Establishes the approach, roles, tools, and rules for managing threats and opportunities on the project, documented in the risk management plan.

Purpose & When to Use

This process defines how risk work will be done so the team manages uncertainty consistently and efficiently. It sets methods, roles, categories, scoring scales, reporting formats, and funding rules for reserves. Use it early in planning, revisit it at major milestones, and tailor it to project size, complexity, and stakeholder risk appetite.

Mini Flow (How It’s Done)

• Review key inputs: charter, business case, agreements, stakeholder list, organizational policies, and lessons learned from similar projects.
• Hold a risk planning workshop with the sponsor, project manager, core team, key stakeholders, and risk specialist (if available).
• Clarify objectives, constraints, and stakeholder risk appetite and thresholds to guide decision making.
• Define methods and tools: how to identify risks, how qualitative scoring will work, when to use quantitative analysis, and how results feed decisions.
• Set risk categories and a simple risk breakdown structure (RBS) to group sources of risk.
• Assign roles and responsibilities, including risk owner, action owner, and who approves reserves and escalations.
• Agree on scales and criteria for likelihood, impact, and other attributes (for example, urgency or detectability) and create a scoring grid.
• Plan risk response approaches, escalation paths, and how contingency and management reserves will be estimated, approved, and tracked.
• Define monitoring and reporting: review cadence, risk metrics, audit approach, dashboards, and communication routes.
• Set integration points with scope, schedule, cost, change control, procurement, and vendor management.
• Select repositories and templates for the risk register, reports, checklists, and lessons learned capture.
• Draft the risk management plan, circulate for feedback, obtain approval, baseline it, and communicate to the team.

Quality & Acceptance Checklist

• Purpose, scope, and tailoring choices are stated and fit project size and complexity.
• Roles, responsibilities, and decision rights are clear, including who approves reserves and escalations.
• Risk categories and RBS are defined and usable by the team.
• Likelihood and impact scales are calibrated with numeric or descriptive anchors and a scoring grid.
• Criteria for when to run quantitative analysis are explicit and practical.
• Response strategies for threats and opportunities are described with selection guidance.
• Funding approach for contingency and management reserves, with approval and drawdown rules, is documented.
• Monitoring cadence, risk metrics, audit approach, and report formats are specified.
• Interfaces with schedule, cost, change control, quality, and procurement are defined.
• Templates, data fields for the risk register, and repositories are identified.
• Stakeholder risk appetite, thresholds, and communication needs are reflected.
• Assumptions, constraints, and compliance considerations are captured.
• Lessons learned and historical data sources are referenced for reuse.
• Approval, baseline information, and update triggers are recorded.

Common Mistakes & Exam Traps

• Confusing the risk management plan (approach) with the risk register (list of identified risks).
• Jumping into risk identification or analysis without first agreeing on scales, roles, and methods.
• Using vague, inconsistent scoring that makes prioritization and decisions unreliable.
• Ignoring opportunities and focusing only on threats.
• Copying a prior plan without tailoring to the current project’s context and stakeholders.
• Failing to set criteria and triggers for quantitative analysis and reserve updates.
• Not defining governance for contingency and management reserves and their approvals.
• Omitting integration with change control, leading to uncontrolled responses and scope creep.
• Exam trap: The primary output is the risk management plan, not the risk register.
• Exam trap: Enterprise policies and historical records are useful inputs even if the project is new.

PMP Example Question

Early in planning, the sponsor asks the team to begin ranking risks immediately. The team has not agreed on categories, scoring scales, or roles. What should the project manager do first?

1. Start risk identification to build momentum and refine the approach later.
2. Facilitate development and approval of the risk management plan with methods, roles, and scales.
3. Create a simulation model to quantify schedule and cost uncertainty.
4. Ask functional managers to assign risk owners and begin drafting responses.

Correct Answer: B — Facilitate development and approval of the risk management plan with methods, roles, and scales.

Explanation: Establishing the risk approach comes before identification and analysis to ensure consistency and quality. Without agreed methods and scales, rankings will be unreliable.