Last Updated: June 18, 2026
Activity 9: Evaluate Risk
In the Project MAP (Model, Activities & Phases) framework, Activity 9 is called Evaluate Risk. This step is about identifying, understanding, and managing the uncertainties that may affect a project's success. Before moving from planning to execution, experienced project managers identify potential threats and opportunities, determine which uncertainties require attention, and develop strategies to reduce their likelihood or impact.
Students in this MS Project Master Class do not go through this Activity in detail, but it is still important to understand why it matters. Every Microsoft Project plan is based on assumptions and has some uncertainty. By evaluating risks, project managers can make better estimates, verify schedule logic, develop contingency plans, communicate more clearly with stakeholders, and build a realistic, achievable project plan. Good risk management throughout the project supports better decisions and makes it more likely the project will finish on time, stay within budget, and meet stakeholder expectations.
New to the MS Project Master Class?
If you found this page through a search engine or external link, use the Start Here button below to learn about the Free and Complete MS Project Master Classes, the Learning Portal, Project MAP framework, Activity Workspaces, exercises, and the Master Project.
Figure 9.1: Evaluate Risk Activity in the Project MAP structured framework for building a Master Project in Microsoft Project.
The risk evaluation methods and best practices shared in this Activity come from over 35 years of experience teaching Microsoft Project, training consultants, deploying Project Server, and helping professionals around the world.
Plan Project Communication < Evaluate Risk > Acquire Project Team
Risk management comes at the end of the planning process in the Project MAP framework. At this stage, the project manager has already defined the work, created estimates, set up the schedule, and planned communications. The key question now is whether the project is ready to move forward.
This Activity, called Evaluate Risk, helps answer this question.
The goal of this Activity is to identify the uncertainties that could affect the project's success and determine how to address them. Project managers consider both how likely an event is to occur and how much it could affect the schedule, cost, scope, quality, resources, or stakeholders' expectations. They then focus on the most important risks and develop ways to reduce their likelihood or impact.
Risk Register
A Risk Register is one of the most important tools for managing project uncertainty. Rather than serving as a simple list of potential problems, it provides a structured process for documenting, monitoring, and responding to risks throughout the project life cycle.
Every risk should have an owner responsible for monitoring the risk, coordinating response activities, and reporting changes. Assigning ownership helps ensure accountability and prevents important risks from being overlooked.
Each risk should also include an estimate of its probability of occurring and its potential impact on project objectives such as scope, schedule, cost, quality, or stakeholder satisfaction. Together, these values help project managers prioritize risks and focus attention on those requiring the greatest management effort.
The Risk Register should document the planned response for each significant risk, whether the strategy is to avoid, mitigate, transfer, accept, or exploit the risk. It should also identify the trigger or warning sign that indicates when the response plan should be implemented.
Finally, the register should record the current status of each risk, such as Open, Monitoring, Mitigated, Closed, or Occurred. Risk Registers should not be created once and forgotten. They should be reviewed regularly during status meetings, milestone reviews, and major project changes to ensure new risks are identified, existing risks are reassessed, and completed response actions are documented.
A well-maintained Risk Register helps project managers communicate uncertainty, prioritize management attention, and make better decisions throughout the project.
Methods
There are several common risk management methods, such as qualitative risk analysis, SWOT (Strengths, Weaknesses, Opportunities, and Threats) analysis, contingency planning, and quantitative tools like PERT estimating and Monte Carlo simulation. These approaches help project managers understand uncertainty before the project starts.
Monte Carlo simulation is a popular method for quantitative risk analysis. Instead of giving just one completion date or project cost, it runs the project schedule thousands of times, varying task durations, costs, and risk assumptions. This produces a range of possible outcomes, so project managers can see the likelihood of meeting key milestones rather than relying on a single estimate.
The results are shown as confidence rather than as a certainty. For example, a simulation might show a 50 percent chance (P50) of finishing the project by one date and an 80 percent chance (P80) of finishing by a later date. This helps project managers set realistic schedules, plan for contingencies, explain uncertainty to stakeholders, and make better decisions.
Microsoft Project does not have a Monte Carlo simulation built in. For projects that need this kind of analysis, I use Barbecana's Full Monte add-in. Full Monte works directly with Microsoft Project and provides detailed schedule risk analysis without changing your existing project plan.
Microsoft Project Risk Management
Microsoft Project is a top project scheduling tool, but it lacks built-in features for qualitative or quantitative risk management. It does not include a Risk Register, probability-impact matrix, or Monte Carlo simulation. Instead, it is meant to show the results of risk management within the project schedule.
Project managers often use different features in Microsoft Project to track and manage risks. Custom fields let you record things like risk scores, probability, impact, priority, or mitigation status. You can use the Notes field to add details about risks, assumptions, actions, and contingency plans to each task. Hyperlinks can connect tasks to documents such as Risk Registers, issue logs, engineering reports, or compliance files stored outside the project.
Many organizations set up custom views, tables, filters, and reports to highlight high-risk tasks, contingency plans, schedule reserves, or other important details. These custom displays help project managers share risk information with stakeholders without changing the main project schedule.
If your organization needs more advanced analysis, Microsoft Project can work with third-party risk management tools. These tools can perform tasks such as qualitative risk assessments, Monte Carlo simulations, and probabilistic schedule analysis, all using your Microsoft Project schedule as a basis.
The main goal of risk management is not just to create a Risk Register; it is to build a better project plan. Once risks are found and assessed, project managers often update task estimates, change dependencies, add contingency reserves, adjust resources, or update communication plans. These changes show up in the Microsoft Project schedule, making the plan more realistic and achievable.
Enterprise Risk Management (ERM)
Project risk management is usually part of a bigger process called Enterprise Risk Management (ERM). Project risk management focuses on uncertainties within a single project, while ERM provides a way to identify, assess, and manage risks across the entire organization.
Many large companies connect their project Risk Registers with company-wide risk management systems. This helps leaders consistently track strategic, financial, operational, regulatory, cybersecurity, and project risks. When project managers see how their project risks fit into the organization’s overall risk strategy, they can make decisions that support the company’s goals and follow governance rules.
Why Evaluating Risk Matters
Every project has some uncertainty. New technology might not work as planned. Important resources could become unavailable. Requirements might change. Vendors could miss delivery dates. Stakeholders might ask for more features. Some risks can slow down a project, while others can lead to improvements.
Experienced project managers pay attention to these uncertainties. They spot them early, assess their importance, and plan how to handle them before the project starts.
A key idea in this Activity Workspace is that risk management improves the project. Rather than simply documenting risks in a Risk Register, the focus is on using risk evaluation to improve the project plan. Better estimates, more realistic schedules, clearer communication, contingency plans, and informed decisions all help the project succeed.
Even if you do not do a formal risk analysis for your Master Project, knowing these ideas will help you see why experienced project managers keep checking their assumptions, looking for uncertainty, and updating their plans as they go.
Next Activity: Acquire Project Team
Now that the Planning phase is finished, the Project MAP framework moves from planning to actually carrying out the project.
The next activity, Acquire Project Team, starts the Executing phase by assigning the people who will do the work listed in the project schedule. In Microsoft Project, this means creating resource details, assigning resources to tasks, and getting the project ready for resource analysis and workload management.
Resource planning usually starts during project planning, but bringing the project team on board is a key step. The project now shifts from deciding what will be done and how to figuring out who will do the work.
By the end of the next activity, your Master Project will begin to transition from a well-planned schedule to a project that can be staffed, analyzed, and managed throughout its life cycle.
Evaluate Risk FAQs
What is project risk?
Project risk refers to an uncertain event that could affect your project’s goals, such as scope, schedule, cost, quality, or stakeholder satisfaction (Project Management Institute [PMI], 2021). While many see risks as problems, they can also create opportunities to improve how a project performs.
All projects have some uncertainty. Requirements might change, important resources could be unavailable, vendors might miss deadlines, or new technology might not work as planned. On the other hand, good things can happen too, like finishing early, saving money, or delivering more value than expected.
Good project managers spot these uncertainties early, assess their importance, and decide how to handle them before the project starts. Knowing about project risks helps make schedules more realistic, improves estimates, and leads to better decisions.
Why is risk evaluation important in project management?
Risk evaluation helps project managers identify and manage uncertainty before it becomes a problem. Instead of waiting for issues, experienced managers assess potential risks, estimate their likelihood and potential impact on the project, and decide where to focus their attention.
A key idea in the MS Project Master Classis that managing risks improves projects. Looking at risks often leads to better estimates, stronger schedules, clearer communication plans, smarter use of resources, and solid backup plans.
Not every risk needs action. Risk evaluation helps distinguish between small uncertainties and those that could significantly affect the project. By focusing time and resources on the most important risks, project managers are more likely to finish on time, stay on budget, and meet stakeholder expectations.
Does Microsoft Project include risk management features?
The latest versions of Microsoft Project do not have built-in tools for qualitative or quantitative risk management. Older desktop versions had PERT Analysis, but this feature is no longer included.
Even though Microsoft Project is not made just for risk management, it can still help with the process. Project managers can use custom fields, notes, links, attached documents, custom views, and reports to connect risks, mitigation plans, contingency plans, and other documents to project tasks.
Many organizations also use specialized third-party tools that integrate with Microsoft Project to perform advanced analyses, such as Monte Carlo simulations and probabilistic scheduling.
The results of risk management should show up in the Microsoft Project schedule through updated estimates, schedule changes, added contingency reserves, and improved project planning.
What is qualitative risk analysis?
Qualitative risk analysis involves assessing each risk to determine its likelihood and potential impact on the project’s goals. This helps decide which risks need management’s attention.
Instead of relying on statistics, qualitative methods rely on professional judgment, expert opinions, past experience, and structured methods for ranking risks. Many organizations use a Probability-Impact Matrix or a risk-scoring system to compare risks consistently.
Qualitative analysis is usually done early in project planning and forms the basis for creating mitigation and contingency plans. It helps project managers focus their limited resources on the risks most likely to impact the project’s success.
What is quantitative risk analysis?
Quantitative risk analysis uses numerical data and statistics to estimate how uncertainty could affect project outcomes.
Unlike qualitative analysis, which ranks risks, quantitative analysis tries to answer questions like:
What is the probability of completing the project by a specific date?
What is the probability of staying within budget?
Which project activities contribute the greatest uncertainty?
Common techniques include PERT estimating, decision tree analysis, sensitivity analysis, and Monte Carlo simulation. Monte Carlo simulation, for example, models thousands of possible project outcomes.
Quantitative analysis is usually used for bigger or more complex projects, but knowing these techniques helps project managers set realistic expectations and make better plans.
What is a Risk Register?
A Risk Register is a document that helps record, organize, and track project risks throughout the project’s life.
A typical Risk Register includes:
A description of each risk.
The cause of the risk.
The probability that the risk will occur.
The potential impact on the project.
A relative risk score.
Planned Management Actions.
Planned Contingent Actions.
Assigned responsibility.
Current status.
The Risk Register serves as a primary reference for project managers and stakeholders, ensuring important risks are tracked and managed as the project progresses.
What is SWOT analysis in project management?
SWOT stands for Strengths, Weaknesses, Opportunities, and Threats.
Unlike traditional risk analysis, which mainly focuses on potential problems, SWOT offers a broader view by examining both the project’s internal strengths and weaknesses and its external environment.
Strengths identify internal advantages.
Weaknesses identify internal limitations.
Opportunities identify favorable external conditions.
Threats identify external risks that may affect project success.
Many organizations do a SWOT analysis early in project planning. It helps the team think strategically about both opportunities and risks before making detailed schedules and plans.
What is risk mitigation?
Risk mitigation means creating and using strategies to lower the chance that a risk will happen or to lessen its impact if it does.
Examples of mitigation include:
Revising the project schedule.
Assigning additional resources.
Improving communications.
Conducting additional testing.
Providing training.
Changing technical approaches.
The goal of mitigation is not to remove every risk. Instead, project managers work to reduce the uncertainty of the risks most likely to affect the project’s success.
What is contingency planning?
Contingency planning prepares the project team to respond if a known risk materializes, even after attempts to prevent it.
Unlike mitigation, which seeks to prevent a risk, contingency planning aims to reduce its impact after the risk has occurred.
A contingency plan typically identifies:
The event that triggers the response.
The actions that should be taken.
The individuals responsible.
Required resources.
Expected outcomes.
Making contingency plans before the project starts helps teams respond quickly, consistently, and effectively when something unexpected happens.
What is the difference between a Management Action and a Contingent Action?
In the MS Project Master Class, there is a clear difference between Management Actions and Contingent Actions.
A Management Action is a step taken in advance to reduce or eliminate the likelihood that a risk will occur. These actions aim to improve the project before it starts by dealing with the main causes of uncertainty.
A Contingent Action is a planned response to use if the risk occurs, even after trying to prevent it. These actions help reduce the impact and help the project recover faster.
In simple terms:
Management Actions attempt to prevent the risk.
Contingent Actions prepare the project team to respond if prevention is unsuccessful.
Using both approaches strengthens the project and increases the chances of achieving its goals.
What is a Probability-Impact Matrix?
A Probability-Impact Matrix helps project managers look at and rank project risks during qualitative risk analysis. For each risk, they consider how likely it is to occur and how much it could affect the project's goals if it does occur.
The matrix makes it easier to tell which risks need more attention and which ones are less important. Many organizations use numbers or colors like green, yellow, and red to show risk levels clearly.
What is residual risk?
Residual risk is the risk that remains after taking steps to manage or reduce it. Even when you reduce the likelihood or impact of a risk, some uncertainty often remains.
Project managers need to track residual risks throughout the project to determine whether further action is needed or contingency plans should be developed.
What is risk appetite?
Risk appetite is how much and what kind of risk an organization is willing to take as it works toward its goals.
Organizations with a high risk appetite are open to more uncertainty if it means bigger rewards or new ideas. Those with a low risk appetite prefer predictability and seek to reduce uncertainty before taking action.
Knowing the organization's risk appetite helps project managers make choices that align with what leaders expect and the company culture.
What is risk tolerance?
Risk tolerance sets the amount of change in project goals that is okay before managers need to step in. While risk appetite indicates how much uncertainty the organization can handle overall, risk tolerance sets clear limits on factors such as schedule, cost, scope, quality, and performance.
For example, a company might allow a project to finish one week late, but if it looks like it will be more than a month late, managers would need to approve it.
What is project uncertainty?
Project uncertainty is anything that makes it hard to know exactly how a project will turn out. This can stem from unclear requirements, shifting expectations, new technology, resource constraints, market changes, or other unknowns.
Risk management seeks to identify and understand uncertainty before it causes problems. This helps managers make better estimates, develop contingency plans, and keep the project on track.
What is a risk trigger?
A warning sign or event that indicates a particular risk is becoming more likely or has already occurred. Identifying triggers helps project managers recognize problems early and implement planned response actions before the impact becomes more severe.
Some examples include missed milestones, late vendor deliveries, insufficient staff, going over budget, or changes in the project's needs.
What is risk response planning?
Risk response planning means determining how the team will handle the risks they identify. Common ways to respond include avoiding the risk, reducing its likelihood or impact, transferring it to someone else, accepting it, or taking advantage of opportunities to help the project.
Good response planning ensures major risks are addressed before they become problems for the project.
What is schedule contingency?
Schedule contingency is extra time added to a project plan to cover known risks and uncertainties. Instead of expecting everything to go perfectly, project managers build in this time to help ensure they meet key deadlines and finish on time.
This extra time should be based on risk analysis, not just a random guess, and should be adjusted as the project progresses and as things change.
What is cost contingency?
Cost contingency is money set aside to cover known risks that could increase project costs. These reserves allow organizations to handle unexpected costs without immediately exceeding the approved budget.
Just like schedule contingency, cost contingency should be based on risk analysis and reviewed regularly as risks change or are addressed during the project.
Suggestions and Corrections
Please help us make this MS Project Master Class Book and the Master Class Learning Portal better. Click on the Comments button below to send us suggestions and corrections.