Risk Management: Identifying, Assessing and Responding
What this domain tests
Risk Management tests whether you can identify threats and opportunities, assess them consistently, assign responses and keep the picture current. Questions ask you to classify a response strategy, judge a risk matrix entry, or decide which risk deserves attention first.
Core rules
- A risk is an uncertain event that, if it occurs, affects the project objectives. It is described as cause → event → effect, so the response can address the right element.
- Assess probability and impact, usually in a matrix, and derive priority. High probability with high impact demands action; low–low is monitored. Risks affecting the business case, not only the project plan, must reach the owner.
- Each risk has an owner, a response and a trigger. Response strategies for threats: avoid (remove the cause), reduce or mitigate (lower probability or impact), transfer (insurance, contract, fixed-price supplier), accept (deliberate, with reserve). Opportunities can be exploited, enhanced, shared or accepted.
- Residual risk after response is recorded; accepting a risk is a decision, not an oversight.
- Review risks at every decision point and whenever the context changes. The register is a live instrument.
Worked example
A project depends on one supplier for the network hardware, and that supplier has warned of component shortages. First pass: probability high, impact high (four-week delay to a critical path item). Reasoning: transferring the risk through a penalty clause reduces the financial impact but not the delay, so mitigation is the primary response - order earlier, pre-approve an alternative component, and schedule the installation with buffer. The trigger is the supplier’s confirmation date slipping past week 18. The residual risk of a two-week delay is accepted by the owner, and the item stays in the register with an owner.
Traps that cost marks
- Risks described so vaguely (“technical risk”) that no response can be designed.
- Registers with responses but no owners, or owners who never report.
- Choosing “accept” for a high-impact risk to avoid an awkward conversation.
- Reviewing risks only at start-up, so the register goes stale.