| Course | BU 396 Managing Project Risks |
|---|---|
| Unit | Unit 1 |
| Paper type | Risk management plan |
| Length | About 950 words, 6 pages |
| Format | APA 7 student paper |
| School | Herzing University |
| Program | BS in Project Management |
| Updated | September 2026 |
Free sample paper for BU 396 Unit 1
Bands, Categories and Who May Say Yes: A Risk Management Plan for a Composite Two-Day Riverfront Festival, Written Before a Single Risk Is Named
Student Name
Business, Herzing University
BU 396: Managing Project Risks
Instructor Name
January 21, 2026
Bands, Categories and Who May Say Yes: A Risk Management Plan for a Composite Two-Day Riverfront Festival, Written Before a Single Risk Is Named
The Project and the Purpose of This Plan
The Cedar Bend Riverfest is a composite two-day food and music festival, built for this course, to be held on August 22 and 23, 2026, in the riverfront park of a mid-sized Iowa river city. It is organized by the Cedar Bend Downtown Partnership, a nonprofit, with a budget of $410,000, an expected attendance of 25,000 over two days, about 60 food and craft vendors, two stages and roughly 300 volunteers. The events director is the project manager and reports to the Partnership's board chair, who acts as sponsor.
This document sets the rules by which risks on the festival will be recorded, rated, owned and escalated. It deliberately contains no risks. Guidance from the Project Management Institute (2019) describes risk management planning as defining how risk activities will be conducted, and warns that teams who begin listing risks before agreeing on scales and authority end up arguing about ratings rather than acting on them.
What Counts as a Risk and What Is an Issue
For this project, a risk means anything not yet certain that would, should it happen, change how the festival meets one of its objectives: budget, the festival dates, attendee safety or the quality of the experience. An issue is something that has already happened or is certain to happen and now needs managing. A forecast of thunderstorms three days out is a risk; a thunderstorm moving across the park on Saturday afternoon is an issue. The distinction matters because risks are handled in the register with ratings and planned responses, while issues go to the issue log with an owner and a deadline for action. When a risk occurs, its register entry is closed as realized and an issue is opened, with a cross-reference between them.
The plan also covers the upside, events that may or may not occur and would benefit the festival, such as a sponsor increasing its commitment. Hillson (2002) argued that the same process should manage both, and the festival's bands apply to both.
Two gray areas are settled here as well. A known constraint, such as the city's requirement that amplified sound end at 10:00 p.m., is neither a risk nor an issue; it is a planning assumption and goes in the project plan. And a concern that cannot yet be stated as an uncertain event, such as a vague worry about the economy, is recorded in the workshop notes until someone can express it as a specific event with a consequence, at which point it may enter the register.
Probability Bands
Every entry will be rated on the probability that it occurs before or during the festival, using five bands with stated ranges.
| Band | Label | Range |
|---|---|---|
| 1 | Rare | Less than 5% |
| 2 | Unlikely | 5% to 20% |
| 3 | Possible | 20% to 40% |
| 4 | Likely | 40% to 65% |
| 5 | Almost certain | More than 65% |
Impact Bands, Defined Separately by Objective
Impact is rated separately for cost, schedule, safety and experience quality, because a $15,000 overrun and a two-hour delay to the gates are not the same size to the people who care about each. An entry takes the highest band it reaches on any objective.
| Band | Cost to the Partnership | Schedule | Attendee safety | Experience quality |
|---|---|---|---|---|
| 1 | Under $2,000 | Minor delay, no program change | No injury | Few attendees notice |
| 2 | $2,000 to $10,000 | One act or vendor lost | Minor first aid cases above normal | Complaints on social media |
| 3 | $10,000 to $30,000 | Program shortened by up to 3 hours | One injury needing hospital care | Noticeable drop in satisfaction |
| 4 | $30,000 to $75,000 | One day's program substantially cut | Several hospital cases | Damage to next year's ticket sales |
| 5 | Over $75,000 | A festival day canceled | Serious injury or loss of life | Festival's future in doubt |
Categories
Entries will be filed under six categories, a simple risk breakdown structure agreed with the core team: weather and environment; permits and regulation; people, including volunteers, staff and performers; vendors and suppliers; safety and security; and finance and sponsorship. A category is assigned when an entry is raised and does not change, which lets the team see later where risks clustered. Kendrick (2015) recommends categories drawn from the project's own sources of trouble rather than a generic list, and these six come from the Partnership's reviews of its previous events.
Each category also has a default owner, who takes new entries in that category until the core team assigns someone better placed: the operations lead for weather and safety, the events director for permits and people, the vendor coordinator for vendors and the finance manager for finance and sponsorship.
Who May Accept Exposure
Authority to accept a risk, meaning to carry it without further action beyond monitoring, depends on its score, calculated as probability band multiplied by the highest impact band. Scores of 1 to 6 may be accepted by the risk owner. Scores of 8 to 12 may be accepted only by the project manager, who must record the reason. Scores of 15 to 25 require the sponsor's written decision, and any entry with a safety impact of 4 or 5 requires the sponsor's decision regardless of score. Spending from the risk reserve up to $5,000 per draw may be approved by the project manager; larger draws require the sponsor.
The risk reserve itself will be set after the quantitative analysis, not in this plan, so that its size follows from the risks rather than from a guess made before any were named.
Roles, Tools and Timing
The project manager owns the register and the process. Each entry has one named owner who monitors it and carries out its response. The Partnership's operations lead acts as risk facilitator for the identification workshop. The register will be kept in a shared spreadsheet with a change log, and entries will never be deleted, only closed. The full register will be reviewed every two weeks from February through June, weekly in July and daily during the final week. ISO 31000 describes risk management as iterative and embedded in how an organization makes decisions, not as a one-time exercise (International Organization for Standardization, 2018), and the review cadence is designed to make it so. Identification will begin once the board chair has approved this plan. The Cedar Bend Riverfest and its organizers are composites created for this course.
References
Hillson, D. (2002). Extending the risk process to manage opportunities. International Journal of Project Management, 20(3), 235-240. https://doi.org/10.1016/S0263-7863(01)00074-6
International Organization for Standardization. (2018). Risk management: Guidelines (ISO Standard No. 31000:2018).
Kendrick, T. (2015). Identifying and managing project risk: Essential tools for failure-proofing your project (3rd ed.). AMACOM.
Project Management Institute. (2019). The standard for risk management in portfolios, programs, and projects. Project Management Institute.
What the BU 396 Unit 1 instructions ask for
The first unit of BU 396 asks students to write a risk management plan for a project before identifying any risks. Most versions want the project introduced briefly, definitions of risk and issue, probability and impact scales with defined ranges, risk categories, thresholds for who may accept or escalate risks, roles and responsibilities and the timing of risk reviews. Many rubrics ask for impact to be defined separately for different objectives, such as cost and schedule. Instructors check that the plan contains no actual risks, since identification is the next unit's task. A composite project is usually acceptable if described clearly. Expect a few pages with tables for the scales, citing a risk management standard in APA 7, and keep the project's size and budget realistic so the dollar bands make sense.
How the BU 396 Unit 1 example is put together
The sample opens with a short description of the festival and explains why the plan deliberately lists no risks. A definitions section separates risks from issues, gives an example of each, explains how a realized risk becomes an issue and settles two gray areas. A probability table sets five bands with ranges, and an impact table defines five bands separately for four objectives. A categories section lists six groups and explains where they came from, then assigns each a default owner. The authority section ties acceptance to score ranges, adds a safety override and sets limits for reserve draws. The final section assigns roles, names tools and sets a review cadence that tightens as the festival approaches, then states that identification begins only after approval.
BU 396 Unit 1 rubric: what full points look like
Herzing's grading for the planning unit usually weighs the clarity of definitions, the quality of the rating scales, the authority and escalation rules and completeness. Definitions earn full points when risk and issue are clearly separated with a rule for converting one to the other. Scales are judged by stated ranges for probability and impact bands defined per objective, which prevents a schedule delay and a cost overrun from being treated as the same thing. Authority rules score highest when they name who may accept exposure at each level and include a route for safety or other critical impacts, as the sample does. Completeness rewards roles, tools, review timing and categories. Instructors also check that no actual risks appear. Clear tables and correct citations of a recognized standard complete the grade, and a note on where categories came from earns further credit.
Common BU 396 Unit 1 mistakes, and how to avoid them
The most common Unit 1 mistake is filling the plan with a list of risks, which belongs in the identification unit. Another is using probability bands without ranges, so that likely means something different to each reader. Students often define impact with one scale for everything, which forces awkward comparisons between money, time and safety. Authority rules are frequently missing or vague, leaving nobody sure who can accept a risk. Some plans forget opportunities entirely. Others set a review cadence that never changes as the project nears its deadline. Finally, keep the plan practical; tables a team can use at a meeting are worth more than pages of theory about risk management, and a plan the sponsor has actually approved carries more weight than one that is only drafted.
Get a BU 396 Unit 1 example written to your instructions
Send the Unit 1 instructions and the rubric posted in your BU 396 classroom, plus the project or case your section assigns. We write a custom example that defines the bands numerically, splits impact by objective, fixes categories and thresholds, and names who may accept what. First custom sample free, back in 24 to 48 hours.
More BU 396 papers and project management samples
- BU 396 Unit 2: Risk identification workshop output
- BU 396 Unit 3: Qualitative analysis and scoring
- BU 396 Unit 4: Quantitative analysis
- BU 396 Unit 5: Response strategy selection
- BU 396 Unit 6: Risk register
- BU 396 Unit 7: Monitoring and review plan
- BU 396 Unit 8: Risk report to sponsor
- BU 345 Unit 1: Project selection record
- BU 433 Unit 1: Agile principles and fit analysis
- BU 434 Unit 1: Stakeholder identification and analysis
- BU 436 Unit 1: Global project context analysis
BU 396 Unit 1 questions, answered
Can I set the bands however I like?
Within whatever the instructions fix, yes, and the reasoning behind your choice is the graded part. Bands have to suit the project in front of you, since a six month build and a three year program do not share a definition of a serious delay. State the range each band covers, say what the top one would mean for this sponsor, and use the same bands in every later unit.
Does this unit need a real project?
Follow the instructions, since many sections supply a case. Where the choice is open, a composite project you describe fully works better than a real one you only half know, because every band you define has to mean something measured against it. Say in the opening that the project is constructed, and treat its budget and its dates as case material rather than as facts about the world.
Is my company's risk methodology usable here?
No. A corporate risk framework, its rating matrix and the register templates built around it are internal property, and a graded submission is read by people outside that company. Build the bands from the course reading and the project described in the assignment. If the shape of what you handle at work informs your thinking, that is unavoidable and fine; reproducing the document itself is not.
Where can I find a free BU 396 Unit 1 sample paper?
The full BU 396 Unit 1 risk management plan is published above for free, with its probability and impact tables and margin notes. A plan for a different project can be drafted free if you send a description and the unit prompt, normally in a couple of days.
Can I set the BU 396 Unit 1 bands however I like?
Within reason, yes, as long as each band has a stated range and the ranges fit the project's size. The sample sets cost bands from under $2,000 to over $75,000 because the festival's budget is $410,000. Bands that ignore the project's scale make every later rating less useful.