PMI-RMP PMI Risk Management Professional (PMI-RMP) Exam Questions and Answers

The project manager should discuss the risk response strategies with the stakeholders to handle their expectations. This will help the project manager to align the risk responses with the stakeholder’s risk appetite, preferences, and expectations. It will also help the project manager to obtain the stakeholder’s support and approval for the risk responses. This is the best way to ensure clear visibility on the project risks and progress. Adding buffers to the schedule to accommodate risk (option A) is not a good practice, as it may create false expectations and hide the true impact of risk. Ensuring the risk register includes all identified risks (option B) is important, but it is not enough to handle stakeholder expectations. The project manager also needs to communicate the risk register to the stakeholders and discuss the risk responses with them. Developing a communication plan to share updates on risks (option D) is also a good practice, but it is not sufficient to handle stakeholder expectations. The project manager also needs to involve the stakeholders in the risk response planning process and obtain their feedback and approval. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 97; PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), 6th ed., 2017, p. 407.

The project manager should develop a communication plan to share updates on risks (D) to handle stakeholder expectations, especially since the organization has a low risk appetite and stakeholders are very engaged. This approach ensures that stakeholders are regularly informed about the project's risks and progress, addressing their concerns and expectations. This is supported by the PMI's PMBOK Guide, Sixth Edition.

A low CPI value (0.53) indicates that the project is over budget. This may be due to an inaccurate cost baseline, which means the initial budget estimation was not correct. This would not necessarily mean that cost control processes are ineffective, actual reported costs are inaccurate, or cost-related risks are effectively managed.

The CPI value is calculated by dividing the earned value (EV) by the actual cost (AC). A CPI value of less than 1 indicates that the project is over budget, meaning that the actual cost is higher than the planned cost. A low CPI value can have several possible causes, such as poor estimation, scope creep, change requests, or inaccurate reporting. However, in this case, the SPI value is greater than 1, which indicates that the project is ahead of schedule, meaning that the earned value is higher than the planned value. This suggests that the cost baseline, which is derived from the planned value, is inaccurate and does not reflect the true cost of the work. Therefore, the risk manager should interpret such a low CPI value as a sign of an inaccurate cost baseline, and not as a result of ineffective cost control processes, inaccurate actual costs, or effective cost related risk management. References: PMI-RMP® Certification Handbook1, page 9; PMBOK® Guide, page 267.

In risk management, to calculate the contingency budget for risks, we use the Expected Monetary Value (EMV) formula: EMV=Probability of Risk×Impact of Risk\text{EMV} = \text{Probability of Risk} \times \text{Impact of Risk}EMV=Probability of Risk×Impact of Risk

For Risk A:

Probability: 40% or 0.40

Impact: US$100,000\text{EMV of Risk A} = 0.40 \times 100,000 = US$40,000

For Risk B:

Probability: 60% or 0.60

Impact: US$20,000\text{EMV of Risk B} = 0.60 \times 20,000 = US$12,000

Total contingency budget = EMV of Risk A + EMV of Risk B

40,000 + 12,000 = US$52,000

Thus, the total contingency budget required for both risks is US$52,000. This approach follows PMI’s risk management guidelines, specifically under the "Quantitative Risk Analysis" process. This process focuses on determining numerical probabilities and monetary impacts to compute the expected financial impact of identified risks​​.

According to the PMI Risk Management Professional (PMI-RMP)® Handbook1, one of the domains of the PMI-RMP exam is Risk Monitoring and Reporting, which involves tracking identified risks, monitoring residual risks, identifying new risks, executing risk response plans, and evaluating risk process effectiveness throughout the project1. The risk manager of the related project should have reformed the risk monitoring and closing process properly to ensure that the contingency budget is only used for the intended risks and not for other purposes. The risk manager should have also communicated the status and outcomes of the risk activities to the relevant stakeholders, such as the functional manager and the CEO, to avoid any confusion or conflict over the budget allocation1. References: 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 6.

The risk manager should have ensured a more accurate project work plan and budget to prevent the functional manager from requesting to use the project's contingency budget. A well-planned budget would have avoided the shortage in the functional manager's department budget.

In agile projects, the risk burndown chart is used to monitor the reduction of project risk over time. If risk exposure is found to be increasing, it is essential to act immediately by selecting and implementing risk mitigation actions that can reduce exposure in upcoming iterations. The PMI “Agile Practice Guide” and the PMBOK® Guide state:

“In agile projects, risks are identified and managed continuously. When risk exposure is high, mitigation actions (often called ‘risk mitigation stories’) should be prioritized in the next iteration or sprint to bring exposure back to acceptable levels.”

— Agile Practice Guide, PMI, Section 5.7 (Responding to Risks in Agile Projects)

“Project teams may develop risk response actions as work items and prioritize these for execution in the backlog, particularly in iterative and incremental environments.”

— PMBOK® Guide, 6th Edition, Section 11.6.2.3

Therefore, prioritizing risk mitigation stories for the next sprint (Option C) is the most effective and officially recommended response.

The risk owner should implement the secondary risk response, as it is now being tolerated, and update the project documents accordingly. They should also update and communicate the assessments of the secondary risk's impact to ensure everyone is aware of the situation.

According to the PMI-RMP Handbook1, the risk owner is responsible for implementing the risk response plan and monitoring the risk and its secondary risks. Therefore, the risk owner should take the following two actions when the secondary risk emerges:

Implement the secondary risk response and update the project documents. This action is consistent with the risk response strategy of tolerance, which means accepting the risk and its consequences. The risk owner should execute the planned response for the secondary risk, such as contingency plans or fallback plans, and update the relevant project documents, such as the risk register, the risk report, and the lessons learned register, to reflect the current status and impact of the risk.

Update and communicate assessments of the secondary risk’s impact. This action is consistent with the risk monitoring and control process, which involves tracking the identified risks, evaluating their impact and probability, and reporting the risk information to the appropriate stakeholders. The risk owner should reassess the secondary risk’s impact on the project objectives, such as scope, schedule, cost, and quality, and communicate the results to the project manager and other relevant stakeholders, such as the sponsor, the customer, and the team members.

PMI-RMP Handbook1

PMBOK Guide, 6th edition, Chapter 11: Project Risk Management2

Project risks should be closed when the stakeholders agree a risk is no longer applicable. This ensures that risks are actively managed and only relevant risks are considered throughout the project lifecycle.

According to the PMI Risk Management Professional (PMI-RMP) Reference Materials, project risks are uncertain events or conditions that may have a positive or negative effect on one or more project objectives1. Project risks can be closed when they are no longer applicable to the project or its activities. The process of closing project risks involves verifying that the risk responses have been completed, documenting the outcomes, and evaluating the effectiveness of the risk management process2. The decision to close a project risk should be made by the stakeholders who are responsible for or affected by the risk, as they are the ones who can determine whether the risk is still relevant or not. Therefore, the correct answer is B. When the stakeholders agree a risk is no longer applicable.

The first thing the risk manager should do is analyze the situation and meet with the risk owner. This will allow the risk manager to understand the challenges faced by the risk owner and work with them to find a solution. Conducting a cost-benefit analysis or changing the risk response strategy may be necessary, but it is important to first understand the situation before taking any action.

According to the PMI-RMP Exam Content Outline, one of the tasks in the domain of Risk Response Planning is to “assist the risk owners in developing and implementing risk response strategies and actions based on the agreed-upon risk response plan”. Therefore, the first thing the risk manager should do is to analyze the situation and meet with the risk owner to understand the root cause of the challenges and the cost overrun, and to discuss possible solutions or alternatives. Highlighting this situation to the project manager, conducting a cost-benefit analysis, or changing the risk response strategy are possible actions that can be taken after the analysis and meeting, but not before. References: PMI-RMP Exam Content Outline, Domain 3: Risk Response Planning, Task 31

When a risk has materialized and become an issue despite preventive actions, the next logical step is to implement the pre-established risk response plan. This plan is designed specifically to address the risk if it occurs, ensuring that the project can quickly and effectively manage the issue. According to PMI's risk management guidelines, implementing the risk response plan is a critical step once a risk has been triggered, as it provides a structured approach to resolving the issue with minimal impact on the project​.

Reviewing published operational experience reports from similar projects or industries can help the risk manager objectively identify risks for the chemical laboratory project. These reports provide valuable insights into potential risks and lessons learned from other projects.

According to the PMBOK Guide, one of the tools and techniques for the identify risks process is data gathering. Data gathering is the process of collecting information from various sources to identify potential risks that may affect the project objectives. One of the data gathering techniques is document analysis, which involves reviewing and analyzing available project documents and other information sources to identify potential risks. Some of the documents that can be analyzed are project charter, project management plan, stakeholder register, assumptions log, agreements, and lessons learned1.

One of the information sources that can be useful for identifying risks in a project constructing a chemical laboratory is published operational experience reports. These are reports that document the experiences, lessons learned, best practices, and recommendations from other organizations or projects that have constructed or operated chemical laboratories. These reports can provide valuable insights into the common risks, challenges, and opportunities that are associated with chemical laboratory projects, such as safety hazards, environmental regulations, equipment failures, design specifications, quality standards, and stakeholder expectations. By reviewing published operational experience reports, the risk manager can objectively identify risks that are relevant and applicable to their project, as well as learn from the successes and failures of others23.

Some of the other options are not relevant or appropriate for the question scenario:

Importing a risk register from other industry chemical laboratories is not a valid option, as it would not allow the risk manager to objectively identify risks that are specific and unique to their project. A risk register is a document that records the identified risks, their causes, impacts, responses, owners, and other information related to the risk management process. A risk register is a project-specific document that reflects the characteristics, objectives, and context of a particular project. Importing a risk register from other industry chemical laboratories would not ensure that the risks are relevant, accurate, or comprehensive for the risk manager’s project. Moreover, it would violate the intellectual property rights and confidentiality agreements of the other projects1.

Defining chemical laboratory safety risk thresholds is not a tool or technique for identifying risks, but rather for performing qualitative risk analysis. Risk thresholds are the measures of the level of uncertainty or the level of impact at which a stakeholder may have a specific interest. Risk thresholds are used to determine the significance of each risk and to prioritize them for further analysis or action. Defining chemical laboratory safety risk thresholds would not help the risk manager to objectively identify risks, but rather to evaluate them1.

Drafting threat and opportunity risks that come to mind is not an objective or systematic way of identifying risks, but rather a subjective and intuitive one. This option would rely on the risk manager’s personal judgment, experience, or creativity, which may not be sufficient or reliable for identifying risks in a project constructing a chemical laboratory. This option would also not ensure that the risks are based on factual and verifiable information sources, such as project documents or published reports. Drafting threat and opportunity risks that come to mind would not help the risk manager to objectively identify risks, but rather to generate them1.

PMBOK Guide, 6th edition, pages 397-399, 414-415, 431-432, 441-4421; Risk Management Professional (PMI-RMP)® Cert Guide, pages 63-642; Risk Management Professional Exam Outline, page 73.

Residual risks are the risks that remain after the risk response plan has been implemented. They are the risks that are accepted by the project team and stakeholders as part of the project. Residual risks may have low probability or impact, but they still need to be monitored and controlled throughout the project. The first thing that the risk manager should do when a risk owner identifies and reports some residual risks is to analyze, document, and communicate them to the relevant stakeholders. The risk manager should assess the probability and impact of the residual risks, and determine if they require any further response or contingency plan. The risk manager should also update the risk register and the risk report with the information about the residual risks, and share them with the stakeholders who need to be aware of them. This will help the project team and stakeholders to be prepared for any potential occurrence of the residual risks, and to take appropriate actions if needed. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 94-95, 101.

According to the PMBOK Guide, one of the tools and techniques for the identify risks process is data gathering. Data gathering is the process of collecting information from various sources to identify potential risks that may affect the project objectives. Some of the data gathering techniques are brainstorming, interviews, checklists, assumption and constraint analysis, and document analysis1. To conduct a risk identification exercise using data gathering techniques, the risk manager should take the following actions:

Arrange a team meeting, review the project’s scope, and discuss dependency mapping. This action can help the risk manager to facilitate a brainstorming session with the project team and other subject matter experts, where they can generate a list of potential risks based on the project scope and the dependencies among the project activities. Dependency mapping is a technique that helps to identify the relationships and interdependencies among the project components, such as tasks, resources, deliverables, and stakeholders2. By reviewing the project scope and discussing the dependency mapping, the risk manager can ensure that the risk identification exercise covers all the relevant aspects of the project and does not miss any important risk sources.

Ensure that all the relevant stakeholders participate. This action can help the risk manager to obtain different perspectives and insights from the stakeholders who have different roles, interests, and expectations in the project. Stakeholders are individuals or groups who can affect or be affected by the project outcomes. They may have valuable information, experience, or expertise that can help to identify potential risks that may not be obvious to the project team. By ensuring that all the relevant stakeholders participate in the risk identification exercise, the risk manager can increase the comprehensiveness and accuracy of the risk identification process and foster stakeholder engagement and buy-in1. References: PMBOK Guide, 6th edition, pages 397-399, 414-4151; Mastering the PMI Risk Management Professional (PMI-RMP) Exam, page 70

With 25 identified risks, and considering the constraints and resources available, the appropriate next step is to perform a qualitative risk analysis. This process helps prioritize the risks based on their probability and impact, as well as other relevant factors like urgency, proximity, and detectability. By doing so, the team can focus on the most significant risks that require immediate attention and develop response plans accordingly, optimizing the use of available resources. PMI recommends this approach to ensure that risk management efforts are both efficient and effective in addressing the most critical risks first​.

Increasing variances during the execution phase imply that the uncertainty and risk are increasing, as the project performance is deviating from the planned values.

According to the PMBOK® Guide – Sixth Edition1, variance analysis is a technique used to compare the actual performance of the project against the planned or expected performance. It can be applied to various aspects of the project, such as scope, schedule, cost, quality, and risk. Variance analysis can help identify deviations from the baseline and determine the causes and impacts of those deviations. If the variances are shown as increasing, it means that the actual performance is deviating more and more from the planned performance, which implies that the uncertainty and risk are increasing. This could affect the project objectives and deliverables, and require corrective or preventive actions to bring the project back on track. The other options are not correct, as they are either too specific (B and D) or contradictory © to the result of the variance analysis. References: PMBOK® Guide – Sixth Edition, pages 262-263.

The risk manager should review the feature with the project team to determine the cause and impact of the untestability, and to identify possible solutions or alternatives. The risk manager should also update the risk register and the risk response plan accordingly. This is the best option among the given choices, as it involves the relevant stakeholders and follows the risk management process. Confirming the risk triggers are still valid is not sufficient, as it does not address the problem or its consequences. Asking the architect to develop acceptance criteria is not appropriate, as it may not be feasible or effective to test the feature with new criteria. Escalating the issue to the project board is premature, as it may not be necessary or desirable to involve the senior management without first analyzing the situation and proposing a course of action. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Chapter 11: Project Risk Management, pp. 414-415. 5

When a key feature may not be testable due to changes in the environment, the risk manager should review the feature with the project team to understand the issue, assess its impact, and determine the appropriate risk response. This collaborative approach ensures that the team has a clear understanding of the situation and can work together to address the risk.

In highly complex projects where changes and new information are expected to arise continually, it's crucial to implement a dynamic and frequent risk management process. This approach ensures that risks are identified, assessed, and addressed promptly as they emerge throughout the project lifecycle. By regularly updating risk assessments and involving key stakeholders in ongoing risk discussions, the project team can maintain a proactive stance, effectively mitigating potential issues before they escalate. This continuous engagement fosters transparency and reduces stakeholder anxiety by demonstrating a commitment to managing uncertainties actively.

PMI Risk Management Study Guide References:

The importance of a dynamic risk management process is emphasized in the PMI-RMP Exam Preparation Study Guide, which highlights the need for continuous risk assessment and stakeholder engagement to adapt to evolving project conditions.

Variance analysis is a method used to compare planned project performance against actual performance. Since the project sponsor has requested a performance report for the entire 10-year initiative, variance analysis would allow the risk manager to identify discrepancies between what was planned and what has been achieved over the course of the project. This analysis is crucial for understanding performance trends, cost deviations, schedule variations, and overall project health.

PMI's guidelines support the use of variance analysis in performance reporting as it provides insights into how well the project is adhering to its planned budget, schedule, and scope​​.

In risk management, it is common that not all risks can be completely eliminated. Residual risk is the remaining risk after all possible mitigation efforts have been applied. If the residual risk is within the organization’s risk appetite—meaning the organization is willing to accept this level of risk—it is appropriate to proceed with the plan. The PMI framework supports this approach, as risk management is about balancing effort and benefit, ensuring that mitigation efforts are commensurate with the risk involved​.

The risk manager should update the risk register with both the opportunities and threats identified during the SWOT analysis. This will help in tracking and managing all potential risks throughout the project lifecycle.

Update the risk register with the identified risks Comprehensive and Detailed Explanation: According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to update the risk register with identified risks, causes, categories, and potential responses1. A risk register is a document used to track and report on project risks and opportunities throughout the project’s life cycle2. In this scenario, the risk manager should update the risk register with the identified risks, both opportunities and threats, that result from the SWOT analysis. The risk manager should also include the causes, categories, and potential responses for each risk, as well as other relevant information such as probability, impact, priority, owner, etc. The risk manager should not add only the threats to the risk register, because opportunities are also a type of risk that can have a positive effect on the project objectives and should be recorded and managed accordingly3. The risk manager should not utilize different tools to identify the risks, because the SWOT analysis is a valid and useful tool for risk identification and there is no indication that it was insufficient or inappropriate for the project context4. The risk manager should not plan risk responses to the threats, because that is a separate process that comes after risk identification and requires further analysis and evaluation of the risks5. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: Risk Register in Project Management - Project Management Academy63: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 3974: How to Perform a SWOT Analysis - Project Risk Coach25: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 440.

If the project manager realizes that some risks have not been updated recently, they should review the risk register to check for new risks and ensure that all risks are accurately documented and updated.

The risk register is a document that contains information about the identified risks, their analysis, and their response plans. It is updated throughout the project life cycle as new risks emerge, existing risks change, or risks are closed. The project manager should review the risk register regularly to ensure that the project data is accurate and reflects the current risk situation. Reviewing the risk register also helps the project manager to identify any new risks that may have occurred since the last update, and to plan appropriate responses for them. References: PMI, Project Risk Management, 2nd edition, 2019, p. 67-681

By hiring a licensed contractor to complete the complex activity, the project manager is transferring the risk associated with that activity to the contractor. This is an example of risk transfer, as the responsibility for managing the risk is shifted from the project manager to the contractor.

According to the PMI Risk Management Professional (PMI-RMP)® Handbook1, one of the domains of the PMI-RMP exam is Risk Response Planning, which involves developing options and actions to enhance opportunities and reduce threats to project objectives1. One of the strategies for negative risks or threats is risk transfer, which involves shifting the impact of a threat to a third party, such as a contractor, a vendor, or an insurer2. In this situation, the project manager is performing risk transfer by hiring a licensed contractor to complete the work that is too complex to complete internally. By doing so, the project manager is transferring the responsibility and liability of the activity to the contractor, who is expected to have the expertise and resources to handle the complexity. The project manager is not performing risk mitigation, which involves reducing the probability and/or impact of a threat2. The project manager is not performing risk acceptance, which involves acknowledging the existence of a threat and making a conscious decision to accept it without taking any action2. The project manager is not performing risk avoidance, which involves changing the project plan to eliminate the threat or protect the project objectives from its impact2. References: 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 62: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 436.

After analyzing the information collected from individual project team members, the risk manager's primary output is an updated risk register. The risk register is a key document in risk management, containing all identified risks, their analysis, and the planned responses. As new information is gathered and analyzed, the risk register is updated to reflect the current status of each risk, any changes in their probability or impact, and any adjustments to the risk response plans.

PMI emphasizes that the risk register should be continually updated throughout the project to ensure that all risks are properly managed and documented​​.

A stakeholder impact and influence analysis is a technique to identify the level of interest and power of each stakeholder, and to assess how they may affect or be affected by the project outcomes. It can help the risk manager to understand the stakeholder’s perspective and expectations, and to communicate with them effectively. In this case, the risk manager should perform a stakeholder impact and influence analysis to understand why the major investor is about to drop their intention to continue executing the project, and to address their concerns and needs. A risk impact analysis, a risk reserve analysis, and a procurement analysis are not relevant to the stakeholder’s decision, and would not help the risk manager to understand their rationale. References: PMI Risk Management Professional (PMI-RMP)® Exam Content Outline1, PMI Practice Standard for Project Risk Management2, Risk Management Professional (PMI-RMP)® Cert Guide3

When preparing risk reports for inclusion in the monthly status report for project executives, the risk manager should adhere to the format established in the risk management plan. This ensures consistency, clarity, and alignment with the overall project management framework, making it easier for executives to understand and assess the information. PMI emphasizes the importance of following established communication protocols and formats in risk reporting to maintain effective stakeholder engagement​.

When managing risks in a project that spans multiple regions with varying degrees of risk appetite, it is essential to align the project's risk thresholds with the organization's overall risk appetite. This approach ensures consistency across all regions and projects, particularly in multinational organizations where varying regional practices and risk appetites could create discrepancies. By aligning with the organizational risk appetite, the project team ensures that the risk management process adheres to the strategic objectives and governance framework set by the organization. This alignment also helps in managing stakeholder expectations and ensuring that the project remains within acceptable risk parameters set by the organization as a whole, as emphasized in the Risk Management Policy​.

The risk registry is a document that records the identified risks, their characteristics, their status, and their responses. It is a key input for risk management and a source of information for project stakeholders. The risk manager should review the risk registry first to understand the current state of the project risks, especially the ones related to the client’s vendor, and to evaluate the effectiveness of the risk responses implemented so far. Enhancing risk identification, reviewing the contingency reserves, and creating a risk response plan are possible actions that the risk manager may take after reviewing the risk registry, but they are not the first thing to do. References: PMI Risk Management Professional (PMI-RMP)® Exam Content Outline1, PMI Practice Standard for Project Risk Management2, Risk Management Professional (PMI-RMP)® Cert Guide3

The project’s contingency allowance is a provision in the project budget that is intended to cover known risks that may affect the project costs. The risk of increased fuel costs was identified and included in the contingency allowance, so the project manager should use it to process the freight invoices at the actual shipping costs. This is the best way to handle the risk without affecting the project scope, schedule, or quality. Requesting a formal change order from the customer (option B) is not necessary, as the project budget already has a provision for this risk. Processing the freight invoices for the budgeted amount and hoping the shipping company will forgive the difference (option C) is unethical and unprofessional, as it violates the terms of the contract and the PMI Code of Ethics and Professional Conduct. Asking the project sponsor to cover the additional shipping costs on the company’s reserves account (option D) is also not appropriate, as the company’s reserves are meant for unknown risks that are beyond the project’s control, not for known risks that are already accounted for in the project budget. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 72; PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), 6th ed., 2017, p. 252.

The project manager should use the contingency allowance to cover the additional shipping costs, as it was specifically included in the project budget for such risks. This approach avoids requesting unnecessary changes or relying on external sources to cover the cost overrun.

Before deciding to hire an external vendor to accelerate the delivery plan, it's essential to assess the potential internal and external factors that could influence this decision. Conducting a SWOT analysis allows the project team to systematically evaluate:

Strengths: Internal capabilities that could support the decision.

Weaknesses: Internal limitations or challenges.

Opportunities: External factors the project could capitalize on.

Threats: External factors that could pose risks.

This comprehensive assessment provides a balanced perspective, enabling informed decision-making regarding the engagement of an external vendor.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Content Outline lists SWOT analysis as a technique for assessing project risk complexity and identifying potential threats and opportunities, facilitating informed decision-making in project risk management.

According to the PMBOK® Guide, a scope change request is a formal proposal to modify any project document, deliverable, or baseline. It is an output of the Perform Integrated Change Control process, which is the process of reviewing all change requests, approving changes, and managing changes to the deliverables, organizational process assets, project documents, and the project management plan. A scope change request may introduce new risks or affect existing risks on the project, which may impact the project objectives, such as scope, schedule, cost, and quality.

The risk manager should support the project manager with the scope change request by evaluating any new risks that are introduced due to the change in scope. This is because the risk manager is responsible for planning, implementing, and monitoring the risk management activities on the project, as well as communicating and reporting the risk information to the project manager and other stakeholders. The risk manager should use the appropriate risk identification and analysis techniques, such as brainstorming, interviews, checklists, SWOT analysis, cause and effect diagrams, probability and impact assessment, etc., to identify and evaluate the new risks that may arise from the scope change. The risk manager should also document the new risks in the risk register, which is a project document that contains the details of all identified individual project risks and other relevant information.

The other options are not valid for what the risk manager should do to support the project manager with the scope change request:

Update the risk management plan to reflect the scope change: This is not a valid option because the risk management plan is a component of the project management plan, which describes how risk management activities will be structured and performed on the project. It is an output of the Plan Risk Management process, which is the process of defining how to conduct risk management activities for a project. The risk management plan should not be updated to reflect the scope change, but rather to reflect any changes in the risk management approach, methodology, roles and responsibilities, budget, timing, risk categories, definitions, reporting formats, etc. The risk management plan should be updated only when there is a change in the risk management process, not in the project scope.

Reassess the identified risks that impact the project scope: This is not a valid option because reassessing the identified risks that impact the project scope is part of the Monitor Risks process, which is the process of implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project. The risk manager should not reassess the identified risks that impact the project scope before evaluating any new risks that are introduced due to the change in scope. The risk manager should first identify and analyze the new risks, and then reassess the existing risks to determine if they are still valid, relevant, and prioritized.

Update the risk register to identify, analyze, and plan a response for any new risk: This is not a valid option because updating the risk register to identify, analyze, and plan a response for any new risk is a combination of several risk management processes, such as Identify Risks, Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis, and Plan Risk Responses. The risk manager should not update the risk register to identify, analyze, and plan a response for any new risk in one step, but rather follow the sequential and iterative risk management processes to ensure a comprehensive and consistent risk management approach. The risk manager should also coordinate and communicate with the project manager and other stakeholders when updating the risk register, as well as obtain their approval and input.

PMBOK® Guide1, Risk Management Professional (PMI-RMP)® Cert Guide1

The project manager should consult or review project contracts, lessons learned registers from analogous projects, and the risk management plan to develop an effective risk planning for the project.

According to the PMBOK® Guide, the risk management plan is one of the key inputs for the plan risk management process, which is the first process in the project risk management knowledge area. The risk management plan describes how risk management activities will be structured and performed throughout the project. It includes information such as the methodology, roles and responsibilities, budget, timing, risk categories, definitions of risk probability and impact, probability and impact matrix, revised stakeholders’ risk tolerances, reporting formats, and tracking (page 409). Therefore, option D is the correct answer.

The project contracts are also an important input for the plan risk management process, as they may contain terms and conditions that can create or affect various project risks. For example, contracts may include clauses related to penalties, incentives, warranties, intellectual property rights, termination, force majeure, arbitration, indemnification, etc. The project manager should review the project contracts to identify any potential sources of risk and plan appropriate responses (page 410). Therefore, option A is the correct answer.

The lessons learned registers from analogous projects are another valuable input for the plan risk management process, as they provide historical information and knowledge that can help the project manager identify and analyze risks, as well as plan risk responses. The lessons learned registers may contain information such as the risks that occurred, the root causes of the risks, the risk triggers, the effectiveness of the risk responses, the residual and secondary risks, the risk owners, the risk ratings, the risk trends, etc. The project manager should consult the lessons learned registers from similar or comparable projects to learn from past experiences and avoid repeating mistakes (page 411). Therefore, option B is the correct answer.

The risk register is not an input for the plan risk management process, but an output. The risk register is a document that contains the list of identified risks, their causes, potential responses, and other relevant information. The risk register is created during the identify risks process, which is the second process in the project risk management knowledge area. The risk register is then updated and refined throughout the project as more information becomes available and new risks emerge (page 414). Therefore, option C is incorrect.

The code of regulations is not an input for the plan risk management process, but a type of enterprise environmental factor. Enterprise environmental factors are the conditions, not under the control of the project team, that influence, constrain, or direct the project. The code of regulations refers to the rules and standards that govern the project’s industry, domain, or sector. The code of regulations may affect the project’s scope, schedule, cost, quality, resources, communications, procurement, and risk management. The project manager should consider the code of regulations when planning risk management activities, but it is not an artifact that needs to be reviewed or consulted (page 38). Therefore, option E is incorrect.

Mitigation involves taking proactive steps to reduce the probability or impact of a risk event. In this scenario, the facilitator anticipates the risk of attendees not receiving the product brochure due to spam filters. By advising participants to check their spam folders, the facilitator addresses the issue before it escalates, thereby reducing the likelihood of miscommunication or information loss. This preemptive action exemplifies a mitigation strategy, aiming to lessen the potential negative impact on the workshop's effectiveness.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Preparation Study Guide defines risk mitigation as "the process of implementing actions to reduce the likelihood or impact of a risk to acceptable levels," highlighting the importance of proactive measures in risk management.

 The risk matrix heat map is a graphical tool that displays the probability and impact of risks in a project. The horizontal axis represents the probability of occurrence, and the vertical axis represents the impact rating. The colors indicate the level of risk exposure, from green (low) to red (high). The risk in question is located in the upper right quadrant of the matrix, which means it has a high impact rating. The probability of occurrence can be estimated by looking at the scale on the horizontal axis. The risk is slightly to the left of the 50% mark, which means it has a probability of occurrence of about 40%. Therefore, the correct statement that describes the risk is B. The risk has a probability of 40% of occurrence and a high impact rating. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 104-105.

According to the PMBOK Guide, risk prioritization is the process of assigning a level of importance to each identified risk based on its probability and impact, as well as other factors such as urgency, stakeholder tolerance, and project objectives. Risk prioritization helps the project team to focus on the most significant risks and allocate resources accordingly. One of the tools and techniques for risk prioritization is stakeholder engagement, which involves involving the key stakeholders in the risk analysis and decision making process. Stakeholder engagement helps to ensure that the risk prioritization reflects the expectations and preferences of the stakeholders, and that they are aware of and agree with the results. By engaging the key stakeholders during the prioritization process, the risk manager could have avoided the board’s request to sort the risks differently, as the board would have been part of the process and would have accepted the outcome. References: = PMBOK Guide, 6th edition, pages 406-407; The Standard for Risk Management in Portfolios, Programs, and Projects, page 67.

A company manages confidential customer information, and a data breach exposing sensitive information was discovered. What should the risk manager do?

A. Execute the security risks contingency plan.

B. Get a report of customers affected by the risk.

C. Identify residual and secondary risks.

D. Coordinate a response with the risk owner.

Answer: D

According to the PMBOK Guide, the risk owner is the person assigned the responsibility of monitoring the risk and implementing the risk response plan. The risk owner should be involved in the risk response execution and evaluation, and should communicate the results and outcomes to the relevant stakeholders. In the case of a data breach, the risk owner should coordinate a response with the risk manager and other parties involved, such as the security team, the legal team, the customer service team, and the senior management. The risk owner should also report the status of the risk and the effectiveness of the response plan to the risk manager. The risk manager should oversee the risk response process and ensure that the risk is handled appropriately and in alignment with the project objectives and stakeholder expectations. References: = PMBOK Guide, 6th edition, pages 452-453; The Standard for Risk Management in Portfolios, Programs, and Projects, page 79.

The risk manager should use the Delphi method in this situation, as this is a technique that can help resolve differences among experts and reach a consensus on the identified risks and their characteristics. The Delphi method is a tool used to make quick decisions with consensus. This technique consists of sending several sets of anonymous questions to each expert. This is followed by a group discussion after every round. The Delphi method can help the risk manager to solicit the opinions of all experts without revealing their identities. This way, the experts can express their views freely and honestly, without being influenced or intimidated by others. The Delphi method can also reduce personal bias, ego, or emotional conflict among the participants. The risk manager can use the results of the Delphi method to create a list of potential risks and their causes, effects, and probabilities. The other options are not appropriate techniques for the risk manager to use in this situation. Brainstorming is a technique that can help generate ideas and identify risks, but it may not be effective in resolving differences among experts, as it involves open and spontaneous discussion. Focus group is a technique that can help collect requirements and opinions from stakeholders, but it may not be suitable for resolving technical disagreements among experts, as it involves a moderated and structured discussion. Checklist analysis is a technique that can help identify risks based on historical information and lessons learned, but it may not be helpful in resolving differences among experts, as it involves a predefined list of potential risks. References: 3, 4, 5

The best practice is to log the risk and the associated response strategies in the risk register to ensure it is monitored, analyzed, and managed throughout the project. The PMBOK® Guide states:

"All identified risks and their planned responses should be recorded in the risk register to facilitate ongoing monitoring and management."

— PMBOK® Guide, 6th Edition, Section 11.2.3.1

Ignoring or treating these as mere assumptions could result in unmanaged risks and potential project failure.

The risk register is a dynamic document that must capture not only planned risk responses but also the actual outcomes of risks and the effectiveness of risk responses implemented. According to the PMBOK® Guide:

“The risk register should be updated with information on the results of risk responses, risk event outcomes, and actual effectiveness of the actions taken. This enables ongoing learning and continuous improvement in risk management.”

— PMBOK® Guide, 6th Edition, Section 11.7.3.2 (Project Document Updates: Risk Register)

This ensures that both the realized outcomes of risks and the success or failure of responses are tracked for future reference and lessons learned.

The risk manager should include an escalation process in the risk management plan to address risks that may impact other projects. This ensures that any identified risks that could affect multiple projects are communicated and managed appropriately across the organization.

The risk manager should include an escalation process in the risk management plan to deal with risks that may affect other projects or the organization as a whole. An escalation process is a set of procedures that defines how and when risks should be communicated to higher levels of authority or responsibility for decision making or resolution. The escalation process should specify the criteria, roles, responsibilities, and communication channels for escalating risks. The risk manager should follow the escalation process when identifying risks that may have extensive impacts beyond the scope of the project. The other options are not appropriate actions for the risk manager to take. Contacting the risk managers of the other projects and informing them is not sufficient, as it does not ensure that the risks are properly addressed or resolved. Taking note of the extensive impact of these risks in the risk register is not enough, as it does not involve the necessary stakeholders or decision makers. Addressing the unique characteristics of these risks on a case-by-case basis is not consistent, as it does not follow a standard process or protocol. References: 2, 3, 4

Biases during risk identification can skew the perception of potential risks and their triggers. To mitigate this, the risk manager should rely on objective data, such as published operational experience reports, which provide historical data and insights into what has triggered risks in similar projects. This approach reduces the influence of biases and ensures that risk identification is based on empirical evidence rather than subjective judgments. Using these reports aligns with best practices in risk management, where decisions are data-driven and supported by documented experiences, reducing the likelihood of overlooking critical risk triggers​​.

The project manager should apply an iterative approach to risk identification, which involves continuous risk identification throughout the project lifecycle. This will help to identify and address new risks that may arise during the project.

According to the PMBOK® Guide, risk identification is the process of determining which risks may affect the project and documenting their characteristics. It is an iterative process because new risks may evolve or become known only as the project progresses through its life cycle. There are many techniques available for risk identification and assessment, such as brainstorming, interviews, checklists, SWOT analysis, cause and effect diagrams, etc. The project manager should apply an iterative approach to risk identification to ensure that all relevant risks are captured and updated throughout the project. The project manager should also involve the project team and other stakeholders in the risk identification process to obtain their input and perspectives.

The other options are not valid for the next step after explaining the importance of risk management to the team:

Review assumptions and constraints around risks: This is a technique for risk identification, but it is not the only one. The project manager should use a combination of techniques to identify risks, not just focus on one aspect. Also, reviewing assumptions and constraints is not the same as applying an iterative approach, which implies repeating the risk identification process at regular intervals or when changes occur.

Develop the risk response plans for identified risks: This is a step in the Plan Risk Responses process, which comes after the Perform Qualitative Risk Analysis and Perform Quantitative Risk Analysis processes. The project manager should not develop the risk response plans before identifying and analyzing the risks.

Determine the likelihood and impact of the risks: This is a step in the Perform Qualitative Risk Analysis process, which comes after the Identify Risks process. The project manager should not determine the likelihood and impact of the risks before identifying them.

PMBOK® Guide1, Risk Management Professional (PMI-RMP)® Cert Guide

When a risk manager needs to prioritize resources to respond to multiple identified risks, qualitative analysis is the most appropriate tool. Qualitative analysis helps in evaluating the likelihood and impact of each risk using subjective criteria, allowing the risk manager to prioritize which risks require more immediate attention or resources based on their potential impact on the project.

PMI's guidelines on risk management suggest that qualitative analysis is particularly useful in the initial stages of risk assessment, where risks are categorized and ranked based on their severity. This process helps in prioritizing risks that need immediate attention, thus optimizing the use of resources in a project​​.

To determine the total story points for the entire initiative, we must sum up the estimates provided in the backlog from the email exhibit. The backlog includes the following user stories with their respective story point estimates:

New log-in screen – 6

Save passwords – 4

Defect fixing – triaged top 10 – 8

Accessibility – color blind – 4

Increase security – 21

Shopping cart – 7

Accept credit card payments – 5

Accept bank drafts – 9

New sort order – 3

Add AI chatbot – 5

Total story points calculation:

6 + 4 + 8 + 4 + 21 + 7 + 5 + 9 + 3 + 5 = 72 story points

Thus, the total number of story points for the initiative is 72, making option A the correct answer.

The risk management plan is a document that describes how risk management activities will be structured and performed on a project. It defines the roles and responsibilities, risk categories, risk appetite and thresholds, risk identification and analysis methods, risk response strategies, risk monitoring and reporting mechanisms, and risk governance mechanisms1. The risk management plan should be aligned with the project management plan, which defines the project scope, schedule, cost, quality, and other aspects2. When an organization decides to accelerate a key project, it means that the project objectives, assumptions, constraints, and environment have changed. This will affect the risk exposure and profile of the project, as well as the risk management approach and resources. Therefore, the first action for the project risk manager to take is to revise the risk management plan to reflect the new situation and ensure that the risk management process is still effective and efficient. Revising the risk management plan may involve updating the risk categories, risk appetite and thresholds, risk identification and analysis methods, risk response strategies, risk monitoring and reporting mechanisms, and risk governance mechanisms to suit the accelerated project. The project risk manager should also communicate the revised risk management plan to the relevant stakeholders and obtain their approval and support1. Ensuring sufficient resources are available, updating the risk register, and meeting with the project’s stakeholders are all important actions to take when accelerating a project, but they are not the first action. These actions should be done after revising the risk management plan, as they depend on the updated risk management approach and process. For example, the project risk manager may need to allocate more resources to risk management activities, identify and analyze new or changed risks, implement new or modified risk responses, and report the risk status and performance to the stakeholders based on the revised risk management plan1. References: 2, 1.

When a project is accelerated, the risk landscape changes. The project risk manager should first revise the risk management plan to address the new timeline and its potential impacts on the project. This will help in identifying new risks, reassessing existing risks, and updating risk responses.

 A SWOT analysis is a risk identification technique that helps to identify high-level and strategic project risks by examining the internal and external factors that may affect the project objectives. A SWOT analysis involves listing the strengths, weaknesses, opportunities, and threats of the project, and then analyzing how they may impact the project positively or negatively. A SWOT analysis can help to uncover potential risks that may not be obvious from other techniques, such as prompt lists, interviews, or brainstorming12

 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 10 2: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Seventh Edition, page 11.2.2.1

The first element the risk owner should look for in the response plan is to verify that due dates for the actions have been identified. This ensures that risk mitigation actions are timely and can be effectively monitored.

 After identifying the risks and assigning risk owners, the next step is to develop risk response plans that describe how to address each risk. The first element that the risk owner should look for in the response plan is the due date for the actions that are required to implement the response. The due date is important because it helps to prioritize the risk response activities, monitor the progress of the risk response, and ensure that the response is executed in a timely manner. The due date also helps to align the risk response with the project schedule and avoid any delays or conflicts. The other elements, such as the probability of a secondary risk, the impact on the quality of the components, and the relationship with the critical path, are also relevant for the risk response plan, but they are not the first element that the risk owner should look for. References: PMI, 2017. A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Newtown Square, PA: Project Management Institute, Inc., pp. 407-4081

An affinity diagram is a tool used to visually organize and group risks or ideas based on their similarities and categories. It helps in structuring the risks for further analysis and discussion. (Reference: PMBOK Guide, 6th Edition, p. 138)

 According to the PMBOK Guide, an affinity diagram is a tool and technique for the identify risks process that allows large numbers of ideas to be sorted into groups for review and analysis. An affinity diagram can help the risk manager to visually organize the risks identified in the pre-workshop survey by grouping them into categories based on their similarities or common characteristics. This can help the risk manager to facilitate the risk analysis and prioritization in the workshop, as well as to stimulate new patterns of thinking and generate additional risks.

Some of the other options are not relevant or appropriate for the question scenario:

The analytical hierarchy process is a technique for the plan risk management process that provides a method for comparing and ranking alternatives based on multiple criteria. It is not a tool for visually organizing risks.

A SWOT analysis is a technique for the identify risks process that examines the project from the perspective of its strengths, weaknesses, opportunities, and threats. It is not a tool for visually organizing risks, but rather for generating them.

Assigning probability and impact is a technique for the perform qualitative risk analysis process that assesses the likelihood and the potential effect of each individual risk on the project objectives. It is not a tool for visually organizing risks, but rather for evaluating them.

PMBOK Guide, 6th edition, pages 397-399, 414-415, 431-432, 441-442; PMI-RMP Exam Content Outline, 2015, page 7.

The The project manager should include secondary and residual risks as part of the risk response plan. Secondary risks are those risks that arise as a direct result of implementing a risk response to a specific risk. Residual risks are those risks that are expected to remain after the planned responses of risks have been taken, as well as those that have been deliberately accepted. Both secondary and residual risks should be identified, analyzed, and monitored throughout the project life cycle. The project manager should communicate the risk response plan to the project sponsor and other stakeholders, and explain how the project team has planned to manage the secondary and residual risks12

 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 10 2: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Seventh Edition, page 11.2.2.1

project manager should include secondary and residual risks in the risk response plan, as they may still impact the project. Proactively addressing these risks will help the project team to be prepared and manage them effectively if they occur.

The project manager should have performed risk identification exercises for the full lifecycle of the project, including the construction phase, to ensure that all potential risks were identified and addressed in the risk register.

Risk identification is the process of determining the risks that may affect the project and documenting their characteristics. Risk identification should be performed throughout the project lifecycle, as new risks may emerge or change over time. Risk identification should also consider all aspects of the project, such as scope, schedule, cost, quality, resources, stakeholders, and procurement. By performing risk identification exercises for the full lifecycle of the project, the project manager could have identified and planned for the potential risks associated with the construction phase, such as delays, material shortages, quality issues, or safety hazards. This would have helped to prevent or mitigate the impact of the risk event that occurred, and to ensure that the risk register is updated and comprehensive. Performing a Monte Carlo sensitivity analysis, adding generic construction risks, or reviewing the assumptions/exclusions register are not sufficient or effective ways of identifying the specific risks that may affect the project during the construction phase. These are either tools for risk analysis, risk response planning, or project initiation, but not risk identification. References: PMI-RMP® Certification Handbook1, page 9; PMBOK® Guide, pages 397-398.

When there is confusion among risk action owners about when to initiate risk responses, it suggests that the risk thresholds and triggers may not be well-defined or understood. Revisiting and clarifying these thresholds and triggers can help ensure that everyone involved understands the specific conditions under which a risk response should be initiated. This will reduce confusion and ensure that risk responses are executed consistently and appropriately.

PMI’s risk management practices emphasize the importance of clearly defined risk thresholds and triggers to guide the timely and effective implementation of risk responses​​.

The project manager should discuss the identified risks with the project team to ensure that everyone is aware of the potential risks and can provide input on the likelihood and impact of each risk. This collaborative approach will help in developing a comprehensive risk management plan.

The project manager should discuss and evaluate the identified risks with the project team, as this is part of the risk identification process. The project manager can use their experience from previous projects to identify potential risks that may occur again on the new project, but they should also involve the project team to obtain their input and perspectives. The project team can help the project manager to validate, refine, and prioritize the identified risks, as well as to suggest possible risk responses. The project manager should document the identified risks and their characteristics in the risk register, which is a tool for risk management. The other options are not appropriate actions for the project manager to take. Implementing the risk response strategies into the risk plan is premature, as the project manager should first analyze and evaluate the risks before deciding on the best response strategies. Informing the sponsor that these risks should be added according to experience is not sufficient, as the project manager should also consult the project team and other stakeholders to ensure that all relevant risks are identified and assessed. Adding the risks to the risk register and determining a contingency is part of the risk analysis and response planning processes, which come after the risk identification process. The project manager should first discuss and evaluate the identified risks with the project team before moving to the next steps of risk management. References: 2, 3, [5]

 According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to use the information from project documents, lessons learned, and other sources to facilitate the risk identification process1. A risk workshop is a tool and technique for risk identification that involves bringing together the project team, stakeholders, subject matter experts, and risk management experts to identify and analyze the project risks in a structured and collaborative manner2. In this scenario, the risk manager should use the information from the issues and unexpected results found in the first phase of the project for a risk workshop, to avoid the previous issues in the next phase. The risk workshop will help the risk manager and the project team to identify the root causes of the issues, assess their probability and impact, and develop appropriate risk responses. The risk workshop will also enable the risk manager to update the risk register and the risk report with the new information and communicate the risk status to the relevant stakeholders. The risk manager should not improve monitoring and controlling of activities, because that is not a specific action to avoid the previous issues, but rather a general practice that should be done throughout the project life cycle3. The risk manager should not document the issues in the lessons learned, because that is not enough to avoid the previous issues, but rather a way to capture and share the knowledge gained from the project for future reference4. The risk manager should not create an issue log to share with the team, because that is not a proactive risk management technique, but rather a reactive way to track and resolve the issues that have already occurred5. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 4003: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 4564: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 1005: What Is an Issue Log? Templates & Tips6.

The full risk description is the first thing that the risk manager should complete before moving forward with the risk response planning. The full risk description is a detailed statement that describes the risk, its causes, its effects, and its context. It provides the basis for the risk analysis and the risk response planning. The risk categorization, the risk simul-ation, and the risk response plan are possible steps that the risk manager may take after completing the full risk description, but they are not the first thing to do. References: PMI Risk Management Professional (PMI-RMP)® Exam Content Outline1, PMI Practice Standard for Project Risk Management2, Risk Management Professional (PMI-RMP)® Cert Guide3

When a risk manager notices that the risk register is missing key data, the most critical information they will require first includes the risk description, risk probability, and risk impact. These elements are fundamental to understanding each risk and planning appropriate responses. The risk description provides a clear understanding of what the risk is, while the probability and impact help in assessing the severity and likelihood of the risk occurring, which are essential for prioritizing and managing risks effectively.

PMI’s risk management guidelines emphasize the importance of having these core data points to effectively manage risks throughout the project lifecycle​​.

According to the PMBOK Guide, the risk response plan is the set of actions that the project team will take to address the identified risks. The risk response plan should be reviewed and updated periodically throughout the project lifecycle, as new risks may emerge or existing risks may change. The risk owners are the persons assigned the responsibility of monitoring the risks and implementing the risk response actions. The risk owners should work with the risk manager and other stakeholders to evaluate the effectiveness of the risk response plan and make any necessary adjustments. In this case, the risk manager should ask the risk owners to review the risk response plan and see if there are any alternative or additional actions that can be taken to deal with the delay caused by the external team. Starting a quantitative analysis, crashing the schedule, or transferring the risk are not appropriate actions for this situation, as they are either too late, too costly, or too risky. References: = PMBOK Guide, 6th edition, pages 452-453; The Standard for Risk Management in Portfolios, Programs, and Projects, page 79.

Documenting the results of the risk monitoring and controlling process is important for creating lessons learned. This helps future projects by providing a reference for risk management practices and experiences.

The documentation of the results of monitoring and controlling risks is a valuable source of information for lessons learned. Lessons learned are the documented information that reflects both the positive and negative experiences of a project. They represent the organization’s commitment to project management excellence and the project manager’s opportunity to learn from the actual experiences of others. By documenting the results of monitoring and controlling risks, the project team can capture the effectiveness of the risk responses, the changes in the risk exposure, the root causes of the risks, the best practices and the lessons learned for future projects. This documentation can help to improve the risk management process, enhance the project performance, and increase the organizational knowledge base. References: PMI Risk Management Professional (PMI-RMP) Examination Content Outline and Specifications1, page 10; A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 406; Lessons learned - PMI.

The project charter is the first resource the project manager should reference to determine the risk tolerance and risk attitudes of the project’s key stakeholders, as it contains information such as the project purpose, objectives, success criteria, high-level risks, and key stakeholder list. The project charter is an output of the Develop Project Charter process, which is part of the Initiating process group. The project charter provides the project manager with the authority to apply organizational resources to project activities and establishes a partnership between the performing organization and the requesting organization. References: PMBOK Guide, 6th edition, page 81-82.

Enterprise environmental factors (EEFs) provide information about the organization's culture, risk tolerance, and risk attitudes, which can help the project manager determine the risk tolerance and risk attitudes of the project's key stakeholders. (Reference: PMBOK Guide, 6th Edition, p. 39)

The risk manager should choose to exploit opportunities, as this response aims to maximize the positive effects of opportunities, which can help recover the project's contingency reserve and profit margin.

Exploit is a positive risk response strategy that aims to ensure that the opportunity is realized 1. It involves eliminating the uncertainty associated with a particular upside risk and making it happen 2. For example, if there is an opportunity to reduce the project cost by using a cheaper supplier, the project manager can exploit it by signing a contract with the supplier and securing the savings. Exploit is the opposite of avoid, which is a negative risk response strategy that seeks to eliminate the threat or protect the project from its impact 2.

The other options are not appropriate for taking full advantage of opportunities. Mitigate is a negative risk response strategy that reduces the probability and/or impact of a threat 2. It is the opposite of enhance, which is a positive risk response strategy that increases the probability and/or impact of an opportunity 1. Accept is a risk response strategy that involves acknowledging the risk and not taking any action unless the risk occurs 2. It can be applied to both threats and opportunities, but it does not actively pursue them. Transfer is a negative risk response strategy that shifts the impact of a threat to a third party, along with ownership of the response 2. It is the opposite of share, which is a positive risk response strategy that allocates ownership of an opportunity to a third party who is best able to capture it for the benefit of the project 1.

According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, a secondary risk is a risk that arises as a direct result of implementing a risk response to a specific risk. In this case, the risk response is to contract an external vendor to provide additional capacity and expertise to the project team. The secondary risk is the confidentiality risk that the contracts department has identified. The risk manager should assess the secondary risk to determine its probability, impact, and priority, and to plan appropriate responses. This is part of the Perform Qualitative Risk Analysis and Plan Risk Responses processes in the PMBOK® Guide2. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline 2: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition

For complex projects, facilitating a risk identification exercise with key stakeholders ensures thoroughness. PMBOK® Guide recommends:

"Formal risk identification with all relevant stakeholders is critical, particularly in complex projects, to ensure all potential risks are recognized."

— PMBOK® Guide, 6th Edition, Section 11.2

When facing resistance from team members, the risk manager should engage in open communication to address their concerns and clarify the importance of risk management in the project.

According to the PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1, the risk manager should handle this situation by meeting with team members to address their concerns. This is because:

Resistance to risk management is a common challenge that can hinder the effectiveness and efficiency of the risk management process. Resistance can stem from various factors, such as lack of awareness, understanding, commitment, trust, or support for risk management; fear of negative consequences or blame; competing priorities or interests; or cultural differences or biases.

Meeting with team members to address their concerns is a proactive and constructive way to overcome resistance and foster a positive risk culture within the project. By meeting with team members, the risk manager can:

Communicate the value and benefits of risk management for the project and the organization, such as improving decision-making, enhancing performance, increasing stakeholder satisfaction, and reducing uncertainty and variability.

Educate and train team members on the risk management principles, processes, tools, and techniques, and how they can be applied to the project context and objectives.

Involve and empower team members in the risk management activities, such as identifying, analyzing, prioritizing, responding, and monitoring risks, and solicit their feedback and suggestions for improvement.

Recognize and reward team members for their contributions and achievements in risk management, and celebrate the successful outcomes and opportunities realized by the project.

The other options are not effective in handling this situation because:

Continuing to implement the risk strategy without addressing the resistance can lead to further conflict, resentment, and distrust among the team members, and undermine the quality and credibility of the risk management process and outputs.

Reducing the number of risk management activities can compromise the project’s ability to identify and respond to the risks that may affect its scope, schedule, cost, quality, or other objectives, and expose the project to unnecessary threats or missed opportunities.

Raising the concerns with the project sponsor can escalate the issue and create a negative impression of the team members, and may not resolve the underlying causes of the resistance or improve the team’s engagement and commitment to risk management.

PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1

Risk Management Professional (PMI-RMP)® Exam Cert Guide2

Including project risks as a permanent agenda item in periodic project progress meetings helps in several ways:

1. Monitoring Variances and Trends (A): Regular discussions on risks allow the project team to monitor any variances and trends in the project’s risk profile. This ongoing assessment ensures that any deviations from the expected risk levels are promptly identified and addressed.

2. Utilization of Lessons Learned (C): Frequent risk discussions enable the project team to apply lessons learned from previous risks more effectively. This helps in refining risk responses and improving the overall risk management process.

3. Updating the Risk Register and Closing Out Expired Risks (E): Regular meetings ensure that the risk register is consistently updated, including the closure of risks that are no longer relevant or have expired. This keeps the risk management documentation current and accurate, which is essential for effective project management​.

When a project lacks predefined organizational process assets (OPAs) related to risk categories, the risk manager can utilize the Work Breakdown Structure (WBS) to identify potential project risk categories. The WBS decomposes the project scope into manageable components, providing a hierarchical representation of all deliverables and work packages. By analyzing each element of the WBS, the risk manager can systematically identify areas where risks may arise, effectively categorizing them based on project activities and deliverables. This approach ensures a comprehensive assessment of potential risks across all aspects of the project, facilitating targeted risk management efforts.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Preparation Study Guide notes that "the WBS serves as a foundational tool for risk identification, enabling project teams to systematically examine each component for potential risks and categorize them appropriately."

The project risk manager should monitor risk thresholds closely, as they represent the organization's risk appetite. In a project with a low risk appetite, it is essential to ensure that risks are managed within the defined thresholds to address stakeholders' concerns and maintain their confidence in the project's success.

According to the PMI Risk Management Professional (PMI-RMP) Reference Materials, risk thresholds are the measure of acceptable variation around an objective that reflects the risk appetite of the organization1. Risk appetite is the degree of uncertainty an entity is willing to take on in anticipation of a reward2. In this case, the project has a significant impact on the organization and the stakeholders have a low risk appetite, meaning they are not willing to accept much deviation from the project objectives. Therefore, the project risk manager should monitor the risk thresholds closely to ensure that the project risks do not exceed the acceptable level of variation and impact the project performance negatively. By monitoring the risk thresholds, the project risk manager can also identify when risk responses are needed and evaluate their effectiveness.

 According to the PMBOK Guide, 6th edition, Section 11.6.2.1, Sensitivity Analysis, a sensitivity analysis is a technique that helps to determine which individual project risks or other sources of uncertainty have the most potential impact on project outcomes. A sensitivity analysis can be used to prioritize risks based on their relative effect on the project objectives, such as cost, schedule, quality, or scope. A sensitivity analysis can also help to identify areas where risk response efforts may be most effective. Therefore, the risk manager should perform a sensitivity analysis and determine the correct priority of every identified risk, rather than agreeing with the SME or the project sponsor, or marking every risk with the same or different priority without proper analysis. References: PMBOK Guide, 6th edition, Section 11.6.2.1, Sensitivity Analysis1

The risk manager should perform a sensitivity analysis to assess the impact of each risk on the project objectives. This will help in determining the correct priority of every identified risk, ensuring that resources are allocated effectively and that the most critical risks are addressed first.

Residual risk refers to the remaining risk after implementing risk responses or controls. In this scenario, despite the policy requiring complex passwords and regular updates, some employees' inability to comply increases the likelihood of password compromise. This non-compliance elevates the residual risk beyond acceptable levels. The risk manager should reassess the residual risk to determine its current status and evaluate whether additional controls or actions are necessary to mitigate the heightened threat. This reassessment ensures that the organization's risk management strategies remain effective and aligned with its security objectives.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Preparation Study Guide defines residual risk as "the risk that remains after risk responses have been implemented," highlighting the need for continuous monitoring and reassessment to address any changes in risk exposure.

The main output of the stakeholder meeting in the initiation phase is to identify threats and opportunities that may impact the project in a positive or negative way. This information will be used to develop the risk management plan.

The meeting that the project stakeholders are invited to in the initiation phase is part of the Identify Risks process. The purpose of this process is to identify the risks that may affect the project objectives in a positive or negative way, and to document their characteristics. The main output of this process is the risk register, which is a document that contains the list of identified risks, their causes, potential responses, and other relevant information. The risk register is an essential input for the subsequent risk management processes, such as Perform Qualitative Risk Analysis, Perform Quantitative Risk Analysis, Plan Risk Responses, and Monitor Risks. Therefore, the correct answer is B. Identifying threats and opportunities. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 79-80, 86-87.

The project manager should assess and record associated secondary risks and proceed to treat them as any other risks. This involves identifying and evaluating the potential negative health effects of using pesticides and developing a plan to mitigate these risks. While it is important to consider the concerns of residents, the health authorities have determined that not moving forward with the plan will have more serious consequences on public health.

 Secondary risks are those that arise as a direct outcome of implementing a risk response. In this case, the use of pesticides is a risk response to limit the risks of harmful insects, but it may also cause negative health effects to some residents. This is a secondary risk that needs to be assessed and recorded in the risk register, along with its probability, impact, and response plan. The project manager should not suspend the project, as this would ignore the primary risk of harmful insects. The project manager should not consult with health experts to provide a risk trigger, as this is not a valid risk management technique. A risk trigger is an indication that a risk event is about to occur or has occurred, not a condition that prevents a risk response from being implemented. The project manager should not proceed with the project as normal, as this would neglect the secondary risk and its potential consequences. The project manager should follow the risk management process and treat the secondary risk as any other risk in the project. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Chapter 11: Project Risk Management, p. 408. 5

A risk register should be developed before submitting a formal bid response to help the company understand the project's risk profile and account for potential risks in their proposal. This allows the company to make informed decisions about cost, schedule, and resources. (Reference: Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, Section 11.2)

A risk register is a document that is used as a risk management tool to identify potential setbacks within a project. A risk register is typically created at the start of a project (before it begins), and is regularly referenced and updated throughout the life of a project through deliberate risk monitoring and control1. A risk register is an important component of any successful risk management process and helps mitigate potential project delays that could arise. A risk register is shared with project stakeholders to ensure information is stored in one accessible place2. A risk register also helps to establish a hierarchy of risks, starting with the most impactful. The goal should be to have a path to mitigating those risks, reducing the harm they cause, or eliminating them. The register should also outline what’s considered an acceptable level of risk and how to set up insurance to help offset the impacts3. Therefore, a risk register should be developed before a formal bid response is provided to the client to gain a greater understanding of the project’s risk profile. This will help to estimate the project costs, schedule, and scope more accurately and realistically, as well as to identify the contingency plans and reserves needed to deal with the potential risks. Developing a risk register during the project execution phase, when a client project kick-off meeting is held, or after a project budget is set up with a purchase order are all too late to effectively identify and manage the risks that could affect the project success. References: 2, 3, 1, 4

According to the PMBOK Guide, the risk owner is the person assigned the responsibility of monitoring the risk and implementing the risk response plan. The risk owner should be involved in the risk response execution and evaluation, and should communicate the results and outcomes to the relevant stakeholders. In the case of a data breach, the risk owner should coordinate a response with the risk manager and other parties involved, such as the security team, the legal team, the customer service team, and the senior management. The risk owner should also report the status of the risk and the effectiveness of the response plan to the risk manager. The risk manager should oversee the risk response process and ensure that the risk is handled appropriately and in alignment with the project objectives and stakeholder expectations. References: = PMBOK Guide, 6th edition, pages 452-453; The Standard for Risk Management in Portfolios, Programs, and Projects, page 79.

The risk manager should perform a quantitative risk analysis to determine the potential impact of risks on the project's completion date. This will help in providing a more accurate project completion date to the customer, considering the risks and their potential effects on the project schedule.

 According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Analysis is to perform quantitative risk analysis using techniques such as Monte Carlo simul-ation, decision tree analysis, sensitivity analysis, etc., to quantify the possible outcomes for the project and their probabilities, and to evaluate the cost and schedule impacts of risks1. In this scenario, the risk manager should perform a quantitative risk analysis and update the results, because the project costs have increased significantly and the customer has imposed a strict deadline for the project completion. A quantitative risk analysis will help the risk manager to estimate the probability of meeting the project objectives, such as cost and schedule, and to determine the appropriate contingency reserves for the project. A quantitative risk analysis will also provide more accurate and reliable information for the customer and the project team, and will support the risk response planning process2. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 92: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, pages 431-432.

Stakeholder engagement is critical in risk management, especially when decisions may impact project deliverables. By involving stakeholders more in risk management activities and decision-making processes, the risk manager could have ensured that all parties were aware of potential changes and their implications. This engagement helps in securing stakeholder buy-in and support, thus preventing situations where stakeholders might oppose decisions after the fact. PMI’s risk management framework emphasizes the importance of continuous and active stakeholder engagement throughout the project lifecycle​.

In complex projects with multiple deliverables, locations, and stakeholders, best practice is to combine individual risk identification (e.g., interviews, surveys) with group-based methods (e.g., focus groups, workshops) to ensure comprehensive risk coverage and diverse input. According to the PMBOK® Guide:

“Both individual and group risk identification techniques are valuable. Combining interviews (individual) with facilitated workshops or focus groups (group) can help identify risks at all levels and build a comprehensive risk register for the overall project.”

— PMBOK® Guide, 6th Edition, Section 11.2.2.2 (Data Gathering: Interviews, Facilitation)

ISO 31000 also recommends a mix of approaches to ensure risks are not overlooked due to limited perspectives.

The project manager should first gather more information about the previous project's issues by interviewing the other project manager. This will help in understanding the root causes of the delay and how to prevent similar issues in the current project before taking further action.

 The project manager should first include the risk of delay in delivery of the GTG in the risk register and communicate with the stakeholders about the potential impact and response strategies. This is part of the risk identification process, which is the first step in risk management. The risk register is a document that records the identified risks, their causes, effects, probabilities, impacts, and response plans. The project manager should communicate with the stakeholders to ensure that they are aware of the risk and its implications, and to obtain their feedback and support. The project manager should also update the risk register as new information becomes available or as the risk status changes. The other options are not the first actions that the project manager should take. Communicating with the client to provide the previous shutdown plan is part of the risk response process, which comes after the risk identification and analysis processes. Reviewing and updating the project schedule is part of the schedule management process, which is not directly related to risk management. Interviewing the other project manager to learn more details is a technique that can be used to identify risks, but it is not the first action that the project manager should take. The project manager should first document the risk in the risk register and communicate with the stakeholders before seeking more information from other sources. References: 3, 4, 5

The risk manager's request to include Field 2 in the scope of the current project is a clear attempt to increase the project’s profitability by expanding its scope to a more lucrative area. This type of request is aimed at increasing project earnings, as it involves altering the project’s objectives to capture a more significant financial opportunity.

According to PMI, requests that seek to modify project scope for financial gain are typically categorized as efforts to increase project earnings or revenue​​.

The project manager should evaluate the risk with the team and update the issueing to address the concerns of the stakeholders and local businesses.

This concern is a potential risk that could affect the project’s reputation, stakeholder satisfaction, and profitability. The project manager should evaluate the risk with the team and update the issue log, which is a tool for documenting and monitoring the resolution of issues that arise during the project. The issue log should include information such as the issue description, the priority, the owner, the status, and the actions taken. The project manager should also communicate with the stakeholders and the local businesses to address their concerns and seek a mutually beneficial solution. The project manager should not ignore the concern, as it could escalate into a bigger problem. The project manager should not discuss the concern with the local business owners alone, as this could bypass the stakeholders and create more conflicts. The project manager should not update the key risks and perform a quantitative risk analysis, as this is a time-consuming and complex process that may not be necessary for this type of risk. The project manager should not adjust the construction work hours to after business hours, as this could incur additional costs, disrupt the project schedule, and affect the workers’ safety and productivity. References: PMI, 2017. A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Newtown Square, PA: Project Management Institute, Inc., pp. 115-116, 408-4091