Risk Management Fundamentals, Principles and Terminology
Core definitions
Risk is an uncertain event or set of circumstances that, if it occurs, has a positive or negative effect on objectives. Every element matters: uncertainty (probability between 0 and 1), event, and effect on objectives. Threats are negative risks; opportunities are positive risks and are managed with the same cycle, not separately bolted on. A risk is not an issue: an issue has already happened and is managed reactively; a risk may or may not happen and is managed proactively. Learn the vocabulary chain: cause → event → effect (consequence), often written as a risk statement ("Because X may happen, Y may result, leading to Z").
Principles
Risk management should be proportionate (effort matched to exposure), aligned with objectives, integrated into project processes rather than a bolt-on, systematic and structured, based on best available information, tailored to context, human and cultural (people and behaviour matter), transparent and inclusive, and dynamic and responsive to change. These mirror ISO 31000 principles and are frequently tested by asking which principle a scenario illustrates.
Traps
- Confusing risk appetite (willingness to pursue exposure) with risk tolerance (acceptable variation) and risk threshold (the limit that triggers escalation).
- Treating likelihood × impact as a precise value rather than a ranking aid.
- Calling an issue a risk, or describing a cause as the risk itself.
Worked example
"Supplier may fail to deliver on time (event), because they are single-sourced (cause), causing a two-week schedule slip and £50k cost (effect)." This is a complete threat statement; a statement missing the effect cannot be evaluated.
Rule of thumb
If it has already happened, it is an issue; if it might happen and affects objectives, it is a risk.