At a glance

A risk response is a deliberate choice about an uncertain event that could affect a project objective. For a threat, you try to prevent or limit harm. For an opportunity, you consider whether to secure or improve a potential gain.

Remove
Change the plan so the threat cannot arise, or take action to secure an opportunity.
Change
Reduce a threat’s probability or impact; improve an opportunity’s probability or benefit.
Pass on
Arrange for another party to carry some exposure or help capture the benefit. Check what remains yours.
Keep
Accept the remaining exposure deliberately. Name a trigger and prepare a contingency where needed.
Escalate
If the response exceeds your authority, secure a decision from someone who can own it.

When to use it

Use it when…

You have a specific uncertain event, an objective at stake, and a decision to make about action or spending. Use it when reviewing a risk register, comparing supplier arrangements or preparing a delivery gate.

Do something else when…

The event has already happened: manage the issue and recovery. If the risk statement is vague, clarify the cause and consequence first. If an obligation dictates the action, a cheap expected cost does not override it.

How to use it

  1. Make the uncertainty specific.Write the cause, the possible event and the effect on an objective. Separate your evidence from your assumptions about probability and impact.
  2. Compare real options.Include deliberate acceptance as a baseline. Compare cost, time, expected benefit and the worst credible outcome. Look for new risks introduced by each response.
  3. Give the decision an owner.Agree the action, budget, deadline and authority. A transferred cost does not necessarily transfer responsibility for delivery.
  4. Prepare for what remains.Record residual exposure, a trigger for the contingency plan and the resources it needs. Escalate anything beyond your decision rights.
  5. Revisit the assumptions.Check whether the action happened and changed the exposure. Review when evidence or the project changes; close the risk when it can no longer occur.

Worked example: an integration delay

A city team is moving resident parking permits online. A payment integration may arrive late. The estimated chance is 40%, with €30,000 of extra work if it happens. Weekly integration tests cost €5,000 and are estimated to reduce the chance to 15%.

Accept the exposure€12,000

40% × €30,000
Expected loss

Test and retain residual risk€9,500

15% × €30,000 + €5,000
Expected loss + response cost

The response improves expected cost by €2,500, if those estimates hold. This supports testing; it does not guarantee a saving on this one project.

Finish the decision, not just the calculation.

Assign the integration lead to organise the tests and report failures. Prepare a manual-payment fallback if the gateway is unavailable. Confirm that the team could still absorb the full delay cost, and set a review point for the probability estimate.

See how expected monetary value works.

Common pitfalls

  • Choosing a label instead of an action. “Reduce” needs a named activity, a budget and an owner.
  • Treating a contract as the end of risk work. A supplier can owe compensation while your project still misses its objective.
  • Forgetting residual and secondary risks. Testing lowers one exposure but consumes time and may reveal more work.
  • Using an average to justify an intolerable outcome. Financial efficiency is one input to judgement, alongside affordability, obligations and risk appetite.
  • Escalating without acceptance. Confirm who has taken the decision and who continues to monitor it.

Where the bodies place it

These are reading pointers, not a claim that the qualifications are equivalent.

IPMA® — Individual competence baseline

ICB4 §4.5.11 addresses identifying, assessing and responding to uncertainty. EMV is included among the supporting techniques.

Read the official source

PMI® — Guide and exam outline

The eighth-edition guide includes a risk performance domain. The July 2026 exam outline places risk and issue work in Business Environment, tasks 4 and 5.

Read the official source

APM — Qualification handbook

The qualification handbook covers risk and issue work in objective 23, including response choices and contingency planning. This is a topic pointer, not an exam weighting.

Read the official source

Guide context: the official eighth-edition guide overview. Checked 27 September 2026.

Attribution & source

The remove / change / pass on / keep grouping is the series’ own teaching synthesis, by fannarmaximus; it is not a proprietary model or a framework invented by any one certification body.

Adapted from the series’ risk-responses model sheet. The underlying risk-response practices are documented by the organisations linked above; no single historical originator is claimed. No proprietary figure is reproduced.