APM Project Risk Management Level 1 common mistakes
APM Project Risk Management Level 1 · Understand the traps and how to avoid them.
Treating 'risk' as synonymous with 'threat', so any question asking for a risk response gets only avoidance/reduction/mitigation answers, and opportunity-type options are dismissed as distractors.
Everyday usage of the word 'risk' is negative, and candidates carry that into the exam, forgetting the APM definition covers both threats and opportunities and that responses are chosen by probability/impact direction.
What to do instead
Before answering any response question, explicitly classify the item as threat or opportunity, then recall the paired response sets (threats: avoid, reduce, transfer, accept, share? - opportunities: exploit, enhance, share, accept, reject). Check whether an opportunity option fits before eliminating it.
Confusing risk 'ownership' with risk 'action/treatment responsibility' and assigning the same person to both without justification, or naming the project manager as owner of every risk.
Candidates conflate accountability for managing the risk with doing the mitigation task, and default to the PM because they cannot imagine delegating.
What to do instead
Learn the distinction: the risk owner is accountable for managing the risk and its response (often the person who best controls the uncertainty), while action owners execute specific response actions. If a question asks who should own a risk, choose the role with authority and proximity to the cause, not automatically the PM.
Choosing a qualitative or quantitative technique by name recognition rather than by matching the technique to the question's purpose, e.g. answering 'Monte Carlo' whenever numbers appear, or 'risk matrix' whenever prioritisation is mentioned.
Technique names are memorised as vocabulary rather than as tools with defined inputs, outputs and applicability, so candidates pattern-match on surface words.
What to do instead
Build a technique-selection table: purpose (prioritise vs quantify aggregate effect vs model cost/schedule confidence), inputs required (data availability, independence assumptions), and output. Practise 'which technique and why' questions where two plausible techniques appear.
Treating risk identification as a one-off activity at project start, so questions about when to re-identify risks or update the register are answered with 'at the start' or 'at gate reviews only'.
Linear mental models of the lifecycle persist from general project management study, and the iterative nature of risk management is under-weighted.
What to do instead
Anchor on the principle that identification is continuous and triggered by change: scope changes, stage boundaries, issue occurrence, lessons learned, stakeholder changes. When a question mentions a change event, look for the option that revisits identification and the register.
Mixing up risk, issue, assumption and dependency, e.g. logging a problem that has already happened as a risk, or treating an assumption as a fact needing no monitoring.
The definitions overlap in plain English, and candidates answer on the basis of the scenario's narrative rather than the formal test of whether the event is certain and already occurring.
What to do instead
Apply three tests to every scenario item: has it happened yet (issue vs risk)? Is it uncertain (risk) or taken as true pending confirmation (assumption)? Is it within the project's control (risk) or reliant on an external party (dependency)? State the test result before selecting.
Answering governance questions with generic 'the PM should escalate' or 'the sponsor decides' without reference to defined tolerances, thresholds and delegated authority.
Candidates lack fluency with tolerance and escalation-threshold concepts and fall back on hierarchy intuition rather than the framework's decision rules.
What to do instead
Learn the escalation logic: risks within tolerance are managed at the level that owns them; those breaching tolerance or thresholds escalate to the next governance level with defined authority. Practise questions that give a tolerance figure and a risk exposure and ask what happens next.
Confusing risk appetite, risk attitude, risk tolerance and risk threshold, using them interchangeably in definitions and scenario answers.
The terms are closely related and often taught together, so candidates learn them as a cluster without distinct operational meanings.
What to do instead
Memorise one-line discriminators: appetite = willingness to take risk in pursuit of objectives; attitude = the prevailing mindset/behaviour toward risk; tolerance = acceptable deviation from objectives/limits; threshold = the specific point at which action or escalation is triggered. Test each against a short scenario until the mapping is automatic.
Describing risk responses in vague verbs ('monitor it', 'manage it', 'raise awareness') instead of naming a recognised response strategy and the concrete action that implements it.
Candidates answer in the language of everyday management rather than the framework's response taxonomy, and vague options feel safe.
What to do instead
For every response question, name the strategy first (avoid/reduce/transfer/accept for threats; exploit/enhance/share/accept for opportunities) and then check the action matches that strategy. Reject options that cannot be mapped to a named strategy.
Ignoring secondary risks and residual risk after a response is chosen, so questions asking what must be recorded or reviewed after treatment are answered as if the risk were closed.
Responses are mentally modelled as removing the risk entirely, and candidates do not habitually ask 'what new risk does this response create, and what exposure remains?'
What to do instead
After selecting any response, run a two-question check: does the response introduce a new risk (secondary), and what exposure remains (residual)? Look for the option that updates the register and reassesses rather than the option that closes the risk.
Treating risk reporting as a status-update activity, choosing options about frequency or format over options about decision-useful content such as exposure trends, movement against tolerance and escalated risks.
Reporting is associated with routine progress communication, and candidates underestimate the exam's emphasis on reporting as a decision-support and escalation mechanism.
What to do instead
Judge reporting options by whether they enable a decision: exposure against tolerance, changes since last period, top risks and their owners, and escalation requests. Prefer content-and-purpose options over format-and-cadence options unless the question explicitly asks about cadence.