To define the approach, tools, techniques, roles, and resources required to effectively manage risk.
How will we identify risks?
How will we analyze and prioritize them?
Who is responsible?
What level of risk is acceptable?
Project Charter (high-level risks, objectives)
Project Management Plan (existing components)
Stakeholder Register
Enterprise Environmental Factors (EEF) (market conditions, regulations)
Organizational Process Assets (OPA) (risk templates, lessons learned)
1. Expert Judgment - Engaging risk experts, senior managers, or domain specialists.
2. Data Gathering
Brainstorming
Interviews
Checklists
3. Data Analysis
Stakeholder risk tolerance analysis
Risk probability and impact definitions
4. Meetings
Workshops to align stakeholders on risk approach and expectations.
The Risk Management Plan is the primary output and includes:
1. Risk Strategy / Approach
Methodology for managing risks
Alignment with project objectives
2. Roles & Responsibilities
Defines who does what
Example:
Project Manager → overall accountability
Risk Owner → responsible for specific risks
3. Risk Categories
Structured using a Risk Breakdown Structure (RBS)
Examples:
Technical risks
External risks
Organizational risks
4. Probability & Impact Definitions
Standard scales (e.g., High/Medium/Low or numeric scales)
Ensures consistency in evaluation
5. Risk Appetite & Thresholds
Defines acceptable levels of risk
Example:
Cost overrun tolerance: ±5%
Schedule delay tolerance: 2 weeks
6. Reporting Format
Risk register format
Risk dashboards and escalation procedures
7. Budget & Resources
Allocation for risk management activities
Contingency reserves
8. Timing
Frequency of risk reviews
Integration with project meetings