APM Project Risk Management Level 1 cheat sheet

Risk is an uncertain event or set of events that, if it occurs, affects the achievement of objectives; it combines probability of occurrence with impact on objectives.

Pure (downside) risk has only negative outcomes; business/speculative risk can produce either threat or opportunity.

Risk exposure (expected value) = probability × impact; used to rank threats and opportunities on a common scale.

Threat and opportunity are both risks: a threat is an uncertain event with negative effect, an opportunity is an uncertain event with positive effect.

Individual risk is a single uncertain event; overall project risk is the aggregate effect of all sources of uncertainty on project objectives.

A risk cause (source) precedes the event; the event precedes the effect (consequence). Describing cause-event-effect supports response design.

Inherent risk is assessed before controls; residual risk remains after planned responses; secondary risk is created by a response.

Risk appetite is the amount of risk an organization is willing to seek or accept; risk tolerance is the acceptable variation around a specific objective.

Risk context covers internal factors (objectives, culture, capability, resources) and external factors (market, regulatory, political, technological, environmental).

A risk management framework comprises policy, defined roles and responsibilities, processes, and supporting tools and techniques.

Governance sets who owns risk decisions: the project board/sponsor owns overall project risk; risk owners own individual risks; risk actionees own response actions.

Escalation rules define thresholds above which a risk moves from project to programme or portfolio level, or upward to senior management.

The risk management plan documents approach, methodology, roles, funding, timing, categories, appetite/tolerance and reporting formats.

A risk breakdown structure (RBS) is a hierarchical source-based categorization of risk used to structure identification and analysis.

Risk appetite and tolerance should be expressed as measurable thresholds (e.g., cost, time, quality, safety) so responses can be tested against them.

A risk management framework is proportionate: the level of formality and effort should match project scale, complexity and risk exposure.

Identification seeks to find, recognize and record individual risks and sources of overall project risk, including both threats and opportunities.

Techniques include brainstorming, interviews, Delphi, checklists, prompt lists, SWOT analysis, assumption analysis, and cause-and-effect (fishbone) diagrams.

Assumptions and constraints are a primary risk source: an assumption that proves false, or a constraint that is breached, becomes a risk.

A prompt list (e.g., PESTLE, technology, people, commercial, external) reduces the chance of blind spots in identification.

Stakeholder engagement in identification improves coverage; diverse perspectives surface risks a single team would miss.

Identification output is a risk register entry: unique ID, cause, event, effect, category, owner, and initial assessment.

Identification is iterative and should be repeated at phase gates and after significant change, not performed once at project start.

Opportunity identification deliberately looks for favorable uncertainty: positive deviations in cost, time, scope, quality or benefit.

Qualitative analysis assesses probability and impact using defined scales to produce a risk rating (e.g., low/medium/high) and prioritize risks.

A probability-impact matrix maps assessed probability and impact to a rating; cells above tolerance trigger escalation or active response.

Quantitative analysis assigns numeric values to probability and impact to model combined effect on project objectives.

Expected monetary value (EMV) = probability × monetary impact; EMV of a threat is negative, EMV of an opportunity is positive.

Monte Carlo simulation runs many iterations of cost/duration distributions to produce a probability distribution of outcomes (e.g., P50, P80).

Sensitivity analysis (tornado diagram) ranks which risks or variables most affect the outcome, guiding analysis and response effort.

Decision trees compare options by expected value across branches, incorporating probabilities and payoffs.

Evaluation compares the analyzed risk against appetite/tolerance to decide: accept, actively respond, escalate, or reject the activity.

Threat responses: avoid, reduce (mitigate), transfer, accept (retain), and escalate.

Opportunity responses: exploit, enhance, share, and accept (or escalate).

Avoid removes the cause of the threat or changes the plan to eliminate exposure; reduce lowers probability and/or impact.

Transfer shifts financial consequence to a third party (insurance, contract, warranty); it does not remove the risk itself.

Exploit ensures the opportunity is realized; enhance increases probability and/or impact; share allocates ownership to a party best able to capture it.

Acceptance is a deliberate decision to retain exposure, with contingency (time, cost, or reserve) where appropriate.

Each response needs an owner, action(s), target dates, cost, and expected residual risk after implementation.

Contingency plans are triggered if a defined risk occurs; fallback plans apply if the primary response fails.

Monitoring tracks risk status, response progress, residual exposure, and changes in probability/impact over time.

Risk reviews should be scheduled at defined intervals and at phase gates; triggers (early warning indicators) signal when a risk is materializing.

A risk register is a live document; entries are updated for status, reassessment, closure, or escalation.

Reporting should be audience-appropriate: board needs summary exposure against tolerance; delivery teams need detailed actions and owners.

Key reporting metrics include top risks by rating, exposure trend, overdue responses, and number of risks above tolerance.

Risk communication is two-way: it informs stakeholders and gathers new information that feeds back into identification and analysis.

Closure requires evidence the risk is no longer relevant or has occurred and been managed; closed risks are archived for lessons learned.

Escalation reporting states the risk, current exposure, why it exceeds the current level's authority, and the decision required.

Opportunities are managed with the same rigor as threats: identified, assessed, assigned an owner, responded to, and monitored.

Opportunity exposure uses the same probability × impact logic, but the impact is a positive benefit to objectives.

Risk exposure changes across the lifecycle: high uncertainty early (concept/definition), reducing as design and delivery progress.

Early lifecycle phases offer the greatest opportunity to influence outcomes at lowest cost; late changes carry higher cost and risk.

Risk management should be integrated with scope, schedule, cost and quality planning rather than run as a separate activity.

Benefits realization depends on managing both threats to benefits and opportunities to exceed them.

Lessons learned from closed risks and realized opportunities should feed forward into future projects and the organizational knowledge base.

Portfolio and programme levels aggregate project risk to inform investment decisions and balance overall exposure.

Risk maturity models describe progression from ad hoc/reactive risk handling through defined, managed, to optimized/embedded practice.

Higher maturity is characterized by consistent process, defined roles, quantitative analysis where warranted, and risk-informed decision making.

Risk culture reflects shared attitudes and behaviors: whether people raise risks openly, and whether bad news travels upward without blame.

A blame-oriented culture suppresses reporting; a just/learning culture encourages early disclosure and faster response.

Maturity assessment identifies gaps in process, competence, tools and culture, and sets improvement priorities.

Continuous improvement uses lessons learned, audit findings, and post-project reviews to update the framework, templates and training.

Competence development (training, coaching, communities of practice) is a maturity lever alongside process and tooling.

Measuring maturity should use evidence (e.g., review frequency, response closure rates, escalation timeliness) rather than self-assessment alone.