I85PREP
⌘ K
APM Project Risk Management Level 1 study materials
APM Project Risk Management Level 1 study resources

APM Project Risk Management Level 1 practice questions

One question at a time. Build your APM Project Risk Management Level 1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk management fundamentals, principles and terminology

In project risk management, how is 'risk' best defined?

  1. Any deviation from the approved project schedule baseline
  2. A documented lesson learned from a previous project
  3. An uncertain event that, if it occurs, affects project objectives Correct answer.
  4. A confirmed problem that the project team must resolve

Explanation

Risk is defined by uncertainty combined with potential effect on objectives; it has not yet happened. A problem that has occurred is an issue, not a risk.

Question 2Risk management fundamentals, principles and terminology

Which two dimensions are combined when assessing the level of a risk exposure?

  1. Probability of occurrence and impact on objectives Correct answer.
  2. Risk appetite and risk budget
  3. Cost baseline and schedule baseline
  4. Risk owner and risk actionee

Explanation

Risk exposure is the product of the likelihood of the event and the magnitude of its consequence on objectives. Both dimensions are needed because a high-impact but very unlikely risk may rank lower than a likely moderate one.

Question 3Risk management fundamentals, principles and terminology

What distinguishes a 'threat' from an 'opportunity' in risk management?

  1. A threat is recorded in the risk register; an opportunity is not
  2. A threat has negative potential effect; an opportunity has positive potential effect Correct answer.
  3. A threat is owned by the sponsor; an opportunity is owned by the team
  4. A threat is certain to occur; an opportunity is uncertain

Explanation

Both threats and opportunities are uncertain events, but they differ in the direction of their potential effect on objectives. Opportunities are managed so that they are exploited or enhanced, threats so that they are avoided or reduced.

Question 4Risk management fundamentals, principles and terminology

A project manager records a risk and names a person responsible for implementing the agreed response. What is this person called?

  1. Risk actionee Correct answer.
  2. Risk owner
  3. Project sponsor
  4. Risk champion

Explanation

The risk owner is accountable for managing the risk overall, while the actionee carries out the specific response action. Separating the two makes accountability for implementation explicit.

Question 5Risk management fundamentals, principles and terminology

Which statement describes 'risk appetite'?

  1. The amount of risk an organisation is willing to accept in pursuit of objectives Correct answer.
  2. The total value of the contingency reserve held for a project
  3. The maximum number of risks permitted in the register
  4. The list of risks that have been escalated to the sponsor

Explanation

Risk appetite expresses the willingness of an organisation or individual to take on risk in pursuit of reward. It informs thresholds and tolerances used when deciding whether a risk is acceptable.

Question 6Risk management fundamentals, principles and terminology

What is the primary purpose of the risk management plan?

  1. To describe how risk management will be structured and performed on the project Correct answer.
  2. To record the actual costs incurred by risk responses
  3. To list every identified risk with its owner and response
  4. To replace the project's change control procedure

Explanation

The risk management plan is a process and governance document covering methodology, roles, funding, thresholds and reporting. The list of individual risks belongs in the risk register.

Question 7Risk management fundamentals, principles and terminology

Which outcome indicates that a risk has been 'avoided'?

  1. Insurance is purchased to transfer the financial consequence
  2. A contingency reserve is set aside to cover the risk if it happens
  3. The risk is accepted and monitored without further action
  4. The activity giving rise to the risk is removed from the project scope Correct answer.

Explanation

Avoidance changes the project so that the threat can no longer arise, for example by removing the activity or choosing a different approach. Other responses leave the risk in place and deal with its consequences.

Question 8Risk management fundamentals, principles and terminology

What does 'residual risk' mean?

  1. The risk that has been transferred to a third party
  2. The total risk before any response is planned
  3. The risk that has already occurred and become an issue
  4. The risk that remains after planned responses have been applied Correct answer.

Explanation

Residual risk is what is left once the agreed response has been implemented, and it must be judged acceptable against tolerances. It should be re-assessed and monitored during the project.

Question 9Risk management fundamentals, principles and terminology

A project has a firm fixed-price contract with a supplier for a well-defined package of work. Which risk response is the fixed price primarily achieving for the buyer?

  1. Transfer Correct answer.
  2. Acceptance
  3. Exploitation
  4. Avoidance

Explanation

A fixed-price contract shifts the financial consequence of cost overruns to the supplier, which is transfer. The risk itself is not eliminated, and the buyer may still bear schedule or quality consequences.

Question 10Risk management fundamentals, principles and terminology

A risk has a 20% chance of occurring and, if it occurs, would cost GBP 50,000. What is its expected monetary value as an exposure?

  1. GBP 50,000
  2. GBP 10,000 Correct answer.
  3. GBP 20,000
  4. GBP 5,000

Explanation

Expected monetary value multiplies probability by impact, so 0.20 x 50,000 = 10,000. This figure is used to size contingency and to compare risks on a common basis.

Question 11Risk management fundamentals, principles and terminology

During a workshop the team asks 'what could prevent us achieving this milestone?' and records answers. Which risk identification technique are they using?

  1. Root cause analysis
  2. Brainstorming Correct answer.
  3. Earned value analysis
  4. Monte Carlo simulation

Explanation

Open prompting questions in a group session to generate candidate risks is brainstorming. It is a divergent technique intended to surface risks before they are analysed and filtered.

Question 12Risk management fundamentals, principles and terminology

A project manager wants to understand how a risk arose so that the underlying driver can be addressed rather than only its symptom. Which technique is most appropriate?

  1. Probability-impact matrix
  2. Root cause analysis Correct answer.
  3. Risk breakdown structure
  4. Checklist analysis

Explanation

Root cause analysis traces a risk back to its underlying source so that a response can remove or reduce the driver. Treating only symptoms leaves the cause able to generate further risks.

Question 13Risk management fundamentals, principles and terminology

What is the main purpose of a risk breakdown structure (RBS)?

  1. To record the dates on which risks were closed
  2. To show the sequence in which risk responses will be implemented
  3. To calculate the expected monetary value of each risk
  4. To provide a hierarchical framework of risk sources for identifying and categorising risks Correct answer.

Explanation

An RBS groups risks by source, such as technical, commercial or external, giving a structured prompt set for identification and a basis for reporting. It is a classification tool, not a schedule or valuation tool.

Question 14Risk management fundamentals, principles and terminology

In a probability-impact matrix, a risk sits in the high-probability, high-impact zone. What is the most appropriate immediate action?

  1. Record it and review it at the next project closure
  2. Transfer it to the risk actionee without further analysis
  3. Remove it from the register because it is too severe
  4. Prioritise it for a detailed response plan and escalate as required Correct answer.

Explanation

Risks in the high-high zone exceed normal tolerance and warrant priority attention, a developed response and escalation where authority is exceeded. Prioritisation ensures effort goes where exposure is greatest.

Question 15Risk management fundamentals, principles and terminology

Which statement best describes the difference between risk tolerance and risk threshold?

  1. Tolerance is set by the supplier; the threshold is set by the customer
  2. Tolerance applies only to opportunities; the threshold applies only to threats
  3. Tolerance is the acceptable range of variation; the threshold is the limit beyond which action is required Correct answer.
  4. Tolerance is measured in cost; the threshold is measured in time

Explanation

Tolerance defines the range within which the project may operate without escalation, while the threshold marks the boundary that triggers action when crossed. Both are expressed against objectives and agreed with the sponsor.

Question 16Risk management fundamentals, principles and terminology

A risk has been assessed as low probability and low impact. Which response is normally most appropriate?

  1. Avoid the risk by changing scope
  2. Exploit the risk to gain benefit
  3. Transfer the risk through insurance
  4. Accept the risk and monitor it Correct answer.

Explanation

Low-exposure threats are usually accepted, with monitoring so that the assessment can be revisited if conditions change. Applying costly responses to minor risks would not be proportionate.

Question 17Risk management fundamentals, principles and terminology

What is the key difference between a risk and an issue?

  1. A risk is recorded in the register; an issue is never recorded
  2. A risk is always negative; an issue is always positive
  3. A risk may happen in the future; an issue has already happened and needs resolution Correct answer.
  4. A risk belongs to the sponsor; an issue belongs to the project manager

Explanation

Risk concerns uncertain future events, whereas an issue is a current problem requiring action now. When a risk materialises it is converted into an issue and managed through issue resolution.

Question 18Risk management fundamentals, principles and terminology

A project manager decides to fund a contingency reserve based on the aggregate expected monetary value of identified risks. Which statement about this reserve is correct?

  1. It covers unknown risks that cannot be foreseen
  2. It is released to the sponsor at project start
  3. It covers known risks that have been identified and analysed Correct answer.
  4. It replaces the need for a change control process

Explanation

Contingency reserve addresses known-unknowns, that is, identified risks whose probability and impact have been assessed. Unforeseen events are covered by management reserve instead.

Question 19Risk management fundamentals, principles and terminology

In quantitative risk analysis, what does a Monte Carlo simulation produce?

  1. A ranked list of risks by owner
  2. A probability distribution of possible project outcomes Correct answer.
  3. A register of unidentified risks
  4. A single deterministic estimate of project duration

Explanation

Monte Carlo simulation repeatedly samples from input distributions to model the range of possible outcomes and their likelihoods. This supports confidence-based estimates such as the duration with an 80% chance of being met.

Question 20Risk management fundamentals, principles and terminology

A risk owner reports that a previously high-rated risk has fallen to low exposure because the underlying condition has changed. What should happen next?

  1. Increase the contingency reserve to reflect the new rating
  2. Delete the risk from the register without recording the change
  3. Re-assess and update the risk record, adjusting any reserve held for it Correct answer.
  4. Close the project because the risk has gone

Explanation

Risk management is iterative, so ratings and responses are reviewed as conditions change and the register is updated accordingly. Reserve held against the risk should be reviewed at the same time.

Question 21Risk management fundamentals, principles and terminology

Which of the following best describes a 'secondary risk'?

  1. A risk that remains after all responses are complete
  2. A new risk created as a consequence of implementing a risk response Correct answer.
  3. A risk that has been escalated to the sponsor
  4. A risk shared between two projects in a programme

Explanation

Secondary risks arise from the response itself, for example a new technology introduced to avoid a technical threat may bring unfamiliar integration risks. They must be identified and managed like any other risk.

Question 22Risk management fundamentals, principles and terminology

A project manager is choosing between two responses to a threat. Response A costs GBP 30,000 and reduces expected exposure from GBP 100,000 to GBP 20,000. Response B costs GBP 10,000 and reduces exposure from GBP 100,000 to GBP 70,000. On expected value grounds, which is preferable and why?

  1. Response A, because its net benefit of GBP 50,000 exceeds Response B's net benefit of GBP 20,000 Correct answer.
  2. Response B, because it costs less in absolute terms
  3. Response A, because it removes the risk entirely
  4. Neither, because both responses cost more than the risk

Explanation

Net benefit is the reduction in expected exposure minus the cost of the response. Response A gives 80,000 - 30,000 = 50,000, while Response B gives 30,000 - 10,000 = 20,000, so A is preferable on this criterion.

Question 23Risk management fundamentals, principles and terminology

Why is it important that risk identification involves the wider project team and stakeholders rather than only the project manager?

  1. It guarantees that no risks will be overlooked
  2. It removes the need for later risk analysis
  3. Diverse perspectives surface risks that a single viewpoint would miss Correct answer.
  4. It transfers legal liability for the risks to those involved

Explanation

Risk identification benefits from varied experience and knowledge of different parts of the work, increasing the range of risks found. It improves coverage but cannot guarantee completeness, so identification is repeated throughout the lifecycle.

Question 24Risk management fundamentals, principles and terminology

A project operates within an organisation that has a low risk appetite for safety matters but a high appetite for innovation. How should this affect risk management on the project?

  1. Innovation risks should be avoided because appetite applies only to threats
  2. Safety risks should be escalated and treated conservatively while innovation risks may be accepted more readily Correct answer.
  3. All risks should be treated identically to ensure consistency
  4. Safety risks should be accepted because they are usually low probability

Explanation

Appetite drives how much exposure is acceptable in each category, so thresholds and responses should differ accordingly. A low appetite for safety means little tolerance and early escalation, while a high appetite for innovation permits more risk-taking.

Question 25Risk management fundamentals, principles and terminology

A risk register shows a risk with high impact, low probability and no assigned owner. Which conclusion is most defensible?

  1. The risk should be closed because low probability means it is unimportant
  2. The risk should be removed from the register until it becomes likely
  3. The register has a governance gap because every active risk should have an accountable owner Correct answer.
  4. The risk should be transferred because it has high impact

Explanation

Accountability for each active risk must be assigned so that assessment, response and monitoring actually happen. A high-impact risk without an owner is a control weakness regardless of its probability.

Question 26Risk management fundamentals, principles and terminology

Which statement best defines a project risk in line with risk management fundamentals?

  1. Any event that has already happened and is now affecting the project schedule
  2. An uncertain event that, if it occurs, will have a positive or negative effect on project objectives Correct answer.
  3. A guaranteed cost overrun that has been included in the project budget
  4. A documented lesson learned from a previous, unrelated project

Explanation

Risk is defined by uncertainty of occurrence combined with an effect on objectives, and that effect may be beneficial (opportunity) or harmful (threat). The defining feature is that the event has not yet happened and its occurrence is uncertain.

Question 27Risk management fundamentals, principles and terminology

In risk management terminology, what does the term 'likelihood' refer to when assessing a risk?

  1. The date by which a risk response must be completed
  2. The total number of risks recorded in the risk register
  3. The chance or probability that a risk event will actually happen Correct answer.
  4. The estimated cost of the response should the risk occur

Explanation

Likelihood expresses the probability or chance of a risk occurring, and it is normally assessed together with impact to establish the level of exposure. It is a probability judgement, not a cost, count or date.

Question 28Risk management fundamentals, principles and terminology

A project manager is preparing to assess the risks recorded on a new register. Which activity correctly belongs to the risk analysis stage rather than to identification or response planning?

  1. Estimating the probability and impact of each identified risk to establish its level of exposure Correct answer.
  2. Brainstorming with stakeholders to surface previously unrecorded threats
  3. Assigning an owner and a target date to each response action
  4. Closing risks that are no longer relevant and archiving the register

Explanation

Risk analysis is the stage at which identified risks are evaluated, typically by estimating probability and impact, to determine their relative significance and prioritisation. Identifying new risks and planning responses are separate stages of the risk process.

Question 29Risk management fundamentals, principles and terminology

Two risks have the same expected monetary value, but one has a very high impact with very low probability and the other has a moderate impact with moderate probability. Why might a project manager prioritise the high-impact, low-probability risk?

  1. Because the potential severity of a single event may exceed the organisation's risk tolerance even if its expected value is modest Correct answer.
  2. Because low-probability risks are always more likely to occur than moderate-probability risks
  3. Because expected monetary value ignores probability entirely when ranking risks
  4. Because high-impact risks never require a documented response plan

Explanation

Expected value averages out outcomes, but organisations also care about the size of a single worst-case hit against their tolerance and capacity to absorb loss. A rare event that could breach tolerance or threaten viability therefore warrants attention beyond its expected value.

Question 30Risk management fundamentals, principles and terminology

An organisation records risks using a scale that combines probability and impact into a single exposure score. Two risks score identically, but Risk A affects a single non-critical activity while Risk B affects a regulatory compliance milestone. What does this illustrate about risk evaluation?

  1. Regulatory compliance objectives should be excluded from risk assessment because they are outside project control
  2. Probability and impact scales should be discarded in favour of purely qualitative descriptions
  3. Identical exposure scores always mean the two risks are interchangeable and can be managed with the same response
  4. A numeric exposure score alone may not capture the strategic significance of the objective affected, so judgement must supplement the rating Correct answer.

Explanation

Quantified exposure scores support comparison, but the importance of the objective affected is a separate consideration that can change priority. Evaluation therefore combines the calculated rating with judgement about which objectives matter most to the organisation.

Question 31Risk context, governance and the risk management framework

In risk governance, what is the primary purpose of defining an explicit risk appetite for a project?

  1. To allocate blame when a risk event occurs
  2. To guarantee that no risk with a high rating will ever be realised
  3. To list every risk that has been identified during the project lifecycle
  4. To state the amount and type of risk the organisation is willing to accept in pursuit of its objectives Correct answer.

Explanation

Risk appetite expresses the amount and type of risk an organisation is prepared to accept in pursuit of its objectives. It provides a reference point against which identified risks can be judged as tolerable or not. It is not a register of risks nor a guarantee that risks will not occur.

Question 32Risk context, governance and the risk management framework

Which document typically sets out the approach, responsibilities, processes and reporting arrangements for managing risk on a specific project?

  1. The risk management plan Correct answer.
  2. The quality register
  3. The business case
  4. The lessons-learned log

Explanation

The risk management plan describes how risk management will be structured and performed on the project, including roles, processes, tools and reporting. The business case justifies the investment, while the lessons log and quality register serve other purposes.

Question 33Risk context, governance and the risk management framework

A project sponsor insists that all risks rated above a defined threshold be escalated to the project board for a decision. Which governance mechanism does this illustrate?

  1. Risk avoidance
  2. Risk transfer
  3. Risk exploitation
  4. Risk escalation Correct answer.

Explanation

Escalation is the governance route by which risks beyond a defined threshold or outside the project's authority are raised to a higher decision-making body. Transfer, avoidance and exploitation are risk response strategies, not governance routes.

Question 34Risk context, governance and the risk management framework

What distinguishes a risk from an issue in project risk management?

  1. A risk is always negative, whereas an issue is always positive
  2. A risk is recorded in the register, whereas an issue is never recorded
  3. A risk is an uncertain future event, whereas an issue is a problem that has already happened Correct answer.
  4. A risk has already occurred, whereas an issue has not yet occurred

Explanation

A risk is an uncertain event that, if it occurs, will affect objectives; an issue is a problem that has already materialised and requires management now. Both can be recorded and tracked, and risks can be threats or opportunities.

Question 35Risk context, governance and the risk management framework

Which role is normally accountable for ensuring that the risk management framework is applied consistently across a portfolio of projects?

  1. The individual project team members
  2. The customer's end users
  3. The portfolio or programme risk function Correct answer.
  4. The external auditor

Explanation

Consistency of the risk framework across projects is a governance responsibility typically held at portfolio or programme level. Team members apply the process locally, auditors provide independent assurance, and end users have no governance accountability.

Question 36Risk context, governance and the risk management framework

Which of the following best describes a risk tolerance?

  1. The maximum exposure an organisation is prepared to bear before action must be taken Correct answer.
  2. The schedule of risk review meetings
  3. The method used to score the likelihood of a risk
  4. The total number of risks a register can hold

Explanation

Tolerance defines the threshold of exposure that can be accepted before escalation or action is required. It is a boundary derived from appetite, not a counting limit, a scoring method or a meeting schedule.

Question 37Risk context, governance and the risk management framework

A project manager is setting up risk governance for a new project. Which action best establishes clear ownership of individual risks?

  1. Record every risk anonymously to encourage open reporting
  2. Leave ownership to be decided when the risk occurs
  3. Assign all risks to the project manager by default
  4. Assign each significant risk to a named risk owner with authority to act Correct answer.

Explanation

Each significant risk should have a named risk owner accountable for monitoring it and implementing the agreed response. Anonymous recording removes accountability, and defaulting everything to the project manager undermines distributed ownership.

Question 38Risk context, governance and the risk management framework

An organisation's risk policy states that projects must not accept any risk that could breach a statutory safety requirement. Which concept does this policy most directly express?

  1. A lessons-learned review
  2. A contingency reserve calculation
  3. A risk response of transference
  4. A risk appetite of zero tolerance in a defined category Correct answer.

Explanation

Zero tolerance in a defined category is a specific expression of risk appetite, setting a boundary that cannot be exceeded. It is not a response strategy, a reserve calculation or a review activity.

Question 39Risk context, governance and the risk management framework

During a governance review, a project board notes that risks are being identified but no one is monitoring whether agreed responses are actually implemented. Which element of the risk framework is weakest?

  1. Risk appetite definition
  2. Risk monitoring and control Correct answer.
  3. Risk identification
  4. Risk classification

Explanation

Monitoring and control covers tracking risks, verifying that responses are implemented and evaluating their effectiveness. Identification is occurring, so the gap lies in the monitoring and control element of the framework.

Question 40Risk context, governance and the risk management framework

A programme manager wants risk information from several projects to be comparable so it can be aggregated. Which governance arrangement best supports this?

  1. Allowing each project to design its own scoring scales
  2. Adopting a common risk taxonomy and assessment scales across the projects Correct answer.
  3. Restricting risk reporting to verbal updates at meetings
  4. Recording risks only after they have occurred

Explanation

Aggregation requires a shared taxonomy and consistent assessment scales so that ratings mean the same thing across projects. Bespoke scales, verbal-only reporting and retrospective recording all prevent meaningful comparison.

Question 41Risk context, governance and the risk management framework

Which statement best explains why the risk management plan should be agreed before risk identification begins in earnest?

  1. It defines the process, scales and responsibilities that identification will follow Correct answer.
  2. It fixes the price of the project contract
  3. It guarantees that all risks will be found
  4. It removes the need for a risk register

Explanation

The plan establishes how risk management will be conducted, including methods, scales, roles and reporting, giving identification a consistent basis. It does not set contract price, replace the register or guarantee completeness.

Question 42Risk context, governance and the risk management framework

A risk owner reports that a threat has moved outside the project's authority to manage and now affects a strategic objective. What is the most appropriate governance action?

  1. Delete the risk from the register to avoid duplication
  2. Close the risk because it is no longer within the project's control
  3. Escalate the risk to the level that owns the affected objective Correct answer.
  4. Reclassify the risk as an opportunity

Explanation

When a risk exceeds the project's authority or affects objectives owned elsewhere, it should be escalated to the appropriate level. Closing or deleting it would leave the exposure unmanaged, and reclassification would misrepresent it.

Question 43Risk context, governance and the risk management framework

Which pair correctly matches a governance body with its typical risk responsibility?

  1. Project board - approves the risk approach and major responses beyond tolerance Correct answer.
  2. End user - maintains the corporate risk taxonomy
  3. External supplier - sets the organisation's risk appetite
  4. Team member - approves the organisational risk policy

Explanation

The project board provides direction and approves the risk approach and responses that exceed delegated tolerance. Organisational policy, appetite and taxonomy are set at organisational level, not by team members, suppliers or end users.

Question 44Risk context, governance and the risk management framework

A project uses a probability-impact matrix with defined score bands. What governance benefit does this provide?

  1. It replaces the need for a risk register
  2. It guarantees that high-scoring risks will be eliminated
  3. It removes the need for expert judgement in assessment
  4. It provides a consistent, transparent basis for prioritising risks and setting thresholds Correct answer.

Explanation

A defined matrix gives a consistent and transparent way to rate and prioritise risks and to set escalation thresholds. It supports rather than replaces judgement, cannot guarantee elimination, and works alongside the register.

Question 45Risk context, governance and the risk management framework

Which of the following is the clearest example of a governance control that provides assurance that risk management is effective?

  1. A scheduled independent review of the risk register and response effectiveness Correct answer.
  2. A team member mentioning a concern in passing
  3. An unsigned note in a meeting agenda
  4. A risk workshop held once at project start

Explanation

Independent review of the register and of response effectiveness provides objective assurance that the framework is working. Informal remarks, one-off workshops and unsigned notes do not provide reliable assurance.

Question 46Risk context, governance and the risk management framework

An organisation wants to embed risk management so that it informs decision-making rather than being a paperwork exercise. Which governance practice best supports this?

  1. Requiring risk information to be a standing input to key decision gates and reviews Correct answer.
  2. Scoring risks once and never revisiting the scores
  3. Completing the risk register only at project closure
  4. Keeping risk information confidential to the project manager

Explanation

Embedding risk management means it informs decisions, so risk information should be a standard input to decision gates and reviews. Deferring, concealing or freezing risk information prevents it from influencing decisions.

Question 47Risk context, governance and the risk management framework

A risk has been assessed as within appetite but close to the tolerance boundary. Which governance response is most appropriate?

  1. Close the risk because it is within appetite
  2. Monitor the risk closely and define a trigger for escalation if exposure increases Correct answer.
  3. Immediately escalate it to the board regardless of thresholds
  4. Take no action and remove it from monitoring

Explanation

Risks within appetite still require monitoring, and proximity to the tolerance boundary justifies a defined escalation trigger. Removing, closing or over-escalating would either lose control or bypass agreed thresholds.

Question 48Risk context, governance and the risk management framework

A project board delegates authority to the project manager to accept risks up to a defined score, above which board approval is required. A newly identified risk scores just above that limit. What is the correct governance action?

  1. The risk is omitted from the register until it occurs
  2. The risk is escalated to the board for a decision Correct answer.
  3. The project manager accepts it and records the decision
  4. The risk is re-scored downward to fit within delegated authority

Explanation

Risks above the delegated threshold must be escalated to the body that holds the authority. Accepting it, re-scoring it to fit, or omitting it would breach the governance framework.

Question 49Risk context, governance and the risk management framework

Two projects in the same programme assess an identical risk differently because they use different likelihood and impact scales. What is the most significant governance consequence?

  1. The project board will be unable to meet
  2. Aggregated programme risk exposure may be misstated and decisions misinformed Correct answer.
  3. The risk register will become invalid and must be deleted
  4. The risk will automatically be transferred to a supplier

Explanation

Inconsistent scales make ratings non-comparable, so aggregated exposure may be misstated and decisions taken on faulty information. Transfer, register invalidation and meeting logistics are not the direct consequences of scale inconsistency.

Question 50Risk context, governance and the risk management framework

A governance review finds that risks are recorded but the organisation's stated risk appetite has never been used to judge them. What is the most likely effect on decision-making?

  1. Response costs will always fall
  2. All risks will automatically be treated as opportunities
  3. Risks will be judged without reference to acceptable exposure, so escalation and response decisions lack a consistent basis Correct answer.
  4. The risk register will become shorter over time

Explanation

Risk appetite provides the reference point for judging whether exposure is acceptable and when to escalate or act. Without it, decisions lack a consistent basis; it does not convert risks to opportunities, shrink the register or reduce costs.