Risk Management Plan

A Risk Management Plan is a document that a project manager prepares to foresee risks, estimate impacts, and define responses to issues. It also contains a risk assessment matrix.

A risk is "an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives." Risk is inherent with any project, and project managers should assess risks continually and develop plans to address them. The risk management plan contains an analysis of likely risks with both high and low impact, as well as mitigation strategies to help the project avoid being derailed should common problems arise. Risk management plans should be periodically reviewed by the project team to avoid having the analysis become stale and not reflective of actual potential project risks.

Most critically, risk management plans include a risk strategy. Broadly, there are four potential strategies, with numerous variations. Projects may choose to:

• Avoid risk — Change plans to circumvent the problem;
• Control/Mitigate risk; — Reduces impact or likelihood (or both) through intermediate steps;
• Accept risk — Take the chance of negative impact (or auto-insurance), eventually budget the cost (e.g. via a contingency budget line);
• Transfer risk — Outsource risk (or a portion of the risk - Share risk) to third party/ies that can manage the outcome. This is done e.g. financially through insurance contracts or hedging transactions, or operationally through outsourcing an activity.

(Mnemonic: SARA for Share Avoid Reduce Accept, or A-CAT for "Avoid, Control, Accept, or Transfer")
Risk management plans often include matrices.