Risk is exposure to the consequences of uncertainty. In a project context, it is the chance of something happening that will have an impact upon objectives. It includes the possibility of loss or gain, or variation from a desired or planned outcome, as a consequence of the uncertainty associated with following a particular course of action. Risk thus has two elements: the likelihood or probability of something happening, and the consequences or impacts if it does.

Risk management refers to the culture, processes and structures that are directed towards the effective management of potential opportunities and adverse effects.

The risk management process involves the systematic application of management policies, processes and procedures to the tasks of establishing the context, identifying, and analyzing, assessing, treating, monitoring and communicating risk.


Risk identification is the process of determining what, how and why things may happen.

Risk analysis is the systematic use of available information to determine how often specified events may occur and the magnitude of their consequences. It may use any of a wide variety of mathematical and other models and techniques.

Risk evaluation determines whether the risk is tolerable or not and identifies the risks that should be accorded the highest priority in developing responses for risk treatment.

Risk treatment establishes and implements management responses for dealing with risks, in ways appropriate to the significance of the risk and the importance of the project.