A risk is an uncertain event or condition that, if it occurs, affects at least one project objective. Risks can be negative (threats) or positive (opportunities). An issue is a risk that has already happened. Risk management is the discipline of finding risks early, deciding which matter, and acting before they turn into issues.
The five-step process
- Plan — agree how you will manage risk: scales, roles, review frequency, risk appetite.
- Identify — find risks through workshops, checklists, assumption reviews, lessons learned and expert interviews.
- Assess — score probability and impact and prioritise.
- Respond — choose a strategy, assign an owner and plan actions.
- Monitor — review regularly, track triggers, close risks that have passed and add new ones.
Writing a good risk statement
Use the cause → event → effect structure:
Because our supplier is the only certified source (cause), they may be unable to deliver the parts on time (event), which would delay assembly by up to four weeks and add overtime costs (effect).
A statement like "supplier risk" cannot be assessed or owned. A precise one points straight at possible responses.
Assessing risks
Qualitative assessment rates probability and impact on a scale — usually 1 to 5 — and multiplies them to get a score. Plot the scores on a probability-impact matrix (heatmap) to see priorities at a glance. Our free risk matrix tool does this automatically.
Quantitative analysis assigns numbers: expected monetary value (probability × cost impact), Monte Carlo simulation of schedule and cost, and sensitivity analysis. Use it for large or high-stakes projects where contingency must be justified.
Expected monetary value example
A 30% chance of a $50,000 rework cost has an EMV of $15,000. Summing EMVs across threats (minus opportunities) gives a defensible starting point for contingency reserve.
Response strategies
| For threats | Meaning | Example |
|---|---|---|
| Avoid | Remove the cause | Use proven technology instead of beta |
| Mitigate | Reduce probability or impact | Prototype early; add testing |
| Transfer | Shift impact to a third party | Insurance, fixed-price contract |
| Accept | Acknowledge and hold contingency | Budget reserve for minor delays |
| Escalate | Outside the project's authority | Raise to programme or sponsor |
For opportunities the mirror strategies are exploit, enhance, share, accept and escalate.
The risk register
A risk register is the living record of risks. Minimum columns: ID, description, category, probability, impact, score, owner, response strategy, actions, status and trigger. Download a free risk register template or use the online tool.
Habits that make risk management work
- Review the top risks in every status meeting — not just once at kickoff.
- Give every risk a named owner with time to act.
- Reward people for raising risks early; never shoot the messenger.
- Track contingency use and release unused reserve when risks close.
Put this into practice
Use our free tools to apply what you just read — or get a free consultation if you want an expert to look at your project.