4 Risk, Change, and Project Controls

How project controls work together

Project controls help teams respond to uncertainty and change while protecting agreed outcomes, value, and compliance. Risk, issue, change, procurement, communication, and stakeholder management are connected: a risk response may require a change or purchase, a supplier delay may threaten a milestone, and stakeholder feedback may reveal an opportunity or proposed scope change.

Manage these areas throughout the project life cycle, adapting the approach to governance and delivery method. The PMP examination assesses judgment in realistic situations and emphasizes predictive, adaptive, and hybrid approaches, as well as managing changes, resolving issues, and planning and managing risk.

Distinguish risks, issues, and changes

A Risk concerns an uncertain future event or condition; an Issue is a present condition or problem requiring action; and a Change proposes or approves an adjustment to a project artifact, baseline, or way of working. Correctly classifying an item helps the team choose the appropriate response.

For example, the possibility that a supplier will miss a delivery date is a risk. The team might investigate alternatives or order early. Once the supplier confirms a delay, it is an issue. If the team proposes an alternate component that changes cost, schedule, or requirements, that proposal is a change request.

Identify and manage risks

Plan how risks will be identified, analyzed, assigned, responded to, and monitored. Identify them repeatedly—not only during planning—because new information, delivery results, and external conditions may reveal new risks or alter existing ones.

Record risks in a Risk register, with useful details such as cause, uncertain event, potential effect, probability, impact, owner, response, and status. Assess each risk’s likelihood and possible impact. Qualitative analysis prioritizes risks, often with probability-and-impact ratings. Quantitative analysis estimates effects numerically when project needs and available data justify it.

Assign a Risk owner to monitor each risk and carry out its planned response. Common strategies for threats are avoiding, mitigating, transferring, or accepting the risk. Strategies for opportunities include exploiting, enhancing, sharing, or accepting it. Escalate a risk when it falls outside the project manager’s authority or the project’s agreed thresholds. Monitor residual risks, secondary risks created by responses, and newly identified risks.

Resolve and track issues

Track present problems in an issue log. Record the issue, its impact, priority, owner, due date, decisions, and resolution. Investigate the cause, involve people with the necessary expertise or authority, agree on action, and monitor progress.

If resolving an issue would change an approved baseline, use change control rather than quietly adjusting the plan. Communicate significant risk and issue impacts to people who can act on them.

Evaluate and authorize changes

Change control ensures that proposed changes are considered deliberately, approved by the proper authority, and incorporated consistently. Requests may come from a customer, team member, supplier, regulator, new risk, or changing business need. Clarify the need and evaluate effects on scope, schedule, cost, quality, resources, risk, procurement, compliance, benefits, and affected stakeholders.

Follow the project’s governance and change-control plan. Depending on the organization, the project manager may decide some changes; others may require a sponsor, product owner, change control board, or governance body. Record each request and its disposition, and communicate whether it is approved, rejected, deferred, or needs more analysis. Do not implement a change to an approved baseline before the authorized decision, except where an established emergency procedure allows otherwise.

After approval, update relevant plans, baselines, requirements, schedules, budgets, contracts, and records. Inform affected people and verify implementation. In adaptive work, teams may refine and reprioritize a product backlog within agreed decision rights. This does not remove governance: changes to funding, contractual commitments, regulatory obligations, or other controlled project boundaries still need appropriate approval. Change control should enable valuable adaptation while preventing uncontrolled scope growth.

Plan and manage procurement

Procurement management covers obtaining goods or services from outside the project team or organization. Early in planning, assess what to make or buy, procurement lead times, internal purchasing rules, supplier capability, market conditions, and risks such as dependency, quality, security, sustainability, and compliance. Define needs through clear specifications or a statement of work, and select a sourcing and contract approach suited to the work and its uncertainty.

Solicit and evaluate offers using documented criteria, which may include technical capability, price, delivery, quality, risk, and lifecycle value. Follow organizational procurement rules and manage conflicts of interest fairly. The contract defines obligations, deliverables, acceptance conditions, and procedures for payment and change. Monitor supplier performance against the contract, coordinate dependencies, document decisions, resolve issues through appropriate channels, and formally close procurement when obligations are complete.

A change affecting a contract must follow both project change control and the contract’s modification provisions. Coordinate with procurement or legal specialists when required.

Contract types and financial risk

Contract type affects how financial risk is distributed. A fixed-price arrangement can give the buyer greater price predictability when requirements are clear, while placing more cost-overrun risk on the seller. A cost-reimbursable arrangement may suit work with greater uncertainty but requires the buyer to manage and monitor costs. Time-and-materials arrangements combine labor rates and materials costs; establish suitable limits and oversight. The best choice depends on scope clarity, risk allocation, market conditions, and organizational policy; no single contract type is universally superior.

Engage stakeholders throughout the project

Identify stakeholders early and revisit the list throughout the life cycle. Stakeholders may include the sponsor, customer, users, delivery team, functional managers, suppliers, regulators, and affected communities. Analyze their needs, influence, expectations, concerns, and preferred involvement. Use that analysis to plan appropriate engagement rather than assuming one message or meeting format suits everyone.

Stakeholder engagement is ongoing. Compare stakeholders’ current engagement with the involvement needed for project success. Address resistance by understanding its cause, sharing relevant evidence, and involving people appropriately. Do not treat disagreement as misconduct or promise a change that has not been approved. Escalate unresolved matters through agreed governance paths, and update engagement plans as stakeholder roles, influence, needs, or project circumstances change.

Plan clear, two-way communication

A communications plan clarifies who needs what information, when, how, and from whom. Choose channels to suit the message:

• Interactive communication supports discussion and feedback.

• Push communication sends information to recipients.

• Pull communication makes information available for stakeholders to access.

Confirm understanding for high-impact decisions, sensitive changes, risks, and escalations. Keep reporting timely, factual, and tailored—for example, concise, decision-focused updates for sponsors and detailed coordination information for delivery teams. Communication is two-way: listen for concerns, confirm requirements, and adapt when stakeholder needs or project conditions change.

Apply controls across the life cycle

Apply the controls throughout the project life cycle, adapting them to governance and delivery method.

• Initiating: Clarify objectives, governance, decision rights, major stakeholders, initial risks, and procurement constraints.

• Planning: Establish approaches for risk, issue, change, procurement, communications, and stakeholder management; define baselines and thresholds where appropriate.

• Executing: Deliver work, engage stakeholders, communicate information, conduct procurements, and carry out approved responses and changes.

• Monitoring and controlling: Compare actual results with plans, reassess risks, resolve issues, monitor suppliers and stakeholder engagement, and route proposed changes through governance.

• Closing: Confirm acceptance and completion of contractual obligations, resolve or transfer remaining matters, communicate outcomes, and record lessons learned.

Use logs and reports as working controls, not paperwork for its own sake. Keep ownership and status clear, escalate promptly when thresholds are crossed, and connect related records—for example, linking a supplier issue to its risk, contract, change request, decision, and stakeholder communication. First understand the facts and authority limits; then involve the right people, evaluate consequences, take the planned or approved action, and communicate the result.