During a project's initial planning session, the project team identifies a possible risk. The team is under the impression that a critical vendor might delay delivery. This could impact both the project schedule and budget. The team shares insights on the risk's likelihood and impact with the risk manager. What should the risk manager do?

The scenario describes the point in the risk management process where a risk has been identified and initial thoughts on its characteristics have been gathered. The immediate and logical next step, according to the PMI framework, is to conduct a formal analysis. The Perform Qualitative Risk Analysis process uses tools like the probability-impact matrix to assess the likelihood and potential effect of identified risks. This assessment generates a risk score, which is then used to prioritize risks, ensuring that high-priority threats are addressed first. This systematic approach is crucial for focusing resources on the most significant risks to the project's objectives.

A. Ignoring a known external risk is a direct violation of the principle of comprehensive risk management, which requires addressing all significant threats.
B. Allocating contingency funds is a risk response that should only be planned after a risk has been properly analyzed and prioritized.
C. Waiting indefinitely is a passive approach that introduces delay and uncertainty, undermining the proactive nature of effective risk management.

1. Project Management Institute. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Newtown Square, PA: Project Management Institute. Section 11.3, Perform Qualitative Risk Analysis, states, "The key benefit of this process is that it focuses efforts on high-priority risks." Subsection 11.3.2.2, Probability and Impact Matrix, details this tool as a grid for mapping the probability and impact of each risk to determine its priority.

2. Project Management Institute. (2019). The Standard for Risk Management in Portfolios, Programs, and Projects. Newtown Square, PA: Project Management Institute. Chapter 5, Section 5.4, Perform Qualitative Risk Analysis, describes this process as the method for "prioritizing identified individual project risks for further analysis or action by assessing their probability of occurrence and impact as well as other characteristics."

3. Hillson, D. (2002). The Risk Breakdown Structure (RBS) as an Aid to Effective Risk Management. Project Management Journal, 33(4), 38–50. This article, while focused on the RBS, reinforces the PMI process where risk identification is followed by a structured analysis (qualitative and/or quantitative) to understand and prioritize risks before developing responses. The use of probability and impact is fundamental to this analysis step. DOI: https://doi.org/10.1177/875697280203300405