Project Risk Treatment and Action Plans

Why the Best Response Strategy Is Not Always the Most Obvious One

The average project manager considers responses to each high-priority risk. Better project managers evaluate all four response strategies for each risk. The best project managers go further — they consider three additional decision factors that determine not just what to do about a risk, but when to do it and how to document and track the chosen approach.

Choosing a risk response is not a simple matching exercise. It requires balancing financial trade-offs, assessing secondary risk introduction, evaluating timing constraints, and building a response plan robust enough to survive the pressures of day-to-day execution. This article addresses both the art of choosing the right response and the discipline of documenting it in a plan that drives action.

Three Critical Factors in Choosing a Response Strategy

Factor 1: Triple Constraint Trade-Offs

Every risk response involves trade-offs between time, scope, and cost. The question is not just "how do I address this risk?" but "which constraint am I willing to flex to protect the others?"

As the saying goes, you can spend money to save time — but that is not always the best approach. The optimal trade-off depends on which constraint your stakeholders are most sensitive to.

Factor 2: Secondary Risks Introduced by the Response

Risk responses can — and frequently do — introduce new risks to your project. These secondary risks must be identified and assessed as part of the response selection process.

For example, engaging a second vendor to mitigate supply chain risk may reduce your supply disruption probability, but it introduces contract management risks (coordinating two vendors), quality consistency risks (ensuring both vendors meet the same specification), and intellectual property risks (sharing design information with an additional party).

The introduction of secondary risks does not automatically disqualify a response strategy. It simply means you must evaluate the secondary risks and determine whether the net risk position after implementing the response is genuinely better than the original risk.

Factor 3: Timing of the Decision and Execution Speed

A frequently overlooked factor in response selection is when you need to commit to the response and how quickly it can be executed.

Consider two response options for the same risk:

• Option A costs AUD 4,000 but takes two months to implement. You must commit to it well before you know whether the risk will actually materialise.
• Option B costs AUD 4,500 but can be executed immediately before the risk is expected to occur. You can wait longer before deciding.

If both options have an equal chance of reducing the risk's impact, Option B may be preferable despite being slightly more expensive. Option B gives you more decision flexibility — you can wait to see whether the risk is genuinely materialising before spending money on the response. If the risk dissipates on its own, Option B saves you the entire cost. Related consideration: Speed of approval. If two options are similar in cost and effectiveness, choose the one you can execute more quickly. This gives you more time to gather information before committing, and more flexibility to adjust your approach as conditions evolve.

Building the Risk Response Plan

With your response strategies selected, the next step is to compile them into a Risk Response Plan — a structured document that captures your risks, analysis, response strategies, and the timing and accountability for executing those strategies. This plan transforms your risk analysis from an intellectual exercise into an actionable management tool.

Fundamental Elements of the Response Plan

Element 1: Risk Details For each risk, include the risk description (cause-event-impact statement), the identified causes, the potential impacts, and the triple constraint elements affected.

Element 2: Analysis Results Include both the qualitative assessment (probability/impact ratings, priority zone) and the quantitative analysis (EMV calculation, cost estimates).

Element 3: Response Strategy and Actions Document the selected response strategy (Avoid / Transfer / Mitigate / Accept) and the specific actions required to implement it. Where more than one response is being considered, include both primary and secondary response plans.

Element 4: Contingency Reserves and Contract Actions If executing your response plans involves drawing on contingency reserves or taking contractual actions with vendors (invoking contract clauses, activating alternate supply agreements), document these specifically.

Elevating the Response Plan into a Control Document

The elements above create a competent response plan. The following additions transform it into a powerful control document:

Timing milestones. For each risk, specify two critical dates:

1. Assessment date — when you will check the status of the risk to determine whether the response action needs to be executed
2. Decision deadline — the latest date by which you must commit to executing the response action (after this date, the response can no longer be implemented in time)

These dates should be added as tasks in your project schedule and assigned to specific individuals.

Vendor and external dependency check dates. For risks involving external parties, specify when you will check on the status of products, deliverables, or commitments not under your direct control. Defence context: Consider a scenario where two specialist systems engineers are due to join your integration team at a critical project phase, but they are currently assigned to another program. Your response plan should include two timing milestones: (1) a status check date — when you will assess whether the other program is running on schedule and whether the engineers will be released on time; and (2) a decision deadline — the latest date by which you must go to the external market to contract replacement engineers if the internal resources will not be available.

Defence and Heavy Engineering Application: A Response Plan in Action

On a naval patrol vessel construction program, a sample risk response plan entry might read:

Risk PV-023: Propulsion gearbox long-lead-time delivery delay

Common Pitfalls

Pitfall 1: Building a plan that sits in a drawer. A response plan that is not actively monitored and executed is a planning exercise, not a management tool. Ensure timing milestones are in your project schedule and assigned to named individuals. Pitfall 2: Ignoring the timing dimension. Two response options that look identical in cost and effectiveness may be dramatically different in timing. Always consider when you need to commit and how long the response takes to implement. Pitfall 3: Failing to identify secondary risks from your responses. Every response action should be assessed for the new risks it introduces. These secondary risks must be documented and managed. Pitfall 4: Not including both assessment and decision dates. Assessment dates tell you when to check the risk's status. Decision deadlines tell you when you must act. Both are essential for proactive risk control. Pitfall 5: Creating an overly complex plan. The response plan should be detailed enough to drive action but concise enough to be maintained. If updating the plan takes longer than managing the risks, simplify your approach.

Key Takeaways

• Choosing the right response strategy requires evaluating triple constraint trade-offs, secondary risk introduction, and timing/execution speed — not just the four strategy options.
• The Risk Response Plan documents risk details, analysis results, response strategies, actions, contingency reserves, timing milestones, and accountability assignments.
• Timing milestones — assessment dates and decision deadlines — transform the plan from a static document into a proactive control tool.
• Response strategies that provide greater decision flexibility (allowing you to wait longer before committing) are often preferable even if slightly more expensive.
• In defence and heavy engineering, response plans integrate with the Integrated Master Schedule, EVM systems, and contractual mechanisms including LD flow-down and management reserve drawdown.
• The plan is only valuable if it is actively monitored, regularly updated, and directly linked to project schedule tasks.

Documenting Responses in the Risk Register

Every response strategy must be recorded in the Risk Register. The original an illustrative event project plan documented mitigation actions in narrative form within the body of the report — this is useful for communicating context but insufficient for operational management.

The register should be updated with these additional fields:

Why Risk Treatment Plans Fail Without Action Plans

A risk register identifies threats. A risk evaluation worksheet selects treatment strategies. But neither of these documents answers the question that matters most to the people who must actually do something: "Specifically, what needs to happen, by whom, with what resources, by when, and how will we know it worked?"

In heavy engineering and defence projects, where risk treatment actions can involve capital expenditure, regulatory submissions, supplier qualification programs, and cross-functional coordination, the gap between "we have decided to mitigate this risk" and "the mitigation is actually implemented" can be months or years. The Risk Action Plan closes that gap with accountability, deadlines, and performance measures.

Bringing It All Together: The Complete Risk Management Process Flow

The illustrative event project plan attempted elements of each process but did not execute them in sequence, did not connect them through a shared risk register, and did not establish the iterative feedback loop (11.6 → 11.2) that keeps the system alive.

The assessor's feedback, when decoded, was requesting exactly this: a demonstrated understanding of the complete risk management process as defined in PMBOK, applied systematically using the tools and techniques from the course, and documented in a traceable, auditable manner.

From Strategy to Documentation: Controls and Treatment Plans

The Controls Register — Documenting What's Already in Place

Before planning new responses, the project team must understand what controls are already in place and whether they are working. The Controls Register is the document that captures this information.

The Controls Register structure is straightforward:

The value of the Controls Register lies in forcing an honest assessment of current risk exposure. Many project teams discover, when they actually document existing controls, that:

• Controls exist on paper but are not consistently implemented
• Controls address only part of the risk (e.g., prevention but not detection)
• Controls were designed for a previous project phase and are no longer relevant
• Multiple overlapping controls exist for some risks while other risks have no controls at all

Worked Example — Site Security Controls

Consider the "Trespassers" risk from a construction site. The Controls Register documents four existing controls:

These controls fall into two categories:

Preventive controls (reduce the likelihood of the risk occurring):

• Visitor reporting requirement
• Building locking procedures

Detective controls (reduce the time to detect and respond when the risk occurs):

• No trespassing signage (deterrence + legal basis for prosecution)
• Intruder alarms and security lighting

The risk register's assessment that implementation is "Inadequate" might reflect that staff are not consistently locking buildings, that the visitor reporting requirement is not enforced at all entry points, or that the intruder alarm system has not been tested recently. This assessment drives the need for a Treatment Plan.

The Treatment Plan — Documenting What Will Be Done

The Risk Treatment Plan documents the response actions for risks that require further intervention beyond existing controls. It is the action plan that closes the gap between current residual risk and the target risk level.

The Treatment Plan structure captures the full decision-making chain:

Worked Example — Trespasser Treatment Plan

For the P1 Trespassers risk, the Treatment Plan documents four treatment options:

Treatment 1 — Security Guards at Events

• Preferred option: Yes
• Cost/benefit: Direct charge per event
• Risk rating after treatment: Medium
• Responsible: Site Manager
• Timeline: Immediate implementation

Treatment 2 — Comprehensive Visitor Management Policy

• Possible option: New visitor policy — all visitors report to reception, fill in visitors' register, receive identification tags, are escorted to venue, and escorted back to sign out and return tags. Anyone without identification to be challenged. All staff to wear identification tags.
• Preferred option: Visitors report to reception, receive and return identification tags. Anyone without tags to be challenged. All staff to wear tags.
• Cost/benefit: Plastic tags produced at minimum cost and recyclable
• Risk rating after treatment: Medium
• Responsible: Site Office
• Timeline: Immediate implementation

Treatment 3 — Equipment Security

• Possible option: Secure all equipment — strap computers to desks, store valuables in locked areas
• Preferred option: All valuables stored in secure storerooms
• Cost/benefit: Minimal cost and resource demands
• Risk rating after treatment: Medium
• Responsible: Project Manager
• Timeline: Completed by specified date

Treatment 4 — Physical Security Upgrades

• Possible option: Security areas to have metal grilles fixed to windows and deadlocks fitted to doors
• Preferred option: Upgrade existing secure storerooms
• Cost/benefit: Minimal cost for maximised benefit
• Risk rating after treatment: Medium
• Responsible: Site Manager
• Timeline: Completed by start of next project phase