Risk questions appear across the PMP, and most of them test whether you know what to do next, not definitions. Learn the sequence, the response strategies and the two reserves, and you will answer most of them correctly.
The risk process in order
- Plan how risk will be managed on the project.
- Identify risks and record them in the risk register.
- Qualitative analysis: rank risks by probability and impact.
- Quantitative analysis: put numbers on the biggest risks, for example with EMV or simulation.
- Plan responses and assign a risk owner to each.
- Implement the agreed responses when needed.
- Monitor risks throughout the project and look for new ones.
The exam loves "what should the project manager do first?" The answer usually comes earlier in this list than candidates think. If a new risk appears, you analyse it before you respond to it.
Responses to threats and opportunities
| Threats (negative risks) | Opportunities (positive risks) |
|---|---|
| Escalate: outside the project's authority, pass to the right level | Escalate |
| Avoid: change the plan to remove the threat | Exploit: make sure the opportunity happens |
| Transfer: shift the impact to a third party, e.g. insurance or a contract | Share: partner with someone better placed to capture it |
| Mitigate: reduce probability or impact | Enhance: increase probability or impact |
| Accept: acknowledge it, actively (with a reserve) or passively | Accept |
Pairs to remember: avoid / exploit, transfer / share, mitigate / enhance.
Contingency reserve vs management reserve
| Contingency reserve | Management reserve | |
|---|---|---|
| For | Known unknowns: identified risks | Unknown unknowns: risks nobody identified |
| Controlled by | The project manager, per the risk plan | Management or the sponsor |
| Part of the cost baseline? | Yes | No, it sits in the budget above the baseline |
Trap: if an unidentified risk occurs, you cannot simply use contingency reserve. You request management reserve through the change process.
Risk vs issue
- A risk might happen. It lives in the risk register.
- An issue is happening now. It lives in the issue log.
When a risk occurs, it becomes an issue. If you planned a response, the risk owner implements the contingency plan. If nothing was planned, you use a workaround.
More terms the exam uses
- Risk owner: the person responsible for monitoring a risk and carrying out its response.
- Trigger: the warning sign that a risk is about to occur.
- Fallback plan: used if the contingency plan does not work.
- Residual risk: what remains after a response.
- Secondary risk: a new risk created by a response.
- Risk appetite and threshold: how much uncertainty the organisation will accept.
EMV in one minute
Expected monetary value = probability × impact.
A 30% chance of a 50,000 euro supplier penalty has an EMV of 0.30 × −50,000 = −15,000 euros. A 20% chance of a 40,000 euro bonus has an EMV of +8,000 euros. Add them for the overall exposure: −7,000 euros.
In a decision tree, calculate the EMV of each branch, include the cost of each option, and pick the best net value.
Risk in agile projects
Agile teams manage risk through short iterations and frequent feedback. Risky work is often done early, sometimes as a spike (a short experiment), and risk items can sit directly in the backlog. Reviews and retrospectives surface risks every sprint.
Try a question
During execution, a key supplier warns that a component may be delivered three weeks late. This risk was not in the risk register. What should the project manager do first?
A. Use the contingency reserve to pay for express delivery.
B. Add the risk to the risk register and analyse its probability and impact.
C. Escalate the delay to the sponsor.
D. Replace the supplier.
Answer: B. A new risk must be recorded and analysed before any response is chosen. A uses a reserve meant for identified risks. C and D jump to a response before understanding the risk.
Practice
For the full list of formulas, see the PMP formulas cheat sheet, then try the free 30-question PMP quiz.