What is a risk

Definition

In project management, a risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives, such as the schedule, the cost or the quality of the result. This is how PMI's PMBOK Guide frames it. A negative risk is a threat and a positive one is an opportunity. Each risk is rated by how likely it is and how much it would matter, and the two together, probability × impact, give a score that sets the order in which risks get attention. The PMBOK Guide lists four responses to a threat: avoid it (change the plan so it cannot happen), mitigate it (make it less likely or less harmful), transfer it (move the impact to someone else, for example through insurance) and accept it. Opportunities have four of their own: exploit, enhance, share and accept. Newer editions of the Guide add a fifth response to both lists, escalate.

Why it matters

Writing the risks down before the work starts turns a vague worry into a short list with scores, owners and one planned response each, so when something does go wrong the first move is already decided. A risk that happens becomes an issue, a problem to handle now. The list is not a one off: risks change as the project moves, so it is read again at a fixed interval.

Directly related: Issue, Project, Dependency.

Improvement tips

• Keep a risk register: each risk with its probability, impact, score, owner and planned response.
• Give every risk one owner who watches it and acts if it starts to happen.
• Pick one response per threat: avoid, mitigate, transfer, for example through insurance or a contract, or accept. Educational material, not tax or legal advice.
• Read the register again once a month and after any big change to the plan.

Common mistakes

• Writing the register once at the start and never reading it again.
• Listing only threats and missing the opportunities, which need a plan too.
• Naming a risk without an owner or a response, so nothing happens when it arrives.