PMI-RMP common mistakes
PMI-RMP · Understand the traps and how to avoid them.
When a scenario opens a new project or phase, the candidate immediately picks 'identify risks' or 'create the risk register' as the next action, without first checking whether risk appetite, tolerances/thresholds, probability-and-impact definitions, the RBS, and risk roles have been agreed.
The exam's 'what should the project manager do next' stems reward sequence, and identification feels like the obvious first risk activity. Candidates also carry over the habit of treating the risk register as the deliverable of risk management, so they skip the planning decisions that make scoring and prioritisation meaningful.
What to do instead
Before answering any sequencing question, ask yourself: 'Do agreed thresholds and scoring scales exist?' If the scenario shows no tolerance or scale, the correct option is almost always to establish it with the sponsor and key stakeholders. Memorise the order: tailor the approach and define appetite/scales → identify → analyse → plan responses → implement → monitor.
The candidate answers risk-methodology questions with boilerplate - applying a full quantitative Monte Carlo programme to a small, low-complexity project, or using a generic template RBS and register without reference to the delivery approach, contract type, or organisational process assets in the scenario.
Templates are easy to recall and feel 'PMI-correct'. The exam, however, tests tailoring: the environment described (fixed-price contract, agile delivery, regulatory oversight, immature data) is supposed to change the answer.
What to do instead
For every methodology question, extract two things from the stem: the delivery/contract context and the maturity of available data. Large, data-rich, high-stakes → quantitative analysis and detailed reserves. Small, data-poor, fast-moving → qualitative analysis, light documentation, frequent review. If an option ignores the stated context, eliminate it.
Faced with a stakeholder who is uneasy about a risk or has a different tolerance, the candidate selects 'escalate to the sponsor', 'send the risk report to the stakeholder', or 'update the stakeholder register' instead of choosing to meet the stakeholder and understand and address the concern. Similarly, the candidate lets the sponsor be named risk owner for risks the team can own.
Escalation and documentation are visible, defensible actions, so they feel safe under exam pressure. Candidates also confuse 'keeping stakeholders informed' with 'engaging stakeholders', and confuse the risk owner (accountable for managing the risk) with the person performing the response action.
What to do instead
Rank options by directness: talk to the affected stakeholder first, escalate only when authority or tolerance is genuinely exceeded, and report only after the interaction. When assigning ownership, pick the person with the authority and proximity to manage the risk - usually not the sponsor unless the risk is project- or programme-level.
Register entries are written as causes ('the vendor is new'), as effects ('the schedule slips'), or as issues already happening, rather than as a structured cause → uncertain event → effect statement with an assigned owner and a defined trigger.
Natural language descriptions of worries read like risks, and under time pressure candidates accept any negative-sounding statement as a valid risk. Issues versus risks is the single most common conceptual blur in risk work.
What to do instead
Apply a two-second test to every risk in a stem: is it uncertain (may or may not happen) and does it have a cause and a consequence? If it is already happening, it belongs in the issue log and needs an issue response, not a risk response. When a question asks which register entry is best, choose the one with cause, uncertain event, effect, owner, and trigger.
The candidate treats identification as a single early event - relying on brainstorming alone, and not re-running identification after a change request, phase gate, or major assumption failure. Assumptions and constraints are also left unexamined as risk sources.
Most study material presents identification as one process step with one technique, so candidates don't build the reflex that new information generates new risks. Assumption analysis feels like a planning chore rather than a risk technique.
What to do instead
When a stem mentions a change, a gate, or a surprise, look first for options that re-identify risks. Remember the technique toolkit as a checklist you can scan: brainstorming, interviews, Delphi, checklists, assumption and constraint analysis, SWOT, prompt lists, and document review - then pick the one matched to the situation (e.g., Delphi when experts are dispersed and you need anonymity and consensus).
The candidate selects 'perform quantitative risk analysis' for a newly identified, clearly minor risk, or selects 'perform qualitative analysis' when the decision at hand is a major bid/no-bid or reserve-setting call with good data available.
Quantitative analysis sounds more rigorous, so it is picked as the 'more professional' answer. Candidates also forget that the two processes answer different questions: prioritisation versus numerical effect on objectives.
What to do instead
Match the technique to the decision: if the question is 'which risks deserve attention', the answer is qualitative (probability-impact matrix, urgency assessment). If the question is 'how much contingency, or which of two options is worth more', and data exists, the answer is quantitative (decision tree, EMV, sensitivity/tornado, Monte Carlo). If data is insufficient, the fix is to improve the data or proceed qualitatively - not to force a model.
Arithmetic and concept errors in expected monetary value work: summing probabilities instead of weighting impacts, forgetting to net out investment cost in a decision tree, treating EMV as the amount to hold as reserve, and confusing contingency reserve with management reserve.
EMV questions are the only heavily numeric items on the exam, and candidates practise the formula but not the interpretation, so they compute a number and then select the wrong reserve or decision from it.
What to do instead
Write the branches out: EMV of an option = sum of (probability × impact), then subtract the cost of the option before comparing. Contingency reserve covers identified risks and is derived from the analysis (EMV or simulation); management reserve covers unidentified, in-scope-but-unplanned work and sits with the sponsor. If a stem describes an unknown-unknown, the reserve is management reserve.
Response strategy selection is fuzzy: 'transfer' is chosen for risks whose probability cannot be shifted to a third party, 'avoid' is chosen when only the impact is being reduced, and 'accept' is chosen as a default rather than as a deliberate, documented decision for a risk that cannot be economically addressed.
The strategies overlap in everyday speech, so candidates match on the words in the stem rather than on the mechanism. Acceptance also feels like the low-risk option when the candidate is unsure.
What to do instead
Classify by mechanism before reading options: eliminate the cause or the exposure entirely = avoid; reduce probability and/or impact = mitigate; move the financial consequence (not the accountability) to a third party = transfer (insurance, warranty, fixed-price contract); deliberately retain with no action = accept (active acceptance means a contingency plan and reserve); share with a partner who is best able to manage it = exploit/share for opportunities. Then check the option actually changes that mechanism.
Responses are chosen without being made operational: no named response owner, no budget or schedule in the plan, no trigger defined, and no distinction between a contingency plan (planned, for an identified risk), a fallback plan (if the contingency fails), and a workaround (unplanned, for an issue that has occurred). Secondary and residual risks from the chosen response are ignored.
The exam often asks 'what should the project manager do next' right after a response is selected, and candidates jump straight to 'implement the response' or 'update the register' instead of the step that makes it executable. The three plan types are memorised as definitions but not applied.
What to do instead
After choosing a strategy, the next action is to make it actionable: assign the response owner, secure resources and authority, integrate it into the cost and schedule baselines, and define the trigger and contingency/fallback. Then re-analyse for secondary risks created by the response and residual risk left after it - if either is material, that is the answer.
Risk monitoring is reduced to 'update the risk register'. The candidate does not distinguish updating risks from re-evaluating them, from auditing the risk process, and does not think of reserve analysis, variance and trend analysis, or technical performance measurement as monitoring tools when a stem describes drift in cost, schedule, or reserve consumption.
Updating the register is always plausible, so it becomes the default answer for any monitoring question. Candidates also under-learn the tools that produce the evidence for reporting, so they can't recognise the specific situation a stem is describing.
What to do instead
Read the stem for what is changing: a single risk's status → update and reassess; the whole exposure picture → risk review/reassessment; whether the risk process itself is working → risk audit; reserve being consumed faster or slower than planned → reserve analysis; performance drifting without new risks → variance and trend analysis. Choose the tool matched to the evidence described, and remember work performance reports feed the risk report.