If a risk has high probability and high impact, what is the recommended management approach?

• A. Do nothing until it occurs
• B. Prioritize mitigation and contingency planning
• C. Move risk to the next phase
• D. Assume risk will not occur

Answer: (B)

Handling risks that are both likely and damaging means acting proactively to reduce exposure. When a risk has high probability and high impact, the best approach is to prioritize mitigation and contingency planning. Mitigation aims to lower either the chance the risk occurs or the severity of its consequences, such as by strengthening controls, adding redundancies, or diversifying resources. Contingency planning prepares you to respond effectively if the risk still materializes, with clear steps, assigned roles, and reserves to limit damage. Together, these efforts reduce overall risk and increase resilience.

Doing nothing until it occurs leaves you exposed to a likely event with serious consequences. Simply moving the risk to the next phase isn’t an actual risk-management strategy, and assuming the risk won’t occur ignores its probability and potential impact.