Risk Mitigation Plan (Risk Response Plan)

Purpose

The risk mitigation plan (also sometimes referred to as a risk response plan) communicates how specific risks will be dealt with and the action steps that are required to carry them out. It gives team members a clear sense of the actions that they are expected to take and provides management with an understanding of what actions are being taken on their behalf to ameliorate project risk.

Application

The plan is frequently applied in the project management software as a series of tasks in addition to those that were on the original activity list. The risk mitigation plan may also identify specific triggers, which are events that spur action based on the escalating proximity of a given risk. As risks become imminent, the risk mitigation plan identifies what actions should occur and who is responsible for implementing those actions.

Content

The risk mitigation plan is a list of specific actions being taken to deal with specific risks. It often lists the names of the individuals responsible for carrying out those actions, as well. Ideally, it is an evolutionary document, capturing information on the outcomes of the risk strategies for future reference.

It can be developed in a tabular format in a spreadsheet or in project management software, using the supplemental text fields that are available in most software packages. The latter approach is particularly effective when risks are identified and associated with specific work packages within the work breakdown structure.

The plan may include guidance on how to write risk event statements, as well as how to write strategy or response statements. In general, both are significantly enhanced when written as full sentences detailing the nature of the risk and/or strategy under consideration.

Approaches

In defining risk responses or mitigation strategies, the Project Management Institute acknowledges four basic approaches: avoidance, acceptance, mitigation, and deflection. Whatever approaches are applied, definition of terms will be essential in crafting a sound mitigation plan. The document should incorporate reference to the terms and what they mean:

Responsible

Avoidance: To eliminate the conditions that allow the risk to be present at all, most frequently by dropping the project or the task.

Acceptance: To acknowledge the risk’s existence, but to take no preemptive action to resolve it, except for the possible development of contingency plans should the risk event come to pass.

Mitigation: To minimize the probability of a risk’s occurrence or the impact of the risk should it occur.

Deflection: To transfer the risk (in whole or part) to another organization, individual, or entity.

The risk mitigation plan or risk response plan should also include some guidance on the frequency of updates to the documentation.

Considerations

If the risk mitigation or risk response plan is maintained separately from the project plan as a whole, it will be treated as a separate level of effort. Ideally, it should be integrated with other project plan documentation to ensure that it becomes part of the routine associated with project planning.