations and frequent demonstrations expose risks early.
  • The team reviews risks in planning, daily meetings, reviews, and retrospectives.
  • A visible risk board or risk burn-down shows the exposure over time.
  • The product owner balances value and risk when ordering the backlog.

3. Monitoring and controlling risks

Monitoring checks that the responses are carried out, that their effect is as expected, and that the risk profile is changing as foreseen. It also finds new risks.

Activity Purpose
Risk reviews Regular meetings to reassess each risk, its status, and the response; frequency set in the plan
Risk audits An independent check of how effective the risk process and responses are
Reserve analysis Compare the remaining contingency reserve with the remaining risk; decide whether the reserve is adequate
Technical performance measurement Compare technical achievements with the plan (response time, capacity); a deviation signals a risk
Variance and trend analysis Observe cost and schedule indicators; a declining trend can reveal an emerging risk
Status meetings Include risk in the agenda of every status meeting
Triggers and indicators Compare against warning signs set in the register

Decisions in control:

  • Close a risk when it can no longer occur or its time has passed.
  • Update probability and impact with new information.
  • Add new risks and secondary risks.
  • Release unused reserves when the associated risks are closed, according to the policy.
  • Raise change requests for corrective or preventive actions that alter plans.
  • Document lessons learned.

Reserve analysis example

At the start, the contingency reserve was 150,000. At month 6, 45,000 has been used on two risks that occurred. The register shows remaining open risks with a total EMV of 130,000. Remaining reserve = 150,000 - 45,000 = 105,000, lower than the EMV of 130,000, a gap of 25,000. The project manager reports the shortfall, proposes options (additional mitigation, reduced scope, more contingency), and uses the change process if the baseline changes.

Worked example: a trigger fires

Scenario. A project to open a new store has risk R-12: the building permit may be delayed (probability 30%). The contingency plan: rent a temporary pop-up space for 3 months (cost 45,000). The trigger: no permit decision by 30 April. The fallback plan: negotiate a longer lease at the old location. The contingency reserve for this risk is 45,000. On 30 April the permit is still pending, and the city says the review takes 8 more weeks.

Step 1: confirm the trigger. The date is reached and the information is verified with the city department.

Step 2: treat as an issue and launch the response. The risk has become an issue. The project manager obtains the approval specified in the plan (the sponsor, for use of the reserve) and executes the contingency plan: sign the pop-up lease.

Step 3: update the project. Reduce the contingency reserve by 45,000 and record it; update the schedule, cost forecast, and risk register (R-12 occurred); look for secondary risks: the pop-up may have lower traffic, and staff must be moved.

Step 4: monitor effectiveness. Track sales at the pop-up and permit progress weekly. If the permit is not issued within 8 weeks, activate the fallback: the longer lease at the old location.

Step 5: communicate. Inform the sponsor, the store managers, the marketing team, and the landlord of the new date, the cost, and the effect on opening.

Why not wait for the permit? Waiting costs lost revenue and a longer idle period. Why not redesign the plan from scratch? A prepared contingency is faster and cheaper than an improvised workaround.

4. Communicating risk status and impact

Risk information is useful only when the right people see it, in a form they can act on. The communications plan defines audience, content, frequency, and channel.

Audience Needs Typical form
Sponsor and steering committee Overall exposure, top risks, decisions requested, reserve status One-page dashboard, exposure trend
Risk owners Their risks, actions, triggers, due dates Register extract, task list
Team Current risks that affect daily work, new risks to watch Risk board, daily meeting
Customers and suppliers Risks that touch their obligations Targeted reports, joint reviews
Regulators or auditors Compliance and control evidence Formal reports

Good risk reporting:

  • States the overall risk exposure and its trend, not only a list.
  • Shows the top 5 to 10 risks with probability, impact, owner, response status, and next step.
  • Includes risks that have become issues and what was done.
  • Reports reserve usage and remaining reserve compared with exposure.
  • Indicates decisions needed from stakeholders, with dates.
  • Uses plain language and visual tools such as heat maps and trend arrows.
  • Is honest: do not hide bad news or present false certainty.

Tailor the tone to the culture and the stakeholder's risk appetite, but never conceal material information. Transparency builds trust and allows early decisions.

5. Common pitfalls and exam tips

Common pitfalls

  • Choosing a response without comparing its cost with the risk exposure.
  • Treating transfer as elimination; the risk remains, and the contractor's failure still affects you.
  • Forgetting residual and secondary risks.
  • Not assigning an owner, or assigning a group.
  • Waiting for the problem rather than watching triggers.
  • Spending management reserve without change control.
  • Running risk reviews without updating the register or reporting results.

Exam tips

  • Exam tip: Match the strategy to the wording: insurance or a fixed-price contract is transfer; extra testing is mitigate; changing the approach is avoid; setting aside a reserve with no other action is active acceptance.
  • Exam tip: For opportunities use exploit, share, enhance, escalate, and accept; not avoid or mitigate.
  • Exam tip: If a response creates a new risk, it is a secondary risk and must be registered.
  • Exam tip: When a risk with a plan occurs, use the contingency plan; when none exists, use a workaround.
  • Exam tip: A response that needs a baseline change goes through integrated change control.
  • Exam tip: In agile projects, reduce uncertainty early with spikes and by prioritizing risky items.

Comparison: key response types

Plan Trigger When used Funded by
Mitigation action None, done in advance Before the risk Project budget or contingency reserve
Contingency plan Yes If the event occurs Contingency reserve
Fallback plan Failure of the first response If the response is not effective Contingency or management reserve through control
Workaround After the event No plan existed Management reserve if unidentified

Mini case study

Case. You manage a mobile payments app with a 1,200,000 budget and a 100,000 contingency reserve, of which 70,000 remains. The register includes: R-03, a third-party fraud detection service may be unavailable at peak (probability 25%, impact 80,000); R-05, the app store may reject the release for privacy reasons (probability 15%, impact 60,000 and 3 weeks); R-09, an opportunity to capture 200,000 of extra sales if you finish 4 weeks early (probability 20%). Today the third-party service announces a migration in two months, and a penetration test found a vulnerability in token storage. The steering committee meets in two days and the sponsor asks for "the risk situation".

Question. What do you do?

Solution (commented).

  1. Treat the vulnerability as an issue, since it exists: log it, assign an owner, fix it with priority, and re-test. Look for secondary risks (release delay). If the fix changes a baseline, raise a change request.
  2. Update R-03: the migration raises the probability, say to 40%, so EMV = 0.40 x 80,000 = 32,000. Mitigate with a redundant provider (30,000, residual exposure low) or transfer through a service-level agreement with penalties. Document the decision with the sponsor and use the contingency reserve.
  3. R-05: mitigate with a pre-submission privacy review (5,000) and prepare a contingency plan for rapid resubmission; trigger: first rejection notice.
  4. R-09 (opportunity): consider enhancing or exploiting it, but never at the expense of the security fix.
  5. Reserve analysis: 70,000 remaining against planned spending of 35,000 plus an issue fix and residual exposure: little margin. Report a possible shortfall and options.
  6. Communicate: a one-page report for the steering committee with exposure, top risks, the issue and its fix, reserve position, the opportunity, and decisions requested (approve the redundant provider, confirm security over early launch).
  7. Do not hide the vulnerability, spend management reserve without change control, or promise the early launch before the fix.

Key terms

  • Mitigate: reduce the probability or impact of a threat.
  • Avoid: change the plan to eliminate a threat.
  • Transfer: shift the impact of a threat to a third party.
  • Accept: acknowledge a risk and not act in advance.
  • Escalate: pass a risk outside the project's authority to a higher level.
  • Exploit, share, enhance: strategies for opportunities.
  • Contingency plan: a response launched when a trigger occurs.
  • Fallback plan: an alternative if the first response fails.
  • Workaround: an unplanned response to a risk that occurred.
  • Residual risk: risk that remains after a response.
  • Secondary risk: a new risk caused by a response.
  • Reserve analysis: comparing remaining reserve with remaining risk.
  • Risk audit: independent examination of risk process effectiveness.

Summary checklist

  • I choose responses for threats and opportunities that are cost-effective and owned.
  • I prepare contingency and fallback plans with triggers and reserves.
  • I register residual and secondary risks.
  • I execute preventive responses early and launch contingency plans when triggers fire.
  • I review risks regularly, audit the process, and analyze the reserve.
  • I handle security and sustainability risks as normal risks with owners and actions.
  • I raise change requests when responses alter baselines.
  • I communicate exposure, top risks, reserves, and decisions needed, honestly and clearly.
  • I apply early, risk-driven practices in agile and hybrid projects.

Official sources