Risk, Change, and Issue Management
This domain tests whether you can separate uncertainty from current problems, respond proportionately and control change without destabilizing baselines.
Risk versus issue
- A risk is an uncertain future event; an issue is realized and affecting the project now.
- Maintain a RAID log: risks, assumptions, issues and dependencies.
- A risk owner is accountable for managing the risk; an action owner executes a specific response.
- Threat responses are avoid, mitigate, transfer and accept. Opportunity responses are exploit, enhance, share and accept.
- Score risks by probability times impact, and define review triggers.
Change control
A change request needs impact analysis across scope, schedule, cost, quality and risk. The change control board decides, baselines are updated, and the decision is communicated. Emergency changes may proceed with retrospective approval, but they still need a record.
Worked example
A risk has 30% probability and a $200,000 impact, so expected exposure is $60,000. A mitigation costs $25,000 and reduces probability to 10%, giving exposure of $20,000. Total mitigated cost is $45,000, a net benefit of $15,000 versus $60,000. The reasoning: compare expected exposure plus mitigation cost against the unmitigated exposure, not against zero.
Traps
- Logging issues as risks, which delays escalation and response.
- Approving changes without updating baselines, so reporting stays falsely green.
- Confusing the risk owner with the person performing the mitigation action.
- Holding no contingency reserve and treating every risk as acceptable.