Every project carries uncertainty that can help or hurt it. This principle is about working that uncertainty deliberately and continuously: identifying threats and opportunities, and choosing responses that are sized to the risk and aligned with the organization’s risk appetite.
Risk is not only negative. Teams seek to reduce exposure to threats — delay, overrun, failure, reputational harm — while pursuing opportunities such as time and cost savings, better performance, or advantage. A response is only as good as its execution, so each should be appropriate for the risk’s significance, cost-effective, realistic, agreed by relevant stakeholders, and owned by a named person.
Common misunderstanding. Risk management is not a register you fill in once. Risks emerge and change throughout the project, and a response no one owns is not really a response.