Project risk management is the systematic process of identifying, analysing, responding to and monitoring uncertain events or conditions that could affect project objectives. A risk is generally an uncertain event or condition that, if it occurs, can have an effect on objectives such as scope, schedule, cost, quality, safety or benefits. Risk is therefore different from an issue: a risk describes uncertainty about something that might happen, whereas an issue is a problem or condition that has already occurred or is currently occurring. Risk management seeks to increase awareness of uncertainty and prepare appropriate responses rather than assuming that uncertainty can be eliminated.
Risk management begins with identifying potential sources of uncertainty. Risks can arise from technology, suppliers, requirements, stakeholders, resources, dependencies, regulatory changes, market conditions, security, infrastructure, organisational change and external events. Identification methods include workshops, interviews, lessons learned, assumption analysis, checklists, historical data, expert judgement and examination of project dependencies. A risk register commonly records identified risks, causes, potential events, consequences, owners, response actions and status. Good identification is continuous because new risks can emerge as the project progresses and assumptions are tested.
Risk analysis examines the likelihood and potential consequences of identified risks. Qualitative analysis may classify probability and impact using defined categories, while quantitative analysis can use numerical estimates, simulations, decision trees or other techniques when sufficient data exists. A risk's significance depends on both its potential effect and the project's context. A low-probability event with catastrophic consequences may warrant attention even if its expected value is relatively low. Dependencies between risks can also matter because several apparently separate risks may share a common cause or amplify one another.
Risk responses are selected according to the nature of the risk and the project's objectives. For threats, common response strategies include avoiding the risk, reducing its probability or impact, transferring or sharing aspects of its consequences, or accepting it with appropriate monitoring and contingency. Opportunities can be approached through strategies such as exploiting, enhancing, sharing or accepting the opportunity. The terminology varies between standards and methodologies, but the underlying principle is that a response should be proportionate to the exposure and should have a clear owner and implementation mechanism.
Risk management is closely connected with contingency planning and project budgeting. A response may require additional resources, alternative suppliers, technical redesign, insurance, contractual provisions, schedule float or reserve funding. Some risks are best addressed before they occur because preventive action can be cheaper than recovery. Others may be deliberately accepted because mitigation would cost more than the potential exposure or because the risk falls within the organisation's tolerance. Risk appetite and tolerance are therefore important governance concepts: they define how much uncertainty the organisation is prepared to accept in pursuit of objectives.
Risk management should distinguish inherent risk from residual risk. Inherent risk represents exposure before planned controls or responses, while residual risk represents the exposure remaining after responses are implemented. A response may introduce secondary risks of its own, creating a need for further analysis. For example, outsourcing a critical component may reduce internal delivery risk but introduce supplier dependency, contractual and concentration risks. Risk management is therefore iterative rather than a one-directional exercise. Controls should be monitored to determine whether they actually reduce the intended exposure.
Common weaknesses in project risk management include creating a risk register once and never updating it, recording vague statements without causes or consequences, assigning ownership without authority, confusing issues with risks, treating every risk as equally important, and focusing exclusively on threats. Another problem is false precision: assigning a numerical probability to an uncertain event without credible evidence can create an appearance of rigour without improving decision quality. Risk workshops can also suffer from groupthink, optimism bias and availability bias. Effective practice combines structured analysis with informed judgement and revisits assumptions as evidence changes.
The purpose of project risk management is not to create a project with zero risk, which is generally impossible and often undesirable. Risk management enables informed choices about uncertainty by making exposures visible, prioritising significant threats and opportunities, assigning accountability and preparing proportionate responses. It supports planning, budgeting, scheduling, procurement, governance and decision-making because risk information affects all of these areas. A mature approach treats risk as an ongoing management responsibility throughout initiation, planning, delivery and closure, with escalation when exposure exceeds agreed tolerance and with lessons captured so that future projects can make better decisions.
