In this article, while reviewing the "EPC" contracts and the different stages of risk management according to the "PMBOK" standard, a general proposed model for this type of contract is presented, in which the necessity of planning and managing risk in the stages before winning the tender and after winning and signing the contract has been examined and considered. In recent years, the construction market has moved towards contracts in which the final amount and the time of completion of the work are guaranteed. Risk management knowledge, as a subset of project management knowledge, has gradually become a source of influence with such developments. The "PMBOK" standard has divided the risk management process into 6 stages: risk planning, risk identification, qualitative risk analysis, quantitative risk analysis, risk response and risk control. The proposed model in this research is that the contractor must implement stages 1 to 4 of risk management before bidding and after signing the contract, perform the 6 mentioned stages. In this model, the results of the pre-bid risk management review can be used as input to the post-contract phase. The six risk management phases operate like a cycle and are similar to a trial and error method. Initially, the work phases begin with limited parameters. As the project progresses and more details of the work are identified, the impact of risks on more activities must be considered and more risks become apparent, so risk management needs to plan, identify, analyze, respond to, and control new risks over a specific period of time. Methods were also proposed and reviewed for the risk planning and risk identification phases, so that EPC contractors can more easily review and manage risks in these types of contracts.