Study guide
8.4 Risk 5-Step Technique & Application
PRINCE2 Practitioner Version 7
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Exam Strategy & Open-Book Technique
2 PRINCE2 7 Method Overview
2.1 The PRINCE2 7 Method 2.2 What Changed in PRINCE2 7 2.3 Performance Targets, Tolerances & Project Context
3 PRINCE2 Principles (1–4)
3.1 Continued Business Justification 3.2 Learn from Experience 3.3 Defined Roles, Responsibilities & Relationships 3.4 Manage by Stages
4 PRINCE2 Principles (5–7) & Applying Principles
4.1 Manage by Exception 4.2 Focus on Products 4.3 Tailor to Suit the Project 4.4 Applying Principles in Context
5 People Management in Projects
5.1 Organisational & Project Ecosystems 5.2 Leadership in Projects 5.3 Team Culture & Diversity 5.4 Communication, Stakeholder Engagement & Change Management
6 Practices Overview & Business Case
6.1 The Seven Practices & Tailoring 6.2 Business Case: Desirability, Viability & Achievability 6.3 Business Case Lifecycle & Management Products 6.4 Business Case Application & Tailoring Scenarios
7 Practices: Organising & Plans
7.1 Organising: Roles & Accountability 7.2 Organising: 5-Step Ecosystem Technique 7.3 Plans: Three Levels & Product-Based Planning 7.4 Plans: Techniques, Tolerances & Tailoring
8 Practices: Quality & Risk
8.1 Quality: Planning, Control & Assurance 8.2 Quality Techniques & Management Products 8.3 Risk: Threats & Opportunities 8.4 Risk 5-Step Technique & Application
9 Practices: Issues
9.1 Issues Practice: Issue vs Change & Categories 9.2 Issues 5-Step Technique & Supporting Techniques 9.3 Change Control, Configuration & Priority/Effort Assessment
10 Practices: Progress, Sustainability & Application
10.1 Progress: Controls, Tolerances & Reports 10.2 Sustainability as the 7th Performance Target 10.3 Tailoring the Practices 10.4 Practices Application Scenarios (BL4)
11 Processes: Model, Starting, Directing & Initiating
11.1 The Seven Processes & Process Model 11.2 Starting Up a Project 11.3 Directing a Project 11.4 Initiating a Project
12 Processes: Controlling a Stage & Product Delivery
12.1 Controlling a Stage 12.2 Managing Product Delivery 12.3 Stage Control & Exception Scenarios (BL4) 12.4 Work Packages & Reporting Cycle
13 Processes: Stage Boundary, Closing & Tailoring
13.1 Managing a Stage Boundary 13.2 Closing a Project 13.3 Tailoring the Processes 13.4 Process Application Scenarios (BL4)
14 Tailoring, Management Products & Exam Technique
14.1 Tailoring to Project Environment, Scale & Agile 14.2 Management Products & the v7 Project Log 14.3 Final Exam Technique, Full Scenarios & Common Traps
8.4 Risk 5-Step Technique & Application
Key Takeaways Explain This Topic AI
The v7 risk technique is a five-step cycle: identify, assess, plan, implement, and communicate — communication is woven through the cycle, not a final stage.
Threat responses are avoid, reduce, transfer, accept, share, and prepare; opportunity responses are exploit, enhance, share, accept, and reject — the response sets differ and must not be conflated.
The Risk Owner is accountable for managing a specific risk; the Risk Actionee executes the agreed response — the roles may be combined but are conceptually distinct.
For small or low-risk projects, risk management is tailored down: a lighter Risk Management Approach, simpler assessment scales, and fewer formal responses, while keeping the five-step discipline.
Last updated: August 2026
The Five-Step Risk Technique
PRINCE2 v7 structures risk management as a five-step technique. The steps are not strictly linear — communication in particular runs through the whole cycle — but they provide a disciplined sequence for thinking about each risk.
Step 1 — Identify
Identify the risks worth managing, along with their causes, events, and effects . Techniques include risk workshops, checklists, prompt lists, brainstorming, lessons from previous projects, and review of the project's assumptions. The output is a populated Risk Register (or v7 Project Log) with each risk expressed as a cause-event-effect statement. Identification also surfaces the risk categories defined in the Risk Management Approach, ensuring the team does not fixate on one category (e.g. technical) and miss another (e.g. commercial).
Step 2 — Assess
Assess each identified risk in two stages. Estimate the probability, impact, and proximity — these are the raw numerical or qualitative judgements. Then evaluate the net effect on objectives, taking account of any correlations between risks (one risk may amplify or dampen another). The output is a prioritised view of risks, typically expressed through a probability-impact grid and a net effect summary, that informs which risks warrant planned responses and which can be monitored.
Step 3 — Plan
For each risk that exceeds the project's risk tolerance, select an appropriate risk response and assign a Risk Owner (and, where appropriate, a Risk Actionee ). Planning also includes estimating the cost of responses, updating the risk budget, and revising the project plan where responses change the schedule or scope. A risk with no planned response is accepted by default — but that acceptance should be explicit, not accidental.
Step 4 — Implement
Execute the agreed responses and monitor their effectiveness. Implementation is not a one-off action: risks evolve, proximity changes, new risks emerge, and responses sometimes fail. The Risk Owner tracks status and triggers escalation when a risk moves outside tolerance. Implementation feeds back into Steps 1 and 2 — re-identify and re-assess as the project changes.
Step 5 — Communicate
Communicate risk status to stakeholders throughout the cycle — not as a final report but as an ongoing stream. Communication includes risk reports to the Project Board at end-stage boundaries, highlight reports during stages, and ad-hoc escalation when a risk breaches tolerance. Communication is the step most often underdone in practice and one of the most frequently tested in scenarios.
Risk Responses: Threats vs Opportunities
The response sets for threats and opportunities are different . Conflating them is a high-frequency exam error. The table below sets out the full v7 response sets.
- Threat response What it does Opportunity response What it does
- Avoid Change the plan to remove the cause or event Exploit Change the plan to make the opportunity happen
- Reduce Reduce probability and/or impact Enhance Increase probability and/or impact
Transfer Shift the impact to a third party (e.g. insurance, fixed-price contract) Share Share the opportunity with a partner who can help realise it
Accept Take no action; tolerate the risk within tolerance Accept Take no action; tolerate the opportunity not being realised
Share Share the threat with a partner who can absorb part of it Reject Decide not to pursue the opportunity (e.g. out of scope)
Prepare Plan a contingency response to be triggered if the risk occurs — (opportunities do not have a direct 'prepare' equivalent)
A reliable mnemonic: threats are avoided, reduced, transferred, accepted, shared, or prepared for ; opportunities are exploited, enhanced, shared, accepted, or rejected . Note that share appears in both sets but with different intent — sharing a threat spreads a potential loss; sharing an opportunity spreads a potential gain.
A common scenario shape describes a situation and asks you to choose the best response. The key is to identify whether the scenario describes a threat or an opportunity first, then match the response verb to the action being taken. 'Taking out insurance' is transfer; 'choosing a different supplier to remove the risk' is avoid; 'adding a contingency fund in case the risk occurs' is prepare (a threat) — not accept, because a planned contingency is a form of preparation.
Risk Owner vs Risk Actionee
The Risk Owner is the person accountable for managing a specific risk — they decide on the response, monitor the risk, and report its status. The Risk Actionee is the person who executes the agreed response action on the owner's behalf. The two roles may be held by the same individual, but they are conceptually separate: ownership is about accountability, actionee-ship is about execution. A scenario that describes someone 'responsible for carrying out the agreed mitigation' is describing the Risk Actionee; a scenario that describes someone 'accountable for the risk and its overall management' is describing the Risk Owner.
Tailoring for Small Projects
Risk management must be proportionate. For a small or low-risk project, PRINCE2 expects the technique to be tailored down , not abandoned:
A lighter Risk Management Approach — perhaps a single page defining categories, tolerance, and reporting frequency.
Simpler assessment scales — e.g. high/medium/low rather than a five-point scale.
Fewer formal responses — many low-priority risks can simply be monitored.
Combined roles — the PM may act as Risk Owner for most risks.
The five-step discipline is retained — identify, assess, plan, implement, communicate — even if each step is lightweight.
A scenario that asks how to apply risk management to a small project is testing whether you understand that tailoring simplifies the mechanics while preserving the discipline . Dropping a step entirely is not tailoring — it is neglect.
Exam Scenario Patterns
Choosing the right response. Identify threat vs opportunity first, then match the response verb to the action. Watch for 'prepare' (a threat-only response involving a contingency plan) and 'reject' (an opportunity-only response involving a deliberate decision not to pursue).
Sequencing the five steps. A scenario describes an activity; map it to identify / assess / plan / implement / communicate. Remember that communicate runs throughout.
Risk Owner vs Risk Actionee. Look for the words 'accountable' (owner) versus 'carries out' or 'executes' (actionee).
Tailoring. A small-project scenario that asks for appropriate risk management expects a simplified but complete application of the five-step technique, not its removal.