How to set up risk management in project management?

Updated on July 28, 2026

In a project, it is rare that everything goes exactly as planned.

Delays, changes in direction, strategy and unforeseen events are numerous characteristics that can impact a project.

This is why risk management in project management should not be taken lightly. Indeed, it is crucial, otherwise the project risks being jeopardized.

In service companies, this issue is particularly acute. A project sold at a fixed price, regardless of the actual workload, absorbs its own cost overruns. And a consultant who leaves a project mid-way is rarely replaced with an identical one.

Although we have chosen to address risk management within the specific context of project management, note that it must also be considered on a global scale across the company.

Below you will find the definition of project risk management, the types of risks encountered, the five steps of the process and the tools that allow it to be maintained over time.

The definition of project risk management

Risk management involves identifying, anticipating, and mitigating any event that could negatively impact a project. It includes detecting and analyzing potential threats to limit their impact, and it also encompasses favorable events, known as opportunities. The terms risk management, risk mitigation, and risk control are used interchangeably: the latter emphasizes the mitigation aspect, while the former two refer to the entire process.

Risk management is part of project governance . It must be considered from the beginning of the project, from the preparation phase to delivery, and extends throughout the entire project.

The approach is proactive: it prioritizes anticipation over reaction. When a risk is confirmed, the focus shifts to problem-solving, not risk management.

Two frameworks guide this approach, and they serve different purposes. The AFNOR FD X50-117 standard describes the expected process in France: it defines the vocabulary, steps, and documents to be produced, making it the reference when a client requires a contractual risk management plan. The PMBOK from the Project Management Institute provides the international version, which is more detailed on assessment techniques, and it forms the basis for project manager certifications. Neither standard mandates a specific format: they define what must be covered, not how it should be presented.

Four situations to distinguish from a risk

As soon as one of these conditions is met, the risk is proven. Therefore, several situations must be distinguished from project risk:

1. The fact is : the event has occurred and now it's a matter of solving a real problem.
2. The consequence : the risk materialized and had an impact, for example, a reduction in the project's profit margin. It's important not to confuse cause and consequence: the cause is the element the project manager must be able to influence to limit or avoid the risk.
3. The constraint is a certainty, known at the start of the project, and you can plan around it. When a senior profile is only available from a certain date, you have the option of postponing the assignment, changing the resource planning from this, to recruit or subcontract the mission to a similar profile.
4. An opportunity is an uncertain event with a potentially positive impact, such as a client requesting an extension of their engagement. Similar to risk management, you can use the same methods to plan for the occurrence of an opportunity.

Why implement risk management?

Project risk management serves two measurable objectives: reducing uncertainty about deadlines and budget, and limiting discrepancies between what was promised and what will be delivered. It gives the project manager some leeway, which disappears as soon as the risk materializes.

Without a risk management system, threats are discovered when they materialize, that is, when you no longer have the option of choosing between several solutions.

No project is immune to unforeseen events. Therefore, imagining all the possibilities that could jeopardize it is an important part of the preparation.

To anticipate the unexpected

Risk management gives the project manager a head start: it deals with situations that have not yet occurred, as long as several options remain open.

It also encourages the implementation of preventative measures so that the risk does not become a reality.

And if, despite all your efforts, the risk materializes, you then have the entire action plan to get back on track. The earlier you anticipate situations, the more leeway you have to act in a reasoned and logical manner.

Risk management helps to avoid impulsiveness and hasty decision-making.

To improve project planning

A methodical approach to risk management will allow you to be more precise in preparing your project.

Have you identified a risk of a rare profile being left alone on a critical part of the mission? Listing all potential problems and finding solutions before they even occur will facilitate the mission's execution. You could then plan for a backup team member on this part, or revise the sequencing so that the critical workload doesn't rely on a single person.

Risk management therefore involves implementing prevention strategies to limit the impacts on your project.

Types of risks encountered in projects

Project risks fall into five classic categories: temporal, financial, technical, legal, and operational. In service companies, four additional categories arise from the sales model, and none of these appear in general typologies: resource planning contractual, scope of work and client relationship.

Problems can arise at any point in the project and affect various aspects.

Temporal risks

Time risks mainly concern timing, and in particular schedule management.

• Examples. Poor timeline assessment or a project timeframe that is too short are common time-related risks in project management.
• Consequences. A delay in deliverables, an overall project overrun, customer dissatisfaction, or even team frustration.
• How to avoid them. Take the time to interview project stakeholders to ensure your estimates are realistic. And of course, consider a safety margin.

Financial risks

Financial risks concern everything related to a project's budget.

• Examples: A poor budget assessment, an increase in the price of raw materials or human resources.
• Consequences. The need to find other sources of funding, or to draw on the budget of other company projects. On a larger scale, this can jeopardize the project or even the company itself.
• How to avoid them. Gather as much information as possible to ensure your estimates are highly accurate. Ask your teams questions, use historical data, and stay informed about current events. And, again, consider a margin of error.

Technical risks

The technical risks cover both the tooling and the chosen architecture.

• Examples. A lack of tools, technical resources, or an incompatibility between tools.
• Consequences. Technical risks necessitate finding alternatives. This process is costly and requires time for reflection as well as the mobilization of teams. Both the budget and the schedule are then affected.
• How to avoid them. List your needs at the start of your project and make sure your current resources can meet them. Regularly monitoring the tools in your sector also helps to prevent them.

Legal or regulatory risks

Legal risks can have a heavy impact on your project.

• Examples. The obligation to comply with the GDPR or the modification of a law imposes adjustments that cannot be circumvented.
• Consequences. Non-compliance exposes one to financial penalties or a tarnished reputation.
• How to avoid them. Actively monitor new laws, especially those specific to your sector. For projects involving personal data or regulated sectors, have the clauses reviewed by a lawyer before signing, rather than at the time of a dispute.

Operational, environmental and human risks

• Operational risks. Cyberattacks, data breaches, fraud. A proactive approach remains the best protection: regularly ensure your systems are up to date. Added to this are governance risks, when management priorities change mid-project, and supplier -related risks, such as delivery delays or partner failures.
• Environmental factors. A pandemic or a weather event could cause a sudden halt to the project. Ensure your data remains stored and accessible, even remotely. Regulations fall into the same category: a new legal constraint may be imposed without prior notice.
• Human factors. Turnover , meaning the sudden departure of key employees, impacts the project's progress and may even necessitate recruiting replacements. Team climate also matters: internal conflicts and workplace stress degrade output before any visible delays occur.
• Technical aspects. A new and poorly mastered technology, difficulties in integrating between systems, or inherited technical debt that slows down each delivery.
• Specific to the project itself. Unattainable objectives, poor communication, or human error.
• Cash flow issues. Beyond the budget, financing delays or blocked cash flows can halt a project that is otherwise profitable on paper.

In short: the 10 types of project risks to remember

What project risks can derail a mission? IT Services or in a consulting firm?

In IT Services In consulting firms, a project is a sold, staffed, and invoiced assignment. Five risk categories stem from this model and do not appear in any general typology: the resource planning , the contractual aspect, the decline in profit margin, customer relations and reputation.

The five risk categories specific to service companies

In a consulting firm or a IT Services The project is a mission that is sold, staffed, and invoiced. Five categories of risks arise from this model.

1. The risk of resource planning

The turnover of a key consultant during an assignment, a skills gap (i.e., a mismatch between the required technologies and the actual skill level of the assigned consultant), or a resource availability issue (due to workload overload and poor time management) can all lead to problems. Replacing a consultant takes time, and billing is pending during this period. Added to this is client resistance to change when their teams fail to adopt the project's deliverables.

2. Contractual risk

The tunnel effect, also known as scope creep, refers to the drift in scope: the initial statement of requirements remains incomplete, and additional requests arrive without any budget increase. Poor workload estimation during the planning phase produces the same effect upstream. Late acceptance testing, that is, the phase of client acceptance of deliverables, delays the entire final schedule, and the late penalties stipulated in the contract transform a delay of a few weeks into a complete loss.

3. The risk of margin deterioration

On a fixed-price project, an underestimated cost is entirely absorbed by the profit margin, since the selling price remains fixed. On a time-and-materials project, billed based on actual time spent, the same discrepancy manifests itself differently: the cost is billed, but the client disputes it, or the annual budget is exhausted before the scope is completed. The quality of deliverables falls into the same category: a rejected proposal is reworked at your expense.

4. Customer risk

Insufficient client involvement, with their contacts unavailable to validate each step. Governance conflicts among several decision-makers on their side. A change in priorities mid-project. These three situations cause delays without any decisions being made on your end.

5. Reputational risk

A mission that ends badly doesn't just cost you your profit margin. In a profession where references circulate, it weighs on subsequent opportunities with the same client and within their ecosystem.

One limitation to be aware of. This framework assumes that the mission has been priced. On a fixed-price mission sold without a detailed cost estimate, project risk management comes too late: the risk was taken at the time of signing, and monitoring will only document any deviations.

Risks can therefore be of various kinds. They can accumulate and create a snowball effect: a legal risk generates a temporal risk, which in turn triggers a financial risk. It is therefore essential to address a risk as soon as it arises.

The 5 steps of project risk management

Project risk management takes place in five stages: identify the risks, rate them according to their probability and impact, prioritize them by criticality, decide on a response for each one, then monitor their evolution in the steering committee until the project is closed.

Step 1. Identify the risks

Identifying involves pinpointing financial, human, technical and planning threats through dialogue with the team, brainstorming and feedback from past projects.

Identification relies on the collective and on the memory of past projects. A risk that no one has named will neither be rated nor monitored.

Risk management is a collective issue. It is not uncommon for this exercise to take the form of a brainstorming session, to generate ideas but also to involve the teams.

We encourage you to reach out to your colleagues, whether they are working directly on the project or others who have faced similar project situations.

Four sources provide useful information for this exercise:

1. The project team , in a brainstorming workshop, sees the technical challenges before anyone else.
2. The stakeholders , both on the client side and internally: management, subcontractors, end users.
3. Colleagues who have carried out comparable missions , whose experience avoids rediscovering known pitfalls.
4. The closing reports and risk registers of past projects. This is the most neglected source, and the only one that documents what actually happened rather than what was feared.

The result of this step has a name: risk mapping . It consists of listing potential threats from the start of the project, before any rating, in order to have a complete inventory rather than a list of risks that one remembers.

At this point, everyone's role becomes clear. The goal is to specify who is responsible for what to avoid any ambiguity. In a project, risk management is generally assigned to the project manager. The other stakeholders remain vigilant, whether it's the project sponsor, the steering committee , or the operational team.

💡 To discover how to carry out a reliable and complete risk analysis, follow our guide dedicated to risk analysis in project management .

Step 2. Rate the probability and the impact

Rating, or assessing risks, involves measuring the probability of occurrence and the impact of each event, then comparing the two on a rating scale, most often from 1 to 5.

Each identified risk is rated on two separate scales. Probability measures the chance of the event occurring, impact measures what it would cost if it did occur.

A scale of 1 to 5 is sufficient in most projects, provided that each level is named rather than leaving a bare number.

The impact isn't limited to the budget. It's measured along four axes that don't change together: deadlines , workload , costs incurred, and the quality of the deliverable. A risk can be significant in terms of workload but negligible in terms of deadlines.

Step 3. Prioritize by criticality

Prioritizing involves classifying risks in a criticality matrix, often read from green to red, to know where to act first.

The criticality of a risk is the product of its probability and its impact. It is used to rank action priorities, from most critical to least urgent. It provides a treatment order, not an absolute truth.

This prioritization is primarily used to decide what you won't address. A project that tracks forty risks isn't tracking any. Focus monitoring on the five to ten most critical risks, and leave the others in the log without a dedicated action plan.

Step 4. Decide on an answer

Treating involves choosing a response strategy – avoid, reduce, transfer, accept or escalate – and then appointing a person responsible for each risk identified.

Each priority risk receives a strategy and an appointed manager. Without a designated manager, the risk will not be monitored.

Define a precise action plan

Preparing solutions involves developing a detailed action plan. This plan must specify:

• who is responsible;
• what he is responsible for;
• how he will deal with the problem;
• When.

This plan unfolds in two distinct phases. Preventive actions aim to stop the risk from occurring. Corrective actions limit the damage if it does occur nonetheless. Both are prepared simultaneously.

Choose a strategy

Faced with a risk, five strategies are possible, and the choice depends on who can act on the cause.

The details of the first four strategies remain unchanged. Accepting means acknowledging the risk, recognizing its presence, and preparing solutions in advance. Mitigating involves defining an action plan that reduces the likelihood of occurrence and limits the impact. Transferring shifts responsibility to another team or service provider, without eliminating the risk. Avoiding seeks to remove the source of the risk, which isn't always possible: at your level, you won't have any impact on the emergence of a global pandemic.

Escalating the issue is not about shirking responsibility. A resource allocation decision between two tasks or a renegotiation of scope is beyond the project manager's decision-making authority. Escalating the issue places the decision where it can be made.

Mitigation plans. Each priority risk receives a concrete plan: reserve resources to absorb an absence, clear contract clauses on the scope and acceptance, a fallback milestone on the schedule.

The provision. Accepting a risk means assuming the cost if it occurs. This requires preparation: a reserve of time or budget, decided upon during the scoping phase and identified as such, avoids having to draw on the mission's margin for error when the unforeseen event occurs.

Step 5. Monitor risks in the steering committee

Monitoring involves regularly updating the risk register and reviewing progress in the steering committee throughout the project.

Monitoring involves updating the risk register throughout the project. If it's completed during the scoping phase and then forgotten until closing, it will have served only to tick a box.

The natural review point is the steering committee. At each meeting, three questions are sufficient: what risks have changed since the last time, which ones have been removed from the list, and which ones have been added.

This regular review distinguishes project risk management from a simple scoping document. It transforms a fixed list into an alert system.

Why a problem is often discovered too late

In service companies, project risk rarely manifests as an identifiable event. It appears as a margin that erodes silently, only becoming apparent at the end of the month, or sometimes the entire project. Three warning signs can help detect it beforehand.

The mechanism is simple. Sales figures are recorded with a delay of a few days. Actual consumption is consolidated at the end of the month. The gap between sales and output therefore appears once it has been established, when there is little left to adjust.

Three signals can be seen before this consolidation:

1. The rate at which resources are consumed , compared to the actual progress of the deliverable. Fifty days consumed out of a hundred does not mean that the mission is half done.
2. Requests outside the scope were accepted without an amendment. Each one taken individually seems negligible, but their cumulative effect is noticeable in the margin.
3. The actual availability of the profiles positioned over the coming weeks, rather than that which appeared in the workload plan at the time of the estimate.

This is the purpose of the alert threshold: to decide in advance at what point you want to be notified of the deviation, rather than discovering the deviation once it has been consolidated.

At PMP, a consulting firm with 250 employees operating in five countries, visibility into employee workload and project margins was limited. The spreadsheets, being too rigid, prevented access to up-to-date data, and budgetary risks were only detected after the fact, at closing time.

❝

Stafiz has allowed us to grow our teams more efficiently. The structure that Stafiz provides us with allows us to manage more and more projects while maintaining the expected level of reliability.

Frédéric Jover
Co-founding Partner

After deploying Stafiz, from opportunity assessment to invoicing, PMP's operational processes are managed through a single tool. Project managers are notified when their project budget becomes at risk and can take the necessary actions before it's too late.

Whether a fixed-price or time-and-materials contract involves different levels of risk. In a fixed-price project, the difference is reflected in the profit margin: the price is fixed, and each additional day is deducted from the final result. In a time-and-materials contract, the risk is reflected in the billable volume and the client relationship: the days are billed, but the budget is depleted faster than anticipated. The same risk triggers two different warning thresholds.

The tools: matrix, register and management software

Three tools support project risk management: the matrix, which visualizes criticality; the register, which documents monitoring; and the project management software, which links risks to actual project data. The first two are contained in a spreadsheet; the third becomes necessary when the number of tasks increases.

Use a risk matrix

The risk matrix combines the probability and impact of each risk to visualize its criticality. Also called a risk management plan, it serves as a reference throughout the project lifecycle.

Its construction, the qualitative and quantitative approaches and the models to be completed are detailed in our guide on how to carry out a risk analysis in project management .

Make a risk register

The risk register complements the matrix: it allows for the monitoring of risks.

It lists all the risks, whether they occurred and what the consequences were.

The register must be kept up to date as it serves as a reference throughout the project, and potentially on other projects. It provides a detailed overview of the risks and helps project managers in their decision-making.

A usable register has nine columns:

The owner column makes the difference. The other eight describe the risk; this one decides who takes care of it.

Choosing project risk management software

Project risk management is an essential step in project management. It establishes a proactive approach: you anticipate problems instead of reacting to them.

In a service company, this approach directly protects the profit margin on projects. A risk identified early is addressed through arbitration: postponing a milestone, strengthening a team, or initiating contractual discussions. A risk discovered late is no longer addressed; it is simply paid for.

The method consists of five steps and three tools. Identify, with the team and drawing on past project experience, the information is then rated on two named scales, prioritized to focus only on the essentials, a response is decided upon with a manager, and the register is reviewed at each steering committee meeting. The matrix visualizes, the register documents, and the project management software links everything to the actual mission data.

To learn more: discover how Stafiz illuminates the management of your missions , or request a demonstration to see risk monitoring applied to your own missions, without obligation, or explore our project monitoring guide if you are building your system from scratch.

The five steps fit into a spreadsheet as long as the number of tasks can be counted on one hand. Beyond that point, the log becomes outdated between committee meetings, the assessment becomes self-reported, and no one notices that a task has consumed three-quarters of its workload for only half its progress. This is where a project management tool changes the nature of the exercise: it doesn't store risks, it calculates them based on the project's actual data. Several project management tools offer this type of functionality.

Stafiz connects the resource planning The system combines mission progress and financial management in one place: planning a consultant's workload directly feeds into the mission forecast, since the system knows their daily rate. Forecast indicators flag deviations before they become entrenched, and alert thresholds are configurable on a project-by-project basis. This is what distinguishes a project management system from a traditional project management tool: the latter tracks task progress without knowing the cost to those performing them, and therefore cannot anticipate margin overruns.

See project management in Stafiz

Stafiz helps professional services gain visibility and better manage their resource planning and their project progress through real-time data, taking into account all costs and financial KPIs.

To learn more about the Stafiz platform, request a demo.

Request a demo