PRINCE2 - Risk

The purpose of the risk theme is to identify, assess and control uncertainty and, as a result, improve the ability of the project to succeed. All projects encounter uncertainty when trying to achieve their objectives. This uncertainty may arise from events inside or outside the organization. For example, there may be uncertainty about the ability of the organization to agree the scope of the project within certain timescales or the availability of critical resources. There might also be uncertainty about the final scope and shape of legislation with which a project is required to ensure compliance.

Risks can have either a negative or positive impact on objectives if they occur. PRINCE2 uses the terms:

• Threat For uncertain events that would have a negative impact on objectives.
• Opportunity For uncertain events that would have a positive impact on objectives.

These can impact the project's objectives of delivering an agreed scope and benefits to an agreed time, cost and quality. Given that all projects involve some degree of risk-taking, it follows that projects need to manage risk, and they need to do so in a way that supports effective decision-making. This provides a disciplined environment for proactive decision-making.

For risk management to be effective:

• risks that might affect the project achieving its objectives need to be identified, captured and described
• each risk needs to be assessed to understand its probability, impact and timing (proximity) so that it can be prioritized. The overall risk exposure needs to be kept under review, together with the impact of risk on the overall business justification for the project
• responses to each risk need to be planned, and assigned to people to action and to own 
• risk responses need to be implemented, monitored and controlled.