Plan and manage risk

PMP ECO · Business Environment (26%) · Task B5. Find what could go wrong (and right), size it, plan a response for the ones that matter, and manage them through the project.

What it is

Risk management runs: plan the approach → identify risks → qualitative analysis (probability × impact, to prioritise) → quantitative analysis (EMV, Monte Carlo, for the big ones) → plan responses → implement → monitor. A risk can be a threat or an opportunity, with symmetric response strategies:

• Threats: avoid · transfer · mitigate · accept (· escalate)
• Opportunities: exploit · share · enhance · accept (· escalate)

Why it matters

• Risk is future-focused and cheap to address early; the same event handled as a surprise (an issue, B4) costs far more.
• Sizing risk (EMV) is what justifies the contingency reserve and turns "we should be careful" into a funded plan.

Where you do it in VanillaPM

The Risk Register captures each risk with probability, impact, EMV, category, response strategy, and owner; the Risk Management Plan sets thresholds and approach; and Monte Carlo supports quantitative analysis. Responses that create tasks bridge into the schedule.

Walked example — Coral Ridge Resort

Coral Ridge's register is a coastal-build masterclass in risk: cyclone / storm-surge damage (mitigate via storm-season sequencing + transfer via insurance), piling hits soft strata (mitigate via geotech + PERT-estimated duration), ECA clearance delay, imported façade/lifts stuck at customs, monsoon overrun, salt-air corrosion (mitigate via the corrosion-protection quality standard), community beach-access dispute, and construction-loan rate rise. It also tracks a positive risk — an early open in peak season lifts ADR (an opportunity the team exploits by fast-tracking the sea-view stack). EMV across the threats sizes the contingency.

The artefact

• Risk register (probability · impact · EMV · response · owner) + Risk Management Plan.

Best practices & pitfalls

• Do manage opportunities, not just threats — the early-open upside is as real as the cyclone downside.
• Do watch for secondary risks (a response that creates a new risk) and residual risk (what's left after the response).
• Pitfall: a register written once and never reviewed; risk is continuous — new risks appear as the project moves.

On the PMP exam

Risk is dense: the eight response strategies (threat vs opportunity), qualitative vs quantitative, EMV, secondary/residual risk, risk appetite/threshold, and reserves. Know that accept (active or passive) is a valid strategy, and that risk management runs the whole lifecycle, not just at planning.