There is only one output of risk management planning, and that is the risk management plan. The plan describes how the risk process will be performed during the project life cycle.
Methodology: Describes the approaches, tools, and data sources to be used when doing risk management.
Roles and responsibilities: Defines the team of people responsible for managing the identified risks and responses and outlines their roles. People outside of the project team may be named, to keep the risk analysis unbiased.
Budgeting: Defines the budget for risk management for the project. This is included in the cost baseline.
Timing: Defines when and how often the risk management process will be performed. This process should begin early in the project life cycle and be revisited throughout project execution.
Risk categories: A good way of providing the structure necessary to identify risks consistently is to outline the categories of risks in a RBS (Risk Breakdown Structure), which is further defined in the Figure 274. The risk categories could also simply be listed.
Definitions of risk probability and impact: Outlines the scales that will be used during qualitative risk analysis to assess the probability and impact of the risks that have been identified for a particular project. Scales could be qualitative, from "very low" to "very high," or quantitative, like a scale from 1 to 5.
Probability and impact matrix: The combination of each risk's probability and impact will lead to an overall risk rating, which allows the risks to be prioritized. The combinations that lead to a risk with "high" importance vs. "low" is tailored for the specific project.
Revised stakeholder tolerances: Stakeholder tolerances will be defined and revised as necessary as they pertain to the specific project.
Reporting formats: This component defines the risk register and other risk reports. Outlines how they will be created and distributed.
Tracking: This component defines how risk will be recorded for the benefit of this project and future projects, as well as if and how the risk processes will be audited.