You can recite the five risk response strategies from memory. Avoid, transfer, mitigate, accept, escalate.
Then a situational question puts two of them in front of you as answer choices, both technically valid, and you freeze. That freeze isn't a knowledge gap. It's a judgment gap — and it's one of the most common reasons capable, experienced professionals lose marks they shouldn't.
The misconception
Most candidates study risk response strategies as a list of definitions. They can tell you what "mitigate" means. What they can't always do is tell you why mitigate is correct in one scenario and wrong in the next one that looks almost identical.
The exam isn't testing whether you know the five terms. It's testing whether you can read a scenario and identify which strategy the situation calls for — based on authority, cost, timing, and who owns the consequence if nothing is done.
What each strategy actually signals
Here's the distinction that matters — what each strategy is for, and what it looks like in practice:
Avoid — best when the threat has a high probability and a large negative impact you can eliminate by changing the plan.
Scenario: A key vendor has a history of missing deadlines, so you switch vendors before work begins — the threat no longer exists on this project.
Transfer — best when a third party is better positioned to own the risk and absorb the impact if it happens.
Scenario: Your project depends on expensive equipment on-site. If it's damaged, repair costs could blow the budget. Instead of absorbing that risk yourself, you purchase an insurance policy on it — so if damage happens, the insurance company pays, not your project.
Mitigate — best when you can't eliminate the risk but can reduce how likely it is or how bad it would be.
Scenario: A critical deliverable has a history of quality issues, so you add a second reviewer before release — the error can still happen, but it's far less likely to reach the customer.
Accept — best when the risk is low-priority or not cost-effective to address any other way.
Scenario: A minor supplier might be a few days late on a low-cost component, so you either set aside a small contingency reserve (active acceptance) or simply monitor it periodically without acting (passive acceptance).
Escalate — best when the risk is outside your project's scope or requires authority you don't have.
Scenario: A new regulation could affect multiple projects across the organization, so you raise it to the program level and stop tracking it yourself — it's no longer your risk to manage.
Read those again. Four of the five are things a project manager does within their own authority. One of them is the project manager recognizing they don't have the authority to act at all — and stepping back once it's handed off.
Where candidates go wrong
The exam's favourite trap works in two directions:
Escalating when you should mitigate. The scenario gives you a risk that's uncomfortable, but it's still well within your budget authority and your team's control. Escalating it here reads as avoiding ownership — not good judgment.
Mitigating when you should escalate. The scenario describes a risk tied to a regulatory change, an executive-level dependency, or a cost impact beyond your approved reserve. If you try to manage it yourself, you're answering a "should I act" question with "how do I act" logic. Wrong lens entirely.
Look at the question itself. Anything beyond your budget, your sign-off authority, or your project's boundaries points toward escalation — no matter how solvable it looks. And once escalated, let it go. The exam treats continued monitoring as a sign you never really handed it off.
How to actually study this
Definitions won't carry you through a scenario-heavy exam. Pattern recognition will.
Stop memorizing the list. Instead, tag scenarios by signal:
Outside my authority, handed off for good → escalate
Shift the impact elsewhere → transfer
Reduce the odds or the damage → mitigate
Change the approach entirely → avoid
Do nothing (passive) or set aside a reserve (active) → accept
When you practice questions, don't just check if you got the right answer. Check whether you identified the reason the correct strategy fit — authority, cost, timing, or ownership.
Build five real scenarios from your own work history, one per strategy. If you've ever passed a decision up the chain because it wasn't yours to make, that's your escalate example. Use it. Real cases stick better than textbook ones.
The takeaway
The five risk response strategies aren't a vocabulary test. They're a test of whether you know where your authority ends and someone else's begins. Understand that boundary, and the correct strategy becomes obvious.
If you've been treating this section as flashcards, it's worth re-approaching it as judgment practice before exam day, not during it.
P.S. Planning your ECO 2026 study plan? The PMP Study Plan Calculator maps domain weights to your study time — free, under a minute: https://vandersonbaril.com/products/pmp-study-calculator/
Know a colleague sitting the PMP exam? Share this with them.
Thanks for reading, and see you next Saturday.
