HKSM

A risk management plan describes how the project will identify, analyze, respond to, and monitor risks. It defines the approach, roles, methods, thresholds, categories, reporting, and resources needed to manage uncertainty.

Key Points

• A component of the project management plan that explains the end-to-end approach for managing risk.
• Tailored to the organization, project complexity, and stakeholder expectations.
• Defines roles, governance, escalation paths, and decision thresholds for risk.
• Sets risk categories and scales (e.g., probability and impact) to standardize analysis.
• Describes tools and methods for qualitative and quantitative risk analysis.
• Establishes response strategies, reserves usage, and reporting cadence.

Purpose

The plan ensures everyone understands how risk will be handled before risks occur. It creates consistency in identifying, analyzing, responding to, and monitoring risks, and aligns the team with organizational policies and stakeholder risk appetite.

Typical Sections

• Risk approach and objectives.
• Roles, responsibilities, and governance (including risk owners and escalation path).
• Stakeholder risk appetite and thresholds.
• Risk categories or Risk Breakdown Structure (RBS).
• Scales and matrices for probability, impact, and overall risk rating.
• Methods and tools for qualitative and quantitative analysis.
• Processes for identify-analyze-plan-implement-monitor risks.
• Response strategies and guidelines for threats and opportunities.
• Contingency and management reserves usage and approval process.
• Risk reporting, metrics, and meeting cadence.
• Templates, register structure, and data quality standards.
• Risk audits, reviews, and continuous improvement approach.

How to Create

• Review the project charter, business case, contracts, and organizational risk policy.
• Engage key stakeholders to understand risk appetite, constraints, and compliance needs.
• Select and tailor risk categories, data fields, and templates for the risk register.
• Define probability and impact scales and create the risk matrix with clear rating rules.
• Choose analysis methods and tools, including criteria for when to use quantitative analysis.
• Establish roles, decision rights, and escalation thresholds for risk actions and reserves.
• Document the processes for identification, analysis, response planning, implementation, and monitoring.
• Set reporting formats, metrics, and meeting cadence (e.g., weekly review, monthly audit).
• Confirm funding sources for reserves and the approval workflow to use them.
• Circulate the draft for feedback, finalize, and gain sponsor and team agreement.

How to Use

• Guide risk workshops and routine reviews using the agreed categories and scales.
• Rate new risks consistently and record them in the risk register with owners and due dates.
• Trigger quantitative analysis when criteria in the plan are met.
• Select and implement responses aligned to the plan’s strategies and thresholds.
• Track and report risk exposure, trends, and reserve consumption per the plan’s cadence.
• Escalate risks and approve reserve usage using the defined governance path.
• Update related plans (schedule, cost, procurement, quality) when risk responses affect them.

Maintenance Cadence

• Review at least once per phase or monthly for active projects.
• Refresh after major scope, schedule, cost, or resource changes.
• Update following risk audits, retrospectives, or significant events.
• Realign if stakeholder risk appetite or regulatory context changes.
• Control updates via change control when they affect governance or thresholds.

Example

Sample excerpts from a risk management plan:

• Approach: Apply qualitative analysis to all risks; use Monte Carlo for schedule if critical path float < 10 days.
• Roles: PM chairs weekly risk review; risk owners implement responses; sponsor approves use of management reserve > USD 20,000.
• Scales: Probability 1–5; Impact 1–5 on cost, schedule, and scope; Overall risk rating from matrix.
• Thresholds: Escalate any High-rated risk or any single-risk cost impact > 5% of baseline.
• Reporting: Top 10 risks in weekly status; full register monthly; reserve report each quarter.
• Responses: Threat strategies include avoid, mitigate, transfer, accept; opportunity strategies include exploit, enhance, share, accept.

PMP Example Question

You are starting a complex project in an organization with an established risk policy. What should you do first to guide how risks will be handled on this project?

1. Create and baseline the risk register.
2. Draft the risk management plan aligned to organizational policies and get stakeholder agreement.
3. Begin qualitative analysis with the core team.
4. Set a flat 10% contingency for all activities.

Correct Answer: B — Draft the risk management plan aligned to organizational policies and get stakeholder agreement.

Explanation: The plan defines the approach, roles, thresholds, and methods for risk work. The register and analysis activities follow the agreed plan.