When should Project Risk Management be conducted?

Conducting risk management only during project planning would miss risks that emerge during execution, monitoring, and closing phases of the project.

Limiting risk management to Monitoring and Controlling ignores the critical risk identification and planning activities that must occur in earlier phases.

Quality planning is a distinct process from risk management, and restricting risk activities to only that context is both too narrow and incorrect per the PMBOK Guide.

The PMBOK Guide explicitly states that risk management should be conducted throughout the entire project lifecycle because new risks emerge, existing risks change in probability or impact, and responses need monitoring as the project progresses. Limiting risk management to a single phase would leave unidentified risks unaddressed and allow known risks to go unmonitored.