Risk Strategy and Planning
Setting the frame before naming risks
Risk strategy and planning establishes how the project will manage uncertainty before a single risk is written down. The deliverable is the risk management plan, a subsidiary of the project management plan, covering methodology, roles and responsibilities, budget and schedule for risk work, risk categories (frequently structured as a Risk Breakdown Structure, or RBS), definitions of probability and impact scales, the probability-impact matrix, reporting formats, and tracking. It must trace upward to the organization's risk strategy and to project objectives; a plan that ignores program or portfolio risk policy is a classic wrong answer.
Three terms candidates confuse: risk appetite (how much uncertainty the organization will pursue or retain), risk tolerance (acceptable variation around a threshold), and risk threshold (the concrete limit that triggers escalation). Appetite is a posture; a threshold is a number. Also separate the contingency reserve (for identified risks, sized from expected monetary value or simulation) from the management reserve (for unknown-unknowns, controlled above the project manager).
Traps: treating the plan as written once and frozen (it is revisited at phase gates); naming the project manager as default risk owner; omitting stakeholder appetite and thresholds; confusing the risk management plan with the risk register, which simply holds the risks.
Rule of thumb: if aggregate EMV of identified risks exceeds the reserve you hold, escalate for more contingency or replan; never accept the gap silently.
Worked example: appetite permits a 10% chance of exceeding budget. Simulation shows a 22% probability of overrun. The threshold is breached, so the plan mandates escalation to the sponsor.