Risk management systems and methods for plant EPCCOM are described. The system comprises a risk management database for storing risk objects, each object representing a real-world risk mitigation factor. A risk recommendation engine is communicatively coupled to the risk management database and is configured to provide recommendations for mitigating and managing risks as a function of efficacy attributes of the risk objects. The efficacy attributes represent the effectiveness of previously implemented and/or simulated risk mitigation strategies. The efficacy attributes are preferably multi-variable dependent and are defined by prioritizing and weighing different objectives.