Project Scope and Risk Management: Lesson, Examples and Practice

1Learning goal: what you will be able to do

Most projects that fail do not fail because the work was hard. They fail because nobody agreed what the work was, or nobody planned for what might go wrong. By the end of this lesson you will be able to write down what a project includes and excludes, and to find, rank and price the risks that threaten it.

Time55 to 60 minutes

You needPen, paper and a calculator

AssumedPercentages and basic multiplication. No project experience needed

Learning outcomes

FoundationDefine a project, its scope and a deliverable, and tell scope that is agreed from scope that has crept in.
CoreWrite a scope statement with objectives, deliverables, exclusions and acceptance criteria, and break a project into a work breakdown structure.
CoreIdentify risks, score them on a probability and impact matrix, and calculate expected monetary value (EMV) to size a contingency reserve.
ExtensionChoose between risk responses by comparing expected costs, and judge when an expected-value figure is not enough.

Where this lesson fits

This is the first lesson of Module 2 in Project Management Essentials. Scope and risk are the two planning tasks that every later task depends on: schedules, budgets and team plans are only as good as the scope and risk thinking behind them. The other lessons shown are planned and are not yet published.

Module 1, What a project is and how it is organisedPlanned
Module 2, Lesson 1: Defining project scope and managing riskThis lesson
Module 2, Lesson 2: Scheduling and the critical pathOpen
Module 3, Budgeting and tracking costPlanned
Module 4, Leading the team and reporting progressPlanned

Where this topic appears in practice

The ideas here are shared by the major project management frameworks, including the PMI Guide to the Project Management Body of Knowledge (PMBOK Guide), PRINCE2, and the ISO standards on project management (ISO 21502) and risk management (ISO 31000). They also appear in preparation for professional certifications. The frameworks use slightly different vocabulary, for example "work breakdown structure" and "product breakdown structure", so use the terms your own organisation or syllabus uses. This lesson is general education, supports and does not replace a certification course, and does not award any certificate.

2A familiar example: a surprise birthday party

You are organising a surprise party for 30 friends. The brief from the family is "make it a great night". You have a budget of $600. Before you book anything, two questions: what exactly are you promising to deliver, and what could go wrong?

Scope first. "A great night" means different things to different people. One relative expects a sit-down dinner, another expects a band, a third assumes the party includes transport for elderly guests. If nobody writes it down, you will spend the budget on the loudest request. A one-paragraph agreement fixes this: a two-hour buffet party at the community hall for 30 guests, with music from a playlist, a cake and decorations. Not included: live music, a sit-down meal, transport. The exclusions matter as much as the inclusions.

Risk second. Two things could go wrong. The caterer might cancel late, a 30% chance, and replacing them would cost you about $200 extra. Or the hall might flood, a 5% chance, and a replacement venue would cost $1,000.

Predict first: which risk deserves more of your reserve money?

The second is far more expensive, but far less likely. Estimate which one costs you more on average before you open this.

The caterer risk, by a small margin. Multiply chance by cost: 30% × $200 = $60, while 5% × $1,000 = $50. That product is the expected monetary value. The flood is rarer, but it is the one that could wreck the night, so a good planner also thinks about whether the hall has a cheap cancellation policy or a backup. Numbers help you rank risks; they do not replace judgement.

You have just done the two jobs of this lesson. You defined the boundary of the work, which is scope management, and you priced uncertain events, which is risk management. Professional projects use the same two steps with more rigour. Try the risk register below, which is the real-world version of your party sums.

Try it: the risk register

This register is for a $200,000 project to launch a customer portal. Change a probability or an impact and watch the EMV and the totals update. Use a negative impact for an opportunity, such as a possible saving. Add your own risks.

Project budget ($)

Risk	Probability %	Impact $	EMV

3Clear explanation

Projects, deliverables and scope

A project is a temporary effort that creates a unique product, service or result. It has a start, an end and a goal, which separates it from operations, the repeating work that keeps a business running. A deliverable is anything the project must hand over, such as a working website, a report or a trained team. Scope is the total of the work needed to produce those deliverables. Two flavours are worth separating: product scope (the features and qualities of what you build) and project scope (the work needed to deliver it, including planning, testing and handover).

Scope sits in a three-way trade-off with time and cost, and with quality as the thing you protect. Change one and at least one of the others usually moves. A project manager who agrees to add features without moving the deadline or the budget has not found a free lunch; they have quietly moved the cost into risk.

Writing a scope statement

A scope statement is a short, agreed document that answers these questions:

Objective. What business result is the project for? Make it specific and measurable.
Deliverables. What exactly will be produced?
Acceptance criteria. How will the client decide that a deliverable is done? Without these, "done" is an opinion.
Exclusions. What is deliberately not included? Writing these down prevents the most common arguments.
Assumptions and constraints. What are you taking for granted (for example, the client supplies the content by a stated date), and what limits apply (budget, deadline, law)?

The work breakdown structure

A work breakdown structure (WBS) divides the total scope into smaller and smaller pieces until each piece can be estimated, assigned and tracked. The lowest level pieces are work packages. The key test is the 100% rule: the pieces at each level must add up to exactly 100% of the level above. Nothing may be missing, and nothing may appear twice. A WBS describes what to deliver, not the order or the calendar, which come later.

Scope creep and change control

Scope creep is the gradual addition of work with no matching change to time, budget or approval. It is rarely one big request; it is twenty small, friendly ones. The defence is a change control process: any request outside the agreed scope is written down as a change request, its effect on cost, time and risk is assessed, and the sponsor approves or rejects it. Saying "yes, and here is what it costs" is professional. Saying "yes" with no assessment is how projects drift.

What is a risk?

A risk is an uncertain event that, if it happens, affects a project objective. It is described by cause, event and effect: "Because the supplier relies on one factory, it may deliver late, which would delay testing." Risks that harm the project are threats. Risks that help it are opportunities. A risk is not the same as an issue: an issue has already happened and needs action now, whereas a risk may never happen.

Assessing a risk: the probability and impact matrix

Rate each risk for probability and impact on a 1 to 5 scale and multiply. A score of 1 to 4 is usually low, 5 to 12 medium and 15 to 25 high, although organisations set their own bands. Try the matrix below.

Probability (rows)

Impact (columns)

Rows are probability from 5 (top) to 1. Columns are impact from 1 to 5. Colours show the band: green low, amber medium, red high.

Pricing a risk: expected monetary value

EMV = probability × impact

The expected monetary value is the average cost if the project could be run many times. Add the EMVs of all risks to size a contingency reserve, the budget held for known risks. Many organisations also hold a separate management reserve for unknown unknowns, which only the sponsor releases. Because an EMV is an average, it can hide danger: a 1% chance of a $1,000,000 loss has an EMV of only $10,000, yet nobody wants to meet it unprepared.

Responding to a risk

Strategy	For threats	For opportunities	Example
Avoid / Exploit	Change the plan so the threat cannot happen	Make sure the opportunity happens	Drop an unproven technology / assign your best people to win the discount
Mitigate / Enhance	Reduce probability or impact	Increase probability or impact	Add a second supplier / pay early to secure the discount
Transfer / Share	Move the impact to a third party	Partner so the benefit is shared	Buy insurance or a fixed-price contract / form a joint venture
Accept	Do nothing now; hold a reserve or a fallback plan	Take the benefit if it comes	Keep contingency for a minor delay

The risk register

The risk register is the living table that holds all of this: an ID, the risk in cause-event-effect form, probability, impact, score, owner, planned response, a trigger that tells you the risk is about to happen, and status. Review it at every team meeting, because risks change.

Common mistakes

Mistake	Why it hurts	Fix
No exclusions in the scope statement	Every unstated item becomes a possible argument	List what is out of scope
"Done" is not defined	The client keeps asking for polish	Write acceptance criteria that can be checked
Accepting small requests informally	Twenty small additions become a late, over-budget project	Log every change and assess it
Calling an issue a risk	An event that has happened will not be acted on	Ask: has it already happened?
Risks with no owner	Nobody monitors or responds	Name one owner per risk
Trusting EMV alone	Rare but severe events look small	Also review high-impact risks one by one

4Worked examples

The examples follow one project: a $200,000, 100-day effort to launch a customer portal where customers can sign in, view invoices and download PDF statements. Read each with a pencil in hand, and try the first step before you read on.

Example 1 Foundation 3 marks: in scope or a change?

The agreed scope statement says: In scope: sign-in, viewing invoices, downloading invoices as PDF. Out of scope: a mobile app, online payment, and invoices older than two years. Five requests arrive. Decide for each whether it is within scope or needs a change request. (a) Let customers download an invoice as a PDF. (b) Let customers pay an invoice online. (c) Build an iPhone app. (d) Correct a spelling error on the sign-in page. (e) Show invoices from five years ago.

(a) Named in the deliverables. In scope.
(b) Online payment is excluded. Change request.
(c) A mobile app is excluded. Change request.
(d) A spelling error is a defect in something that is in scope. Fixing it is part of delivering the sign-in page properly. In scope.
(e) Only the last two years are covered. Change request.

Answer: (a) and (d) are in scope; (b), (c) and (e) need a change request, assessed for cost, time and risk before anyone agrees to them.

Example 2 Core 4 marks: objective and acceptance criteria

Write a measurable objective and three checkable acceptance criteria for the portal.

Objective. Start from the business result, not the feature: "Reduce billing-query phone calls by 30% within three months of launch by letting customers view and download their invoices online." It has a measure (30%), a time (three months) and a reason (fewer calls).
Criterion 1 (performance). 95% of portal pages load in under three seconds on the agreed test devices.
Criterion 2 (usability). In a pilot, 9 out of 10 customers find and download an invoice without help.
Criterion 3 (security). Sign-in requires two-factor verification, and the independent security test reports no critical findings.
Each criterion can be tested by someone other than the author, which is what makes it acceptance criteria and not hope.

Answer: a measurable objective plus three criteria that a tester can pass or fail.

Example 3 Core 4 marks: checking a work breakdown structure

The 100-day portal effort is broken into: Design 20 days, Build 45 days, Test 20 days, Launch 10 days. Build is divided into front end 18, back end 20 and integration 7. Does this WBS obey the 100% rule?

Check the Build level: 18 + 20 + 7 = 45, which matches the parent. The Build branch is complete.
Check the top level: 20 + 45 + 20 + 10 = 95 days, but the project is 100 days.
Five days are not accounted for. The usual missing item is project management itself: planning, meetings, reporting and change control.
Add a fifth branch, Project management, 5 days. Now 20 + 45 + 20 + 10 + 5 = 100.

Answer: the original WBS breaks the 100% rule at the top level (95 of 100 days). Adding a 5-day Project management work package fixes it.

Example 4 Core 4 marks: scoring risks on the matrix

Score each risk and give its band (1 to 4 low, 5 to 12 medium, 15 to 25 high). (A) Probability 4, impact 3. (B) Probability 2, impact 5. (C) Probability 5, impact 4. (D) Probability 1, impact 2.

(A) 4 × 3 = 12. Medium.
(B) 2 × 5 = 10. Medium.
(C) 5 × 4 = 20. High.
(D) 1 × 2 = 2. Low.
Order of attention: C first. Then notice that B has the worst possible impact (5) yet scores only medium. A careful manager would review B separately and ask what the contingency is if it happens.

Answer: A = 12 (medium), B = 10 (medium, but severe impact so review it), C = 20 (high), D = 2 (low).

Example 5 Core 5 marks: EMV and the contingency reserve

The register lists: key developer leaves, 20% chance, $30,000; supplier late, 30%, $15,000; requirement change, 50%, $20,000; security test fails first time, 25%, $24,000; and an opportunity, an early-payment discount, 40% chance of saving $5,000. Find the total EMV of the threats, the EMV of the opportunity, the net EMV, and the net EMV as a percentage of the $200,000 budget.

Developer: 0.20 × $30,000 = $6,000.
Supplier: 0.30 × $15,000 = $4,500.
Requirement change: 0.50 × $20,000 = $10,000.
Security test: 0.25 × $24,000 = $6,000.
Threats total: 6,000 + 4,500 + 10,000 + 6,000 = $26,500.
Opportunity: 0.40 × (−$5,000) = −$2,000. A saving counts as a negative cost.
Net EMV: 26,500 − 2,000 = $24,500. As a share of the budget: 24,500/200,000 = 0.1225, which is 12.25%.

Answer: threats $26,500, opportunity −$2,000, net EMV $24,500, or 12.25% of the budget. Many managers would hold a contingency reserve near the threat total and treat the opportunity as a bonus, rather than count on the saving. Check this against the register in section 2.

Example 6 Extension 5 marks: choosing a response

A risk has a 40% chance of costing $50,000. Option 1: accept it. Option 2: mitigate by spending $8,000 on extra testing, which cuts the probability to 10%. Option 3: transfer it by paying a $12,000 insurance premium that covers the full loss. Compare the expected total cost of each.

Accept. EMV = 0.40 × $50,000 = $20,000.
Mitigate. Cost of action $8,000 plus the remaining EMV 0.10 × $50,000 = $5,000. Total expected cost = $13,000.
Transfer. The premium is $12,000 and the loss is covered, so the total expected cost = $12,000 (ignoring any excess or exclusions).
Savings against accepting: mitigate $7,000, transfer $8,000.
Judgement. On expected cost alone, transfer wins by $1,000. But the gap is small, insurance carries conditions, and mitigation (better testing) may reduce other risks too. The numbers narrow the choice; they do not make it.

Answer: expected costs are $20,000 (accept), $13,000 (mitigate) and $12,000 (transfer). Both active responses beat accepting. Transfer is cheapest by a narrow margin, so check the policy terms and side-benefits before deciding.

Example 7 Extension 3 marks: the arithmetic of scope creep

During the 100-day portal project the sponsor makes 12 small requests, and each is "only" 1.5 days of work. None is logged. What happens to the schedule?

Extra work = 12 × 1.5 = 18 days.
As a share of the plan: 18/100 = 18%.
Unless the team works faster or the deadline moves, the project finishes about 18 days late, and the extra work has no budget and has not been tested.
With change control, each request would be priced at 1.5 days, shown to the sponsor, and either approved with a matching change to the plan or declined. The same 18 days would then be a visible decision instead of a surprise.

Answer: 18 extra days, an 18% overrun. No single request was the problem; the lack of a record was.

6Answer explanations

Attempt every question before you open these. A right answer with a wrong method is luck, so read each explanation even when you were correct. Questions 4 and 6 show their own worked solution as soon as you answer, and Question 10 has its model answer built in.

Question 1: a request outside the scope statement

Answer: log a change request and assess its effect on cost, time and risk before the sponsor decides. The feature may be worth doing. The process makes the trade-off visible and gets the money and time approved first.

Why the others fail: building it quietly is scope creep (a). Refusing outright ignores that scope may legitimately change when the sponsor agrees (b). A closed risk has nothing to do with a new requirement (d).

Question 2: a supplier that has already failed

Answer: an issue. A risk is a possible future event. Once the supplier has gone bankrupt the uncertainty is gone, so the matter becomes an issue to be resolved now, for example by sourcing a new supplier.

Scoring it as a "100% risk" (a) is a common shortcut, but it sends the problem into a review cycle instead of an action list.

Question 3: EMV of a 35% risk of $40,000

EMV = 0.35 × $40,000 = $14,000.

A common slip is to enter 35 × 40,000 without converting the percentage, which gives 1,400,000. Always convert a percentage to a decimal first.

Question 4: generated EMV

Convert the percentage to a decimal and multiply by the impact. Use New numbers to repeat until the conversion is automatic.

Question 5: the risk score

Score = 4 × 5 = 20. On the usual bands this is high (15 to 25), so it needs immediate action and sponsor attention.

Question 6: generated total EMV

Compute each EMV separately before adding. Adding all probabilities and all impacts first and then multiplying gives a different, wrong answer, because the multiplication belongs to each risk on its own. Check the worked solution that appears after you answer.

Question 7: is mitigating worth it?

Accept: 0.30 × $60,000 = $18,000.

Mitigate: $6,000 for the action, plus the remaining EMV 0.10 × $60,000 = $6,000, so $12,000 in total.

Saving = 18,000 − 12,000 = $6,000. A common error is to compare $6,000 (the action cost) with the $18,000 EMV and forget the risk that remains after mitigation.

Question 8: the 100% rule

Answer: 80 + 70 + 40 = 190, so 10 days of scope are missing and the rule is broken. The rule applies at every level: the children must add up to exactly 100% of the parent. Look for the missing item; it is often project management or testing.

Question 9: insurance as a response

Answer: transfer. Insurance does not make damage less likely and does not remove the activity. It shifts the financial impact to the insurer in return for a premium. Mitigation (b) would be, for example, better packaging. Avoidance (a) would be not shipping at all.

Question 10: the case task

Mark yourself with the rubric under the model answer. A response that scores 6 or more of the 8 criteria has the main habits in place. If you missed the exclusions or the acceptance criteria, reread the scope statement section. If you missed the EMV step, redo Example 5 without looking.

Open tasks are not counted in the score because only you can judge your own reasoning against the rubric.

7Short recap

A project is temporary and creates something unique. Scope is all the work needed to deliver it.
A scope statement states the objective, deliverables, acceptance criteria, exclusions, assumptions and constraints.
A work breakdown structure divides scope into work packages. At every level, the pieces must total 100% of the parent.
Scope creep is unlogged change. Change control assesses cost, time and risk before the sponsor decides.
A risk is a possible future event, threat or opportunity. An event that has happened is an issue.
Score a risk as probability × impact on the matrix. Review severe-impact risks even when the score is medium.
EMV = probability × impact. The sum sizes the contingency reserve. EMV is an average and can hide rare disasters.
Responses: avoid, mitigate, transfer or accept for threats; exploit, enhance, share or accept for opportunities. Compare expected total costs, then use judgement.

Tick what you can now do

I can define scope and a deliverable and tell an agreed requirement from scope creep.
I can write a scope statement and check a work breakdown structure against the 100% rule.
I can score risks on the matrix and calculate EMV and a contingency reserve.
I can compare risk responses by expected cost and say when the numbers are not enough.

If you ticked fewer than four, return to the matching worked example, redo it without looking, then repeat the generated questions. The next lesson, Scheduling and the Critical Path, turns the scope you defined here into a schedule.

Related lessons and Encyclopedia entries

Scheduling and the Critical Path: the next lesson, which sequences your work packages.
Risk register, Risk scoring and Risk assessment matrix: the Encyclopedia entries on the tools used here.
Critical path method and Stakeholder engagement: what comes after scope and risk.
Opportunity cost: why every scope change has a price.

References and further reading

Titles and publishers only. Search each site for the title to reach the exact page.

Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK Guide), the knowledge areas on scope and on risk. https://www.pmi.org/
AXELOS, Managing Successful Projects with PRINCE2, the themes on risk and on change. https://www.axelos.com/
International Organization for Standardization, ISO 31000: Risk management - Guidelines, and ISO 21502: Project, programme and portfolio management - Guidance on project management. https://www.iso.org/
Association for Project Management, APM Body of Knowledge, the sections on scope management and risk management. https://www.apm.org.uk/

Defining Project Scope and Managing Risk