In this planning process, a response or strategy is developed for each item in the prioritized risk listing. It may include a primary choice and a backup option.

Responses to risk can be categorized in one of three ways:

Accepting the consequences if the event occurs

Active acceptance would involve developing a contingency plan that would be executed if the risk occurs

Passive acceptance would allow the risk event to occur (e.g., making less money if the project is a few weeks late)

Avoiding the consequences by eliminating possibility of the event occurring

Mitigating the risk (reducing it's expected value) by:

Minimizing the probability of occurrence

Minimizing the value of the impact

Deflecting (or transferring) the risk elsewhere (in a software project this might mean passing the risk onto a subcontractor or to the customer).