management literature since the 1990s, e.g. in PMBoK, and became a significant part of project risk management in the years 2000s, when articles titled “opportunity management” also begin to appear in library searches. Opportunity management thus became an important part of risk management. Modern risk management theory deals with any type of external events, positive and negative. Positive risks are called opportunities. Similarly to risks, opportunities have specific mitigation strategies: exploit, share, enhance, ignore. In practice, risks are considered “usually negative”. Risk-related research and practice focus significantly more on threats than on opportunities. This can lead to negative phenomena such as target fixation Method For the most part, these methods consist of the following elements, performed, more or less, in the following order: Identify the threats Assess the vulnerability of critical assets to specific threats Determine the risk (i.e. the expected likelihood and consequences of specific types of attacks on specific assets) Identify ways to reduce those risks Prioritize risk reduction measures The Risk management knowledge area, as defined by the Project Management Body of Knowledge PMBoK, consists of the following processes: Plan Risk Management - defining how to conduct risk management activities. Identify Risks - identifying individual project risks as well as sources. Perform Qualitative Risk Analysis - prioritizing individual project risks by assessing probability and impact. Perform Quantitative Risk Analysis - numerical analysis of the effects. Plan Risk Responses - developing options, selecting strategies and actions. Implement Risk Responses - implementing agreed-upon risk response plans. In the 4th Ed. of PMBoK, this process was included as an activity in the Monitor and Control process, but was later separated as a distinct process in PMBoK 6th Ed. Monitor Risks - monitoring the implementation. This process was known as Monitor and Control in the previous PMBoK 4th Ed., when it also included the “Implement Risk Responses” process. Principles The International Organization for Standardization (ISO) identifies the following principles of risk management: Risk management should: Create value – resources expended to mitigate risk should be less than the consequence of inaction Be an integral part of organizational processes Be part of decision-making process Explicitly address uncertainty and assumptions Be a systematic and structured process Be based on the best available information Be tailorable Take human factors into account Be transparent and inclusive Be dynamic, iterative and responsive to change Be capable of continual improvement and enhancement Be continually or periodically re-assessed