This reading aims to present the concepts, tools, and techniques
of the Plan Risk Management process.
The objective of the Plan Risk Management process is
to have a document, the Risk Management Plan, that
defines how risk management activities will be carried
out in the Project.
The main benefit of carrying out this planning exercise
is that it enables all stakeholders to learn the rules, pro-
cesses, procedures, roles, responsibilities, and templa-
tes that will be applied to the specific management of
the Project under development.
Figure 1 – Structure of the Plan Risk Management Process
Created in-house, based on A Guide to the Project
Mana­gement Body of Knowledge (PMBOK® Guide) /
Project Management Institute, Sixth Edition.
The main elements that make up the Plan Risk Mana-
gement process are described below.
THE OUTPUT
Let us start from the end: What do we want to acom-
plish in this process?
The output of this process is the Risk Management
Plan1, which documents the decisions made about
how Project risks will be managed. This document’s ac-
1 See basic Risk Management Plan template attached.
2 Project Charter, Project Profile, Proposal for Operations Development, Loan Agreement, etc.
curacy and comprehensiveness will define the quali-
ty of communication among stakeholders involved in
the Project’s risk management. Having clear rules that
have been agreed upon among the parties and docu-
mented in the Risk Management Plan is fundamental
for appropriately managing all of the parties’ expecta-
tions and coordinating efforts.
THE INPUTS
What information do we need to analyze to achieve
this output?
The Documents Establishing the Project:2 These are
the documents that make up the Project’s design pha-
se and provide information about policies related to
the Project.
The Stakeholder Register: It provides information about
the stakeholders involved in the Project, such as the orga-
nizations to which they belong and their positions, roles,
and responsibilities. This document will enable us to learn
which stakeholders must be taken into account to define
how Project risks will be managed and which stakehol-
ders will have to be notified of the results.
The Organization’s Processes: They provide infor-
mation about how risks are managed in the organiza-
tions that participate in the Project.
Cultural Factors: They provide information about the
culture and capacities that participating organizations
already have in place regarding risk management. A
particularly relevant example of risk culture in an orga-
nization is its risk appetite, i.e., to what extent the orga-
1
nization accepts risk in connection with the benefits it
can derive. For example, an organization with high risk
appetite will have a high level of risk tolerance, becau-
se it seeks to obtain high profits, while an organization
with low risk tolerance will seek lower yet safer profits.
Risk appetite will also define the threshold of accepta-
ble risk in a project and, based on that threshold that
has been agreed upon by stakeholders, the percenta-
ges assigned to probability and impact on the analysis
matrix will be defined.
3
THE TOOLS AND TECHNIQUES
How do we analyze this incoming information (pro-
cess input) and transform it into the Risk Management
Plan (process output)?
Documentation Review: It facilitates the orderly
analysis of all the information related to risk manage-
ment that has been recorded in several documents
establishing the Project, as well as in the policies of the
organization or organizations that sponsor the Project.
Stakeholder Analysis: It allows for establishing re-
gistered stakeholders’ requirements, expectations, in-
fluence, impact, affinity, and risk appetite. This analysis
facilitates the definition of which stakeholders should
be part of each of the risk management exercises.
Meetings: Once the stakeholders that will be part of
the risk management regulatory process have been
identified, meetings will be held to establish, at least,
the following information, which will be included in the
Risk Management Plan:
Risk management processes related to the Project
(e.g., whether or not the quantitative analysis process
will be carried out)
Responsible parties for these processes (e.g., whe-
ther the Project Manager will be responsible for risk
management processes; whether a responsible party
3 The analysis and probability matrix is a
​​ tool used in the qualitative risk analysis process.
4 In each relevant Module, and as additional information to the readings, we have attached the templates that the Inter-American
Development Bank uses in its workshops on risk analysis of projects financed with sovereign-guaranteed loans.
for the area will be appointed; whether risk monitoring
will be carried out by the monitoring specialist; etc.)
Levels of authority (e.g., who will approve the respon-
se plan; who will decide on the budget allocation for a
risk response; who will allocate resources; etc.)
Communications strategy (e.g., how the response
plan will be disclosed and to whom; how the risk identi-
fication workshop will be convened and who will be in-
vited; how the materialization of a risk will be disclosed
and to whom; etc.)
Risk Tolerance Thresholds (e.g., what probability of
occurrence is considered high level; what risk level is
acceptable to the Project; what risk level requires res-
ponse planning; what impact level implies a certain
delay or cost overrun percentage; etc.)
Tools and templates that will be used for Project risk
management (e.g., information that the Risk Register
must contain; Probability and Impact Matrix levels; level
of detail required in the response plan regarding resour-
ce allocation; etc.)4
Expert Judgment: Risk management is an area that is
particularly integrated into project and organization ma-
nagement, because risks emerge from different sources
and affect different objectives. Therefore, the Plan Risk
process, as well as the other risk management proces-
ses, are the responsibility of the Project Team Manager or
Leader, who will rely on the support of a risk management
expert. The expert must master facilitation and participa-
tory planning development techniques and put his or her
risk management knowledge at the service of the Project
Team and the stakeholders involved.
2
CONCLUSION to the Risk Management Plan in order to complete it.

Plan Risk Management is the first process in the knowle- Each risk planning process will produce a document,
dge area, because it establishes the rules to follow for which will be attached to the Risk Management Plan to
performing all other risk management processes in the complete the Project’s risk planning documents.
Project.

Each project must have these rules in place, within

the framework of the policies, processes, and culture
of participating organizations, to achieve organizatio-
nal commitment and the individual commitment of all
Project Team members, as a critical success factor in
project risk management.

Project risk management rules, processes, procedu-

res, templates, limits, roles, and responsibilities are the
minimum essential elements to be clarified and do-
cumented for appropriate management, as well as to
achieve efficient communication among all stakehol-
ders involved.

Figure 2 - Risk Management Plan Components

Created in-house, based on A Guide to the Project

Mana­gement Body of Knowledge (PMBOK® Guide) /
Project Management Institute, Sixth Edition.

It is important to remember that the expectations of

stakeholders involved in the Project are a key ​​risk area
and the best way to efficiently manage expectations is
communication.

Once regulations for managing Project risks have been

defined and approved, the other risk planning proces-
ses can be developed, and their outputs will be added

3
MAIN TERMS AND DEFINITIONS
IN THIS READING
Constraint. A limiting factor that affects the execu-
tion of a project, program, portfolio, or process.
Enterprise Environmental Factors. Conditions, not
under the immediate control of the team, that influen-
ce, constrain, or direct the project, program, or portfolio.
Expert Judgment. Judgment provided based upon
expertise in an application area, knowledge area, dis-
cipline, industry, etc., as appropriate for the activity be-
ing performed. Such expertise may be provided by any
group or person with specialized education, knowledge,
skill, experience, or training.
Guideline. Official advice or recommendations that
indicate policies, standards, or procedures about how
something should be carried out.
Negotiation. The process and activities carried out
to settle disputes through consultations and dialogues
among the parties involved.
The organization will accept risk that falls below that
risk threshold. The organization will not tolerate risk that
goes above that risk threshold.
Role. A defined function to be performed by a pro-
ject team member, such as testing, filing, inspecting,
or coding.
Stakeholder. An individual, group, or organization
that may affect, be affected by, or perceive itself to be
affected by a decision, activity, or outcome of a pro-
ject.
Stakeholder Analysis. A technique of systematically
gathering and analyzing quantitative and qualitative
information to determine whose interests should be
taken into account throughout the project.
Stakeholder Register. A project document including
the identification, assessment, and classification of
project stakeholders.

Organizational Process Assets. Plans, processes, po- *Reading created in-house, based on A Guide to the Project
Management Body of Knowledge (PMBOK® Guide) / Project
licies, procedures, and knowledge bases that are spe- Management Institute, Sixth Edition.
cific to and used by the performing organization.

Plan Risk Management. The process of defining how

to conduct risk management activities for a project.

Responsibility. An assignment that can be delega-

ted within a project management plan such that the
assigned resource incurs a duty to perform the requi-
rements of the assignment.

Risk Appetite. The degree of uncertainty an organi-

zation or individual is willing to accept in anticipation
of a reward.

Risk Management Plan. A component of the project,

program, or portfolio management plan that describes
how risk management activities will be structured and
performed.

Risk Threshold. The degree of uncertainty or impact

in which a stakeholder may have particular interest.