5 Project Risk Management

How project risk management works

Project risk management is an ongoing, iterative process for handling uncertain future events that could affect project objectives. A risk may be a threat, meaning possible harm, or an opportunity, meaning possible benefit. When a risk happens, it becomes an issue to manage; monitoring can also reveal new risks or show that existing plans need to change.

Identify and record risks

Identify risks throughout the project, not only at the beginning. Involve the project team and relevant stakeholders, and review the project’s scope, schedule, budget, assumptions, resources, dependencies, suppliers, and external conditions. Brainstorming, checklists, lessons from similar projects, and expert judgment can help uncover uncertainties.

Describe each risk by connecting its cause, uncertain event, and possible effect. For example: “Because the supplier has limited production capacity, a critical component may arrive late, delaying system testing.” This structure supports risk assessment and helps the team choose a targeted response.

Record identified risks in a risk register. Useful fields include a description, category, probability, impact, priority, owner, response actions, trigger signs, and current status. Assigning an owner makes responsibility for follow-up explicit.

Assess likelihood and impact

Risk assessment estimates how likely an event is and how much it could affect project objectives, including cost, schedule, scope, quality, or benefits. Teams commonly begin with qualitative analysis: they rate probability and impact on agreed scales, then use a probability–impact matrix to prioritize risks. Define rating meanings and priority thresholds in advance so the team applies them consistently.

For selected high-priority risks, quantitative analysis can estimate effects numerically. One simple technique is expected monetary value (EMV):

For example, if a delay has a $30\%$ chance of causing $\$40{,}000$ in costs, its EMV is:

EMV is an average across uncertain outcomes, not a prediction that the project will incur exactly $\$12{,}000$. More complex analyses may model combined uncertainty in cost or completion dates.

Choose and plan responses

Choose a response proportionate to the risk and supportive of project objectives.

For threats, common strategies are:

• Avoid: Change the plan so the threat cannot affect the project.

• Mitigate: Reduce the likelihood or impact, for example by qualifying a backup supplier.

• Transfer or share: Shift or distribute some exposure, often through an agreement or insurance. Responsibility may be shared, but the project may still face consequences.

• Accept: Take no proactive action beyond monitoring, or prepare a contingency plan in case the risk occurs.

For opportunities, a team may exploit the opportunity to ensure it occurs, enhance its likelihood or benefit, share it with a partner, or accept it without special action. A response may create a new secondary risk, which should also be assessed.

A response plan should specify the action, owner, timing, required resources, and trigger for action. For example, if supplier delays become more likely when a production milestone slips, the team might monitor that milestone and order from the qualified backup supplier when a defined threshold is reached.

Monitor, update, and communicate

Review risks regularly and whenever significant project conditions change. Check whether triggers have occurred, responses are being carried out, and probability or impact has changed. Look for newly emerging risks, risks that have occurred, and residual risks that remain after a response.

Update the risk register, communicate important changes, and close risks that are no longer relevant. Monitoring connects risk management to project decisions: if exposure exceeds agreed limits, the project manager may need to escalate the matter or seek approval to change the plan.

The repeating cycle is to identify uncertainties, assess their likelihood and effects, prioritize them, assign owners and responses, and monitor results. A clear risk register, proportionate analysis, and timely communication help a team act before uncertainty becomes an unmanaged problem and make use of beneficial opportunities.