Project Management guide · Risk, quality and control
Project Risk Management: Process, Tools and Examples
Project risk management is the ongoing process of identifying, analysing, responding to and monitoring uncertain events that could affect a project's objectives. It covers both threats, which could harm the project, and opportunities, which could benefit it.
Key takeaways
- Risk management is continuous: identify, analyse, respond and monitor throughout the project.
- Score risks with clear probability and impact definitions and rank them in a P-I matrix.
- Every significant risk needs an owner, a response and a review date.
- Manage opportunities as well as threats.
What project risk management is
A project risk is an uncertain event or condition that, if it happens, has a positive or negative effect on at least one objective such as scope, time, cost or quality. Risk management does not try to remove all uncertainty. It aims to make uncertainty visible early, so the team can decide deliberately what to do about it rather than reacting once it has become an issue.
- Threats are risks with a negative effect, such as a key supplier delivering late.
- Opportunities are risks with a positive effect, such as a new tool shortening testing.
- Issues are risks that have already happened and now need managing.
The risk management process
- Plan risk management: agree how risk will be handled on this project, including roles, scales for probability and impact, risk appetite and how often risks are reviewed. Record this in the project management plan.
- Identify risks: use workshops, checklists, assumption reviews, lessons from past projects and expert judgment. Write each risk in cause-event-effect form.
- Analyse risks qualitatively: score probability and impact, usually on a 1-5 scale, and rank risks in a probability-impact matrix.
- Analyse risks quantitatively (where justified): model the combined effect of risks on cost and schedule, for example with Monte Carlo simulation.
- Plan responses: choose a strategy and owner for each significant risk, and set triggers and contingency plans.
- Implement responses: carry out the agreed actions.
- Monitor risks: review the risk register regularly, track triggers, close old risks and add new ones.
Probability-impact matrix
A probability-impact (P-I) matrix turns scores into a priority. Multiply probability by impact to get a risk score from 1 to 25, then use agreed bands to decide what action is needed.
| Probability \ Impact | 1 Very low | 2 Low | 3 Medium | 4 High | 5 Very high |
|---|---|---|---|---|---|
| 5 Almost certain | 5 Medium | 10 High | 15 High | 20 Critical | 25 Critical |
| 4 Likely | 4 Low | 8 Medium | 12 High | 16 Critical | 20 Critical |
| 3 Possible | 3 Low | 6 Medium | 9 Medium | 12 High | 15 High |
| 2 Unlikely | 2 Low | 4 Low | 6 Medium | 8 Medium | 10 High |
| 1 Rare | 1 Low | 2 Low | 3 Low | 4 Low | 5 Medium |
Response strategies
| Threat strategy | What it means | Opportunity strategy | What it means |
|---|---|---|---|
| Avoid | Change the plan to remove the threat | Exploit | Act to make sure the opportunity happens |
| Mitigate | Reduce probability or impact | Enhance | Increase probability or impact |
| Transfer | Pass the impact to a third party, e.g. insurance or contract | Share | Partner with a third party better able to capture it |
| Accept | Take no action now; may hold a reserve | Accept | Take advantage if it happens |
| Escalate | Refer to a higher level when outside the project's authority | Escalate | Refer to a higher level when outside the project's authority |
Worked example
A team is moving a warehouse system to a new cloud platform. One risk reads: Because the data migration tool has not been tested with our volume of records, there is a risk that migration overruns the weekend cut-over window, leading to a day of lost trading.
- Probability 3 (possible) x impact 4 (high) = score 12, which falls in the High band.
- Response: mitigate. Run a full-volume rehearsal two weeks before cut-over and split the migration into two batches.
- Contingency plan: if the rehearsal takes more than 30 hours, move cut-over to a bank holiday weekend.
- Owner: data lead. Review: weekly at the project meeting.
- After the rehearsal succeeds, probability falls to 1 and the score drops to 4. That remaining exposure is the residual risk.
Common mistakes
- Treating risk management as a one-off workshop rather than a continuous activity.
- Writing vague risks such as 'resources' or 'budget' that nobody can act on.
- Listing risks without owners, responses or review dates.
- Confusing risks (future, uncertain) with issues (happening now).
- Ignoring opportunities and only managing threats.
- Scoring every risk 'medium' to avoid difficult conversations.
Free templates for this topic
Frequently asked questions
What are the steps of project risk management?
Plan risk management, identify risks, analyse them qualitatively and, where useful, quantitatively, plan responses, implement responses and monitor risks throughout the project.
What is the difference between a risk and an issue in risk management?
A risk is an uncertain future event; an issue is something that has already happened and needs resolving now. Unmanaged risks often become issues.
What are the five response strategies in project risk management?
For threats: avoid, mitigate, transfer, accept and escalate. For opportunities: exploit, enhance, share, accept and escalate.
Who is responsible for risk management on a project?
The project manager leads the process, but each risk should have a named owner who monitors it and makes sure the response is carried out.
How often should risks be reviewed in project risk management?
At least at every regular project meeting or reporting cycle, and whenever a significant change, milestone or new information arises.
What is risk appetite in risk management?
The amount and type of risk an organisation is willing to take in pursuit of its objectives. It guides which risks are acceptable and which need action.
What is qualitative risk analysis in project risk management?
Scoring and ranking risks by probability and impact, usually on simple scales, to decide which need attention first.
What is quantitative risk analysis in project risk management?
Numerical analysis of the combined effect of risks on project outcomes, often using techniques such as Monte Carlo simulation or expected monetary value.
What is expected monetary value in risk management?
Probability multiplied by the financial impact of a risk. A 20% chance of a £50,000 loss has an expected monetary value of £10,000.
Do Agile projects need risk management?
Yes. Short iterations, frequent feedback and visible backlogs reduce many risks, but teams still benefit from identifying and discussing key risks regularly.
What tools help with risk management?
A spreadsheet risk register works for most projects; many project management tools also offer risk fields, custom forms and dashboards.