APM Project Risk Management Level 1 key terms

An uncertain event or set of circumstances that, should it occur, will have an effect on the achievement of one or more project objectives. It is measured by combining the likelihood of occurrence with the impact if it does.

A state of incomplete knowledge about an outcome, event or condition. It exists whether or not the effect is positive or negative, and it is the raw material from which both threats and opportunities are identified.

A risk whose potential effect on project objectives is negative, such as delay, cost overrun, quality failure or loss of benefit. Threat responses aim to avoid, reduce, transfer or accept the exposure.

A risk whose potential effect on project objectives is favourable, such as time saved, cost reduced or extra benefit gained. Opportunities are managed actively rather than simply noted.

The combined measure of how much a risk could hurt or help the project, usually calculated as probability multiplied by impact. It is used to rank risks and decide which ones need active treatment.

The assessed likelihood that a particular risk event will actually occur during the period under consideration. It is usually expressed as a percentage or on a defined scale from very low to very high.

The assessed size of the effect on project objectives if a risk event occurs, expressed in time, cost, quality or benefit terms. Impact may be estimated as a single figure or as a range.

How soon a risk is expected to occur or become relevant relative to the current point in the project. Near-term risks often need faster attention than distant ones, even when their exposure is similar.

The amount and type of risk an organisation is willing to seek or retain in pursuit of its objectives. It sets the boundary within which project-level risk taking is considered acceptable.

The specific range of variation an organisation or stakeholder is prepared to accept around a given objective before action is required. It translates broad appetite into practical limits for a project.

A defined point or level of exposure at which a risk becomes unacceptable and must be escalated or treated. Thresholds are often set against cost, schedule or benefit targets.

The chosen or habitual way an individual or group responds to risk, shaped by experience, culture and personality. It may be risk-averse, risk-seeking or neutral and influences how risks are judged.

The systematic process of identifying, assessing, planning responses to, and monitoring risks so that uncertainty is handled deliberately rather than by accident. It runs throughout the project lifecycle and is repeated as conditions change.

The documented structure of policies, roles, processes, tools and reporting arrangements that governs how risk is managed across an organisation or project. It gives consistency and clarity about who does what and when.

The arrangements for directing and controlling risk management, including accountability, decision rights, escalation routes and oversight. It ensures risk decisions are made at the right level by the right people.

The document describing how risk management will be carried out on a specific project, covering method, roles, funding, timing, scales and reporting. It is agreed early and updated as the project evolves.

The repeating sequence of activities used to manage risk, typically identification, assessment, response planning, implementation and review. Each cycle feeds learning into the next as the project progresses.

The activity of finding and recording sources of uncertainty that could affect project objectives, before they are assessed or treated. It draws on many techniques and many people to reduce the chance of blind spots.

The working record of identified risks and opportunities, holding details such as cause, effect, owner, assessment, response and status. It is the central reference for monitoring and reporting risk.

A hierarchical grouping of risk sources or categories, arranged by area such as technical, commercial, external or organisational. It helps teams identify risks systematically and spot where exposure is concentrated.

Assigning identified risks to defined groups so that similar risks are handled consistently and patterns become visible. Categories may reflect source, affected objective, project phase or the part of the business exposed.

The underlying reason or source that could bring about a risk event, often expressed as the first part of a cause-event-effect statement. Addressing causes is usually more effective than reacting to effects.

The consequence for project objectives if a risk event actually happens, described in terms of time, cost, quality or benefit. Clear effect statements make assessment and response planning more reliable.

Involving people who affect or are affected by the project in identifying and responding to risk. Different perspectives surface different uncertainties and build commitment to the responses chosen.

The overall activity of judging identified risks, covering both qualitative ranking and, where warranted, quantitative analysis. Its purpose is to prioritise attention and inform response decisions.

Assessing risks using descriptive scales for probability and impact to rank them and decide which need further attention. It is quick, uses judgement and is usually applied to all identified risks.

Numerically modelling the combined effect of risks on objectives, often using ranges, distributions and simulation. It produces estimates such as confidence levels for cost or completion date.

A grid that plots risks by assessed likelihood and impact to produce a priority rating. It gives a consistent, visible way to compare risks and set treatment priorities.

The average financial outcome of a risk, calculated by multiplying the probability of the event by its monetary impact. It supports comparison and decisions such as whether to buy insurance or accept exposure.

A modelling technique that repeatedly samples from ranges of input values to show the range of possible project outcomes and their likelihood. It helps set realistic targets and contingency levels.

Estimating a value using optimistic, most likely and pessimistic figures to reflect uncertainty in a single activity or cost. The results can feed simulation or be combined into a weighted average.

The planned action taken to deal with an assessed risk, chosen to match its priority and the organisation's appetite. Each response has an owner, a cost and a trigger for implementation.

A chosen approach for a negative risk, such as avoid, reduce, transfer, accept or escalate. The choice depends on exposure, cost of the response and the level of risk the organisation will tolerate.

A chosen approach for a favourable risk, such as exploit, enhance, share or accept. The aim is to increase the chance the opportunity happens and maximise the benefit if it does.

Shifting the financial or contractual consequence of a risk to another party, for example through insurance, warranties or fixed-price contracts. The underlying risk still exists and may still affect delivery.

A deliberate decision to retain a risk and its consequences without further treatment, usually because the exposure is tolerable or treatment costs more than the effect. It should be recorded and reviewed.

A prepared fallback describing what will be done if a specific risk occurs or a trigger point is reached. It reduces reaction time and is often funded from a contingency reserve.

Time, money or resource set aside to cover the effect of known risks that have been assessed but not fully eliminated. It is released under defined conditions rather than treated as spare capacity.

An amount of time or money held outside the project baseline to cover unknown unknowns and unforeseen work. Its use usually requires approval from a higher authority than the project manager.

An observable condition or event indicating that a risk is about to occur or has occurred, prompting the response to be activated. Triggers make monitoring practical and timely.

The named person accountable for managing a particular risk and its response, including monitoring and reporting on it. Ownership sits with whoever is best placed to act, not necessarily the project manager.

The person responsible for carrying out a specific response action, who may differ from the person accountable for the risk overall. Clear separation of accountability and action prevents responses stalling.

The ongoing checking of risks, responses and triggers to confirm that assessments remain valid and actions are happening. It also detects new risks and closes those that are no longer relevant.

A scheduled or ad hoc examination of the risk register and responses with the project team and relevant stakeholders. It refreshes assessments, adds new risks and confirms that actions are on track.

Communicating risk information to the right audiences in a form they can act on, covering exposure, trends, key risks and response status. Good reporting is timely, honest and matched to the decisions each audience must make.

The two-way sharing of risk information, concerns and decisions among stakeholders throughout the project. It builds shared understanding and supports early warning rather than surprise announcements.

Referring a risk to a higher level of authority when it exceeds the project's tolerance, authority or ability to respond. Escalation should follow a defined route and be recorded.

How developed and embedded an organisation's risk management capability is, from ad hoc and reactive to systematic and continuously improving. Maturity models help identify realistic next steps for improvement.

The shared values, behaviours and norms that shape how openly people talk about risk and how they act on it. A healthy culture rewards early bad news rather than punishing it.

The practice of regularly reviewing how risk management is working and making deliberate changes to strengthen it. Lessons from reviews, audits and project closures feed into updated processes and behaviours.

Knowledge captured from what happened on a project, including how risks were handled, so future work benefits. It is most useful when gathered throughout delivery rather than only at closure.

A group technique for generating a wide list of possible risks without judging them at first. Free thinking is encouraged, then ideas are clarified and recorded for later assessment.

A structured meeting where stakeholders work together to identify, assess or plan responses to risks. It combines group techniques with facilitation to build shared ownership of the output.

A technique for tracing a risk or problem back to its underlying source rather than its symptoms. Understanding the cause allows responses that remove or reduce the risk at origin.

The idea that risk exposure and focus change from concept through delivery to handover and benefits realisation. Early phases carry more uncertainty, while later phases carry more cost of change.