Risk Management

The APM Body of Knowledge defines risk management as the process that allows individual risk events and overall risk to be understood and managed proactively, optimising success by minimising threats and maximising opportunities. Risk management is not about eliminating risk — projects by their nature involve uncertainty and risk — but about making informed decisions about which risks to accept and how to manage those we seek to influence.

The APM PMQ examination regularly features risk questions requiring candidates to understand and apply the risk management process, distinguish between threats and opportunities, and explain risk responses in context.

Key Points

• Risk has two sides: threats (negative) and opportunities (positive)
• Risk management process: Identify → Assess → Plan response → Implement → Communicate
• Risk likelihood and impact determine the risk rating
• Probability × Impact = Risk Score (used in quantitative assessment)
• Risk responses for threats: Avoid, Reduce, Transfer, Accept
• Risk responses for opportunities: Exploit, Enhance, Share, Accept
• Risk Owner is responsible for monitoring and managing specific risks
• Risk Appetite defines how much risk the organisation will accept
• Risk Register documents all identified risks and their management

Key Terms & Definitions

Risk

An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.

Risk Management

A process that allows individual risk events and overall risk to be understood and managed proactively.

Risk Appetite

The level of risk an organisation is willing to accept in pursuit of its objectives.

Risk Register

A document recording identified risks, their assessment, and the responses planned.

Risk Owner

The person responsible for managing a specific risk and its responses.

Residual Risk

The remaining level of exposure after risk responses have been applied.