Risk is about uncertainty
A risk is an uncertain event or condition that may affect objectives. Once it happens, the situation becomes an issue. Keeping that distinction clear helps the team decide whether it should prepare, respond or resolve.
Useful risk responses
| Question | Practical answer |
|---|---|
| Threat — avoid | Change the plan to remove the threat. |
| Threat — mitigate | Reduce probability or impact. |
| Threat — transfer | Shift ownership of the impact through an appropriate arrangement. |
| Opportunity — exploit | Act to make the opportunity happen. |
| Accept | Acknowledge the uncertainty and act if it occurs, with appropriate monitoring or contingency. |
Assumptions deserve attention
An assumption that becomes false can create a new risk or issue. Review important assumptions as the project progresses.
Change control
Change is normal. The professional response is not “never change” but “make the impact visible before committing.” Consider scope, schedule, cost, resources, quality, risk, dependencies and benefits.
RAID thinking
A RAID log can bring Risks, Assumptions, Issues and Dependencies into one working view. The useful fields are owner, date, impact, response and current status.
Make the risk register operational
A risk register becomes useful when every high-priority risk has a concrete response. “Integration may be delayed” is only the beginning. Identify the trigger, owner, mitigation, contingency and date for review.
Risk and issue need different responses
Risk: a payment provider may delay production approval. Mitigation: validate the integration early. Contingency: keep an approved alternative route available.
Issue: the production approval is already late. Now the PM is coordinating recovery, stakeholder communication and a decision about the launch sequence.
Change control is about consequences
The goal is not to make change difficult. It is to stop change from becoming invisible. Ask what requirement changes, which estimates change, what testing changes, which stakeholders are affected, and who has authority to approve the new baseline.
Create five risks for a Shopify migration and add one trigger, one mitigation and one contingency action to each. Then introduce a new payment requirement and trace the impact.