According to the PMBOK, "Good risk monitoring and control processes provide information that assists with making effective decisions in advance of the event occurring."
In our description of risk monitoring, pay special attention to the words in advance of the event occurring because preventative measures help create the least project variance. If a project runs smoothly and has been estimated correctly, schedule and cost variances will be minimal.
Risks are where the unexpected changes will most likely come in a project. PMI heavily recommends actively identifying and tracking risks so that when a risk occurs, the mitigation strategy identified can be implemented.
Do understand that risks happen. Understanding risk control according to PMBOK is relatively simple:
In practice, however, risks are sometimes tricky to identify. Management is often reluctant to consider risks outside the company environment.