What Is Project Risk and How to Manage It

A project risk is anything that could negatively affect your project's timeline, budget, quality, or scope if it occurs. It is not a problem. A problem has already happened. A risk is something that might happen. Managing risks means identifying the most significant ones early, assessing how likely they are to occur and how bad the impact would be, and putting a plan in place before they become problems.

Most project managers do not track risks formally. They carry them in their heads. When one of them materializes, it becomes an emergency that could have been managed if it had been tracked.

How to Score a Risk

Every identified risk gets scored on two factors: probability and impact. Both are scored on a scale of one to five. Probability measures how likely the risk is to occur. Impact measures how severely the risk would affect the project if it occurred. Multiply the two scores to get a risk score. Maximum score is 25.

Use three thresholds: a score above 15 requires immediate action, a score of 8 to 15 requires active monitoring, and a score below 8 can be logged and reviewed periodically. Log your top 5 risks every week and bring the highest scoring one to every status meeting. Most project managers log zero. That is why they get surprised.

Risk Score	Category	Action Required
16 to 25	High	Act now. Assign owner. Implement mitigation this week.
8 to 15	Medium	Monitor weekly. Have a contingency plan ready.
1 to 7	Low	Log and review monthly. No immediate action required.

The 5-Risk Weekly Log

Every project needs a risk log. A simple spreadsheet with five columns is enough: risk description, probability score, impact score, total risk score, and mitigation owner with a due date. Review the risk log at the start of every week. Ask two questions for each risk: has anything changed about the probability or impact since last week, and is the mitigation plan being executed on schedule?

Bring the highest-scoring risk to the weekly status meeting. Use the free Weekly Progress Dashboard to track open risk count alongside milestone completion and budget variance so you always have a complete picture of project health in one place.

The Difference Between a Risk and an Issue

A risk is something that might happen. An issue is something that has already happened and needs to be resolved. Keep risks and issues in separate logs. Mixing them creates confusion about what is being prevented and what is being fixed. When a risk occurs, move it from the risk log to the issue log and update the response accordingly.

Use the free Project Budget Variance Tracker to monitor one of the most common risk categories: budget overruns. It flags overspend automatically and gives you the number you need before your sponsor asks for it.

What to Do When a High-Scoring Risk Has No Clear Mitigation

Some risks cannot be fully mitigated. In these cases, the risk needs to be escalated to the project sponsor with three things: a clear description of the risk, its probability and impact score, and the range of outcomes if it occurs. The sponsor then decides whether to proceed, adjust the project, or pause until the risk is resolved. That is a sponsor decision, not a project manager decision.

If you want the complete risk management system with scripts for escalating risks to sponsors and a log template you can use on your next project today, The Accidental Project Manager covers all of it in one place.