Risk Management Process
What the exam tests
The process domain tests the sequence and purpose of the M_o_R process: identify, assess, plan, implement and review, with communication throughout. Questions often ask what happens next, which technique fits, or who owns an output.
Core rules
- Identify risks and opportunities, capturing cause, event and effect, and the objectives affected. Use workshops, interviews, prompt lists, assumption analysis and lessons learned.
- Assess in two parts: estimate probability and impact (plus proximity and velocity where useful), then evaluate the result against tolerance to decide whether action is needed.
- Plan responses. For threats: avoid, reduce, transfer, accept. For opportunities: exploit, enhance, share, accept. Define actions, owners, dates, triggers and contingency.
- Implement the agreed responses and update the register.
- Review progress, changes, triggers and residual exposure; report and escalate.
- Communication and consultation run throughout; the register is a live record, not a filing cabinet.
Worked example
A distribution team identifies sole supplier failure with the effect that orders are missed for two weeks. Estimate: probability 30% in 12 months, impact £400k - above tolerance. Plan: reduce by qualifying a second supplier; transfer part of the exposure through contractual penalties; accept residual risk with a contingency stock trigger. The risk owner is the operations director; the actionee is the procurement lead. Review monthly and when supplier financial indicators change.
Traps
Jumping to a response before evaluating against tolerance; identifying only threats; confusing risk owner and actionee; treating review as an annual event; and failing to update the register after a change. Avoid describing a response as monitor when no trigger or owner is defined.