In Level 1 you learned to rate a risk by probability and impact. The next step is knowing where the organization itself stands on risk. Risk appetite is how much uncertainty the organization will accept in exchange for what it wants to achieve. A risk threshold is the measurable line where exposure becomes unacceptable, such as "any likely delay of more than two weeks". Every significant risk also gets a risk owner, the person who watches it and carries out its response, and a trigger, the warning sign that the risk is about to happen.
Qualitative analysis quickly ranks risks on a probability and impact matrix and suits every project. Quantitative analysis puts numbers on them and is used for major risks or large projects. Its best-known tool is expected monetary value: EMV = probability × financial impact. Example: a 30% chance of a $50,000 delay penalty gives 0.30 × 50,000 = -$15,000, and a 20% chance of saving $20,000 gives +$4,000, so the total is -$11,000. A decision tree applies the same idea to choices: an option costing $100,000 with a 40% chance of a $30,000 overrun has an expected cost of $112,000, which beats a fixed $120,000 option.
Beyond avoid, transfer, mitigate and accept, there is escalate: used when a risk is outside the project's scope or beyond the PM's authority. It is handed to the right owner, such as the program or portfolio manager, and the PM confirms they have accepted it. A contingency plan is written to run when the trigger appears, and a fallback plan is ready in case the contingency plan fails. After any response some residual risk remains, and the response itself can create a secondary risk. Known risks are funded from the contingency reserve inside the cost baseline, while the management reserve is kept for unknown surprises.
A risk register is not written once and forgotten. The PM holds regular risk reviews: re-assessing probability and impact, closing risks that have passed, adding new ones and checking that responses are working. In agile projects, risk handling is built into the way of working: frequent delivery exposes problems early, a spike tests an uncertain technical idea before the team commits to it, and a risk-adjusted backlog moves risk-reducing work to the top. Risks are also raised in the daily scrum and the retrospective.
💡 Key points
- Risk appetite and thresholds define what is acceptable; every risk has an owner and a trigger.
- EMV = probability × impact; threats are negative and opportunities positive.
- Escalate risks outside your scope or authority, and prepare contingency and fallback plans.
- Review risks regularly; in agile, use spikes and frequent delivery.
🌍 Real-life example
A telecom company is rolling out a 5G network in three cities. The PM logged the risk that the antenna shipment arrives late, made the procurement officer its owner, and set the trigger: "shipping confirmation more than three days late". With a 25% probability and an $80,000 impact, its EMV of -$20,000 went into the contingency reserve. The contingency plan was to buy from a second approved supplier; the fallback plan was to start with whichever city had its equipment. When a nationwide change in import fees emerged as a risk, the PM escalated it to the portfolio manager because it was beyond the project's authority.
📖 Key terms
| English | العربية |
|---|---|
| Risk Appetite | شهية المخاطر |
| Risk Threshold | عتبة المخاطر |
| Risk Owner | مالك المخاطرة |
| Trigger | مؤشر الحدوث |
| Expected Monetary Value (EMV) | القيمة النقدية المتوقعة |
| Residual Risk | المخاطرة المتبقية |