How do you decide when to accept a risk?

1 Risk response strategies

The four main risk response strategies are avoid, transfer, mitigate, and accept. Each has a different effect on risk exposure, which is the product of probability and impact. Avoiding the risk or its source reduces exposure to zero, but there may be negative consequences like increased costs or delays. Transferring the risk or its consequences to a third party reduces exposure for you, but it involves a cost or trade-off. Mitigating the probability or impact of the risk reduces exposure to a lower level, but requires resources, time, and effort. Accepting the risk and its potential consequences implies a willingness to tolerate the risk and its uncertainty.

2 Risk assessment matrix

How do you choose the best risk response strategy for each risk? A useful tool is the risk assessment matrix, which plots the probability and impact of each risk on a grid, and assigns a risk level (low, medium, or high) based on a threshold or a scale. The risk assessment matrix helps you prioritize the risks and decide which ones need more attention or action.

For example, a simple risk assessment matrix may look like this:

| Impact | Low | Medium | High |

| Probability | Low | Low | Medium | High |

| Medium | Low | Medium | High | High |

| High | Medium | High | High | High |

3 Risk response plan

Based on the risk assessment matrix, you can develop a risk response plan, which documents the chosen strategy for each risk, the actions or measures to implement it, the roles and responsibilities of the involved parties, and the expected outcomes or indicators. The risk response plan should also include a contingency plan, which outlines the alternative actions or resources to use in case the risk occurs and the primary response fails or is insufficient.

For example, a risk response plan may look like this:

| Risk | Strategy | Actions | Roles | Outcomes |

| A: Delay in delivery due to supplier issues | Transfer | Contract with a backup supplier and include a penalty clause for late delivery | Project manager: negotiate and sign the contract; Supplier: deliver on time or pay the penalty | Reduced risk exposure; Guaranteed delivery date or compensation |

| B: Increase in costs due to market fluctuations | Mitigate | Monitor the market trends and adjust the budget accordingly; Seek discounts or subsidies from vendors or sponsors | Project manager: oversee the budget and the market analysis; Finance manager: secure the funds and the discounts | Reduced risk exposure; Optimized budget and cash flow |

| C: Dissatisfaction of customers due to quality issues | Avoid | Conduct regular quality checks and tests; Implement feedback mechanisms and improvement processes | Quality manager: ensure the quality standards and the customer satisfaction; Project team: perform the checks and tests; implement the feedback and improvement | Eliminated risk exposure; Enhanced quality and customer loyalty |

| D: Change in regulations or policies affecting the project | Accept | Identify and document the potential changes and their implications; Prepare a communication and advocacy plan to inform and influence the stakeholders | Project manager: coordinate the communication and advocacy plan; Legal advisor: provide guidance and advice on the regulatory or policy changes | Accepted risk exposure; Increased awareness and readiness |

4 Risk monitoring and review

The risk response plan is a dynamic and iterative process, so you need to monitor and review the risks and responses regularly, updating them as needed. You should also evaluate the effectiveness and efficiency of the strategies, learning from successes and failures to improve your risk management skills and practices. To do this, define and collect relevant data and information on the risks and responses. Then, analyze the data using qualitative and quantitative methods, such as charts, graphs, tables, surveys, interviews, or audits to identify trends, patterns, gaps or issues. Afterwards, report and communicate your findings and recommendations in clear formats such as reports, dashboards, presentations or meetings. Finally, update and improve the risk response plan based on your findings and stakeholder feedback. This will help ensure that the plan is relevant, realistic, and effective.

5 Risk acceptance criteria

When should you accept a risk, rather than avoid, transfer, or mitigate it? This decision is determined by various factors, such as the project or business context, the stakeholders’ expectations, and the available resources and capabilities. In general, you should accept a risk if the exposure is low or acceptable, the response is costly or impractical, or the opportunity is high or attractive. Making this decision is not easy; it requires a systematic approach, sound judgment, and an adaptive attitude.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?