1 Project Risk Management Foundations

Project risk and uncertainty

A project risk is an uncertain event or condition that can affect one or more project objectives if it occurs. Objectives may include cost, schedule, scope, quality, safety, compliance, benefits, or strategic value. Risk combines uncertainty about whether or how something will happen with the consequences it could have for the project.

Describe risks clearly

Uncertainty is a lack of complete knowledge about future conditions or outcomes. It is broader than any single risk: uncertainty about a new technology, for example, is not by itself a defined risk. A possible consequence—such as the technology failing to meet performance requirements—makes the uncertainty relevant to project objectives. Risk can be understood broadly as the effect of uncertainty on objectives.

A useful risk statement connects a cause, an uncertain event or condition, and its possible effect:

Because a key supplier has limited production capacity (cause), delivery may be delayed (uncertain event), resulting in a later launch (effect).

This structure helps distinguish a risk from a present-day fact or problem. If the supplier has already missed a delivery, that delay is an issue to manage; the possibility of further delays may remain a risk.

Threats and opportunities

A threat is a risk with a possible adverse effect, while an opportunity is a risk with a possible beneficial effect. Both belong in project risk management because either can influence the achievement of objectives.

A supplier’s early completion could be an opportunity if it allows the team to test sooner and bring a product to market earlier. The same supplier’s capacity shortage could be a threat if it delays delivery. Consider both possibilities rather than assuming all risk is negative.

Establish the business context

Projects operate within a wider business environment. Risks may arise inside the project, such as from uncertain estimates, resource constraints, or technical complexity. They may also arise from the organization and its surroundings, including strategy, customers, suppliers, markets, regulation, and dependencies on other initiatives.

A risk matters in relation to the objectives and priorities it could affect. The same event may have different significance for different projects or stakeholders. Before managing risks, clarify objectives, assumptions, constraints, dependencies, and relevant internal and external conditions. Understand who has authority to make decisions and how the organization’s risk appetite and thresholds guide those decisions. These factors help determine which uncertainties deserve attention and what level of exposure is acceptable.

Manage risk throughout the project

Risk management is not a one-time checklist. It is part of project decision-making from early definition through delivery and transition, and attention should be renewed as plans and circumstances change. Effective practice is integrated, structured, tailored to context, inclusive, dynamic, informed by the best available information, attentive to human and cultural factors, and continually improved.

• Link risk to objectives. Assess uncertainty by considering its possible effect on what the project is expected to achieve.

• Make it part of normal management. Consider risk when shaping plans, budgets, schedules, procurement, and decisions, not only in a separate register.

• Tailor the effort. Use an approach proportionate to the project’s scale, complexity, uncertainty, and potential consequences.

• Involve relevant people. Teams, sponsors, customers, suppliers, and other stakeholders may have different information and perspectives.

• Revisit the picture. Risks can emerge, change, or cease to matter as the project and its environment evolve.

• Be transparent about uncertainty. Use the best information available while recognizing assumptions, gaps, and limits in estimates.

• Learn and improve. Use experience, monitoring, and changing conditions to refine decisions and risk practices.

A sound foundation does not assume that every threat can be removed or every opportunity captured. It makes uncertainty visible and supports informed choices in the interests of project and business objectives.