RISK MANAGEMENT PLAN TEMPLATE

Introduction
The Risk Management Plan template provided below can be downloaded by clicking on one of
the icons above. This Risk Management Plan template is free for you to edit and use as you see
fit. Project risk management is part science and part art, this template is a great tool to get you
started in managing your project's risks. Be sure to sign up for our Newsletter to ensure you
receive announcements about new project management templates.
This section explains why risks exist and highlights the purpose and importance of the risk
management plan. It provides a general description of why risk management is essential to
effectively managing a project and describes what is needed before risk management can begin.
As organizations begin new projects they begin operating in an area of uncertainty that comes
along with developing new and unique products or services. By doing so, these organizations
take chances which results in risk playing a significant part in any project. The purpose of the
risk management plan is to establish the framework in which the project team will identify risks
and develop strategies to mitigate or avoid those risks. However, before risks can be identified
and managed, there are preliminary project elements which must be completed. These elements
are outlined in the risk management approach.
This project is considered a medium risk project as it has an overall risk score of 24 on a scale
from 0 to 100. The project risk score is the average of the risk scores of the most significant risks
to this project. A risk score below 16 is low risk project, a score between 16 and 45 is a medium
risk project and a score above 45 is a high risk project.

Before risk management begins it is imperative that a foundation is established for providing
structured project information, thus, the following project elements were completed and defined
prior to developing this Risk Management Plan:

Define work scope, schedule, resources, and cost elements

Develop project WBS/WBS dictionary

Develop master schedule and detailed schedules

Estimate project cost and finalize budget

Identify required and available resources

Establish performance measurement metrics

Define minimum and maximum baseline thresholds

Schedule

Resources

Cost

Baseline reporting requirements

Format

Frequency of distribution

Distribution list

Define Risk Management Roles and Responsibilities

Project Manager chairs the risk assessment meetings

Project team participates in risk assessment meetings and members serve as

meeting recorder and timekeeper

o

Key stakeholders participate in risk assessment meetings

Project Sponsor may participate in risk assessment meetings

Top Three Risks

It is important to explicitly state the top three risks to the project in the Risk Management Plan.
This will make management aware of the top risks for the project and the nature of the risks.
The top three high probability and high impact risks to this project are:
Delay in Server Equipment
Due to a manufacturers production backlog, the servers are not available for large scale
application testing causing a delay in the project schedule. The project manager will mitigate this
risk by using servers from the backup data center if needed.
Fiber Optics Connection Not Completed
Due to construction delays in installing the fiber optic cable between the data center and the
headquarters facilities users will not have a high speed connection between their site and the
datacenter resulting in slow responses from the application making it unusable. The Project
Manager will implement a site to site broadband Ethernet radio network between the data center
and headquarters facility.
Network Operations Center (NOC) Not Appropriately Staffed
Due to lead times associated with hiring and training additional staff, the NOC does not have the
necessary staff to monitor the additional bandwidth associated with the project resulting in a
delay to the project schedule. The project manager will mitigate this risk by working with the
NOC to create an alternate work schedule to compensate for the staffing shortage until additional
staff hiring and training is complete.
Risk Management Approach

This section of the Risk Management Plan provides a general description for the approach taken
to identify and manage the risks associated with the project. It should be a short paragraph or two
summarizing the approach to risk management on this project.
The approach we have taken to manage risks for this project included a methodical process by
which the project team identified, scored, and ranked the various risks. The most likely and
highest impact risks were added to the project schedule to ensure that the assigned risk managers
take the necessary steps to implement the mitigation response at the appropriate time during the
schedule. Risk managers will provide status updates on their assigned risks in the bi-weekly
project team meetings, but only when the meetings include their risks planned timeframe. Upon
the completion of the project, during the closing process, the project manager will analyze each
risk as well as the risk management process. Based on this analysis, the project manager will
identify any improvements that can be made to the risk management process for future projects.
These improvements will be captured as part of the lessons learned knowledge base.
Risk Identification
Here the Risk Management Plan explains the process by which the risks associated with this
project were identified. It should describe the method(s) for how the project team identified risks,
the format in which risks are recorded, and the forum in which this process was conducted.
Typical methods of identifying risks are expert interview, review historical information from
similar projects and conducting a risk assessment meeting with the project team and key
stakeholders.
For this project, risk identification was conducted in the initial project risk assessment meeting.
The method used by the project team to identify risks was the Crawford Slip method. The project

manager chaired the risk assessment meeting and distributed notepads to each member of the
team and allowed 10 minutes for all team members to record as many risks as possible.
Expert Interview
Two Expert Interviews were held for this project. The interviews revealed several risks which
were then mitigated by making changes to the project plan. The remaining risks are included in
the Risk Register.
Risk Assessment Meeting
A risk assessment meeting was held with key team members and stakeholders. The risks
identified during this meeting were added to the project plan and Risk Register.
Historical Review of Similar Projects
The project team reviewed the history of similar projects in order to determine the most common
risks and the strategies used to mitigate those risks.
Risk Qualification and Prioritization
Once risks are identified it is important to determine the probability and impact of each risk in
order to allow the project manager to prioritize the risk avoidance and mitigation strategy. Risks
which are more likely to occur and have a significant impact on the project will be the highest
priority risks while those which are more unlikely or have a low impact will be a much lower
priority. This is usually done with a probability impact matrix. This section explains risks were
qualified and prioritized for this project. For more information on how to qualify and prioritize
risks refer to our Risk Assessment Meeting Guide.
In order to determine the severity of the risks identified by the team, a probability and impact
factor was assigned to each risk. This process allowed the project manager to prioritize risks

based upon the effect they may have on the project. The project manager utilized a probabilityimpact matrix to facilitate the team in moving each risk to the appropriate place on the chart.
Once the risks were assigned a probability and impact and placed in the appropriate position on
the chart, the recorder captured the finished product and the project manager moved the process
on to the next step: risk mitigation/avoidance planning.
Risk Monitoring
This section of the Risk Management Plan should discuss how the risks in the project will be
actively monitored. One effective way to monitor project risks is to add those risks with the
highest scores to the project schedule with an assigned risk manager. This allows the project
manager to see when these risks need to be monitored more closely and when to expect the risk
manager to provide status updates at the bi-weekly project team meetings. The key to risk
monitoring is to ensure that it is continuous throughout the life of the project and includes the
identification of trigger conditions for each risk and thorough documentation of the process.
The most likely and greatest impact risks have been added to the project plan to ensure that they
are monitored during the time the project is exposed to each risk. At the appropriate time in the
project schedule a Risk Manager is assigned to each risk. During the bi-weekly project team
meeting the Risk Manager for each risk will discuss the status of that risk; however, only risks
which fall in the current time period will be discussed. Risk monitoring will be a continuous
process throughout the life of this project. As risks approach on the project schedule the project
manager will ensure that the appropriate risk manager provides the necessary status updates
which include the risk status, identification of trigger conditions, and the documentation of the
results of the risk response.
Risk Mitigation and Avoidance

Once risks have been qualified, the team must determine how to address those risks which have
the greatest potential probability and impact on the project. This section of the Risk Management
Plan explains the considerations which must be made and the options available to the project
manager in managing these risks.
The project manager has led the project team in developing responses to each identified risk. As
more risks are identified, they will be qualified and the team will develop avoidance and
mitigation strategies. These risks will also be added to the Risk Register and the Project Plan to
ensure they are monitored at the appropriate times and are responded to accordingly. If
necessary, the Risk Management Plan will be updated.
The risks for this project will be managed and controlled within the constraints of time, scope,
and cost. All identified risks will be evaluated in order to determine how they affect this triple
constraint. The project manager, with the assistance of the project team, will determine the best
way to respond to each risk to ensure compliance with these constraints.
In extreme cases it may be necessary to allow flexibility to one of the projects constraints. Only
one of the constraints for this project allows for flexibility as a last resort. If necessary, funding
may be added to the project to allow for more resources in order to meet the time (schedule) and
scope constraints. Time and scope are firm constraints and allow for no flexibility. Again, the
cost constraint is flexible only in extreme cases where no other risk avoidance or mitigation
strategy will work.
Risk Register Every project must maintain a risk register in order to track risks and associated
mitigation strategies. This section describes the risk register criteria as well as where the risk
register is maintained and how these risks are tracked in the project schedule.

The Risk Register for this project is a log of all identified risks, their probability and impact to
the project, the category they belong to, mitigation strategy, and when the risk will occur. The
register was created through the initial project risk management meeting led by the project
manager. During this meeting, the project team identified and categorized each risk.
Additionally, the team assigned each risk a score based on the probability of it occurring and the
impact it could potentially have. The Risk Register also contains the mitigation strategy for each
risk as well as when the risk is likely to occur.
Based on the identified risks and timeframes in the risk register, each risk has been added to the
project plan. At the appropriate time in the planprior to when the risk is most likely to occur
the project manager will assign a risk manager to ensure adherence to the agreed upon mitigation
strategy. The each risk manager will provide the status of their assigned risk at the bi-weekly
project team meeting for their risks planned timeframe.
The Risk Register will be maintained as an appendix to this Risk Management Plan.