How to plan risk management: 16 steps to build an effective plan

In reality, over 60% of small businesses fail partly because they are not well-prepared for risky situations. Whether in business, investment, or personal project management, the lack of a clear risk management plan can quickly turn minor issues into major crises.

If you are looking for a simple, easy-to-apply yet effective way to create a risk management plan, this article will help you quickly understand: what risk is, how to assess its impact, and how to build an effective risk management plan to proactively handle all situations.

Instead of reacting passively when problems occur, you will learn how to foresee issues, minimize damage, and protect your goals realistically and intelligently.

Step 1: Basic Risk Management Approach

Understand how risk management works

• What is risk?

  • It is the impact (positive or negative) of a potential event.

  • It can appear in one or many different situations.

• Core formula in risk management:

  • Risk = Probability × Impact

• This is the foundation when applying a risk management plan in practice.

Identify key risk factors

• Event: What could happen?

  • E.g., data loss, project delay, market volatility

• Probability: How likely is it to occur?

  • Assess based on experience or actual data

• Impact: How severe would the consequences be?

  • Financial, reputational, operational impact

• This is an important step in risk analysis and helps you clearly see the problem before taking action.

Develop risk reduction measures

• Mitigation: How to make risks less likely to occur?

  • Establish procedures, train staff, tighten controls

• Contingency: If it happens, how to minimize damage?

  • Prepare backup plans, insurance, alternative solutions

• Risk reduction effectiveness:

  • Reduction = Mitigation × Contingency

• This is the core of an effective risk management plan.

Calculate remaining risk (Exposure)

• After applying mitigation measures:

  • Exposure = Initial Risk – Reduction

• This is the portion of risk you cannot completely eliminate.

• It can be called: threat level, liability, or severity.

• In practice, businesses use this metric to decide whether to proceed with a plan.

Compare benefits and risks to make decisions

• Apply a simple principle:

  • Are the benefits gained greater than the risks accepted?

• Example:

  • Launching a new project can be high risk.

  • But not doing it means losing competitive opportunities.

• This is an important step in a practical risk management process.

Understand Assumed Risk

• When you decide to proceed:

  • The Exposure will become assumed risk.

• Some cases where acceptance is mandatory:

  • Legal regulations, mandatory organizational requirements

• In business:

  • This risk is often converted into monetary cost.

  • Used to calculate investment efficiency and profit.

Step 2: Create a risk plan for an IT project

Clearly define the project requiring risk management

• Project context:

  • You are responsible for operating a computer system that provides critical information to a large number of users.

  • The current system is old and needs to be replaced.

• Main objective:

  • Develop a risk management plan for the system migration process.

• This is the first step in how to create a risk management plan, helping you understand the scope and avoid overlooking issues.

Define the scope and impact level of the system

• Important but not mission-critical system:

  • If an incident occurs, it does not directly endanger human lives.

  • However, it still significantly affects operations and user experience.

• Examples of potential risks:

  • Service disruption

  • Temporary data loss

  • Errors during system migration

• Correctly determining the level helps you prioritize handling in the risk management process.

Establish a simple, easy-to-apply risk assessment method

• In practical project management, a basic scale should be used:

  • Probability: High / Medium / Low

  • Impact: High / Medium / Low

• Benefits of this assessment method:

  • Easy to understand for both technical teams and management.

  • Faster decision-making.

  • Suitable for practical implementation projects.

Apply the model to the risk management plan

• 1. List key risks

  • E.g., new system bugs, downtime, data loss

• 2. Assess each risk

  • Determine High / Medium / Low for probability and impact.

• 3. Prioritize treatment

  • High risk + high impact → address first

• This is a quick yet effective implementation method in an effective risk management plan.

Practical tips for implementation

• Don't overcomplicate it from the start.

• Prioritize: clear, easy to understand, easy to update.

• Always ask:

  • If the system fails, how will users be affected?

  • What does the business lose in 1 hour of downtime?

Step 3: Gather opinions to identify risks

Organize a risk brainstorm with the team

• Invite the right participants:

  • Team members who understand the project: technical, operations, management

  • Have diverse perspectives to avoid overlooking risks

• Goals of the brainstorm:

  • Identify what could happen

  • Find prevention methods and response plans

• This is a crucial step in how to create a risk management plan to detect issues early

Ask the right questions to uncover risks

• Questions to use:

  • What's the worst that could happen?

  • If the system fails, where could the cause come from?

  • How can we reduce the likelihood of it happening?

  • If it happens, how can we minimize damage?

• Asking the right questions improves the quality of risk analysis

Document comprehensively and systematically

• Record all ideas, without immediate filtering:

  • Even incomplete ideas

• Preliminary classification:

  • Technical risks

  • Operational risks

  • Human risks

• This will be important input for subsequent steps in an effective risk management plan

Encourage open thinking while maintaining control

• Encourage "out of the box" thinking:

  • Rare risks with significant consequences often emerge from different ways of thinking

• Keep the meeting on track:

  • Avoid straying off topic

  • Have a facilitator to ensure progress

• This balance optimizes the effectiveness of the risk management process

Utilize brainstorm results for subsequent steps

• The list of risks obtained will be used to:

  • Assess probability and impact

  • Develop mitigation plans

  • Create contingency plans

• This is an indispensable foundation in a practical and systematic risk management plan

Step 4: Determine the consequences of each risk

Clearly link risks and consequences

• Each risk needs to be tied to specific consequences:

  • Don't just stop at "there is a risk" but clearly answer: if it happens, what will happen?

• Data source:

  • Use the results from the previous brainstorm

• This is an important step in how to create a risk management plan that helps you see the actual impact

Describe consequences in as much detail as possible

• Avoid vague descriptions:

  • Don't write: "Project is delayed"

• Instead, be specific:

  • "Project delayed by 10-15 days"

  • "System downtime of 2 hours, affecting 5,000 users"

• Specificity improves the quality of risk analysis and makes decision-making easier

Quantify consequences with actual data

• Prioritize using numbers:

  • Time: how long delayed?

  • Financial: how much damage?

  • Users: how many people affected?

• Example:

  • "1 day data loss → 50 million VND damage"

  • "3 hours service interruption → 20% daily revenue reduction"

• This is an important factor in an effective risk management plan

Standardize consequence recording

• Each risk should have a clear structure:

  • Risk: System migration issues

  • Consequence: 4 hours downtime, 10,000 lost visits

• Benefits:

  • Easy to compare severity

  • Easy to prioritize actions

• Helps optimize the entire risk management process

Why this step is important in practice

• If consequences are not clearly defined:

  • Easy to misjudge risk severity

  • Incorrect prioritization decisions

• When consequences are clearly quantified:

  • You'll know which risks need immediate action

  • And which risks are acceptable

Step 5: Eliminate irrelevant risks

Focus on actual, controllable risks

• Not all risks need to be included in the plan

  • Only keep risks that are likely to occur and can directly impact the project

• Examples to eliminate:

  • Extremely rare disasters like nuclear war, asteroids...

• This is an important principle in how to create a risk management plan to avoid getting sidetracked

Prioritize actionable risks

• Questions to ask:

  • Is this risk likely to occur in reality?

  • Can you do anything to mitigate or address it?

• If the answer is "no" → eliminate it

• This helps make the plan more focused and effective in the risk management process

Avoid "diluting" the risk plan

• Too many irrelevant risks will cause:

  • Wasted analysis time

  • Difficulty prioritizing actions

  • Team distraction

• An effective risk management plan needs to be clear, concise, and to the point

Maintain a realistic mindset while having overall awareness

• You can:

  • Recognize major risks beyond your control

• But you should not:

  • Include them in the detailed plan for handling

• Instead, focus resources on risks that are predictable and controllable

Core principles to remember

• Not all risks are worth managing

• Only select risks that are:

  • Likely to occur

  • Measurable

  • Actionable

Step 6: List all identified risks

Record all risks comprehensively

• List all collected risks:

  • From the brainstorm and previous analysis steps

• Important principle:

  • Do not omit any risk, no matter how small

• This is a fundamental step in how to create a risk management plan to give you a comprehensive overview

No need to sort or prioritize yet

• Just list each individual risk:

  • Each line is a specific risk

• No need to categorize yet:

  • No need to assess high – low

  • No need to set priority order

• This helps preserve the input data for the subsequent risk analysis step

Write concisely but clearly

• Each risk should be described succinctly:

  • "Error in data migration"

  • "Downtime during migration"

  • "Lack of technical staff"

• Avoid writing too long or vague

• This helps optimize the entire risk management process

Suggested ways to present the risk list

• Example:

  • R1: Data loss during system migration

  • R2: New system incompatibility

  • R3: Service disruption

  • R4: Configuration error

• Coding helps with easy tracking and handling in an effective risk management plan

Why this step is important

• If the risk list is incomplete:

  • Subsequent steps will be inaccurate

• When fully listed:

  • You have a basis for assessment, prioritization, and proper handling

Step 7: Assess risk probability

Assign a probability level to each risk

• For each risk on the list:

  • Determine the likelihood of occurrence as High / Medium / Low

• Simple, easy-to-apply method:

  • Based on practical experience

  • Based on historical data if available

• This is a core step in how to create a risk management plan that tells you which risks are most likely to occur

Use a numerical scale for high accuracy

• Convert probability from 0.00 to 1.00:

  • 0.01 – 0.33 → Low

  • 0.34 – 0.66 → Medium

  • 0.67 – 1.00 → High

• Real-world examples:

  • Minor configuration error → 0.7 (High)

  • Total system loss → 0.2 (Low)

• This method helps standardize risk analysis in a project

Eliminate risks with zero probability

• Important principle:

  • If a risk cannot occur → no need to include it in the plan

• Example:

  • Unrealistic situations that are unlikely to occur

• This helps keep the plan more concise and focused in the risk management process

Suggested approach for practical probability assessment

• Based on factors:

  • Past frequency of occurrence

  • System complexity

  • Level of change in the project

• Questions to ask:

  • Has this risk occurred before?

  • If so, how many times?

Significance of the probability assessment step

• Helps you:

  • Identify which risks are most likely to occur

  • Allocate resources appropriately

• Provides a basis for combining with impact levels, thereby creating an effective risk management plan

Step 8: Assess risk impact level

Assign an impact level to each risk

• For each identified risk:

  • Assess the impact level as High / Medium / Low

• Based on practical criteria:

  • Impact on system operations

  • Financial damage

  • User experience

• This is a crucial step in how to create a risk management plan that helps you understand the severity

Use a numerical scale for detailed analysis

• Convert Impact from 0.00 to 1.00:

  • 0.01 – 0.33 → Low

  • 0.34 – 0.66 → Medium

  • 0.67 – 1.00 → High

• Real-world examples:

  • Minor display error → 0.2 (Low)

  • System downtime for 2 hours → 0.8 (High)

• Helps standardize risk analysis in a project

Eliminate risks with no impact

• Principle to remember:

  • If impact = 0 → no need to include in the plan

• Reason:

  • No impact means no need for management

• Helps optimize and streamline an effective risk management plan

Suggestions for assessing impact level

• Based on factors:

  • Downtime (how long?)

  • Number of users affected

  • Cost of damage (how much money?)

• Questions to ask:

  • If a risk occurs, how severe will the consequences be?

Significance of the Impact assessment step

• Helps you:

  • Identify which risks cause the greatest damage

  • Prioritize addressing critical issues

• When combined with probability, you will be able to build an effective risk management plan and have a basis for accurate decision-making

Step 9: Determine overall risk level

Combine probability and impact level

• Core principle:

  • Risk = Probability × Impact

• Simple approach:

  • Use a High / Medium / Low scale for both factors

• This is a crucial step in how to create a risk management plan to determine prioritization

Use a Risk Matrix table

• Common practice:

  • Create a table combining Probability and Impact

• Simple example:

  • High × High → Very high risk

  • High × Low → Medium risk

  • Low × Low → Low risk

• This table helps visualize in an effective risk management plan

Use numerical scales when more detail is needed

• If using numbers (0.00 – 1.00):

  • Can multiply directly to get the risk value

• Example:

  • Probability = 0.7, Impact = 0.8 → Risk = 0.56

• Suitable for projects requiring high accuracy in risk analysis

No fixed formula for all cases

• Important reality to understand:

  • There is no single standard formula that applies to all projects

• Depends on:

  • Industry

  • Project size

  • Risk acceptance level

• Therefore, the risk management process needs to be flexible, not mechanical

Flexible combination of qualitative and quantitative

• When to use L/M/H:

  • Small projects, quick, easy to understand

• When to use numbers:

  • Large projects, requiring in-depth analysis

• Best practice:

  • Combine both for easy visualization and accuracy

• This is the optimal way to build an effective risk management plan

Objective of this step

• Helps you:

  • Clearly see which risks are most severe

  • Determine the priority for treatment

• Serves as the foundation for moving to the mitigation planning step in how to create a risk management plan

Step 10: Rank risk levels

Arrange risks from high to low

• Based on previously calculated results:

  • Combination of probability and impact level

• Ranking principle:

  • Highest risk → address first

  • Lower risk → address later or monitor

• This is a key step in how to create a risk management plan to help you prioritize correctly

Simple and easy to apply method

• 1. List all risks

• 2. Note the corresponding Risk level (High / Medium / Low or numerical value)

• 3. Sort in descending order

• Example:

  • R1: System Downtime → High

  • R2: Data Error → High

  • R3: Project Delay → Medium

  • R4: Minor Interface Error → Low

Suggestions for presenting the ranking list

• In table or list format:

  • R1 – Highest risk

  • R2 – High risk

  • R3 – Medium risk

  • R4 – Low risk

• Benefits:

  • Easy to view, easy to report

  • Easy to track throughout the project

• Helps optimize the entire effective risk management plan

Notes when ranking risks

• Don't just look at probability:

  • Risks with low probability but high impact still need high priority

• Update regularly:

  • As the project changes, risk rankings also change

• This is an important factor in a flexible risk management process

Significance of risk ranking

• Helps you:

  • Focus resources on the most critical risks

  • Avoid wasting time on risks with less impact

• Serves as a basis for implementing treatment measures in risk management planning

Step 11: Calculate the total risk level

Convert risks to numerical form for calculation

• Convert from qualitative to quantitative:

  • High (H) → 0.8

  • Medium (M) → 0.5

  • Low (L) → 0.2

• Example risk list:

  • H, H, M, M, M, L, L → corresponding:

  • 0.8, 0.8, 0.5, 0.5, 0.5, 0.2, 0.2

• This is an important step in risk management planning when a comprehensive assessment is needed

Calculate the average risk value

• How to calculate:

  • Sum all risk values

  • Divide by the total number of risks

• Example:

  • (0.8 + 0.8 + 0.5 + 0.5 + 0.5 + 0.2 + 0.2) / 7 = 0.5

• This result represents the overall risk level of the entire project

Interpret the results to make decisions

• Convert back to assessment level:

  • 0.5 → Medium

• Meaning:

  • The project has an overall risk level that is manageable

  • But still needs to be monitored and have appropriate treatment plans

• This is the basis for evaluating the effectiveness of an effective risk management plan

Benefits of calculating total risk

• Helps you:

  • Quickly see the “risk health” of the entire project

  • Compare different options

• Supports data-driven decision making in the risk management process

Notes for practical application

• Should not only look at the average value

  • Because it can hide very high risks in the list

• Always combine with:

  • Risk ranking

  • Analysis of each important risk

Step 12: Develop a risk mitigation strategy

Understanding risk mitigation correctly

• Main objective:

  • Reduce the probability of risk occurrence

• Unlike post-incident handling, mitigation focuses on preventing risks from the start

• This is an important step in proactive risk management planning

Prioritize risks that need to be addressed first

• Focus on:

  • High-level risks

  • Medium-level risks

• Low risks:

  • Can be addressed later or only monitored

• Helps optimize resources in an effective risk management plan

Develop specific probability reduction measures

• Principle:

  • Each risk → at least one clear action

• Real-world examples:

  • Risk: delay in critical component delivery

    • Solution: order early from the start of the project

  • Risk: errors during data transfer

    • Solution: multiple tests in a simulated environment

• This is how risk analysis is actually implemented

Suggestions for common mitigation solution groups

• Process:

  • Standardize workflows

• Technical:

  • Testing, backup, redundant systems

• Personnel:

  • Training, clear assignment of responsibilities

• Suppliers:

  • Choose reputable partners, have alternative plans

Ensure solutions are implementable

• Avoid:

  • General, difficult-to-apply solutions

• Should:

  • Be specific, measurable, with implementation timelines

• Example:

  • Do not write: "improve the system"

  • Write: "backup data every 6 hours"

Significance of the risk mitigation step

• Helps you:

  • Reduce the likelihood of risks occurring from the outset

  • Save on future handling costs

• It is the core part of creating an effective risk management plan

Step 13: Develop a risk contingency plan

Understanding contingency plans correctly

• Main objective:

  • Reduce the impact when a risk has already occurred

• Unlike mitigation (prevention), contingency focuses on responding when an incident occurs

• This is an indispensable part of practical risk management planning

Prioritize risks that need a contingency plan

• Focus on:

  • High-level risks

  • Medium-level risks

• Low risks:

  • May not require a detailed contingency plan

• Helps optimize resources in an effective risk management plan

Develop a concrete contingency plan

• Principle:

  • Each risk → has a ready plan of action when it occurs

• Real-world example:

  • Risk: critical component delivery delay

    • Solution: temporarily use old components to maintain the system

  • Risk: new system failure after deployment

    • Solution: rollback to the old system

• This is an effective deployment method in the risk management process

Prepare in advance for quick response

• Contingency plan needs to be:

  • Clear, executable immediately

  • Have a specific person in charge

• Avoid:

  • Waiting until an incident occurs to figure out a solution

• Helps minimize damage in practical risk analysis

Managing risks from external factors

• Characteristics:

  • Cannot be fully controlled (market, suppliers, policies, etc.)

• Approach:

  • Diversify supply sources

  • Prepare alternative plans

  • Flexibly adjust plans

• This is an important mindset in modern risk management planning

Encourage flexible, creative thinking

• Not limited to traditional methods:

  • Always ask: "If plan A fails, is there another way?"

• Example:

  • Not just one supplier

  • Not just one implementation plan

• Helps increase adaptability in an effective risk management plan

Meaning of contingency planning

• Helps you:

  • Avoid being passive when risks occur

  • Reduce damage in terms of time, cost, and reputation

• Is a "safety net" in the entire risk management process

Step 14: Evaluate risk strategy effectiveness

Measure reduction in probability and impact

• Core questions to answer:

  • How much has the risk probability decreased?

  • What is the remaining impact?

• Before vs. After comparison:

  • Before applying the solution

  • After applying mitigation and contingency

• This is a crucial step in risk management planning to check effectiveness

Re-evaluate each risk after treatment

• Update indicators:

  • New Probability

  • New Impact

• Example:

  • Before: Probability = High → After: Medium

  • Before: Impact = High → After: Low

• Helps you gain a more accurate view in risk analysis

Reassign Effective Risk level

• Recalculate risk level after mitigation:

  • Based on newly updated data

• Result:

  • Some risks may decrease from High → Medium or Low

• This is an important step to complete an effective risk management plan

Identify residual risks

• Not all risks can be completely eliminated:

  • Some residual risk will always exist

• Need to clearly define:

  • Which risks are at an acceptable level

  • Which risks still need to be addressed

• Helps optimize the entire risk management process

Adjust strategy if ineffective

• If risk remains high:

  • New solutions needed

  • Or change the approach

• Avoid common mistakes:

  • Thinking a plan is enough

• In reality, risk management planning always needs continuous updates

Meaning of effectiveness evaluation step

• Helps you:

  • Know if the strategy is actually working

  • Optimize resources and costs

• Is the "quality control" step for the entire risk management plan

Step 15: Calculate post-treatment risk

Re-evaluate risk after strategy implementation

• New risk list:

  • M, M, M, L, L, L, L

• Convert to numerical values:

  • 0.5, 0.5, 0.5, 0.2, 0.2, 0.2, 0.2

• This is the result after applying mitigation and contingency in risk management planning

Calculate new average risk level

• Calculation:

  • (0.5 + 0.5 + 0.5 + 0.2 + 0.2 + 0.2 + 0.2) / 7 = 0.329

• Interpretation:

  • 0.329 → falls into the Low category

• Compared to the initial:

  • Before: 0.5 (Medium)

  • After: 0.329 (Low)

Assessing Risk Reduction Effectiveness

• Reduction achieved:

  • ~34.2% overall risk

• Practical implications:

  • Measures have significantly reduced the risk

  • The project is now safer and more manageable

• This demonstrates an effective risk management plan

Understanding Post-Treatment Exposure

• Exposure (residual risk):

  • Is the portion of risk that still exists after solutions have been applied

• In this case:

  • Exposure = Low

• This is an important indicator in the risk management process for deciding whether to proceed or adjust

Notes for practical application

• Do not stop when risk decreases

  • Needs continuous monitoring and updating

• Always check:

  • Are new risks emerging?

  • Are any risks increasing again?

Significance of this step in the overall process

• Helps you:

  • Accurately measure strategy effectiveness

  • Have data for reporting and decision-making

• This is a concluding step in how to create an effective risk management plan

Step 16: Project Risk Monitoring

Identify Risk Cues

• Main objective:

  • Early detection of emerging risks

  • Timely activation of contingency plans

• What are Risk Cues?

  • Early warning signals before a risk becomes an incident

• This is a crucial step in how to create a risk management plan that keeps you proactive

Develop warning signs for each risk

• Focus on High and Medium Risks

• Practical example:

  • Risk: project delay

    • Sign: tasks are consistently 2-3 days late

  • Risk: system errors during deployment

    • Sign: unusual increase in number of errors during testing

  • Risk: supplier late delivery

    • Sign: slow response, changes in delivery schedule

• This is an effective implementation method in the risk management process

Establish continuous monitoring mechanisms

• How to do it:

  • Monitor periodically (daily/weekly)

  • Use reports, dashboards or checklists

• Clearly assign responsibilities:

  • Who is responsible for monitoring each risk

• Helps maintain the effectiveness of an effective risk management plan

Activate contingency plans at the right time

• When Risk Cues appear:

  • Do not wait for the risk to fully materialize

  • Immediately activate the contingency plan

• Example:

  • See signs of delay → immediately add manpower

• This is a determining factor in practical risk analysis

Avoid "silent" risks from emerging

• Common mistake:

  • Having a plan but not monitoring it

• Consequence:

  • Risks occur without anyone realizing them in time

• Identifying Risk Cues helps you:

  • Early detection

  • Significantly reduce damage

Significance of the risk monitoring step

• Helps you:

  • Proactively control instead of reacting passively

  • Increase project success rate

• Is a step to maintain long-term effectiveness in how to create a risk management plan

Optimizing risk management in projects

Focus on the critical path when overloaded

• When managing many tasks or projects:

  • Only focus on tasks on the critical path

• Effective approach:

  • Develop multiple critical path scenarios

  • Add buffer time

• Helps reduce workload while ensuring effectiveness in how to create a risk management plan

Calculate risk costs for decision-making

• Important formula:

  • Reduction = Risk – Exposure

• Practical example:

  • Risk: 0.5 × 1,000,000 = 500,000

  • Exposure: 0.329 × 1,000,000 = 329,000

  • Reduction = 171,000

• Significance:

  • This is the reasonable cost you can invest to reduce risk

• Very important in an effective risk management plan

Always prepare for change

• Risks are not static:

  • High today, could be low tomorrow

  • Some risks disappear, new risks emerge

• Correct approach:

  • Continuous updates

  • Do not use a "fixed" plan

• This is a vital principle in the risk management process

Use Exposure to decide whether to undertake a project

• Example:

  • Project 1,000,000 → Exposure = 329,000

• Questions to answer:

  • Can you accept or provision for this amount?

• If not:

  • Need to reduce scope or adjust plan

• This is a practical mindset in risk management planning

Set up early warnings in the contingency plan

• Principle:

  • There must be a trigger signal for contingency

• Example:

  • Test results show increasing errors → activate rollback

• If there's no signal yet:

  • Proactively design one

• Helps increase the effectiveness of risk analysis

Use tools to monitor risks

• Recommendation:

  • Use a spreadsheet to manage the risk list

• Benefits:

  • Easy to update

  • Easy to track changes

• Supports an effective risk management plan throughout

Always review and ask inverse questions

• Ask yourself:

  • Am I missing any risks?

• Action:

  • Create a checklist

  • Double-check multiple times

• This is an important skill in risk management planning

Simplify when necessary

• For small projects or limited experience:

  • Can skip detailed calculations

  • Use quick assessments (mental math)

• Example:

  • Compare 2 options → choose the less risky one

• Helps save time in the risk management process

Always consider combined risks

• Multiple incidents occurring simultaneously:

  • Low probability but very high consequences

• Reality:

  • Major disasters are often caused by multiple combined failures

• This is an advanced perspective in risk analysis

Avoid emotional and "political" factors

• Common mistake:

  • Assessing risks based on emotions or ego

• Principle:

  • Based on data and logic

• Helps ensure objectivity in an effective risk management plan

Don't ignore low risks, but don't waste resources either

• Correct approach:

  • Still monitor low risks

  • But don't spend too much time

• Helps balance the risk management process

Avoid overly complex planning

• Risk:

  • Getting caught up in unimportant risks

  • Slowing down project progress

• Principle:

  • Risk management supports the project, it doesn't replace it

• This is a practical mindset in risk management planning

Never think all risks have been identified

• Nature of risk:

  • There's always an element of surprise

• Approach:

  • Always update, always be vigilant

• This is the foundation of an effective risk management plan

References

1. Project Management Institute. (2021). A guide to the project management body of knowledge (PMBOK® Guide) – Seventh Edition. PMI.
2. ISO. (2018). ISO 31000:2018 Risk management – Guidelines. International Organization for Standardization.
3. Hillson, D. (2017). Practical project risk management: The ATOM methodology (3rd ed.). Management Concepts Press.
4. Chapman, C., & Ward, S. (2011). How to manage project opportunity and risk: Why uncertainty management can be a much better approach than risk management (2nd ed.). Wiley.
5. Hopkin, P. (2018). Fundamentals of risk management: Understanding, evaluating and implementing effective risk management (5th ed.). Kogan Page.
6. Lam, J. (2014). Enterprise risk management: From incentives to controls (2nd ed.). Wiley.
7. McNeil, A. J., Frey, R., & Embrechts, P. (2015). Quantitative risk management: Concepts, techniques and tools (Revised ed.). Princeton University Press.
8. Kerzner, H. (2022). Project management: A systems approach to planning, scheduling, and controlling (13th ed.). Wiley.
9. Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1–13.

Content editor: Lesley Collins Tran.

Information consulted and verified by expert: Ksenia Derouin.