PMI-RMP cheat sheet

Risk management plan components: methodology, roles and responsibilities, funding, timing, risk categories, probability and impact definitions, probability-impact matrix, thresholds, reporting formats, and tracking.

Risk appetite is the willingness to take risk; tolerance is the acceptable variation around an objective; threshold is the measurable level that triggers action.

Formula: EMV = probability (0 to 1) x impact (currency or duration); used to compare, rank, and budget individual risks.

Contingency reserve covers identified and accepted risks (known-unknowns) and sits inside the cost and schedule baseline; management reserve covers unidentified risks (unknown-unknowns) and sits outside the baseline.

The risk breakdown structure organizes risk sources hierarchically by category (technical, external, organizational, project management) and should align with the work breakdown structure.

Decision rule: risks below the documented threshold may be accepted with monitoring; risks at or above it require an assigned owner and a funded response.

The risk management plan is a subsidiary plan of the project management plan and is approved before risk identification is performed in earnest.

Risk governance defines escalation paths: project risks escalate to program or portfolio when they exceed the project manager's authority or the project's scope.

Scaling factors that determine how much rigor is applied: project size, complexity, criticality, organizational risk maturity, and contractual or regulatory constraints.

Risk owner is the single individual accountable for a specific risk and its response, chosen for proximity, authority, and competence rather than automatically being the project manager.

Power-interest grid: high power plus high interest means manage closely; high power plus low interest means keep satisfied; low power plus high interest means keep informed; low on both means monitor.

Salience model classifies stakeholders by power, legitimacy, and urgency; stakeholders holding all three attributes are definitive and need the closest engagement.

Engagement assessment matrix records current versus desired engagement across five levels: unaware, resistant, neutral, supportive, leading; the gap drives communication actions.

Anonymous elicitation techniques such as Delphi counter hierarchy effects, domination by senior participants, and groupthink during risk workshops.

Stakeholder risk appetite and tolerance are elicited through interviews and documented in the risk management plan; they set the thresholds used in later analysis.

Biases to counter explicitly: optimism bias, anchoring on the first estimate, availability heuristic from recent events, and groupthink in workshop settings.

Risk communication uses calibrated probability language defined once in the plan (for example, likely equals a stated percentage range) so all stakeholders interpret ratings identically.

Risk definition: an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.

Cause-risk-effect format: because of a cause, an uncertain event may occur, which would lead to an effect on an objective.

Identification techniques: brainstorming, Delphi, nominal group technique, interviews, checklists, prompt lists (PESTLE, TECOP), SWOT, root-cause analysis, assumption and constraint analysis, and document review.

Inputs to identification: risk management plan, scope, schedule, cost and resource baselines, assumption log, issue log, lessons learned register, stakeholder register, and procurement documents.

An issue is a risk that has already occurred; it moves to the issue log for resolution while unresolved risks stay in the risk register with an owner and response.

Identification is iterative and is repeated at phase gates and whenever scope, assumptions, contracts, or the external environment change.

Variability risk concerns a range of outcomes around a known parameter; ambiguity risk concerns uncertainty about what is known or how to interpret it.

The risk register records identifier, description, cause, effect, category, owner, probability, impact, score, response, trigger, and status.

Checklists and prompt lists improve completeness for known categories but miss novel risks, so they are paired with assumption analysis and expert judgment.

Risk score = probability x impact; the probability-impact matrix maps scores into priority bands defined by organizational thresholds.

Qualitative analysis is fast and judgment-based (probability-impact matrix, data quality assessment, urgency assessment, categorization); quantitative analysis is numeric (Monte Carlo, decision trees, sensitivity analysis, EMV).

EMV = sum of (probability x outcome value); decision trees select the branch with the highest expected value, and the value of information equals the EMV gain from acquiring it.

Monte Carlo simulation iterates the cost or schedule model hundreds to thousands of times over input distributions, producing a cumulative S-curve from which a confidence level such as P80 is read.

A tornado diagram orders risk variables by their swing on the objective; the widest bar is the most sensitive driver and the best candidate for quantitative modeling or response attention.

Risk data quality assessment rates accuracy, objectivity, reliability, and timeliness; poor-quality data means the risk must be re-evaluated before it is modeled quantitatively.

Risk urgency assessment weights risks by time available to respond, so short-fuse risks take priority even when their probability-impact score is only moderate.

Correlation among risk variables changes simulated outcomes materially; treating correlated risks as independent understates the range of the modeled result.

Quantitative outputs: expected cost and duration, probability of meeting objectives, and the contingency reserve required for a stated confidence level.

Threat strategies: escalate, avoid, transfer, mitigate, accept. Opportunity strategies: escalate, exploit, share, enhance, accept.

Avoid eliminates the threat by changing the plan (scope, schedule, or approach); mitigate reduces probability, impact, or both, leaving a residual risk.

Transfer shifts ownership of the response and the financial consequence to a third party through insurance, warranty, bond, or fixed-price contract; it does not eliminate the risk.

Escalate is used when the risk lies outside the project's scope or the project manager's authority; the project team then does not develop a response of its own.

Passive acceptance means acknowledge and monitor with no action; active acceptance means establish a contingency plan, trigger conditions, and a reserve.

A contingency plan addresses an identified risk if it occurs; a fallback plan is a secondary response used when the primary response proves inadequate.

Secondary risks arise from implementing a response and must be identified, analyzed, and owned like any originally identified risk.

Each approved response is assigned an owner, funded from the contingency reserve, and integrated into the cost, schedule, and resource baselines.

Response selection criteria: feasibility, cost-effectiveness (response cost should not exceed expected exposure), timeliness, stakeholder agreement, and fit with the assigned owner.

A risk audit evaluates whether the risk management process is being executed effectively and whether risk evaluations are accurate; it is distinct from a quality audit.

Reserve analysis compares remaining contingency reserve with remaining risk exposure; reserve trending toward zero while significant risks stay open is an escalation trigger.

A workaround is an unplanned, reactive response to a risk that was not identified or not accepted; a contingency plan is a planned, pre-approved response.

Risk register statuses: active or open, occurring, closed (response executed or risk expired), and retired.

A risk burndown chart plots cumulative risk exposure over time; a flat or rising line indicates that response implementation is not keeping pace with identification.

Variance and trend analysis on cost and schedule, together with technical performance measurement, provides early warning of emerging risk.

Risk reporting content: top risks with scores and trends, response implementation status, reserve status, newly identified risks, closed risks, and escalation items.

Monitoring uses trigger conditions defined during planning; once a trigger is met, the contingency plan is executed without seeking new approval.

Lessons learned from closed risks feed organizational process assets and refine future identification checklists, thresholds, and response templates.