Project Risk Management

The Risk Management Process and Its Standards

The repeating cycle of project risk management and the main guidance documents that describe it.

12 min

Activities: 0 of 2

Every project works with uncertainty. Estimates may be wrong, suppliers may be late, a design may not work as expected, and a stakeholder may change their mind. Risk management is the organised way a project finds this uncertainty early, decides what matters most, and acts while action is still cheap.

In this course you work at an intermediate level. You are expected to apply the methods, choose between them, and adapt them to the size and nature of the project. That starts with a clear picture of the whole process.

Where the guidance comes from

Several respected documents describe risk management. The International Organization for Standardization (ISO) publishes ISO 31000, which gives general principles and guidelines for managing risk in any organisation. Professional bodies such as the Project Management Institute (PMI) and the Association for Project Management (APM) publish guides focused on projects. They use slightly different words, but they describe the same cycle.

The risk management cycle

  1. 1

    Step 1

    Plan

    Decide how risk will be managed on this project: roles, methods, scales, reporting and budget for the work.

  2. 2

    Step 2

    Identify

    Find the threats and opportunities, and write each one clearly.

  3. 3

    Step 3

    Assess

    Judge probability and impact, and decide which risks matter most. Use numbers where the stakes justify it.

  4. 4

    Step 4

    Plan responses

    Choose a strategy and specific, owned actions for each important risk.

  5. 5

    Step 5

    Implement

    Carry out the actions. This is the step most often skipped.

  6. 6

    Step 6

    Monitor and review

    Track triggers, update assessments, close old risks, find new ones, and report.

Why it is a cycle, not a sequence

The steps repeat throughout the project. New risks appear as design develops, as contracts are signed, and as work starts on site. Old risks pass when their time window closes. A process run once at the start is a snapshot that is soon out of date.

Two examples

A small office move ran the cycle in a one-hour workshop, a one-page register and a short weekly check. A large hospital project ran the same cycle with a risk manager, monthly workshops, quantitative analysis and a board report. Both were correct. The process was scaled to the project, but no step was dropped.

Scaling the process

Ask three questions: how large and complex is the project, how new is the work to the organisation, and how severe would failure be? The answers decide how formal and how frequent each step should be.

Order the cycle

Put the steps of one pass through the cycle in order.

  1. 1Identify threats and opportunities
  2. 2Implement the responses
  3. 3Plan responses with owners and dates
  4. 4Plan the approach to risk management
  5. 5Monitor, review and report
  6. 6Assess probability and impact

A project ran a detailed risk workshop at the start and has not reviewed its register for five months. What is the main problem?

1 of 31

Checking your enrolment…