ABSTRACT
Previous steps in the risk management process have concentrated on identifying, understanding, and analysing the threats and opportunities in our project. These steps are clearly vital, because we can’t manage risks which are not identified, or which are poorly understood or even misunderstood. But we mustn’t stop there. If we don’t do anything with the risk information we’ve gathered, we gain no benefit. Diagnosis is the not the same as cure, and analysis must lead to action. In most cases, simply identifying and understanding a risk does not make it go away. Unless the risk process results in action, risks remain unmanaged, and the process is largely a waste of time. We need to decide what to do. This chapter describes our options, and explains how to choose the right course of action for each individual risk, and for the level of overall project risk exposure.
