Risk Management Plan Template

---
title: "Risk Management Plan Template"
methodology: "universal"
complexity: "advanced"
owner: "mirichard"
updated: "2026-09-19"
primary_principles: ["risk-optimization", "stewardship"]
secondary_principles: ["collaborative-leadership"]
principle_rationale: "Establishes shared risk appetite, scoring, response ownership and escalation rules for maintaining and acting on the project risk register."
---

# Risk Management Plan Template

## When to Use

- During planning when risk appetite, scoring, ownership, and escalation need agreement.
- When the team needs rules for maintaining and acting on the risk register.

## When NOT to Use

- As a substitute for identifying and reviewing actual project risks.
- Do not use a completed template or example configuration as proof of fitness for the actual environment. See [Template as substitute for judgment](../../../../../docs/principles/anti-patterns.md#template-judgment).

## Pairs Well With

- [Risk Register Template](../../../../../domains/uncertainty/project-lifecycle/02-planning/risk-management/risk-register-template.md).
- [Enterprise Risk Assessment Template](../../../../../domains/uncertainty/project-lifecycle/02-planning/risk-management/enterprise-risk-assessment-template.md).

Selection context: Measurement domain; universal methodology; advanced complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../../../meta/architecture-research/800-801-context-assessment-model.md).

## Document Information
- **Project Name**: [Enter Project Name]
- **Project Manager**: [Name]
- **Risk Manager**: [Name]
- **Date**: [Date]
- **Version**: 1.0
- **Status**: [Draft/Approved/Active]

## 1. Executive Summary

### 1.1 Purpose
This Risk Management Plan defines how risks will be identified, analyzed, and managed throughout the project lifecycle.

### 1.2 Scope
This plan covers all project-related risks including:
- Technical risks
- Business risks
- Operational risks
- External risks
- Resource risks

### 1.3 Risk Management Objectives
- Minimize the probability and impact of negative risks
- Maximize the probability and impact of positive risks (opportunities)
- Provide systematic approach to risk management
- Enable proactive risk response

## 2. Risk Management Methodology

### 2.1 Risk Management Process
1. **Risk Identification** - Identify potential risks
2. **Risk Analysis** - Assess probability and impact
3. **Risk Response Planning** - Develop response strategies
4. **Risk Monitoring** - Track risks and responses
5. **Risk Control** - Implement risk responses

### 2.2 Risk Categories
| Category | Description | Examples |
|----------|-------------|----------|
| Technical | Technology-related risks | System failures, integration issues |
| Business | Business environment risks | Market changes, competition |
| Operational | Day-to-day operation risks | Resource availability, process issues |
| External | Outside project control | Regulatory changes, vendor issues |
| Resource | People and equipment risks | Key person departure, equipment failure |

### 2.3 Risk Identification Techniques
- Brainstorming sessions
- Expert interviews
- Historical data analysis
- Checklist reviews
- SWOT analysis
- Root cause analysis

## 3. Risk Assessment Framework

### 3.1 Probability Scale
| Level | Description | Probability Range |
|-------|-------------|-------------------|
| Very High | Almost certain to occur | 81-100% |
| High | Likely to occur | 61-80% |
| Medium | May occur | 41-60% |
| Low | Unlikely to occur | 21-40% |
| Very Low | Rare, but possible | 1-20% |

### 3.2 Impact Scale
| Level | Cost Impact | Schedule Impact | Quality Impact | Scope Impact |
|-------|-------------|-----------------|----------------|--------------|
| Very High | >20% increase | >20% delay | Major degradation | Major scope reduction |
| High | 10-20% increase | 10-20% delay | Significant degradation | Significant scope reduction |
| Medium | 5-10% increase | 5-10% delay | Moderate degradation | Moderate scope reduction |
| Low | 1-5% increase | 1-5% delay | Minor degradation | Minor scope reduction |
| Very Low | <1% increase | <1% delay | Negligible impact | Negligible impact |

### 3.3 Risk Scoring Matrix
| Probability \ Impact | Very Low | Low | Medium | High | Very High |
|---------------------|----------|-----|--------|------|-----------|
| **Very High** | 5 | 10 | 15 | 20 | 25 |
| **High** | 4 | 8 | 12 | 16 | 20 |
| **Medium** | 3 | 6 | 9 | 12 | 15 |
| **Low** | 2 | 4 | 6 | 8 | 10 |
| **Very Low** | 1 | 2 | 3 | 4 | 5 |

### 3.4 Risk Priority Levels
- **Critical (20-25)**: Immediate attention required
- **High (15-19)**: Senior management attention
- **Medium (8-14)**: Management attention
- **Low (4-7)**: Monitor and manage
- **Very Low (1-3)**: Accept and monitor

## 4. Risk Response Strategies

### 4.1 Negative Risk (Threat) Responses
- **Avoid**: Eliminate the risk by changing the project plan
- **Mitigate**: Reduce probability or impact
- **Transfer**: Shift risk to third party (insurance, contracts)
- **Accept**: Acknowledge risk and take no action

### 4.2 Positive Risk (Opportunity) Responses
- **Exploit**: Ensure the opportunity is realized
- **Enhance**: Increase probability or positive impact
- **Share**: Allocate ownership to third party best able to capture opportunity
- **Accept**: Take advantage if opportunity occurs

### 4.3 Response Planning Criteria
| Risk Level | Response Required | Timeline | Authority |
|------------|-------------------|----------|-----------|
| Critical | Mandatory response plan | Immediate | Project Sponsor |
| High | Detailed response plan | Within 1 week | Project Manager |
| Medium | Basic response plan | Within 2 weeks | Risk Owner |
| Low | Monitor only | As needed | Risk Owner |
| Very Low | Document only | As needed | Risk Owner |

## 5. Risk Register Template

### 5.1 Risk Register Fields
| Field | Description |
|-------|-------------|
| Risk ID | Unique identifier |
| Risk Description | Clear description of the risk |
| Risk Category | Category from defined list |
| Probability | Likelihood of occurrence |
| Impact | Consequence if occurs |
| Risk Score | Probability × Impact |
| Risk Priority | Critical/High/Medium/Low/Very Low |
| Risk Owner | Person responsible for managing |
| Response Strategy | Avoid/Mitigate/Transfer/Accept |
| Response Actions | Specific actions to be taken |
| Target Date | When response should be completed |
| Status | Open/In Progress/Closed |
| Residual Risk | Risk remaining after response |

### 5.2 Sample Risk Register
| Risk ID | Description | Category | Prob | Impact | Score | Priority | Owner | Response | Actions | Due Date | Status |
|---------|-------------|----------|------|--------|-------|----------|-------|----------|---------|----------|--------|
| R001 | [Risk description] | [Category] | H | M | 12 | Medium | [Name] | Mitigate | [Actions] | [Date] | Open |
| R002 | [Risk description] | [Category] | M | H | 12 | Medium | [Name] | Transfer | [Actions] | [Date] | In Progress |

## 6. Roles and Responsibilities

### 6.1 Risk Management Team
| Role | Responsibilities |
|------|------------------|
| **Project Sponsor** | - Approve risk management plan<br>- Provide resources for risk responses<br>- Make go/no-go decisions |
| **Project Manager** | - Overall risk management accountability<br>- Lead risk identification and planning<br>- Report risks to stakeholders |
| **Risk Manager** | - Facilitate risk management process<br>- Maintain risk register<br>- Monitor risk responses |
| **Risk Owners** | - Monitor assigned risks<br>- Implement risk responses<br>- Report status updates |
| **Team Members** | - Identify risks in their areas<br>- Support risk assessment<br>- Execute risk responses |

### 6.2 Risk Governance
- **Risk Review Board**: [Composition and authority]
- **Escalation Process**: [When and how to escalate]
- **Decision Authority**: [Who can approve responses]

## 7. Risk Monitoring and Control

### 7.1 Risk Review Schedule
- **Daily**: Risk owner monitoring
- **Weekly**: Team risk review
- **Bi-weekly**: Risk register update
- **Monthly**: Stakeholder risk report
- **Phase Gates**: Comprehensive risk review

### 7.2 Risk Reporting
| Report Type | Audience | Frequency | Content |
|-------------|----------|-----------|---------|
| Risk Dashboard | Project Team | Weekly | Top risks, trends, actions |
| Risk Status | Stakeholders | Monthly | Risk summary, changes, issues |
| Risk Report | Sponsor/Board | Quarterly | Comprehensive analysis |

### 7.3 Risk Metrics
- Number of risks by category
- Number of risks by priority level
- Risk closure rate
- Risk response effectiveness
- New risks identified per period

## 8. Risk Communication Plan

### 8.1 Communication Matrix
| Stakeholder | Information Needs | Method | Frequency | Owner |
|-------------|-------------------|--------|-----------|-------|
| Project Team | All risks, detailed status | Risk register, meetings | Weekly | Risk Manager |
| Project Sponsor | High/critical risks | Dashboard, reports | Bi-weekly | Project Manager |
| Steering Committee | Top risks, trends | Executive summary | Monthly | Project Manager |

### 8.2 Risk Communication Guidelines
- **Transparency**: All risks should be openly communicated
- **Timeliness**: New risks communicated within 24 hours
- **Clarity**: Use plain language, avoid jargon
- **Actionable**: Include specific actions and timelines

## 9. Risk Tools and Techniques

### 9.1 Risk Analysis Tools
- Risk probability and impact matrix
- Monte Carlo simulation
- Decision tree analysis
- Sensitivity analysis
- SWOT analysis

### 9.2 Risk Management Software
- [Tool Name]: Primary risk register management
- [Tool Name]: Risk analysis and modeling
- [Dashboard Tool]: Risk reporting and visualization

## 10. Training and Competency

### 10.1 Training Requirements
| Role | Training Required | Duration |
|------|-------------------|----------|
| Project Manager | Risk management certification | 16 hours |
| Risk Owners | Risk identification and response | 8 hours |
| Team Members | Risk awareness | 4 hours |

### 10.2 Competency Assessment
- Risk identification skills
- Risk analysis capabilities
- Response planning experience
- Communication skills

## 11. Integration with Project Management

### 11.1 Integration Points
- **Project Planning**: Risk considerations in all plans
- **Change Management**: Risk assessment for all changes
- **Quality Management**: Risk-based quality planning
- **Procurement**: Vendor risk assessment

### 11.2 Risk Budget
- **Risk Response Budget**: $[Amount] (% of project budget)
- **Contingency Reserve**: $[Amount] (% of project budget)
- **Management Reserve**: $[Amount] (% of project budget)

## 12. Lessons Learned and Continuous Improvement

### 12.1 Lessons Learned Process
- Regular capture of risk management lessons
- Post-project risk management review
- Best practices documentation
- Process improvement recommendations

### 12.2 Process Improvement
- Monthly process review
- Stakeholder feedback collection
- Industry best practice benchmarking
- Tool and technique evaluation

## 13. Appendices

### Appendix A: Risk Register Template
[Link to detailed risk register spreadsheet]

### Appendix B: Risk Assessment Worksheets
[Templates for different risk categories]

### Appendix C: Risk Communication Templates
[Email templates, report formats]

### Appendix D: Risk Management Checklists
[Checklists for different project phases]

---

**Document Approval**

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Project Sponsor | [Name] | | |
| Project Manager | [Name] | | |
| Risk Manager | [Name] | | |

---
*Tailor this worksheet to the selected organizational methodology and approval process.*