Risk management starts with identification: systematically brainstorming what could go wrong, from supplier delays to key staff leaving, often organized by category (technical, financial, external, organizational). Each identified risk is logged in a risk register along with its likelihood, potential impact, and an assigned owner, then ranked so the team focuses energy on the highest-priority threats first. Risk mitigation means taking action now to reduce the probability or impact of a risk -- for example, signing with a backup supplier -- while contingency planning is the separate plan you activate only if the risk actually occurs, such as a reserved fund to cover a late delivery. Reviewing the risk register at every status meeting keeps the team proactive instead of reactive.