“Risk Mitigation Strategies: 5 Types With Examples”

What are the five risk mitigation strategies?

The five strategies come from the risk response planning process in PMI’s PMBOK Guide, and they are the vocabulary most project teams share. Each one changes something different: the plan, the probability, the impact, the ownership, or nothing at all.

Two clarifications before the details. “Risk mitigation strategies” is often used loosely to mean all five responses; in the PMBOK vocabulary, mitigate is only one of them. And the same risk can carry more than one response: you might mitigate the probability, transfer part of the impact, and accept the remainder.

> Important note: A response is not a strategy until it has an owner and a date. “We will monitor it” is an observation, not a response, and it belongs in the accept category only if someone has consciously decided to hold the risk.

How does avoidance work?

Avoidance eliminates the threat by changing the plan so the risk cannot occur. It is the only strategy that takes the probability to zero, and it is usually the most expensive in opportunity terms.

Avoidance looks like this in practice: removing a feature from a release, choosing a proven technology instead of an experimental one, declining a client whose payment terms would break your cash flow, or building on a site with no flood exposure.

The trap is that avoidance is often cheap to describe and expensive to live with. Dropping a feature removes a delivery risk and adds a competitive risk. Changing a supplier removes a quality risk and adds a switching cost.

Worked example: dropping a feature

A team is building a real-time collaboration feature with an unproven sync layer. Engineering estimates a 45% chance of a rework cycle costing $120,000, plus a 30% chance of a two-month delay worth $60,000 in delayed revenue.

• Rework EMV: 0.45 × $120,000 = $54,000
• Delay EMV: 0.30 × $60,000 = $18,000
• Combined exposure: $72,000

Dropping the feature avoids $72,000 of expected cost. But the feature was forecast to generate $150,000 of annual revenue at 55% confidence, an expected $82,500. Avoidance is still the better decision here, because the revenue is uncertain and the cost is not, but notice that the case had to be argued rather than assumed.

How does mitigation work?

Mitigation reduces the probability of the risk, the impact if it happens, or both. It is the most common response and the easiest to do badly, because “we will be careful” is not mitigation.

Real mitigation changes a number:

• Reduce probability: prototype the integration before committing, run a paid pilot, require a certification, add a second qualified supplier, lock the design earlier.
• Reduce impact: keep a buffer in the schedule, hold spare capacity, stage the rollout by region, insure the gap, split a large release into smaller ones.

The test for a proposed mitigation is arithmetic. Estimate the probability and impact before and after, and compare the reduction in EMV with the cost of the response. If the response costs more than the expected loss it removes, you are buying comfort rather than control.

Worked example: dual sourcing

A hardware project depends on a single supplier for a component. Delivery failure would cost $180,000 in expediting, penalties, and lost margin. The supplier’s reliability history suggests a 30% chance of missing the date.

• Current exposure: 0.30 × $180,000 = $54,000
• Qualifying a second supplier costs $22,000 and drops the failure probability to 8%
• New exposure: 0.08 × $180,000 = $14,400
• Total with response: 14,400 + 22,000 = $36,400
• Net benefit: 54,000 − 36,400 = $17,600

The response is worth doing, but only because the mitigation is cheap relative to the loss. At $45,000, the same mitigation would cost more than it saves, and acceptance with a contingency plan would be the rational choice.

How does transfer work?

Transfer moves the financial consequence of a risk to another party. It does not remove the risk, and it rarely reduces the expected cost. What it changes is who absorbs the variance.

Common instruments: insurance, fixed-price contracts, performance bonds, warranties, service-level agreements with credits, and outsourcing arrangements with liability caps.

The honest arithmetic matters here, because transfer is often sold as risk elimination.

Worked example: insurance

A warehouse project holds $400,000 of equipment on site for six months. Theft or damage has a 2% probability over that period.

• Retained exposure without insurance: 0.02 × $400,000 = $8,000
• Policy premium: $6,500, with a $25,000 deductible
• Expected retained loss with insurance: 0.02 × $25,000 = $500
• Total expected cost with insurance: 6,500 + 500 = $7,000

Insurance saves $1,000 in expected value, which is not the point. The real benefit is that the worst case drops from $400,000 to $25,000, which may be the difference between a bad quarter and an insolvent company. Transfer buys predictability, and predictability has a price that does not always show up in an EMV comparison.

Three limits matter. Transfer does not transfer accountability: the client still holds you responsible for the outcome. Transfer can create new risks, such as a contractor who wins on price and fails on quality. And a fixed-price contract often carries the risk inside the price, so you pay for it whether or not the risk occurs.

How does acceptance work?

Acceptance means you acknowledge the risk and choose not to change the plan. It is a legitimate strategy, not a failure of imagination, and it comes in two forms.

Passive acceptance means you note the risk and deal with it if it happens, with no reserve set aside. This is appropriate for low-impact risks where monitoring is enough.

Active acceptance means you set aside a contingency reserve and write a response plan that can be triggered. This is appropriate when the impact is significant but the response cost exceeds the expected loss.

The discipline that separates the two is documentation. A passive acceptance should state the threshold at which it becomes active: “If defect rates exceed 4% in the first month, we activate the fallback vendor.” Without that sentence, acceptance becomes neglect.

Contingency reserves are usually sized from the risk register rather than a round percentage. If five known risks carry EMVs of $12,000, $8,000, $6,000, $4,000, and $2,000, the sum is $32,000, and a reserve in that range is defensible. A blanket “10% of budget” is easier to explain and harder to justify.

How does escalation work?

Escalation moves a risk to someone with the authority or budget to respond. It applies when the risk sits outside the project’s control: a regulatory change, a currency movement, a decision about a shared platform, or a contractual dispute.

Escalation is not passing the problem along. A proper escalation includes four things: a description of the risk in business terms, the current assessment of probability and impact, the options considered and why they were rejected, and the specific decision required by a named person by a named date.

The most common failure is escalating without a decision request. “FYI, there is a regulatory risk” produces sympathy, not action. “We need approval to fund a $40,000 compliance review by 15 March, or we accept a 30% chance of a $250,000 fine” produces a decision.

How do you choose between the five?

Start with the exposure, then compare response costs.

1. Score the risk. Probability from 1 to 5, impact from 1 to 5, multiply for a severity score. Use money for impact where you can, because money makes responses comparable.
2. Check whether you own it. If the decision sits above your authority, escalate before doing anything else.
3. Ask whether you can remove the cause. If the activity is not worth its exposure, avoid. This is the cheapest option when available and the one most often skipped.
4. Compare mitigation cost with EMV reduction. Fund responses that return more than they cost, in order of return.
5. Consider transfer for the tail. Transfer is poor at reducing expected cost and good at capping catastrophic loss. Use it for events you could not survive.
6. Accept the remainder and size the reserve. Whatever is left after responses is residual risk, and it needs a reserve and a trigger.

A simple filter helps: if the response costs less than 30% of the exposure it removes, it is usually worth doing. Above 70%, look at avoidance or acceptance instead.

What does a full risk register look like?

Here is a five-risk register for a 14-person e-commerce replatform, with responses and residual exposure.

Total gross EMV: 56,000 + 22,500 + 10,500 + 40,000 + 4,000 = $133,000.

Total response cost: 18,000 + 12,000 + 9,000 + 15,000 + 0 = $54,000.

Residual EMV: 11,200 + 6,750 + 3,500 + 8,000 + 4,000 = $33,450.

The responses remove $99,550 of expected exposure for $54,000, a return of about 1.84 to 1. That ratio is the argument to make to a sponsor, and it is far more persuasive than a heat map. A contingency reserve in the region of $30,000 to $35,000 covers the residual, with management reserve held separately for unknown risks.

What about positive risks?

The same framework applies to opportunities, with a mirrored set of strategies: exploit, enhance, share, accept, and escalate.

• Exploit removes the uncertainty so the opportunity definitely happens. Staff the project with the expert who can guarantee the early launch.
• Enhance increases probability or impact. Add a second marketing channel to raise the chance the campaign exceeds target.
• Share brings in a partner to pursue an opportunity neither party could capture alone.
• Accept means you will take the benefit if it arrives, without spending to chase it.
• Escalate moves an opportunity above your authority, such as a partnership requiring an executive sponsor.

Most teams write only threats in the register and then wonder why risk management feels like a tax. Naming two or three opportunities with owners changes the conversation in the steering meeting.

What are residual and secondary risks?

Residual risk is what remains after a response is applied. It is the number that belongs in the contingency reserve calculation, and it is the number most registers omit.

Secondary risk is a new risk created by the response itself. Dual sourcing creates a supplier management burden and a possible volume split penalty. Insurance creates a deductible exposure and an administrative cost. A fixed-price contract creates a dispute risk if scope is ambiguous.

Every response should list both. If a proposed mitigation introduces a secondary risk with an EMV larger than the reduction it achieves, the proposal is a net loss disguised as diligence.

> Practical tip: Add one column to the register called “what this response breaks.” It takes two minutes per risk and surfaces the secondary risks that normally appear as surprises in month four.

Common mistakes

• Treating the register as a compliance document. If it is updated only before audits, it is not managing anything.
• Writing “monitor” as a response. Monitoring is a control, not a strategy, and it needs a trigger threshold.
• Ignoring response cost. A mitigation that costs more than the expected loss is a purchase of comfort.
• Assuming transfer removes accountability. The client still holds you responsible for the outcome.
• Forgetting residual risk. The reserve gets sized from gross exposure instead of what remains.
• Escalating without a decision request. A risk handed over without a specific ask will sit unowned.

Where does Doitify fit?

A risk register only works if it is updated where the work happens. When risks live in a spreadsheet nobody opens, the first time the team reads it is during the incident.

Doitify keeps risks and constraints inside the project alongside tasks, dependencies, milestones, and documents, so a risk can be assigned an owner with a due date and linked to the task it threatens. Because the WBS dependencies and schedule sit in the same workspace, the impact of a risk on the critical path is visible rather than imagined.

For transparency: Doitify is our product, and it is a project and team management platform rather than a dedicated enterprise risk system. If you need Monte Carlo simulation across a portfolio, a specialist tool will serve you better. For most delivery teams, the binding constraint is whether anyone updates the register on a Tuesday.

Conclusion

The five risk mitigation strategies are a small vocabulary that prevents a large argument. Avoid removes the cause, mitigate reduces probability or impact, transfer moves the bill, accept holds the risk deliberately, and escalate puts the decision where the authority is.

The discipline that makes them useful is arithmetic plus ownership. Price the exposure, price the response, and keep the residual in the reserve. Then give every response a name and a date, because a strategy without an owner is a sentence in a document, and documents do not prevent incidents.

If this post on risk mitigation strategies was helpful, you might also enjoy Project Management Software for HR Teams: 2026 Guide and Project Collaboration Software: What to Look For.