When a new risk is identified and communicated directly to management, the project manager should first discuss with the consultant to understand why the risk was escalated. This will help the project manager to understand the severity of the risk and why it was not brought to the attention of the team first. Based on this understanding, the project manager can then decide the next steps, which could include including the risk in the risk assessment, entering it into the risk register, or escalating it further. References: PMBOKGuide, 6th Edition, Section 11.1: Plan Risk Management, and Section 11.5: Plan Risk Responses.