HKSM

A section of the project, program, or portfolio management plan that explains how risk management will be organized and carried out, including the processes, roles, tools, and reporting used to manage risks.

Key Points

• Part of the overall management plan and tailored to the project, program, or portfolio context.
• Defines methods, tools, roles, responsibilities, and escalation paths for risk decisions.
• Sets risk categories, probability and impact scales, thresholds, and reporting formats.
• Establishes cadence for risk activities (reviews, audits, updates) and how the risk register is maintained.

Example

On a 12-month ERP implementation, the risk management plan states that the team will use a 1-5 probability and impact scale with a 5x5 matrix, review the risk register weekly, assign a risk owner to each high-priority risk, apply EMV for financial risks over USD 500,000, and escalate any risk with an exposure above a set threshold to the steering committee within 24 hours.

PMP Example Question

During planning, the PM needs to define the probability-impact matrix, set risk thresholds, and document how escalations will occur. Which document should be updated?

1. Risk register
2. Risk management plan
3. Issue log
4. Communications management plan

Correct Answer: B — Risk management plan

Explanation: The risk management plan specifies the approach, roles, scales, thresholds, and escalation process for managing risk; the risk register lists individual risks and their details.