Project risk management

E2 – Managing Performance · CIMA (CGMA Professional Qualification) · 6 min read · Updated: 4 Nov 2026

Welcome to Project Risk Management!

Hello there! Welcome to one of the most practical parts of the E2 syllabus. If you have ever planned a holiday only for it to rain, or organized a party where the DJ didn't show up, you have already experienced Project Risk. In business, projects are unique, one-off endeavors, which makes them naturally riskier than everyday routine operations. In this chapter, we will learn how to spot these risks early and handle them like a pro. Don't worry if this seems a bit technical at first—we’ll break it down into simple, logical steps!

1. What is Project Risk?

In the context of CIMA E2, Project Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective (measured by time, cost, scope, or quality). It is important to remember that risk isn't always bad! While we usually think of "threats" (downside risks), there are also "opportunities" (upside risks).

Analogy: Imagine you are building a garden shed. A threat might be a delay in wood delivery due to supply disruptions. An opportunity might be a sudden supplier discount that lowers your material costs.

Quick Review: Risk = Uncertainty. It can be a threat (negative impact) or an opportunity (positive impact).

2. Sources and Types of Project Risk

To manage project risks effectively, project managers must determine where risks come from (their sources) and classify them by category:

Internal Sources of Risk: Arise from within the project team or the parent organization:
• Technical / Operational Risks: Complex technology failing, software defects, poor system integration, or unforeseen design challenges.
• Resource & People Risks: Key team members leaving, skill shortages, interpersonal conflict, or inadequate training.
• Management & Governance Risks: Poor planning, unrealistic milestone deadlines, weak executive sponsorship, or ambiguous scope definitions leading to scope creep.
• Financial Risks: Inaccurate cost estimates, unexpected cash flow shortages, or budget cuts from senior management.

External Sources of Risk: Arise from outside the project's direct control:
• Commercial / Supplier Risks: Subcontractor bankruptcy, contractual disputes, vendor delivery delays, or raw material price volatility.
• Strategic / Market Risks: Competitor actions rendering the project deliverable obsolete before launch, or changes in customer preferences.
• Regulatory & Legal Risks: New health and safety laws, data privacy regulations, or changes in tax and import rules.
• Environmental & Political Risks: Extreme weather disruptions, geopolitical instability, or public relations pushback.

3. The Project Risk Management Process

Managing risk isn't a one-time job; it happens continuously throughout the entire project life cycle:

1. Risk Identification: Finding out what could go wrong (or right) using brainstorming, checklists, stakeholder interviews, and past project reviews.
2. Risk Assessment: Evaluating the likelihood and potential impact of each identified risk.
3. Risk Response: Deciding on appropriate response strategies (such as TARA).
4. Risk Monitoring and Control: Tracking active risks, maintaining the risk register, and evaluating new risks as the project evolves.

4. Assessing Risks: Probability and Impact

Once we have a comprehensive list of risks, we must prioritize them so resources are allocated effectively. We evaluate two dimensions:
1. Probability: How likely is it that the risk event will happen? (Low to High)
2. Impact: If it occurs, how significant is the effect on time, cost, or quality? (Low to High)

We plot these on a Probability-Impact Matrix (a qualitative risk assessment tool). This matrix highlights high-probability, high-impact risks that demand immediate active management, while low-probability, low-impact risks can simply be placed on a watch list.

5. Responding to Risks: The TARA Framework

When facing project threats, project managers use four established strategies, captured by the mnemonic TARA:

Transfer: Pass the financial or operational consequence of the risk to a third party.
Example: Purchasing insurance policies, including penalty clauses in vendor contracts, or hiring specialized subcontractors.

Avoid: Modify the project scope or methodology so the risk cannot occur.
Example: Choosing proven, off-the-shelf software rather than attempting custom in-house coding of a high-risk feature.

Reduce (Mitigate): Take proactive measures beforehand to lower the probability of occurrence, the impact, or both.
Example: Conducting iterative software testing, running pilot schemes, or providing extensive staff training.

Accept: Acknowledge the risk and decide not to take preemptive action, absorbing any consequences if it occurs.
Example: Accepting a minor fluctuation in office stationery prices where the cost of prevention outweighs the potential impact.

6. The Risk Register and Contingency Planning

The Risk Register is the central logbook where risk information is formally recorded and maintained across the project life cycle. A standard risk register details:
• A unique risk ID and description.
• The source/category of the risk.
• Probability and impact ratings.
• The selected response strategy (TARA).
• The Risk Owner (the named individual responsible for monitoring the risk and executing response actions).
• Residual risk level after mitigation.

Contingency Planning: Even with sound mitigation plans, unexpected issues arise. Project managers establish contingency buffers:
• Contingency Funds: Financial reserves set aside within the project budget for realized risks.
• Contingency Time (Float / Schedule Buffer): Extra time incorporated into schedules to absorb unexpected delays without compromising project completion dates.

7. Using Scenario Planning to Manage Project Risk

Scenario Planning is a forward-looking risk management technique used to explore multiple plausible futures under conditions of high uncertainty. Rather than assuming a single linear forecast, scenario planning helps the project team prepare for distinct operating environments:

• Constructing Scenarios: The team creates alternative narrative scenarios (such as best-case, worst-case, and most-likely case, or scenarios based on external geopolitical/economic shifts).
• Testing Project Resilience: The project plan and budget are stress-tested against each scenario to identify hidden vulnerabilities and critical dependencies.
• Early Warning Indicators: Trigger points and leading indicators are established to alert project managers when conditions are moving toward a specific scenario.
• Flexible Contingencies: Predetermined response plans are developed in advance, allowing the organization to pivot smoothly if adverse conditions materialize.

8. The Contribution of Project Management Software

Modern Project Management Software (e.g. tools supporting Gantt charts, network diagrams, and collaborative tracking) makes a vital contribution to project risk management and overall project success:

• Real-Time Visibility and Monitoring: Centralized dashboards provide real-time updates on milestones, task completion, and resource utilization, enabling early detection of schedule slippage.
• Critical Path and Dependency Tracking: Automated schedule recalculation highlights how a delay in a single task affects downstream activities and the overall critical path.
• Resource Allocation and Capacity Management: Software helps prevent resource bottlenecks, overallocation, and burnout by balancing workloads across team members.
• Integrated Risk Registers: Many applications link risk logs directly to specific work packages and milestones, ensuring risk owners receive automated alerts as trigger dates approach.
• Enhanced Team Communication and Governance: Shared digital workstreams and cloud-based documentation ensure all stakeholders, including virtual and hybrid teams, work with consistent, up-to-date project data.

Summary: Quick Review Box

• Sources of Risk: Internal (technical, resource, governance, financial) and External (commercial, strategic, regulatory, environmental).
• Probability vs. Impact: Evaluated using a qualitative matrix to prioritize risks.
• TARA Framework: Threat responses are Transfer, Avoid, Reduce, and Accept.
• Risk Register: The master document assigning a clear Risk Owner to every recorded risk.
• Scenario Planning: Stress-tests the project against multiple plausible future environments to build resilience.
• Project Management Software: Enhances overall project success through automated scheduling, critical path tracking, resource management, and real-time risk visibility.

References

Management Level Examination Blueprint 2026–2027 — AICPA & CIMA

Quick check

Can you answer these now?

Open each question to check the key ideas from this chapter.

What is the definition of project risk in the context of CIMA E2?

Project risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective such as time, cost, scope, or quality.

What is the distinction between internal and external sources of project risk?

Internal risks arise from within the project team or parent organization (e.g., technical, resource, governance, financial), whereas external risks originate outside the project's direct control (e.g., commercial, strategic, regulatory, environmental).

What are the four core steps in the project risk management process?

The four continuous steps are risk identification, risk assessment, risk response, and risk monitoring and control.

How does a Probability-Impact Matrix help prioritize project risks?

It evaluates risks along two dimensions—likelihood of occurrence and severity of impact—to identify high-priority risks that require immediate active management versus low-priority risks that need only routine monitoring.

What four response strategies comprise the TARA framework for managing project threats?

The four strategies are Transfer (pass consequences to a third party), Avoid (change plans so the risk cannot occur), Reduce (mitigate probability and/or impact), and Accept (absorb the consequences if they occur).

What is a Risk Register, and why is assigning a Risk Owner critical?

A Risk Register is the central document tracking all identified risks, their ratings, and responses, while a Risk Owner is the named individual held accountable for monitoring that specific risk and executing its response actions.

What role do contingency funds and contingency time play in managing project risk?

Contingency funds provide financial reserves within the budget to absorb unexpected costs, while contingency time (float or schedule buffer) provides excess duration to absorb delays without extending the final completion date.

How does scenario planning assist in managing project risk under high uncertainty?

Scenario planning develops multiple plausible narrative futures to stress-test project plans, identify vulnerabilities, and establish early warning indicators and predetermined response strategies.

In what ways does modern project management software support project risk management?

It provides real-time visibility through dashboards, recalculates the critical path automatically when tasks slip, manages resource capacity to prevent bottlenecks, and embeds risk registers with automated alerts.

Ready to test yourself?

Turn these notes into exam-style practice. Get unlimited AI questions on this topic with instant marking and explanations.

Practise This Topic

More E2 – Managing Performance chapters

* The content provided by thinka is generated by AI and may not always be accurate or up-to-date. Please use it as a supplementary resource and verify with official materials.

Put These Notes into Practice

Reading the notes is a great start. Now practise with unlimited AI-generated questions and get instant feedback. 100,000+ students are already improving their grades.

Start Practising Now View Pricing

Done reading? Test yourself with AI practice questions

Practise This Topic Now