8/12/2019 Risk Procedure

1/2

Risk Management Procedures

1. When you are defining the project, perform a complete assessment of project risk. The project

manager can take an initial draft based on what they know and circulate it for

additions/changes/comments. Another technique is to gather all the key stakeholders and discuss

potential risks during a facilitated meeting. Also see the Risk Assessment Checklist template.

2. Assign a risk level to each risk identified. The risk level should be high, medium, or low,

depending on the severity of impact and the probability of the event occurring. Use the following table

as a starting point. For instance, a highly likely/high impact event is obviously a high risk. However, each

event must also be evaluated individually. If you have an event that is not likely to occur, but the impact,

if it occurred, would be devastating (e.g., someone could get killed), you would still want to consider it a

high risk and put together a risk plan accordingly.

Severity of Risk Impact/Probability of Risk Occurring Overall Risk Level

High negative impact to project/Highly likely to occur High

High negative impact to project/Medium likely to occur High

High negative impact to project/Not likely to occur Medium/Low

Medium negative impact to project/Highly likely to occur Medium

Medium negative impact to project/Medium likely to occur Medium/Low

Medium negative impact to project/Not likely to occur Low

Low negative impact to project/Highly likely to occur Low

Low negative impact to project/Medium likely to occur Low

Low negative impact to project/Not likely to occur Low

3. Create a response plan for each high-level risk that you identified to ensure the risk is managed

successfully. This plan should include steps to manage the risk, people assigned, completion dates, and

periodic dates to monitor progress. There are five major responses to a riskleave it, monitor it, avoid

it, move it to a third party, or mitigate it.

4. Evaluate the medium-level risks to determine if the impact is severe enough that they should

have a risk response plan created for them as well.

5. Look at any low-risk items and see whether they should be listed as assumptions. In this way,

you recognize that there is a potential for problems, but because the risk is low, you are assuming that

the condition will not occur.

8/12/2019 Risk Procedure

2/2

6. (Large projects) For every high and medium risk where the project manager is creating a risk

mitigation plan, you should also create a contingency plan to document the consequences to the project

if the risk plan fails and the risk actually occurs.