Day 21: The Risk Process, Identification, and Assessment
9% of the exam - about 2 hours - 14 practice questions
0:00 / --:--
Reading
Risk Defined
A risk is an uncertain event that, if it occurs, has an effect on a project objective. Two features matter. First, risk is about uncertainty: a known, certain cost is not a risk, it is a cost. Second, effects can be negative or positive. A threat is a negative risk. An opportunity is a positive one. The exam does test opportunity responses, and candidates who only think in threats miss those questions.
An issue is a risk that has occurred. Once it happens it moves out of the risk register and into issue management. Confusing the two is a common error.
The Risk Process
Risk management runs in a repeating cycle: plan the approach, identify risks, analyze them qualitatively, analyze the significant ones quantitatively where warranted, plan responses, implement responses, and monitor throughout. It is not a one-time workshop at the start of the project. The exam rewards recognizing that the risk register is a living document reviewed at defined intervals, with new risks added and closed risks retired.
Identification Techniques
Brainstorming, structured interviews with experienced staff, checklists built from historical projects, assumption analysis, document review, SWOT analysis, and the Delphi technique, in which experts respond anonymously across rounds to converge without the distortion of dominant personalities. The point of naming these is that the exam may ask which technique avoids groupthink, and Delphi is the answer.
The output is the risk register, which for each risk records a unique identifier, a description written as cause, event, and effect, the category, the probability, the impact, the resulting score, the response strategy, the owner, the trigger conditions, and the current status.
Writing risks in cause-event-effect form is a discipline worth learning, because it forces clarity: "Because the geotechnical report was based on limited borings, unanticipated rock may be encountered during excavation, which would increase cost and delay the foundation." That is actionable. "Site conditions" is not.
Qualitative and Quantitative Analysis
Each risk is rated for probability and for impact, usually on a scale such as very low through very high, and the two are combined in a probability and impact matrix to produce a priority. This is fast, subjective, and adequate for triage. Its purpose is to decide which risks deserve deeper analysis and active response, not to produce a number.
Quantitative analysis. Applied to the risks that qualitative analysis flags as significant, and to the project as a whole when the stakes justify it.
Expected monetary value multiplies probability by impact. A risk with a 30 percent chance of costing $200,000 has an EMV of $60,000. Summing EMV across independent risks produces a rational contingency figure, which is a defensible alternative to the traditional flat percentage.
Decision tree analysis extends EMV to sequential choices, computing the expected value of each branch to identify the best decision path.
Monte Carlo simulation runs the cost or schedule model thousands of times, sampling from probability distributions for uncertain inputs, and produces a distribution of outcomes. Its output is a probabilistic statement: an 80 percent confidence that the project completes by a given date, or that cost stays below a given figure. Owners increasingly ask for cost and schedule contingency set at a stated confidence level, commonly P80, and the CM should understand what that means.
Sensitivity analysis, often shown as a tornado diagram, identifies which variables most influence the outcome, directing management attention to the few inputs that actually move the result.
Risk Attitude
Owners differ in tolerance, and the exam expects the CM to manage to the owner's tolerance rather than the CM's own. A public agency with statutory funding limits and political exposure may be highly risk-averse and rationally pay a premium to transfer risk. A sophisticated developer may accept risk it understands in exchange for lower cost. The CM's job is to surface the choice explicitly, not to decide it silently.
This is triage, not measurement. Its job is deciding which risks earn quantitative analysis and an active response, not producing a number you would defend to an owner. That number comes from expected monetary value or simulation.Probability and Impact Matrix
Practice Questions
1. A risk that has occurred becomes:
An opportunity
A contingency
A threat
An issue
Answer: d. Once it happens it is no longer uncertain, so it leaves the risk register and becomes an issue to be managed. The distinction matters because the two get tracked and escalated differently.
2. A risk statement in the form "because of X, Y may occur, which would result in Z" is:
An EMV calculation
Overly wordy
A qualitative rating that scores the risk on a five-point probability scale
Cause-event-effect form, which makes the risk actionable
Answer: d. Cause, event, effect separates what is already true from what might happen and what it would cost. That structure tells you where to intervene, which a bare statement like schedule risk does not.
3. The technique that gathers expert input anonymously across rounds to avoid dominant-personality distortion is:
Delphi
Brainstorming
SWOT
Monte Carlo
Answer: a. Delphi runs anonymous rounds with feedback between them. The anonymity is the mechanism: it removes the effect of seniority and volume on what the group concludes.
4. Qualitative risk analysis primarily serves to:
Produce a precise contingency figure that can be defended line by line to the owner
Satisfy the contract
Replace quantitative analysis
Triage risks to decide which deserve deeper analysis and active response
Answer: d. Qualitative analysis is triage. It sorts a long list into what deserves attention, so that expensive quantitative work is spent only where it will change a decision.
5. A risk with a 25 percent probability and a $400,000 impact has an EMV of:
$25,000
$100,000
$1,600,000
$400,000
Answer: b. EMV is probability times impact. 0.25 times 400,000 is 100,000. Note that no single outcome equals the EMV; it is a weighting used to compare risks, not a prediction.
6. Monte Carlo simulation produces:
A distribution of outcomes supporting statements at a stated confidence level
A single most likely value for every activity duration and every cost item in the model
A qualitative rating
A risk register
Answer: a. Monte Carlo runs the model thousands of times across input distributions and returns a distribution of outcomes. That is what lets you say a number at a stated confidence rather than a single guess.
7. A tornado diagram from sensitivity analysis identifies:
The critical path
Insurance requirements
Which variables most influence the outcome
Weather risk
Answer: c. A tornado diagram ranks variables by how much moving each one moves the result. The widest bars are where analysis and control effort actually pay.
8. When the owner's risk tolerance differs from the CM's, the CM should:
Apply the CM's own judgment
Surface the choice explicitly and manage to the owner's tolerance
Default to maximum transfer, since paying a premium is always cheaper than retaining risk
Ignore tolerance
Answer: b. Risk tolerance belongs to whoever carries the risk, and that is the owner. The CM's obligation is to make the choice visible, then manage to the owner's answer rather than the CM's instinct.
9. "Subsurface conditions" written alone in a risk register, with no cause or effect stated, is:
A category label, not an actionable risk statement
An issue
An opportunity
A complete and actionable risk statement
Answer: a. A bare category tells no one what to do. Cause-event-effect form is what turns a label into something a risk owner can actually monitor and respond to.
10. A risk register reviewed only once, at project kickoff, and never updated is:
The correct approach
Missing the living-document discipline the process requires
Sufficient for quantitative analysis, because the initial probabilities remain valid all project long
A form of Monte Carlo simulation
Answer: b. Risk management is a cycle, not an event. A register frozen at kickoff misses new risks that emerge and never retires ones that have passed.
11. A positive risk that, if it occurs, would benefit a project objective is:
A contingency
An issue
A threat
An opportunity
Answer: d. Risk is not only downside. An opportunity is the positive mirror of a threat, and it gets its own response strategies rather than being ignored.
12. The probability and impact matrix is best understood as:
A final contingency calculation once the probability and impact scores have been summed
A precise measurement tool
A triage tool for deciding which risks need deeper analysis and active response
A substitute for the risk register
Answer: c. The matrix sorts, it does not measure. Its output is a priority ranking used to decide where to spend limited quantitative-analysis effort, not a dollar figure to defend.
13. A CM sums the EMV of every significant risk in the register to arrive at a contingency figure. Compared to a flat percentage contingency, this approach:
Replaces the need for a risk register
Is always less accurate
Is a defensible, risk-based alternative grounded in the actual register
Cannot be used on public projects, where statutory contingency percentages are mandatory
Answer: c. Summed EMV ties the contingency number to specific, named risks rather than an arbitrary percentage. That traceability is exactly what makes it defensible to an owner asking where the number came from.
14. A public agency with statutory funding limits is generally:
Prohibited from using contingency
Indifferent to risk allocation, since public funds are backed by the taxing authority
More risk-averse, often rationally paying a premium to transfer risk
Always the most risk-tolerant party
Answer: c. Fixed statutory funding and political exposure both push toward risk aversion. Paying more to transfer risk away from a hard budget ceiling is a rational choice for that kind of owner, not a mistake.
Micro-Assignment
Build a risk register with at least ten entries for a project you know. Write every risk in cause-event-effect form. Rate probability and impact on a five-point scale, compute a score, and sort. Then take the top three and calculate EMV for each. Finally, write one paragraph comparing your summed EMV against whatever flat contingency percentage that project actually carried, and say which you would defend to an owner.
Glossary
Threat / Opportunity
Negative and positive risks.
Issue
A risk that has occurred.
Risk Register
Living document recording risks, ratings, responses, owners, and triggers.
EMV
Expected monetary value; probability multiplied by impact.
Monte Carlo Simulation
Repeated sampling producing a distribution of outcomes.
P80
A confidence level at which 80 percent of simulated outcomes fall at or below the stated value.
Cause-Event-Effect
Risk statement structure separating the underlying condition, the uncertain event, and its consequence.
Probability and Impact Matrix
Qualitative triage tool combining likelihood and consequence ratings to prioritize risks.
Delphi Technique
Anonymous, multi-round expert elicitation method that avoids dominant-personality distortion.