Risk Management
What the domain is really testing
Risk management is a cycle: identify, analyse (qualitative and quantitative), plan responses, implement, monitor. Candidates must distinguish threats from opportunities and know the response families. For threats: avoid, transfer, mitigate, accept (and escalate). For opportunities: exploit, share, enhance, accept. Transfer moves financial consequence, not accountability - the project manager still owns the risk. A risk owner is a named person, not a department.
Concepts to hold firmly
- Probability × impact scoring drives the prioritisation matrix.
- Residual risk remains after response; secondary risk is created by the response.
- Triggers (early warning signs) and risk audits keep the register live.
- Issues are risks that have happened and need action, not analysis.
Traps
Questions often label insurance as "avoidance" - it is transfer. Another common trap is accepting a risk without documenting it; acceptance is a valid strategy but must be recorded with a rationale and often a reserve. Watch for the register being described as a one-off document created at planning; it is reviewed continuously. Also beware of answers that respond to a risk by changing the scope baseline without change control.
Rule of thumb
If a response costs more than the expected monetary value of the risk, acceptance is usually the rational choice. EMV = probability × impact.
Worked example
A 20% chance of a £50,000 penalty has EMV of £10,000. A mitigation costing £4,000 that halves the probability is worth it (new EMV £5,000, saving £5,000 against £4,000 spend). A mitigation costing £15,000 is not justified on EMV alone.