The definition of risk is 'effect of uncertainty on objectives'. (ISO 31000:2009). In the project management context, risk is the effect of uncertainty on project objectives namely time, cost, quality and others.

Definition of risk management is the 'coordinated activities to direct and control an organisation with regard to risk' (ISO 31000:2009). Risk management includes the processes concerned with first identifying, analyzing and evaluating the risks presented by the acquisition and/or development of the product, secondly determining cost-effective treatments for those risks and thirdly implementing the risk plan, while continuously monitoring and reviewing the plan.

It works through a Risk Management Plan with a list of project risks identified in the Risk Register. Risks identified are analysed and prioritized for appropriate risk treatments. Risk Owners are authorized to manage those risks and the risks are continuously monitored and reviewed at various project phases.