Community Champion
Guessing is not a strategy: How to build decision velocity with AI and real-time data
June 10, 2026 | Live Webinar
Categories: risk
This article is part five of my look into project risk management, and today the topic is planning risk management, as determined by the PMBOK® Guide – Sixth Edition.
Read part 1 here: An introduction to risk management
Read part 2 here: Trends and Emerging Practices in Project Risk Management (Part A)
Read part 3 here: Trends and Emerging Practices in Project Risk Management (Part B)
Read part 4 here: Tailoring Risk Management
Plan Risk Management is the first process in the Project Risk Management Knowledge Area. It’s defined as:
The process of defining how to conduct risk management activities for a project.
If you are anything like me, you probably haven’t spent a lot of time thinking about how you are going to do risk management – you just do it. However, if you are new to project management, managing in a different way to how you have done before, or with a larger, more complex or strategic project, leading a project at a new organisation or similar, you will want to spend some time mapping out how the project will approach risk management.
Inputs
The inputs to this process are:
- The Project Charter
- The project management plan, so your risk management approach can be consistent with other areas of the plan
- Project documents including the stakeholder register which helps identify responsibilities for risk management and the risk appetite
- Enterprise environmental factors such as organisational risk management thresholds
- Organisational process assets like the organisational risk policy, risk vocab, authority levels for action planning, lessons learned, other risk management guidelines and documentation that you can reuse or need to align with.
Outputs
There’s only one output to the process and that’s the risk management plan.
You can create a risk management plan that’s a few lines long and says you’ll follow the PMO approach for risk management, or you can create a full, detailed, bespoke risk management plan. Do what you need to do for your project.
I’m lucky in that I’ve always worked in organisation’s where we’ve either had a PMO for guidance or had experienced project managers. Not that being experienced is a shortcut for doing risk management well – you do still need to put some thought into it. I do think, though, that over time, some of the planning activities are done quickly because they are the same as the last 10 projects you’ve run and the act of planning has become so ingrained that you don’t think about the ‘how’ any more, you just focus on the ‘what’.
Anyway, part of being able to apply business acumen and critical thinking is that you make the right choices for your project, so don’t assume that because you’ve run a project before that you don’t need to do any risk management planning.
Tools and Techniques
The tools and techniques you’ll use to come up with your risk management plan are the things you would expect:
- Expert judgment – because you’ll be talking to the risk management professionals in your organisation or using PMO best practices, and applying your own expert judgement to make the tailoring choices
- Data analysis and stakeholder analysis – because the way you approach risk is constrained or governed by the stakeholders you have so you can better align to their risk appetite
- Meetings – because you have to talk to people about how risk will be managed, especially if they are new to the project or the business and haven’t done active risk management before. And you might want a few risk workshops to help define your approach and get everyone on the same page.
Timing
The Plan Risk Management process is something you should do before the project begins working on tasks to complete deliverables. So get your risk management plan completed as quickly as you can before the project begins.
You can, of course, review and update the approach to risk management as the project evolves. Something might happen that means it’s worth reviewing the context for risk management and updating the plan. As with all aspects of the project, keep revisiting it to make sure what you are doing is fit for purpose and updating the associated documentation for the record.
Planning risk management shouldn’t take you too long. It’s about establishing the framework for doing risk management on the project and getting agreement about the activities required to manage risk effectively. If you’ve already got organisational policies that cover risk, or a project risk management process from your PMO, you’re halfway there.
Next time I’ll be looking at what goes into a risk management plan.
Pin for later reading:
Posted on: August 11, 2020 08:00 AM |
Permalink