I.1Perform a preliminary document analysis — Gather and review preliminary documents: industry benchmarks, previous lessons learned, historical data; Determine and assign who is responsible for the analysis (PM, risk manager, financial controller); Establish documents relevant to the risk process.

I.2Assess project environment for threats and opportunities — Determine which OPA / EEF / methodology applies (agile, waterfall, hybrid); Analyze environmental factors; Determine organizational and cultural risk appetite.

I.3Confirm risk thresholds based on risk appetites — Align project risk thresholds to organizational risk appetite; Calculate the risk the organization can absorb (financial, scope, schedule, quality, legal…); Discuss risk thresholds.

I.4Establish risk management strategy — Establish risk processes and tools; Determine risk metrics; Coach/mentor team on best practices (servant leadership).

I.5Document the risk management plan — Define organizational risk roles and responsibilities (RAM / RACI); List key artifacts and key risk management activities (who, what, when, where, how); Use the Risk Breakdown Structure (RBS) to support the plan.

I.6Plan and lead risk management activities with stakeholders — Collaborate with the team conducting risk planning; Manage stakeholder risk appetite and attitudes; Set expectations on rules of engagement.

II.1Conduct risk identification exercises — Conduct meetings, interviews, focus groups, and other SME support activities; Perform detailed analyses of risk identification results; Indicate risks as threats or opportunities.

II.2Examine assumption and constraint analyses — Leverage and categorize assumptions and constraints; Assess the risk associated with each assumption/constraint; Recognize relationships between assumptions/constraints and project objectives.

II.3Document risk triggers and thresholds based on context/environment — Assess, confirm and document risk compliance thresholds and categories; Assess and document risk triggers, causes and timing; Assess and document risk consequences and impact.

II.4Develop risk register — Analyze the validity of identified risks and triggers; Examine risk attributes: probability, impact, urgency; Establish risk origin and ownership (internal/external).

III.1Perform qualitative analysis — Classify risks in the RBS using classifications from the risk management plan; Estimate impact on schedule, budget, resources and scope; Apply risk matrices.

III.2Perform quantitative analysis — Analyze risk data and process performance information against established metrics; Analyze the project's general (overall) risks; Perform forecast and trend analysis on new and historical information.

III.3Identify threats and opportunities — Assess project risk complexity; Perform an impact analysis on project objectives: scope, schedule, cost, resources, quality, stakeholders; Assess compliance objectives against organizational strategic objectives.

IV.1Plan risk response — Determine appropriate response strategy: avoid, accept, mitigate, transfer / exploit, enhance, share, escalate, contingency planning; Decide time-bound response actions and identify action owners; Assess effectiveness of response actions against strategy and objectives.

IV.2Implement risk response — Execute the risk response plan(s) and contingency plan(s); Encourage stakeholders to provide feedback on the risk response; Evaluate and react to secondary and residual risks from response implementation.

V.1Gather and analyze performance data — Reconcile performance data and reports from risk-relevant work packages; Analyze data to determine completion status against the baseline; Perform a variance analysis.

V.2Monitor residual & secondary risks — Monitor risk responses and document residual risk; Monitor risk responses for secondary risks; Assess impact of residual and secondary risks on project objectives.

V.3Provide information required to update relevant project documents — Aggregate and summarize risk data; Monitor and close out expired risks.

V.4Monitor project risk levels — Assess project risk level; Prepare reports for different stakeholders; Communicate risk levels to key stakeholders.