Risk Perspectives and Roles
What the exam tests
This domain tests the four M_o_R perspectives - strategic, programme, project and operational - and the roles that make risk management work. Questions ask you to match a risk to the right perspective and to allocate accountability correctly.
Core rules
- Strategic: long horizon, organisation-wide, board-owned; risks to objectives such as viability, reputation and licence to operate.
- Programme: coordinated change across projects; benefits, dependencies, tranches and business change.
- Project: delivery of a defined output within time, cost and quality tolerances.
- Operational: day-to-day services and processes; short horizon, high volume, service continuity.
- The same process applies at each perspective but is tailored in appetite, techniques, reporting and timescale.
- Risk owner: accountable for managing a risk and its response, with authority to act. Risk actionee: responsible for carrying out response actions. Risk manager/coordinator: facilitates the process, maintains information and reports; does not own every risk. Risk champion: promotes and coaches. Assurance: provides independent evidence. Ownership sits where the response can be authorised.
Worked example
A risk that a regulator withdraws a licence is discussed at a project board. Reasoning: the effect is on the organisation's licence to operate, so it is strategic; the project may contribute a control, but the accountable owner is an executive director. A separate vendor-delay risk affecting a project milestone is owned by the project manager. The project escalates the licence risk to the strategic level rather than retaining ownership.
Traps
Making the risk manager the owner of all risks; assigning ownership to someone without authority; confusing owner and actionee; applying project-scale reporting to strategic risks; and assuming one appetite covers every perspective. Read the objective affected, not the location of the meeting.