6.2 Opportunity Response Strategies

The Five Opportunity Strategies

An opportunity is a risk with a positive effect on one or more project objectives. PMI manages opportunities with the same rigor as threats and defines exactly five strategies, captured by the mnemonic Every Eager Shark Eats Anything: Escalate, Exploit, Share, Enhance, Accept.

The exam loves to test these as mirror images of the threat strategies. Each positive strategy has a negative counterpart that does the opposite. Learn the pairs and you halve the memorization.

A common candidate mistake is treating opportunities as nice-to-haves that need no response. PMI's view is the reverse: pursuing opportunities is a core part of a risk manager's job because realized upside improves cost, schedule, or quality. Like threat responses, opportunity responses are recorded in the risk register with a chosen strategy, an owner, and concrete actions, and they can also create secondary and residual risks.

Exploit

Exploit is the most aggressive opportunity response: it takes whatever action is needed to make the opportunity certain to happen — raising its probability to effectively 100%. Assigning your most skilled people to finish early to win a bonus, or adopting a new technology to guarantee a cost saving, are exploit moves. Exploit is the mirror of avoid: avoid drives a threat's probability to 0, exploit drives an opportunity's probability to 100%.

Enhance

Enhance increases the probability and/or the positive impact of an opportunity without guaranteeing it. Adding resources to an activity to make an early finish more likely, or strengthening the conditions that produce a benefit, are enhancement actions. Enhance is the mirror of mitigate — both adjust probability and impact, one up, one down.

Share

Share allocates ownership of an opportunity to a third party best able to capture it for the project's benefit. Shared upside is realized through partnerships, joint ventures, teaming agreements, risk-sharing consortia, or special-purpose companies.

Share is the mirror of transfer: transfer hands a threat's impact to a third party, share hands an opportunity to the partner who can best exploit it. A frequent trap pairs them — transfer a threat, share an opportunity; using the wrong verb is a classic wrong answer. Note the shared benefit is split between the parties, which is the trade-off for the partner's superior ability to realize it.

Accept and Escalate

Accept takes the opportunity if it arises but pursues no proactive action to chase it; like threat acceptance, it can be active (set aside reserve to capitalize on it) or passive (do nothing but document). Escalate hands an opportunity that is outside the project's authority to the program or portfolio level, removing it from the project's active register so it is monitored higher up.

Accept and escalate are the only two strategies shared by both threats and opportunities, which is a high-frequency exam point. If a question asks which strategy works for either a threat or an opportunity, the answer is escalate or accept — never avoid, transfer, mitigate, exploit, share, or enhance, which are direction-specific.

Threat–Opportunity Mirror Table

Worked example: a software team realizes that finishing two weeks early would trigger a client early-delivery bonus. Exploit would reassign top developers to guarantee the early finish. Enhance would add a tester to make the early finish more likely. Share would bring in a specialist subcontractor partner best able to accelerate the work. Accept would simply take the bonus if it happened, and escalate would apply if the bonus decision sat above the project, with the program office.

When choosing among them, weigh the cost of the response against the value of the upside, exactly as you would for a threat. Exploit and enhance consume project resources, share splits the reward with a partner, and accept costs nothing but secures nothing — match the aggressiveness of the strategy to the priority of the opportunity.

Overall Project Risk Responses

Beyond individual risks, PMI requires a response to overall project risk — the cumulative effect of all uncertainty on the project as a whole. The same families of strategies apply at the whole-project level:

• Avoid / Exploit — for example, cancel or redefine a project whose overall threat level is unacceptable, or aggressively pursue a project whose overall upside is compelling.
• Transfer-share / Mitigate-enhance — restructure the project, use a different delivery approach, or add overall contingency to reduce downside variation or grow upside.
• Accept — proceed with the current overall exposure when it is within the organization's risk appetite.

Reporting overall project risk and its response is the job of the risk report, distinct from the per-risk detail held in the risk register (section 6.4).