The risk response itself creates a new risk. What should we record?
Secondary riskAssess the side effects of the chosen response and decide whether the overall exposure improves. A mitigation is not automatically beneficial merely because it addresses the original concern.
What to do now
- Describe the planned response
- Identify its new failure modes
- Compare overall residual exposure
- Adjust the response and assign new owners
When to escalate
Escalate when
The response creates a more serious exposure than it removes.
Who decides
The accountable risk owner
Example
Adding a backup supplier reduces availability risk but introduces data-handling and integration risks.
Mistake to avoid
Treating mitigation actions as risk-free.
Prevent a repeat
Review whether response tasks and trigger conditions remain appropriate as the project changes.
Suggested ApprovedFlow setup
- Documents
- Tasks
- Approvals
Store the risk assessment as a controlled project document and assign response tasks; do not assume a native risk engine is enabled. See the platform
Related cases
- We only record threats. Should opportunities be included?One-sided uncertainty management
- How should we handle a risk we cannot prevent?Unavoidable exposure
- A release introduces a serious defect. What should the team do first?Release incident response
- How do we define a dependency so it can be managed?Vague dependency record