Risk and Procurement Management
What the exam tests
Risk and procurement: identification, analysis, response selection by threat or opportunity, reserves, and contract types that allocate risk sensibly.
The risk management plan sets appetite, thresholds, and scoring. Identification uses brainstorming, interviews, Delphi, SWOT, and prompt lists; the risk register records causes, triggers, owners, and responses. Qualitative analysis prioritises probability and impact. Quantitative analysis uses EMV, decision trees, sensitivity (tornado), and Monte Carlo simulation.
- Threats: escalate, avoid, transfer, mitigate, accept.
- Opportunities: escalate, exploit, share, enhance, accept.
- Contingency plan for accepted residual risk; fallback plan if contingency fails.
- The risk owner owns the response; transferring risk transfers financial consequence, not accountability for managing it.
Procurement
Make-or-buy analysis precedes procurement strategy. Contract types:
- Firm-fixed-price: seller bears cost risk; suitable for well-defined scope.
- Cost-plus-fixed-fee: buyer bears cost risk; suitable when scope is uncertain.
- Cost-plus-incentive-fee: over/under-runs shared by formula.
- Time and materials: buyer bears cost growth risk; needs a not-to-exceed cap.
Worked example
Risk A: 30% probability, −50,000 impact → EMV −15,000. Risk B: 10%, −120,000 → −12,000. Opportunity C: 20%, +40,000 → +8,000. Total EMV = −19,000. Reasoning: EMV supports comparison and reserve sizing, not prediction of any single outcome; B still warrants an active response because its severity is greatest.
Traps
- Accepting risk without reserving contingency or naming an owner.
- Assuming a fixed-price contract removes all buyer risk; changes and claims remain.
- Confusing secondary risks (caused by a response) with residual risks (remaining after one).