Portfolio Risk Management
Portfolio Risk Management
This domain tests risk at the portfolio level: aggregate exposure, concentration, interdependency, risk appetite, and responses that change the portfolio mix. It is not a repeat of project risk management.
Core rules
- Portfolio risk includes component risks plus portfolio-level risks such as concentration, resource contention, and strategic exposure.
- Risk appetite and tolerance set the boundaries for how much risk the portfolio can carry.
- Aggregate risk with correlation in mind; summing individual risk scores overstates or understates exposure.
- Responses include diversify, balance, buffer capacity, sequence work, and terminate or defer components.
Worked example Three components rely on the same cloud vendor. Each component's vendor risk is rated low. At portfolio level, the concentration is high: one outage could affect three strategic initiatives at once. Response: qualify a second vendor for the most critical component, stagger migration windows, and add a portfolio-level contingency. Reasoning: the individual registers miss correlated exposure; the portfolio risk process exists to see it.
Traps
- Summing component risk scores without considering correlation.
- Treating portfolio risk as only the largest component risk.
- Ignoring strategic risks such as funding loss or regulatory change.
- Applying project risk processes without portfolio aggregation.
- Setting risk appetite once and never revisiting it.
- Documenting portfolio risks in a portfolio risk register with owners and triggers.