Show that you assess risks at the start AND review them regularly. A risk register that is only updated at kickoff is not risk management.
Strong answers include: proactive risk identification (brainstorming, pre-mortems, lessons learned from past projects), risk assessment (probability and impact matrix), mitigation strategies for top risks, contingency plans, regular risk reviews, and escalation criteria. Best candidates mention that some risks are opportunities.
Tests foresight and planning discipline. Ask for a specific example where early risk identification saved a project. Candidates who only manage risks reactively are firefighters, not project managers.