The Discipline of Delivery · companion to Chapter 8
Risk Management
Risk versus issue, the assumption you never wrote down, scoring, and the five responses to a threat.
Risk management mastery guide for software PMs
🛡️
What is risk management?
Proactive, not reactive — the PM's core discipline
Risk management is the structured process of identifying, analysing, and responding to threats (and opportunities) that could affect your project's scope, cost, timeline, or quality — before they become problems. A PM who manages risks proactively has fewer crises. A PM who waits for issues has a constant firefighting schedule.
Risk vs Issue
A risk is something that might happen. An issue is something that has already happened. Risk management prevents issues. Issue management fixes them. Most PMs only do issue management — that's the mistake.
Risk vs Assumption
An assumption is something you believe to be true without proof. Every assumption is a hidden risk. When you document assumptions, you convert hidden risks into visible ones you can manage.
Threat vs Opportunity
Risks are not always negative. A risk is any uncertain event with an impact. Opportunities (positive risks) should be actively exploited — e.g. a new API becoming available early that could accelerate delivery.
Residual vs Secondary
A residual risk is what remains after your response. A secondary risk is a new risk created by your response. Both must be tracked — treating one risk can inadvertently create another.
The 6-step risk management process
▦
Interactive risk heat map
Click a cell to see what score means and how to respond
Every risk is scored on two dimensions: Probability (how likely) × Impact (how bad if it happens). The product gives a Risk Score that determines priority. Click any cell.
Very low
Low
Medium
High
Very high
Probability →
Low (1–4)
Medium (5–9)
High (10–25)
Click any cell above to see the risk score, priority level, and recommended response strategy.
🔀
Risk response strategies
For threats AND opportunities — both need a strategy
For threats (negative risks)
For opportunities (positive risks)
Exploit
Remove uncertainty — make the opportunity definitely happen. Assign best resources to it.
Enhance
Increase probability or impact. Add resources to make the opportunity more likely.
Share
Partner with another party better positioned to capture the opportunity.
📑
Live risk register builder
Add risks — auto-scores and colour-codes them
🗂️
Risk categories for software projects
With real examples and early warning signs
0 / 7
correct
Running a project that is slipping? Book a 30-minute delivery review with Siva: we look at your plan, your numbers and the one thing to fix first.
Companion to Chapter 8 of The Discipline of Delivery by Siva Prasad. Read the chapter to understand why the discipline matters, then use this guide to practise the how.