Risk Analysis and Management

Definition

Risk Analysis and Management is the ongoing practice of identifying, assessing, and planning responses to events that could negatively (or positively) impact an initiative's objectives. It typically involves identifying risks, evaluating their likelihood and impact, and defining mitigation, avoidance, transfer, or acceptance strategies.

Inputs

• Knowledge of the initiative's objectives, scope, and assumptions
• Input from stakeholders and subject matter experts about potential threats or uncertainties

Outputs

• A risk register or log listing identified risks, their likelihood, impact, and assigned response strategy
• A clear ownership and monitoring plan for each significant risk

When to Use

• Any initiative with meaningful uncertainty, complexity, or dependencies that could threaten delivery or outcomes
• Throughout a project lifecycle, not just at the start — risks should be revisited as conditions change
• Communicating exposure and contingency plans to sponsors and stakeholders

When Not to Use

• Very low-risk, low-complexity initiatives where formal risk management overhead exceeds the actual exposure
• Risks so far outside the team's control or scope that tracking them provides no actionable value