Risk Management Plan
Project Name: Project X
Agency: Agency ABC
Business Unit/Program Area: LMN Division
Project Sponsor: Nancy W
Project Manager: Joe P
Date: XX/XX/XX Version: 1.0
Risk Management
INTRODUCTION
Purpose and Objectives
Risk Management is the systematic process of identifying, analysing, and responding to project risks. It
includes maximizing the probability and consequences of positive events and minimizing the
probability and consequences of adverse events to project objectives. A risk management plan defines
how a project team will handle risks to achieve that goal.
RISK-RELATED DEFINITIONS
There are a number of terms used in risk management that should be defined to ensure clear
communications.
Risk
An uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s
objectives. Risk is often a measure of the inability to achieve overall project objectives within defined
project requirements and constraints and has three components: (1) the probability of occurrence, (2)
the impact of the risk on the program, and (3) the time horizon during which the consequences will
occur if the risk is not mitigated.
Risk Management Plan
Probability of Occurrence
Choose the range and language that fits your organisation’s risk tolerance.
The following table defines the probability of occurrence.
Table 1 – Risk Probability of Occurrence
Numeric
Probability range Natural language expression score
91% through 99% “Very likely” to occur 5
61% through 90% “Probably” will occur 4
41% through 60% “May occur” about half of the time 3
11% through 40% “Unlikely” to occur 2
1% through 10% “Very unlikely” to occur 1
Risk Impact
Choose the range and language that fits your organisation’s risk tolerance and scale to align with the project.
The following table defines the risk impact categories and terms. For positive risks, consider the
opposite of the impact description. The examples would remain the same except having a positive
impact to the project.
Table 2 – Risk Impact
Natural
language Numeric
Impact Description Example * expression score
schedule
An event that, if it occurred, adjustment >2
would cause project failure mo Critical 10
(inability to achieve minimum
acceptable requirements) cost impact >
40%
An event that, if it occurred, schedule
would cause major cost/ adjustment >1
schedule increases. mo Serious 8
Secondary requirements may cost impact
not be achieved. >20%
An event that, if it occurred, schedule Moderate 5
would cause moderate cost/ adjustment >
schedule increases, but 2wks
important requirements cost impact >
would still be met.
Risk Management Plan
10%
An event that, if it occurred, schedule
would cause only a small adjustment >
cost/schedule increase. 1wk Minor 3
Requirements would still be cost impact >
achieved. 5%
schedule
An event that, if it occurred, adjustment <
would have no effect on the 2d Negligible 1
project. cost impact
<5%
* These examples are simply rules of thumb and you should adjust them according to your specific project needs.
Risk Score
Choose the matrix that best aligns with your project and adjust the highlighted portion to align with the chosen matrix.
The risk score is a value calculated that is the product of probability of occurrence and impact. You use
the score to compare risks as part of the risk prioritization process. Table 3 is the matrix used to
develop the risk score. The values range from 1 (very low exposure) to 50 (very high exposure).
Although there are no specific break points in the risk exposure ranking, those risks with an exposure
value of less than 20 are generally considered low risks, those risks with an exposure value between 20
and 39 are generally considered moderate risks, and those risks with an exposure value between 40
and 50 are generally considered high risks. The definitions of Low, Moderate, and High are as follows:
Low Risk: Has little or no potential for increase in cost, disruption of schedule, or degradation of
performance. Actions within the scope of the planned project and normal management
attention should result in controlling acceptable risk. No response plans will be made for these
risks. The project will monitor for them and manage them as they come up.
Moderate Risk: May cause some increase in cost, disruption of schedule, or degradation of
performance. Special action and management attention may be required to control acceptable
risk. The project will do some response planning for these risks.
High Risk: Likely to cause significant increase in cost, disruption of schedule, or degradation of
performance. Significant additional action and high priority management attention will be
required to control acceptable risk. The project will do in-depth response plans for these risks.
Positive risks can use the same table and descriptions except instead of trying to avoid the risk, you will
endeavour to make the risk occur and gain the positive impact.
Risk Management Plan
Table 3 – Risk Score
Impact
Negligibl Minor Moderate Serious Critical
Probability
e (1) (3) (5) (8) (10)
Very likely to occur (5) 5 15 25 40 50
Probably will occur (4) 4 12 20 32 40
About 50% chance of occurring
3 9 15 24 30
(3)
Unlikely (2) 2 6 10 16 20
Very unlikely to occur (1) 1 3 5 8 10
ORGANISATION
This section defines organisational responsibilities and the individual roles and responsibilities
for risk management.
Add a section for any organisational entity such as a PMO or EPMO that has responsibility for risk management practices..
Roles & Responsibilities
The following table contains some common roles. Adjust to fit the needs of the individual project.
Table 4 – Roles & Responsibilities
Project Manager:
The overall
coordinator of the
Risk Management
Program
Project Team:
Responsible for
identifying,
monitoring and
managing risks
Subject Matter
Experts (SMEs):
Responsible for
implementing risk
management tasks
per this plan
End Users
Risk Management Plan
RISK MANAGEMENT STRUCTURE AND PROCEDURES
This section describes the risk management process and provides an overview of the risk management
approach.
Risk Assessment
The table below is designed to provide a summary of the overall risk of the project/programme. The Summary section should provide guidance to the
project/programme manager on how much time and effort should be put into the risk management effort. Each section contains sample language that
should be edited to align with the project.
The table below provides an overall review of the project to help determine how much risk
management is appropriate for this project/programme.
With a budget of BWPXXX,000, this project is a mega/large/medium/small sized
Size:
project
This project involves multiple divisions within the organisation, but does not
Complexity: involve any other agency or external organization. The project does work with
complex formulas. We rate this medium complexity.
Importance to
This project is determined to be of high priority within the agency.
Business:
Visibility: While not directly public facing, delivers very important public information.
Agency History: Agency seldom does IT projects of this size or complexity
Skill Levels
ITD is updating an ITD based app. ITD has already done this with other sections of
Vendor:
the app; they are just moving the rest of the app off the mainframe system.
Project Mgr.: Agency staff has no formal PM experience.
Agency Project
About 50% of the SMEs have done a similar project
Team
Summary
Risk Management It has been determined that the project will spend a moderate amount of time
Effort Decision: performing the following risk assessment activities.
Risk Management Plan
Identification
The table below should be a step-by-step process planned for what risk management activities will be done for this category.
What Owner Time Estimate
Describe a technique/step the project will use for risk identification. Include Define who will be responsible for Estimate the time planned to
dates, deadlines and key processes. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a technique/step the project will use for risk identification. Include Define who will be responsible for Estimate the time planned to
dates, deadlines and key processes. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a technique/step the project will use for risk identification. Include Define who will be responsible for Estimate the time planned to
dates, deadlines and key processes. this process. spend on this effort. Break out
multiple meetings and prep
times.
The project/programme will use the following categories of risk in this process:
Insert the project/programme’s initial risk categories here.
Qualitative Analysis
The table below should be a step-by-step process planned for what risk management activities will be done for this category.
What Owner Time Estimate
Describe a step the project/programme will use for risk qualification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk qualification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk qualification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk qualification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Risk Management Plan
What Owner Time Estimate
Describe a task the project/programme will use for risk qualification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Quantitative Analysis
The table below should be a step-by-step process planned for what risk management activities will be done for this category.
What Owner Time Estimate
Describe a step the project/programme will use for risk quantification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk quantification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk quantification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk quantification. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Risk Response Planning
The table below should be a step-by-step process planned for what risk management activities will be done for this category.
What Owner Time Estimate
Describe a step the project/programme will use for risk response planning. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk response planning. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Risk Management Plan
What Owner Time Estimate
Describe a step the project/programme will use for risk response planning. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme project will use for risk response Define who will be responsible for Estimate the time planned to
planning. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programmet will use for risk response planning. Define who will be responsible for Estimate the time planned to
this process. spend on this effort. Break out
multiple meetings and prep
times.
Risk Monitoring and Control
The table below should be a step-by-step process planned for what risk management activities will be done for this category.
What Owner Time Estimate
Describe a step the project/programme will use for risk monitoring and/or Define who will be responsible for Estimate the time planned to
controlling. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk monitoring and/or Define who will be responsible for Estimate the time planned to
controlling. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk monitoring and/or Define who will be responsible for Estimate the time planned to
controlling. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk monitoring and/or Define who will be responsible for Estimate the time planned to
controlling. this process. spend on this effort. Break out
multiple meetings and prep
times.
Describe a step the project/programme will use for risk monitoring and/or Define who will be responsible for Estimate the time planned to
controlling. this process. spend on this effort. Break out
multiple meetings and prep
times.
Risk Management Plan
RISK REGISTER AND RISK LIST
The project’s risk register and risk list is located in the project repository at SharePoint site A.
The risk list covers the following points:
Risk ID – A numbering system that allows a cross reference to the Risk Event.
Risk Event – A description of the risk.
Activity/Task # – Identifies the task or activity is this risk related.
Occurrence – Describe when and how often this risk could take place.
Risk Category – The category the risk is assigned.
Trigger – Describe what would cause this risk to occur.
Source – Enter who identified the risk.
Probability – The likelihood that the risk will occur. See the Definitions section for possible
values.
Impact – The effect on the project objects if the risk event occurs. See the Definitions section
for possible values.
Score– Reflects the severity of the risks effect on objectives. The risk score is determined by
multiplying the risk probability and risk impact values. The intent is to assign a relative value to
the impact on project objectives if the risk in question should occur.
The risk register covers the following points:
Date Identified – The date the risk was identified.
Status – Identifies whether the risk is potential, active, or closed.
Risk Description – A description of the risk.
Risk Probability – The likelihood that the risk will occur. See the Definitions section for possible
values.
Risk Impact – The effect on the project objects if the risk event occurs. See the Definitions
section for possible values.
Risk Score – Reflects the severity of the risks effect on objectives. The risk score is determined
by multiplying the risk probability and risk impact values. The intent is to assign a relative value
to the impact on project objectives if the risk in question should occur.
Risk Assignment – Person(s) responsible for the risk if it should occur.
Agreed Response – The strategy that is most likely to be effective.
o Avoidance – Risk avoidance entails changing the project plan to eliminate the risk or
condition or to protect the project objectives from its impact.
o Transference – Risk transference is seeking to shift the consequence of a risk to a third
party together with ownership of the response. Transferring the risk simply gives
another party responsibility for its management; it does not eliminate it.
Risk Management Plan
o Mitigation – Risk mitigation seeks to reduce the probability and/or consequences of an
adverse risk event to an acceptable threshold. Taking early action to reduce the
probability of a risk’s occurring or its impact on the project is more effective than trying
to repair the consequences after it occurs.
o Acceptance – This technique indicates that the project team has decided not to change
the project plan to deal with a risk or is unable to identify any other suitable response
strategy.
Risk Response Plan – Specific actions to enhance opportunities and reduce threats to the
project’s objectives.
Risk Management Plan
Risk List
Insert a sample of your risk list here if you plan to maintain it in another location, otherwise you can use this space for your risk list. Remember, this is your complete list of risks identified in your project/programme that
didn’t score high enough to move on to the risk register. You will want to review this list regularly with the risk/ project/programme team to see if circumstances have changed that would change the probability or impact of
a risk. Modify to scale with project/programme
Risk Impact
Probability
Risk Score
Risk
Risk Activity/
ID Risk Event Task # Occurrence Risk Category Trigger Source
Page 11 of 12
Risk Management Plan
Risk Register
Insert a sample of your risk register here if you plan to maintain it in another location, otherwise you can use this space for your risk register. Remember, only those risks you are actively monitoring and controlling should be
in your risk register.
Risk Risk Risk Cost Risk Schedule Risk
Risk ID Date Submitted Status Risk Event
Probability Impact Score Quantification Quantification
#/#/####
Risk Agreed
#
Owner Response Quantification Comments
Description:
Assessment:
Response Plan:
Lessons Learned:
Page 12 of 12