Self-assessment: project risk management

1. The project's objectives, success criteria and principal assumptions are clearly defined.

2. Approved criteria state which risks the project may accept and which must be escalated.

3. The steering committee treats major risks as decision items rather than information only.

4. The risk picture influences scope, schedule, procurement and priorities.

5. Risk management is proportionate to the project's complexity, value and consequences.

6. Every material risk has a named risk owner with sufficient authority.

7. Risk ownership and responsibility for completing the action are separated where appropriate.

8. The project manager, sponsor and steering committee understand their roles in risk management.

9. Risks involving operations, suppliers and other projects have clear owners.

10. A working, time-bound escalation route exists when project authority is insufficient.

11. Risks are expressed through a clear cause, possible event and concrete consequence.

12. Risk identification is repeated regularly and at major decisions or changes.

13. Risks, issues, assumptions and decisions are distinguished but can be followed together.

14. Scope changes are assessed for their effect on risk, cost, time and benefits.

15. Experience from realised risks and earlier projects is used to improve the method.

16. The project maintains one shared, current and traceable source of risk information.

17. Risk assessments are supported by relevant evidence and documented assumptions.

18. Early indicators are used where risk development can be detected before impact.

19. Reporting shows changes in exposure rather than only current risk scores.

20. Sensitive risk information has appropriate access controls without obstructing decisions.

21. Likely cost and schedule exposure is assessed for the most material risks.

22. Contingency and margins reflect the project's actual uncertainty and can be explained.

23. Risk actions are prioritised by expected reduction, cost and deliverability.

24. Residual exposure after action is reported and accepted at the appropriate level.

25. Benefits and operational outcomes are included in risk assessment, not merely delivery.

26. Approved risk actions have resources, an owner and a realistic deadline.

27. Risk actions are followed until their effectiveness has been verified.

28. New risks and unintended effects are assessed when major actions are implemented.

29. The project environment enables uncertainty and bad news to be reported early.

30. The project can reprioritise quickly when the risk picture changes materially.