APM Project Risk Management Level 1 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of risk

An uncertain event or set of events that, if it occurs, affects the achievement of objectives, combining probability of occurrence with impact on those objectives.

Risk exposure formula

Risk exposure equals probability multiplied by impact. It produces an expected value used to rank threats and opportunities on a common scale.

Threat versus opportunity

A threat is an uncertain event whose occurrence has a negative effect on objectives. An opportunity is an uncertain event whose occurrence has a positive effect.

Individual versus overall risk

Individual risk is a single uncertain event with its causes and effects. Overall project risk is the aggregate effect of all uncertainty sources on project objectives.

Residual and secondary risk

Residual risk remains after planned responses are applied. Secondary risk is a new risk created by implementing a response.

Risk appetite versus tolerance

Risk appetite is the amount of risk an organization is willing to seek or accept. Risk tolerance is the acceptable variation around a specific objective.

Risk management framework contents

A framework comprises risk policy, defined roles and responsibilities, the risk process, supporting tools and techniques, and reporting arrangements.

Risk ownership and escalation

Risk owners own individual risks and responses. The project board or sponsor owns overall project risk. Risks above defined thresholds are escalated upward.

Risk management plan

A document describing the approach, methodology, roles, funding, timing, risk categories, appetite and tolerance, and reporting formats for risk management.

Risk breakdown structure

A hierarchical, source-based categorization of risk (e.g., technical, commercial, external) used to structure identification and ensure balanced analysis.

Risk context factors

Internal context includes objectives, culture, capability and resources. External context includes market, regulatory, political, technological and environmental factors affecting risk.

Identification techniques

Methods to find risks include brainstorming, interviews, Delphi, checklists, prompt lists, SWOT analysis, assumption analysis and cause-and-effect diagrams.

Assumptions as risk sources

An assumption is something believed true but unproven. If it proves false, or a constraint is breached, it becomes a risk to objectives.

Risk register entry contents

A register entry records a unique identifier, cause, event, effect, category, owner, initial assessment and current status for each risk.

Iterative identification

Risk identification is repeated throughout the project, at phase gates and after significant change, rather than performed once at the start.

Qualitative risk analysis

Assessment of probability and impact using defined scales to produce a risk rating, prioritize risks and decide which need further analysis or response.

Probability-impact matrix

A grid mapping assessed probability against assessed impact to derive a risk rating; ratings above tolerance trigger escalation or active response.

Expected monetary value

EMV equals probability multiplied by monetary impact. Threat EMV is negative; opportunity EMV is positive. EMVs can be summed across a risk set.

Monte Carlo simulation

A quantitative technique running many iterations of cost or duration distributions to produce a probability distribution of project outcomes, such as P50 and P80.

Sensitivity analysis

Analysis, often shown as a tornado diagram, ranking which risks or variables most influence the outcome, guiding where analysis and response effort should focus.

Decision tree analysis

A technique comparing options by expected value across branches, incorporating the probabilities and payoffs of each possible outcome.

Threat response strategies

The strategies for threats are avoid, reduce (mitigate), transfer, accept (retain) and escalate. Each response requires an owner and planned actions.

Opportunity response strategies

The strategies for opportunities are exploit, enhance, share and accept (or escalate). Exploit ensures realization; enhance raises probability or impact.

Transfer of risk

Transfer shifts the financial consequence of a threat to a third party, for example through insurance, contract terms or warranty. The risk itself is not removed.

Contingency and fallback plans

A contingency plan is triggered if a defined risk occurs. A fallback plan is used if the primary response fails or is insufficient.

Risk monitoring activities

Monitoring tracks risk status, response progress, residual exposure and changes in probability or impact, using early warning indicators and scheduled reviews.

Risk reporting metrics

Typical metrics include top risks by rating, exposure trend over time, overdue responses, and the count of risks exceeding tolerance.

Risk closure criteria

A risk is closed when evidence shows it is no longer relevant or it has occurred and been managed. Closed risks are archived for lessons learned.

Lifecycle risk profile

Uncertainty and risk exposure are highest in early phases such as concept and definition, and generally reduce as design and delivery progress.

Early influence on risk

The greatest ability to influence outcomes at lowest cost exists in early lifecycle phases; late changes carry higher cost and greater risk.

Risk maturity progression

Maturity models describe progression from ad hoc, reactive risk handling through defined and managed practice to optimized, embedded and risk-informed decision making.

Risk culture

Risk culture is the shared attitudes and behaviors toward risk, including whether people raise risks openly and whether bad news travels upward without blame.