What are the four basic response strategies for negative risks? Describe each strategy.

(1) Risk avoidance or eliminating a specific threat, usually by eliminating its causes. Of course, not all risks can be eliminated, but specific risk events can be. For example, a project team may decide to continue using a specific piece of hardware or software on a project because they know it works. Other products that could be used on the project may be available, but if the project team is unfamiliar with them, they could cause significant risk. Using familiar hardware or software eliminates this risk.

(2) Risk acceptance or accepting the consequences should a risk occur. For example, a project team planning a big project review meeting could take an active approach to risk by having a contingency or backup plan and contingency reserves if they cannot get approval for a specific site for the meeting. On the other hand, they could take a passive approach and accept whatever facility their organization provides.

(3) Risk transference or shifting the consequence of a risk and responsibility for its management to a third party. For example, risk transference is often used in dealing with financial risk exposure. A project team may purchase special insurance or warranty protection for specific hardware needed for a project. If the hardware fails, the insurer must replace it within an agreed-upon period of time.

(4) Risk mitigation or reducing the impact of a risk event by reducing the probability of its occurrence. Suggestions for reducing common sources of risk on information technology projects were provided at the beginning of this chapter. Other examples of risk mitigation include using proven technology, having competent project personnel, using various analysis and validation techniques, and buying maintenance or service agreements from subcontractors.