Risk and Procurement Management
Risk and Procurement Management
This domain tests risk identification, analysis, response planning, and procurement decisions. Expect questions on risk response strategies, expected monetary value, contract types, and seller selection.
Core rules
- Risk management includes planning, identification, qualitative and quantitative analysis, response planning, and monitoring. The risk register records causes, triggers, owners, responses, and residual risk.
- Threat strategies: avoid, mitigate, transfer, accept, escalate. Opportunity strategies: exploit, enhance, share, accept, escalate.
- EMV = probability × impact. Use it to compare risk exposure, not to replace judgment.
- Make-or-buy analysis decides whether to procure. A statement of work defines the procurement scope; a bidder conference ensures common understanding.
- Fixed-price contracts place cost risk on the seller; cost-reimbursable contracts place more cost risk on the buyer; time and materials suits small, uncertain efforts.
Worked example
A risk has a 20% probability of a −$50,000 impact, so EMV = 0.20 × −50,000 = −$10,000. A mitigation costs $6,000 and reduces probability to 5%, leaving residual EMV = 0.05 × −50,000 = −$2,500. Total exposure becomes −$8,500, an improvement of $1,500. Reasoning: compare the cost of mitigation with the reduction in EMV, not with the full impact alone.
Traps that cost marks
- Believing transfer eliminates risk; it shifts financial consequence, not ownership of the event.
- Choosing fixed-price because it sounds safe when scope is undefined.
- Awarding to the lowest bid without evaluating technical capability.
- Changing contract scope informally instead of through contract change control.