Exploit Strategy: Capturing Positive Risk Opportunities
PMBOK v8 Definition
The exploit strategy is a risk response for high-priority opportunities where the organization wants to ensure that the opportunity is realized. This strategy seeks to capture the benefit associated with a particular opportunity by ensuring that it definitely happens, increasing the probability of occurrence to 100%. Examples of exploiting responses may include assigning an organization's most talented resources to the project to reduce the time to completion or using new technologies or technology upgrades to reduce cost and duration.
Why It Matters for the Exam
The exploit strategy appears frequently in PMI exam questions about risk response planning, specifically within the "Plan Risk Responses" process. You will encounter it in scenario-based questions where you must select the appropriate response for a positive risk (opportunity), and exam questions often test your ability to distinguish exploit from other opportunity response strategies like share, enhance, and accept.
Key Points to Remember (for the exam)
- Definition: The exploit strategy increases the probability of an opportunity occurring to 100%—it ensures the benefit definitely happens.
- When to Use: Selected for high-priority opportunities where the organization wants guaranteed realization of the benefit.
- Examples tested: (1) Assigning the organization's most talented resources to reduce time to completion; (2) Using new technologies or technology upgrades to reduce cost and duration.
- Key Distinction: Exploit is the most aggressive opportunity response—it seeks certainty, not just increased probability.
- Overall Project Level: At the overall project level, exploit may include adding high-benefit elements of scope to add value or modifying risk thresholds with stakeholder agreement.
- Common Confusion: Do not confuse exploit with enhance—enhance increases probability or impact but does not guarantee 100% occurrence; exploit guarantees it.
- Documentation: Exploited opportunities are recorded in the risk register for information and monitoring.
Typical PMI Exam Example
A project team identifies that using a new software automation tool could reduce project duration by 20%. The organization decides to purchase and implement this technology immediately, ensuring the cost and time savings are achieved. The project manager documents this decision in the risk register. This is an example of which risk response strategy?
Answer: Exploit strategy (increasing probability of the opportunity to 100%).
PMI Exam Traps
-
Trap: Confusing exploit with enhance
-
Reality: Exploit guarantees 100% occurrence; enhance only increases probability or impact without guaranteeing it
-
Trap: Selecting share when the organization retains full control
-
Reality: Share involves transferring ownership to a third party; exploit keeps ownership within the organization
-
Trap: Applying exploit to threats instead of opportunities
-
Reality: Exploit is exclusively for positive risks (opportunities); for threats, use avoid, mitigate, transfer, or accept
-
Trap: Thinking exploit is only for individual risks
-
Reality: Exploit can also be applied at the overall project risk level (e.g., adding high-benefit scope elements or modifying risk thresholds)
Important PMI Connections
| Related Concept | Relationship Type | Exam Attention Point |
|---|---|---|
| Share | Opposing strategy | Share transfers ownership to a third party; exploit retains full control for guaranteed benefit |
| Enhance | Similar but different | Enhance increases probability/impact; exploit increases probability to 100% |
| Escalate | Alternative for opportunities | Escalate moves opportunity to higher management; exploit is executed by the project team |
| Acquire Resources | Implementation tool | Assigning talented resources (exploit example) directly links to the Acquire Resources process |
| Risk Register | Output document | Exploit responses are recorded in the risk register for monitoring and information |
Quick Review Questions
-
A project manager assigns the company's top software developers to a critical project phase to ensure a 30% reduction in delivery time. Which risk response strategy is being applied?
-
What is the key difference between the exploit strategy and the enhance strategy for positive risks?
-
An organization decides to use a new technology upgrade to reduce project costs. The project manager ensures this technology is implemented. Which risk response has been selected?
-
When should the exploit strategy be chosen over the share strategy for an opportunity?
-
At the overall project level, what actions might an exploit strategy include?
PMBOK v8 Reference
Section 11.5 - Plan Risk Responses (Risk Response Strategies for Opportunities)