1 Foundations of Project Risk Management
Learn how to connect project uncertainty to objectives, assess and prioritize risks, plan responses, and keep risk information useful throughout a project.
Understand
A is an uncertain event or condition that could affect one or more project objectives if it occurs. The effect may be negative, making it a , or positive, making it an . A risk might happen; an has already happened and needs action.
A specific risk statement connects three elements: the cause, the uncertain event, and the possible effect. For example, because a specialist supplier has not confirmed capacity, delivery may arrive two weeks late, delaying system testing. This makes the uncertainty clear enough to assess and manage.
Establish the project context
Risk assessment is meaningful only in relation to what the project is trying to achieve. Clarify the outcomes, deliverables, dates, costs, quality levels, or benefits that define success, as well as the project’s scope and boundaries: what work and decisions belong to the project and what is outside it.
Establish what is being assumed to be true and what constraints limit the team’s options. Identify stakeholders who can affect or be affected by the project, along with relevant external conditions. Agree how much uncertainty decision-makers can accept, what levels require escalation, who identifies, owns, approves, and reviews risks, and how often reviews take place.
Tailor the process to the project’s size and uncertainty. A small internal project may use a shared register and brief reviews, while a complex or high-stakes project may need specialist analysis and formal escalation. The goal is to support useful decisions, not create paperwork for its own sake.
Search across risk categories
Categories help a team search systematically and group related risks. A risk may fit more than one category, so categories are prompts rather than substitutes for a clear risk statement. Consider both threats and opportunities in every relevant area.
Technical: Design, integration, performance, cybersecurity, or technology maturity.
Schedule and resources: Dependencies, estimates, staffing, skills, or equipment availability.
Cost and commercial: Price changes, funding, supplier capacity, contracts, or payment terms.
Scope and requirements: Unclear needs, changing requirements, or acceptance criteria.
People and organization: Turnover, training, decision delays, or stakeholder alignment.
External: Weather, market conditions, political events, or third-party actions.
Legal, regulatory, and safety: Permits, compliance, privacy, or hazards.
Manage risks iteratively
Risk management is iterative. Monitoring can reveal new risks, change assessments, or show that a planned response needs revision.
Plan the approach. Agree on objectives, categories, rating scales, thresholds, responsibilities, reporting, and the review schedule.
Identify risks. Review scope, schedule, assumptions, dependencies, lessons learned, and stakeholder concerns. Workshops, interviews, checklists, and expert input can help. Record specific uncertainties rather than vague labels such as “supplier risk.”
Analyze and prioritize. Estimate each risk’s likelihood and effect on objectives. A simple qualitative method rates likelihood and impact—for example, as low, medium, or high—and uses a matrix or agreed rules to prioritize. Record the reasoning and uncertainty behind ratings. For major or interconnected risks, quantitative analysis, such as scenario or schedule analysis, may help estimate overall exposure.
Choose and plan responses. For threats, common strategies are to avoid the risk, reduce its likelihood or impact, transfer or share exposure where appropriate, or accept it with a contingency plan. For opportunities, the team may seek to secure the benefit, increase its likelihood or impact, share it, or accept it. Assign an owner and actionable next steps. A response can create a , which should also be assessed.
Implement and monitor. Carry out agreed actions, watch for triggers, reassess likelihood and impact, and check whether the response is working. Escalate risks that exceed authority or agreed thresholds. Close risks that are no longer relevant and record lessons learned.
Make responses and records actionable
A response needs to specify who will do what and when, and what event or decision will prompt further action. “Monitor supplier” is weak. A more concrete response is for the procurement lead to confirm production capacity by 15 May and arrange a qualified backup supplier if capacity is not confirmed. This identifies an owner, action, trigger, and decision point.
The is the working record for identified risks, assessments, responses, ownership, and status. It should be accessible to the people responsible for acting on the information and updated as the project changes. Apply rating definitions consistently, and record the reasoning and uncertainty behind assessments.
Useful register fields include:
ID and date: A unique reference and when the risk was recorded or reviewed.
Risk statement: The cause, uncertain event, and possible effect on an objective.
Category and objective: The relevant risk area and the objective affected.
Likelihood and impact: The current assessment, using consistent rating definitions.
Priority: Relative urgency or exposure, based on the agreed method.
Owner: The person accountable for tracking the risk and coordinating its response.
Response and actions: The chosen strategy, specific actions, action owners, and due dates.
Trigger and contingency: The warning sign to watch for and what to do if the event occurs.
Status and review date: Whether the risk is open, changing, realized, closed, or escalated, and when it should next be reviewed.
Residual risk: The exposure remaining after planned responses.
Apply the process to a launch risk
For a customer portal launch, a supplier’s unconfirmed test capacity is the cause, a delayed test environment is the uncertain event, and postponed launch approval is the possible effect. The team assesses likelihood and impact, assigns a procurement owner to confirm capacity, sets a date to arrange backup capacity if needed, and reviews the risk at the next project meeting.
If the environment is actually delayed, the team records an and manages its impact. It continues to monitor any remaining related risks. Across the project, the process connects uncertainty to objectives: establish context and thresholds, identify threats and opportunities, analyze and prioritize risks, plan and implement owned responses, then monitor, reassess, and update the .