M4.4 — Risk Response & Control

M4.4 — Risk Response & Control

1. Practical outcome

By the end of this section, the learner should be able to turn an analysed threat or opportunity into a controlled management response that is proportionate, owned, time-bound and integrated with the way the project is actually delivered. They should be able to distinguish a response strategy from the actions that implement it, choose an appropriate strategy, define preventive and contingent actions, assign ownership, integrate actions into schedule, cost, procurement and governance, monitor triggers and action effectiveness, reassess residual exposure, identify secondary risk, and escalate when the response is no longer adequate.

The objective is not to populate a risk register with actions. It is to change the project’s exposure before the uncertainty becomes an issue, or to make the project ready to act if the event occurs. A response is successful because it changes probability, consequence, opportunity value, detectability or preparedness in a credible way - not because an action has been marked complete.

M4.4 starts from the outputs of M4.1, M4.2 and, where appropriate, M4.3. It asks what management will now do about the exposure. It deliberately stops short of deciding how much project contingency or management reserve should be held; that is addressed in M4.5 Contingency & Uncertainty.

A useful question throughout this Knowledge Area is: “What must be different in the real project for this risk to be genuinely better controlled - and what evidence will prove that the difference has happened?”

2. Core concepts

Risk response is a change to exposure, not a line in the register

A risk response is a deliberate management intervention intended to alter a threat, increase the value or likelihood of an opportunity, improve preparedness, or consciously accept the exposure within agreed authority. The response should have a traceable relationship to the cause, event or consequence identified in M4.1 and to the significance assessed in M4.2/M4.3.

An action such as “hold a meeting”, “monitor supplier” or “review monthly” is not automatically a response. It only becomes a useful control action if it changes something that matters: for example, secures an alternative supplier slot, removes an unresolved interface, completes a pre-test, brings a decision forward, obtains evidence, or establishes a trigger and fallback plan.

Threat response strategies describe intent; actions make the strategy real

Common response strategies for threats include:

·       Avoid — change the plan so the uncertainty no longer exists or can no longer affect the objective. For example, remove a high-risk technical dependency by choosing a proven alternative before commitment.

·       Reduce — lower the probability and/or consequence through preventive, protective or preparedness actions. For example, run an assurance test early so defects can be corrected before the formal acceptance window.

·       Transfer or share — allocate defined financial, delivery or performance responsibility to another party through a contract, insurance arrangement or shared delivery model. This can change who bears part of the consequence, but it may not remove the project’s schedule or reputational exposure.

·       Accept — make a conscious decision to retain the exposure because further action is not proportionate, is not feasible, or lies outside the current decision threshold. Acceptance should still define monitoring, trigger conditions and any contingency or fallback needed.

Escalation may also be necessary when the response decision sits outside the project team’s authority. Escalation is not a substitute for response; it moves the decision to the level that can act.

Opportunity strategies require the same discipline

For opportunities, common strategies include exploit, enhance, share and accept. Exploit seeks to make the opportunity happen; enhance increases its probability or benefit; share allocates the opportunity to the party best able to realise it; acceptance leaves the opportunity available without additional proactive investment. The same questions apply: what changes, who owns it, by when, what evidence shows success, and what other risks are created?

A response strategy and a response action are not the same thing

“Reduce the supplier risk” is a strategy. “Obtain written confirmation of the support slot by the end of Week 2, nominate a backup engineer, and complete a remote-support rehearsal” is a set of actions that implement the strategy. Strategy provides direction; actions create observable change. A register that records only the strategy is too vague to control. A register that records only actions can become administratively busy without showing what those actions are intended to change.

Preventive actions and contingent actions serve different purposes

Preventive actions are undertaken before the uncertain event to reduce probability or consequence. Contingent actions are pre-planned responses that are executed only if a defined trigger is reached or the risk event occurs. A fallback may be required if the primary response itself fails.

·       Preventive example: complete a pre-witness fire-system review before the formal authority test.

·       Contingent example: if critical defects remain open five working days before formal witness, mobilise additional specialist support and execute a defined defect-closeout sequence.

·       Fallback example: if the planned specialist is unavailable despite the secured slot, activate the named backup engineer and remote support arrangement.

These should not be blurred. If the team waits until the trigger has occurred before deciding what the contingent action might be, it is reacting to an issue rather than controlling a risk.

Risk ownership and action ownership are related but different

The risk owner is accountable for understanding the exposure, ensuring an appropriate response is selected, monitoring the risk, and escalating when necessary. A response-action owner is accountable for delivering a specific action. One risk may therefore have one risk owner and several action owners. The risk owner should not assume that assigning actions transfers accountability for the risk itself.

Timing is part of response effectiveness

A technically sound response delivered after the decision or exposure window may have no value. Every material action should therefore have a latest useful completion date linked to the risk window, decision point, procurement event, test, milestone or trigger it protects. “Due next month” is weaker than “complete five working days before formal witness so defects can be corrected before acceptance.”

Response cost and disruption must be proportionate to the exposure

Risk response competes for money, people, access and management attention. The expected benefit of a response should be considered against its cost, schedule effect, operational disruption and new risks. This does not require every decision to use a formal expected-value calculation, but the trade-off should be explicit. Spending 0.5m CU to remove a 0.1m CU exposure with no other strategic consequence may be poor control; spending the same amount to protect a fixed public opening could be entirely rational.

Transfer does not necessarily remove project exposure

A contract can transfer financial liability or require a supplier to provide recovery, but the project may still suffer delay, loss of service, reputational damage or interface consequences. The project team should therefore ask two questions separately: who bears the contractual or financial consequence, and what exposure remains to the project objective? This connects M4.4 directly to the commercial interfaces in M3.5.

Response actions belong in the project-control system, not only in the risk register

Material response actions should be visible in the control system at the level needed to manage them. A response may require schedule activities, cost forecast changes, purchase orders, contract amendments, design decisions, approvals, assurance reviews, change requests or interface commitments. If a critical response exists only as free text in a risk register, it can be missed by the people controlling delivery.

Represent material responses in the schedule

Give material response work identifiable activities or milestones with a risk/action ID, accountable owner, duration, resources, completion evidence and links to the work it enables. A latest useful completion date is a control threshold; represent genuine dependencies in the network rather than adding a hard constraint solely to make the response appear on time. Smaller actions can remain in an action log if their schedule relationship and escalation route are clear.

Keep a preventive response distinct from a contingent branch. Include authorised preventive work and its cost once in the current delivery plan. Preserve triggered alternatives as conditional scenarios until activation is authorised; then revise the current forecast with the chosen work, resources and logic. Include pre-positioning work where it is already committed. A favourable unapproved response remains a scenario, not an achieved reduction in the current risk model.

Triggers turn monitoring into a decision rule

A trigger is an observable condition that causes a pre-agreed decision or action. Good triggers are specific enough that different people would recognise the same state. Examples include a supplier confirmation not received by a defined date, a test producing more than a defined number of critical defects, a productivity rate falling below a threshold for two consecutive periods, or an approval remaining unresolved inside a defined lead time.

Triggers should be paired with an action. A red flag with no agreed response merely reports deterioration. A useful control says: if X occurs by Y date, then Z action is activated by the named owner.

Residual risk should reflect evidence, not optimism

Residual risk is the exposure expected to remain after the agreed response has been implemented and has the intended effect. It should not automatically be reduced when an action is merely planned or marked complete. The assessment should fall only when evidence supports the changed probability or consequence. If a pre-test discovers more defects than expected, the action may be complete while the residual risk has actually increased.

Responses can create secondary risks

A response can introduce new uncertainty. Adding a second supplier may reduce availability risk but create integration risk. Accelerating testing may protect schedule but increase fatigue or defect leakage. Resequencing work may protect one milestone while consuming access needed elsewhere. Secondary risks should be identified and assessed rather than hidden inside the response narrative.

When the event occurs, management must distinguish the issue from remaining risk

Once a risk event has occurred, that event is no longer uncertain and should be managed as an issue, change, delay, defect or other actual condition. However, uncertainty about the consequence, recovery effectiveness or further related events may remain and should continue to be managed as risk. Closing the original risk automatically at event occurrence can therefore be misleading if significant residual uncertainty remains.

Acceptance is an active governance decision, not “do nothing”

A risk may be accepted because its exposure is within tolerance or because further action is not proportionate. Good acceptance records why the exposure is acceptable, who has authority to accept it, what will be monitored, what trigger would cause reconsideration, and what contingency or fallback is available if needed. The funding and reserve implications of accepted uncertainty are addressed in M4.5.

Closure should mean the uncertainty is no longer decision-relevant

A risk should not be closed simply because the reporting date has passed or because actions are complete. Closure should be based on a clear condition: the event can no longer occur, the objective can no longer be affected, the exposure has become an issue and transferred to another control process, or the opportunity window has expired or been realised. The closure reason and any lesson should be retained.

Reconcile risk with actual progress at every reporting cut off

Use the validated M1.4 evidence and M2.4 current schedule at the same cut-off. Review material risks against the work and conditions that can still expose the objective. A risk score unchanged since baseline is not evidence that the exposure is unchanged.

First confirm the affected scope, activity or milestone, current actual/forecast status, relevant completion criterion and earliest/latest exposure dates. Then compare progress and revised remaining logic with response due dates and trigger conditions. Determine whether each event remains uncertain, has occurred, has passed without occurrence, or has moved to a new window. Completed installation does not retire an acceptance risk if tests remain.

Record occurred events in issue and control records, reflect their known consequences in actuals or remaining forecasts, and remove the corresponding unrealised event from QRA. Keep secondary consequences and genuinely uncertain residual exposure. Close a risk only with evidence that its defined uncertainty can no longer materially affect the objective; retain the history and any related issue until resolved.

Reassess probability, consequence and response effectiveness from evidence, update model mappings and provision where material, and escalate actions whose latest useful dates precede their forecast completion. Review all material links each reporting cycle; rerun QRA when changed inputs or decisions warrant it, rather than mechanically rerunning unchanged models. Urgent triggers require action between routine reviews.

3. Step-by-step method

1. Confirm the risk, objective and current exposure. Re-read the cause-event-consequence statement, affected objective, timing, qualitative assessment and any quantitative analysis. Confirm that the response is addressing the real source of exposure rather than a vague symptom.

2. Confirm decision authority and response threshold. Determine who can approve the response, spend, contract change, design decision or acceptance. Escalate early if the project team lacks authority; do not let an approval gap consume the response window.

3. Define the response objective. State what must change: reduce probability, reduce consequence, remove the threat, increase the opportunity, improve detectability, create preparedness, or consciously accept the exposure. Make the intended effect observable.

4. Generate credible response options. Consider avoidance, reduction, transfer/share and acceptance for threats, and exploit, enhance, share and acceptance for opportunities. Include operational alternatives rather than jumping immediately to the first familiar action.

5. Evaluate each option for effectiveness, timing, cost and feasibility. Test whether it can be completed before the risk window, whether resources and authority exist, what schedule or commercial effect it creates, and whether the expected benefit is proportionate.

6. Select the strategy and define the response logic. Record why the chosen strategy is appropriate, which cause/event/consequence it changes, and what assumptions must hold. Where useful, retain a rejected-option note so later reviewers understand the decision.

7. Assign a named risk owner and action owners. Keep accountability for the risk with one clear owner while assigning each response action to the person able to deliver it. Confirm that the owners accept the responsibility and have the authority to act.

8. Convert the strategy into specific deliverables. Write actions as observable outputs rather than intentions. Define what will be produced, agreed, tested, contracted, approved or changed. Avoid verbs such as “monitor” or “review” unless the expected decision and evidence are also defined.

9. Set due dates from the exposure window backwards. Identify the latest useful completion date for each action and any intermediate decision dates. Link important actions to the schedule or action-control system so late response work becomes visible before it loses value.

10. Integrate the response with cost, procurement, contracts, change and interfaces. Reflect approved response cost in the forecast, raise procurement or contract actions, create required change requests, and link the response to affected dependencies or control accounts. Do not leave material response commitments outside the normal project-control system.

11. Define triggers and early-warning indicators. Specify the evidence that would show the risk is increasing, the response is failing or a contingent action must start. Use thresholds and dates where practical so the decision is not dependent on subjective interpretation at the last moment.

12. Define contingent and fallback actions. For material risks, decide what the team will do if the trigger is reached or the primary response fails. Identify any resources, approvals or supplier arrangements that must be pre-positioned for the contingency to be executable.

13. Assess expected residual exposure and secondary risks. Estimate what risk should remain if the response works and identify new uncertainty introduced by the response itself. Do not reduce the residual assessment merely because an action has been scheduled.

14. Approve, fund and authorise the response. Obtain the necessary management, commercial, safety, technical or change approvals. Confirm that the people, money, access and information needed to execute the response are actually available.

15. Execute the actions and capture evidence. Track delivery of response outputs, not only percentage complete. Retain supplier confirmations, test results, approvals, contract changes, trial data or other evidence that demonstrates what changed in the real project.

16. Test response effectiveness and reassess the risk. Compare actual evidence with the intended response effect. Update probability, consequence, opportunity value or QRA inputs only where evidence justifies the change. If exposure has not reduced as expected, challenge the response rather than the scoring.

17. Escalate, adapt or activate contingency when thresholds are crossed. Use the pre-defined trigger rules. Change strategy where necessary, convert occurred events into issue/action control, and preserve any remaining uncertainty as risk. Do not wait for the next routine risk review if the decision window is closing.

18. Close or transition the risk with a clear reason and capture learning. Confirm that the uncertainty is no longer material or has transferred to another control process. Record which response worked, what evidence proved it, and what should be reused in future projects or later phases.

4. Worked Reference Project example — Community & Learning Centre

Context — turning the M4.3 analysis into controlled action

At Month 16, the Community & Learning Centre still has a fixed public opening date. M4.3 showed that the deterministic schedule retained eight working days between the current readiness forecast and opening, but the quantitative model indicated only a 72% probability of meeting the commitment under current exposure. The largest drivers were fire-system acceptance, technology configuration productivity and the specialist supplier support window. A defined response scenario increased the illustrative probability to 88%.

M4.4 now asks a different question: what has to be authorised, owned, delivered and evidenced for that improved exposure to become real rather than remain a favourable scenario in the QRA model?

Risk R2 — fire-system acceptance

Risk statement: because the integrated fire-system acceptance process depends on a formal witness review and closure of cross-system defects, there is a risk that unresolved defects or late assurance comments delay acceptance, causing integrated testing and readiness activities to start late and reducing protection to the fixed opening date.

Current exposure from M4.3: approximately 30% event probability with a 3-8 working-day schedule consequence if it occurs. The selected threat strategy is reduce. Avoidance is not realistic because formal acceptance is mandatory; simple acceptance is not appropriate because the event is a dominant opening-date driver.

Response objective

Reduce the consequence of a formal-witness failure by finding and closing material defects before the authority test, and improve preparedness so any remaining defects can be corrected within the available window.

Preventive actions

·       The Building Systems Lead remains the risk owner.

·       The Fire Systems Manager owns a full pre-witness integrated test to be completed ten working days before formal witness.

·       The Digital Systems Lead owns completion of the interface evidence pack and test scripts five working days before the pre-witness test so the rehearsal uses the real configuration.

·       A joint defect-closeout workshop is pre-booked for the two days following the pre-witness test, with responsible engineers named in advance.

·       The authority-facing documentation is independently reviewed before submission so administrative omissions do not consume the formal witness window.

The response has a small approved cost for specialist attendance and extended testing support. That cost is incorporated in the current cost forecast through M3; it is not hidden as an unrecorded “risk action”.

Trigger and contingent action

The trigger is defined as either more than three Category-A defects at the pre-witness test, any unresolved Category-A defect five working days before formal witness, or a material authority comment that cannot be answered within two working days. If the trigger is met, the Building Systems Lead activates the pre-agreed contingent plan: extended defect-closeout shifts, additional specialist attendance, daily senior review and protected access to affected areas. If the primary specialist cannot attend, the named backup specialist is activated.

This is materially stronger than “monitor fire-system risk weekly” because it links a measurable condition to a pre-authorised action and owner.

Evidence and residual exposure

When the pre-witness test is completed with two minor defects and both are closed within forty-eight hours, the response has produced evidence. The risk owner can now justify changing the M4.3 consequence range from 3-8 working days to 1-4 working days for the response scenario. The probability is not set to zero because the formal authority witness remains an external event with residual uncertainty.

Schedule control checks whether the pre-witness test, evidence-pack predecessor and defect-closeout successors are all represented in the current plan with feasible resource and access assumptions. Cost control checks that approved specialist attendance is included once. The risk review tests whether completed evidence supports the revised consequence range; the three checks have different purposes.

If, by contrast, the pre-witness test had revealed ten major defects, marking the action “complete” would not justify a lower residual risk. The evidence would indicate that exposure had increased and the response would need to be escalated.

Risk R1 — specialist supplier support window

The specialist supplier support risk has a 25% current-event probability in the M4.3 model. The response objective is to reduce the probability that required commissioning support is unavailable when the technology system reaches its critical test window.

Management initially suggests “transfer the risk to the supplier through the contract”. The controls team challenges this wording. A commercial clause may transfer some cost liability, but it does not transfer the project’s opening-date consequence. The selected strategy is therefore reduce, supported by contractual commitment and a backup arrangement.

·       Commercial Manager owns a written contract amendment confirming the primary support slot and response times by the end of Month 16 Week 2.

·       Technology Lead owns nomination and competency verification of a backup engineer before the same date.

·       The team completes a remote-support connectivity rehearsal before the commissioning window.

·       Trigger: if written primary-slot confirmation is not received by the due date, the backup route is activated immediately rather than waiting until commissioning.

Once written confirmation, backup competency and the rehearsal are evidenced, the M4.3 response scenario reduces the modelled event probability from 25% to 10%. Again, the change is justified by evidence, not by the intention to obtain confirmation.

Opportunity O1 — staged training access

The staged-access opportunity can partially protect readiness if completed rooms are released for training before every area is fully complete. The selected strategy is enhance rather than simply accept the opportunity.

·       Operational Readiness Lead owns room-release criteria covering safety, systems availability, access and training content.

·       Area owners pre-agree which training modules can proceed independently and which still require full-building acceptance.

·       The schedule contains explicit staged-training activities rather than assuming the benefit in narrative only.

·       Trigger: when a room passes the agreed readiness criteria, the corresponding training activity is released; if the criteria are not met, the team does not force the opportunity into the forecast.

This changes the opportunity from a hopeful assumption into a controlled option. As evidence improves, the M4.3 opportunity probability can move from 40% toward the 60% response-scenario assumption.

Secondary risks and trade-offs

The responses are then challenged for secondary risk. Extended fire-system testing could reduce access for technology configuration; premium supplier commitment could create additional cost; staged training could create confusion if room status is not clearly controlled. Each secondary exposure is assigned an owner and, where material, entered into the risk or interface process rather than ignored because the primary risk response is beneficial.

Control review — two weeks later

At the next control review, management does not ask only whether the response actions are green. It asks whether the actions changed the exposure. The fire pre-witness test has passed with minor defects closed, the supplier slot is contractually confirmed with a verified backup, and the first rooms have met staged-training criteria. The evidence supports the response assumptions used in M4.3, so the project reruns the quantitative model and confirms an illustrative opening-date success probability close to the previously modelled 88% response scenario.

The remaining fire-system and supplier exposure stays on the register until the formal witness and critical support window have passed. Actions are complete, but the risks are not yet closed because the events can still affect the objective.

Worked progress and exposure reconciliation

At the next cut-off the installation activity is complete, but formal fire acceptance is not. R2 remains open because its witness/retest window remains ahead. For R1, verify the revised commissioning dates against the confirmed supplier slot: a two-week slip can reopen availability exposure even when the original booking action was completed. If the actual support window passes successfully, retire that defined event with attendance and completion evidence.

If formal witness identifies the later 0.35m CU defect considered in M4.5, record the defect as an issue and forecast the evidenced correction cost and work. Stop sampling the same defect as an unrealised event while retaining uncertain retest or knock-on consequences. Link its issue, risk, schedule, forecast and any authorised drawdown; installation progress alone provides no basis for releasing acceptance provision.

Management summary from M4.4:

The three principal opening-readiness responses are now controlled through named owners, dated deliverables and explicit triggers. Pre-witness fire-system assurance has reduced the credible consequence of a formal acceptance problem; the specialist supplier slot is contractually confirmed with a verified backup route; and staged training is being released only against agreed room-readiness criteria. Evidence now supports the response assumptions previously tested in M4.3, and the quantitative model can therefore be rerun on a justified post-response basis. The project should continue to monitor the formal fire witness and supplier support window as residual risks rather than close them simply because preventive actions are complete. Any contingency or reserve implications are taken forward through M4.5 rather than embedded invisibly in the response actions.

5. Interpretation and professional judgement

The best response acts on the real driver, not the wording of the risk

A broad risk statement can produce broad actions. Practitioners should trace the response to the physical, commercial, technical or organisational driver. If the cause is late authority feedback, adding more internal reporting will not reduce the risk. If the cause is limited specialist capacity, an additional internal meeting is unlikely to change probability. Response quality depends on causal logic.

Action completion is not the same as risk reduction

This is one of the most important disciplines in risk control. A response action can be 100% complete and the risk can remain unchanged or even worsen. The control question is therefore: what evidence shows that probability, consequence, opportunity value or preparedness changed? Risk reviews should separate action status from exposure status.

Responses should mature as the project learns

An early response may be information-gathering because the uncertainty is poorly understood. Later, as evidence improves, the response may become contractual, technical or operational. The fact that a risk has been on the register for months does not mean the original action remains appropriate. Reassess the response when the cause, timing or exposure changes.

Do not wait for a perfect response if the decision window is closing

Risk response often occurs under incomplete information. Where the exposure window is close, a good practitioner distinguishes reversible from irreversible actions, obtains the evidence that materially affects the decision, and acts within authority. Endless refinement of the risk analysis can itself become a risk if it delays a time-critical response.

Transfer language needs commercial precision

A supplier may accept liquidated damages, warranties or performance obligations, yet the project may still miss its milestone. Conversely, a project may retain financial exposure but reduce operational risk through alternative supply or redundancy. “Transferred” should therefore describe the specific consequence transferred and the exposure retained, not imply that the risk has disappeared.

Acceptance should be deliberate and visible

Teams sometimes label a risk “accepted” because nobody has found a response. That is not acceptance; it is unmanaged exposure. Genuine acceptance requires a decision by the right authority, a rationale, monitoring, trigger conditions and clarity about what happens if the exposure changes. M4.5 then addresses how accepted uncertainty relates to contingency and reserve.

Contingent actions must be executable, not aspirational

A fallback supplier that has no contract, no technical approval and no capacity is not a real fallback. A recovery shift that depends on people who are already committed elsewhere is not a credible contingency. Test whether the contingent action could actually start when the trigger occurs: authority, people, access, materials, commercial route and decision rights should be considered in advance.

Response actions can compete with each other

Several risks may draw on the same specialist team, access window or contingency budget. Optimising each risk independently can therefore produce an impossible combined response plan. The project-controls practitioner should look across the portfolio of actions, identify shared constraints, and prioritise responses according to objective impact and timing.

A response can move risk rather than reduce it

Resequencing may protect a milestone but consume float elsewhere. Accelerating work may protect schedule but increase cost or quality risk. Outsourcing may reduce resource risk but increase interface or commercial exposure. Good risk control recognises these transfers between objectives and disciplines rather than reporting only the favourable effect.

Opportunities need enabling decisions before the window closes

Opportunities are frequently lost because teams discuss them but do not create the conditions needed to realise them. An opportunity response should therefore identify the enabling decision, latest decision date, owner, resources and evidence exactly as for a threat. “We could stage training” becomes useful only when the room-release rules, training sequence and approvals exist.

Risk closure should withstand challenge

A reviewer should be able to ask why a risk is closed and receive an objective answer: the acceptance event passed, the procurement decision removed the dependency, the opportunity window expired, or the issue transferred to another controlled process. “Actions complete” is not enough. Closure should be based on the uncertainty no longer being material to the objective.

6. Practice diagnostic

Use this table to challenge the quality of the approach or deliverable. The rows consolidate the most important recurring red flags and checks; they are prompts for professional judgement rather than a substitute for the method above.

A good M4.4 control record should allow management to see, in one chain, the exposure, chosen strategy, actions, owners, due dates, triggers, evidence, residual risk and next decision. If the record cannot explain how the real project is being changed, it is only administration.

7. Try-it-yourself practical exercise

Use the Month 16 Community & Learning Centre position from M4.3. The deterministic schedule retains eight working days before the fixed opening date. Current quantitative analysis indicates a 72% probability of meeting opening, driven principally by fire-system acceptance, technology configuration productivity and a specialist supplier support window. A staged-training opportunity may improve readiness. Management has asked for a response plan that can be authorised this week.

Complete the exercise in seven parts:

·       1. Select one threat and one opportunity. For each, write a one-sentence response objective that states what must change in the real project.

·       2. Generate at least three plausible strategy options for the threat and two for the opportunity. Explain why you selected the preferred strategy and why at least one alternative was rejected.

·       3. Define three specific response actions for the threat. Give each action an owner, observable deliverable and latest useful completion date linked to the risk window.

·       4. Define one trigger, one contingent action and one fallback. Explain what must be pre-authorised so the contingent action is executable rather than aspirational.

·       5. Identify at least two secondary risks or cross-objective effects created by the proposed response and explain how they would be controlled.

·       6. State the evidence that would justify reducing probability or consequence after implementation. Then state what evidence would instead indicate that the response has failed and exposure should be increased.

Additional task: at the reporting cut-off, installation is complete, fire witness is still forecast, the commissioning window has slipped beyond the booked supplier slot, and one previously uncertain defect has occurred. Prepare a risk-to-progress reconciliation for R1 and R2. Separate closure evidence, renewed exposure, issue conversion and residual uncertainty, and identify the control records that must change.

·       7. Write a management statement of no more than 180 words covering the current exposure, chosen response, decision required this period, trigger, expected residual exposure and the point at which the risk can legitimately be closed.

Final challenge question: “If every action on this risk were marked complete tomorrow, what evidence would you still need before you were willing to tell management that the project exposure had actually reduced?”

8. Bridge to capability

The How-to teaches how analysed uncertainty becomes executable response. At APPLIED and above, capability assessment should test whether the practitioner can select, implement and review realistic responses within their exposure windows. Owned actions, triggers, delivery integration and evidence of changed exposure should support the assessment; completed actions alone do not prove effectiveness. Supporting work products are illustrative and should be assessed with the practitioner’s reasoning. Sample learning questions illustrate the judgement at each recognition level; they are discussion prompts rather than validated assessment items.

Learning question: Do you understand how a response changes risk exposure?

Capability question for APPLIED and above: Can you demonstrate an executable response and evidence that it changed exposure or improved the project's ability to react?