A Risk Management Plan is a document prepared by a project manager to foresee risks, to estimate the effectiveness, and to create response plans to mitigate them. It also consists of the risk assessment matrix.

A risk is defined as "an uncertain event or condition that, if it occurs, has a positive or negative effect on a project's objectives.  Risk is inherent with any project, and project managers should assess risks continually and develop plans to address them. The risk management plan contains an analysis of likely risks with both high and low impact, as well as mitigation strategies to help the project avoid being derailed should common problems arise. Risk management plans should be periodically reviewed by the project team in order to avoid having the analysis become stale and not reflective of actual potential project risks.

Most critically, risk management plans include a risk strategy. Broadly, there are four potential strategies, with numerous variations.


Projects may choose to:

• Accept risk; simply take the chance that the negative impact will be incurred
• Avoid risk; changing plans in order to prevent the problem from arising
• Mitigate risk; lessening its impact through intermediate steps
• Transfer risk; outsource risk to a capable third party that can manage the outcome