about 3.3% of the exam content - about 90 minutes - 14 practice questions
0:00 / --:--
Reading
Risk is any uncertain event that, if it happens, changes your project for better or worse. Notice
the words uncertain and if. A hurricane that already flooded the job site is not a
risk; it is an issue, and you manage it in the issue log. A hurricane that
might flood the job site in September is a risk, and you manage it in the risk register
before it happens. That difference, uncertain future event versus present-tense problem, is the
single most tested idea in this whole area.
Risk also runs both directions. A threat is a negative risk. An
opportunity is a positive risk. When a lumber supplier offers GCHS a 12% discount if
we commit to a full year of volume, that is a positive risk, and PMI expects you to manage it with the
same discipline you would use on a threat.
The risk management plan: deciding how you will decide
Before you list a single risk, you write the risk management plan. It does not
contain risks. It contains the rules of the game: who does risk work, how often you meet about it, what
categories you will sort risks into (an RBS, or risk breakdown structure), how you will
score probability and impact, how much money and time you can set aside, and, most importantly, the
organization's risk thresholds.
Risk appetite: the general, high-level willingness to take on uncertainty in
pursuit of a reward. GCHS has a high appetite for trying new accessibility designs and a very low
appetite for anything that jeopardizes a HUD grant.
Risk tolerance: how much variation around an objective the organization can
absorb. We can tolerate a rehab finishing two weeks late; we cannot tolerate two months.
Risk threshold: the specific measurable line that turns appetite into action.
For example: any risk scoring above 12 on the matrix gets a written response plan and a named owner;
any risk with a potential cost over $75,000 gets escalated to the executive director.
Threshold is the concrete number. Appetite is the attitude. Exam questions love to make you pick
between those two words.
Finding risks: identification is continuous, not a one-time meeting
Risk identification happens at kickoff and then again, and again, for the life of the project.
Everyone on the team participates: risk identification is not the project manager's private hobby.
Techniques you should recognize:
Brainstorming and nominal group technique: generate ideas
broadly, then rank them.
Interviews with experienced crew, inspectors, and funders.
Checklists built from past GCHS projects: fast, but they only catch risks
someone already met before, so never rely on a checklist alone.
Root cause analysis: start with a known problem and work backward to the
conditions that create it.
Assumption and constraint analysis: every assumption in the project charter is
a risk wearing a disguise. If we assumed the homeowner would relocate during demolition, write that
down as a risk.
SWOT: strengths, weaknesses, opportunities, threats; forces you to look for
positive risks too.
Document analysis, prompt lists (PESTLE, TECOP), and
Delphi technique (anonymous rounds of expert input, used when a loud senior voice
would otherwise dominate the room).
The risk register and the risk report
These are two different documents and the exam checks that you know it.
Sources of overall risk exposure, number of risks by category, trends, key drivers, and summary of high-priority risks
Audience
Team members doing the work
Sponsor, steering committee, funders
Question it answers
What could happen on this task, and who owns it?
How risky is this project overall, and is it getting better or worse?
Every risk needs a risk owner, one named person, not a department, who watches
the risk, watches for the trigger, and executes the response. A risk trigger is the
early warning sign that the risk is about to become real: the National Hurricane Center posting a
tropical depression in the Gulf, a supplier quote that expires in 10 days, an inspector who has failed
two of our last three rough-ins.
Analyzing risk: qualitative first, then quantitative
Qualitative risk analysis is the quick pass. You rate each risk's probability and
impact, often on a scale of 1 to 5 or Very Low to Very High, multiply or plot them, and get a
risk score that tells you which risks deserve real work. It is subjective, cheap, and
fast, and it is done on every project.
Probability
Impact 1 (Very low)
Impact 2 (Low)
Impact 3 (Moderate)
Impact 4 (High)
Impact 5 (Very high)
5 (Very likely)
5
10
15
20
25
4 (Likely)
4
8
12
16
20
3 (Possible)
3
6
9
12
15
2 (Unlikely)
2
4
6
8
10
1 (Rare)
1
2
3
4
5
Qualitative analysis also considers urgency (how soon the response must start),
proximity (how soon the risk could hit), manageability, and
data quality: a high score built on a wild guess deserves less confidence than one
built on ten years of GCHS cost history.
Quantitative analysis is the deep pass, and it is optional: you do it on large,
complex, or high-visibility projects where the extra effort pays for itself. It analyzes the combined
effect of risks on overall project objectives.
Expected monetary value (EMV) = probability × impact. Threats are entered as
negative numbers, opportunities as positive. A 30% chance of a $40,000 flood loss has an EMV of
−$12,000. Summing the EMVs of your identified risks gives a defensible starting point for the contingency reserve. Some organizations net opportunities against threats; others reserve for threats only.
Decision tree analysis: compares two or more courses of action by rolling EMV
backward through the branches. Example: buying a $30,000 backup generator outright versus renting for
$4,000 with a 45% chance of a $60,000 storm shutdown. Rent branch = $4,000 + (0.45 × $60,000) =
$4,000 + $27,000 = $31,000, so buying at $30,000 is the better expected value by $1,000.
Monte Carlo simulation: runs the schedule or budget thousands of times using
ranges instead of single-point estimates, and returns a probability distribution: for example, an 82%
confidence of finishing by March 15. It answers how likely is this date, not which risk
matters most.
Sensitivity analysis / tornado diagram: shows which individual variables have
the biggest effect on the outcome. The longest bar at the top of the tornado is the thing to attack
first.
Key points
Qualitative = subjective ranking, done on all projects, prioritizes individual risks. Quantitative =
numeric modeling, done on some projects, evaluates the combined effect on overall objectives. If a
question says the PM wants to know the probability of meeting a date, that is Monte Carlo. If it says
the PM wants to know which risk drives the most cost variance, that is sensitivity analysis.
Responding to threats and opportunities
Five strategies each, and they mirror each other. Learn them as pairs.
Threat (negative)
What it means
Opportunity (positive)
What it means
Avoid
Eliminate the threat entirely: change the plan so the risk cannot occur. Move the roof tear-off out of hurricane season.
Exploit
Make certain the opportunity happens: remove all uncertainty. Assign your best crew so the bonus milestone is guaranteed.
Transfer
Shift ownership and impact to a third party, usually for a fee: insurance, warranties, performance bonds, fixed-price subcontracts.
Share
Give part of the upside to a partner better positioned to capture it: a joint venture or partnership with a community college training program.
Mitigate
Reduce probability or impact to an acceptable level; you still own the risk. Order long-lead windows early; add moisture testing.
Enhance
Increase probability or impact of the good outcome; you still own it. Pre-qualify two extra volunteer crews to raise the odds of an early finish.
Accept
Take no action to change the risk. Active acceptance sets a contingency reserve; passive acceptance simply documents it and reacts if it happens.
Accept
Take the upside if it shows up, but do nothing to chase it.
Escalate
Used for either direction: the risk falls outside the project's scope or the PM's authority, so ownership moves to the program, portfolio, or executive level. Once escalated and accepted by that level, it leaves your active register, but you still record that it was escalated.
The escalation nuance
PMI generally wants project managers to act rather than run to the sponsor. But escalation is
the textbook-correct response when the risk genuinely sits outside your authority: a change in HUD
regulations, a corporate insurance program, a decision to enter a new county. Do not confuse
"escalate a risk you cannot own" (correct) with "escalate a problem you could have solved" (wrong).
Secondary risks, residual risks, and reserves
Responses create consequences of their own.
Secondary risk: a brand-new risk created by your response. You transfer
framing to a fixed-price subcontractor to avoid cost overrun, and now you carry the new risk that the
sub goes out of business mid-job.
Residual risk: what is left over after the response. You elevate the
HVAC condenser three feet to mitigate flooding; a 4-foot surge would still reach it. That leftover
exposure is residual, and it is normally accepted and documented.
Contingency reserve: time and money for known risks you have
identified and analyzed. It sits inside the cost baseline and is normally used at the PM's discretion, following the rules in the plan.
Management reserve: time and money for unknown risks, the
things nobody saw coming. It sits outside the cost baseline, in the total project budget, and
requires management approval to release. Using it usually changes the cost baseline.
Risk in agile and hybrid work, and the new 2026 pressures
About 60% of the 2026 exam is adaptive or hybrid, and agile teams manage risk continuously rather
than in a quarterly document review.
Risk-adjusted backlog: risk response actions are put on the product backlog as
real work items and ordered alongside features, so risk work actually gets done instead of living in a
spreadsheet nobody opens.
Spikes: short, timeboxed research or prototype efforts used to reduce
uncertainty before committing. Building one mock-up bathroom to test a curbless shower detail is a
spike.
Fail fast: deliberately testing the riskiest assumption early and cheaply, when
changing course is still inexpensive.
Short feedback loops: every iteration review and demo is a risk-detection event;
small batches mean smaller blast radius when something goes wrong.
Threat and opportunity review in retrospectives, plus a visible risk board so the
whole team, not just the PM, watches exposure.
New pressures for 2026: AI, ESG, and supply chains. The 2026 exam explicitly
expects you to think about technology and sustainability risk.
AI-driven risk analytics can scan historical project data, weather patterns, and
supplier performance to surface risks a human would miss and to sharpen probability estimates. Treat
AI output as an input to analysis, not a decision. The PM validates the data, checks for bias
in the training set, and keeps a human accountable for the response. AI also brings its own risks: data privacy of homeowner records, hallucinated outputs, and over-reliance.
ESG and sustainability risk: climate exposure, material sourcing, energy
performance, and community impact are now legitimate register entries. For GCHS, rising flood-plain
maps and stricter energy codes change what a compliant rehab costs.
Supply chain and market risk: lumber and copper price swings, long-lead
equipment, single-source suppliers. Responses include dual sourcing, early buy-out, escalation clauses
in subcontracts, and holding a materials contingency.
Watch out
Risk management is never finished. Reassess risks at every status meeting, at every phase gate, after
every major change, and whenever the environment moves. A register last updated at kickoff is a
finding on any audit, and on the exam, "review and update the risk register" is very often the
correct FIRST action.
Practice Questions
1. During a GCHS rehab, the project manager learns that the homeowner's roof is currently leaking and has already damaged new drywall. How should this be recorded?
As an assumption in the assumption log
As a new risk in the risk register, rated by probability and impact
As an issue in the issue log, because it has already occurred
As a secondary risk arising from the drywall response
Answer: c. A risk is an uncertain FUTURE event. Once the event has occurred and is causing damage now, it is an issue and belongs in the issue log for active resolution. Recording it as a risk with a probability is wrong because the probability is no longer uncertain; it is 100% and already realized.
2. Which document does the risk management plan contain?
The quantitative EMV calculation for each threat
The contingency reserve drawdown log
The list of identified project risks and their owners
The methodology, roles, budgeting, timing, categories, and thresholds for doing risk work
Answer: d. The risk management plan describes HOW risk will be managed: methodology, roles and responsibilities, funding, cadence, risk categories (RBS), definitions of probability and impact, and stakeholder risk thresholds. The list of actual risks lives in the risk register, not the plan; confusing the two is a common exam trap.
3. A project manager defines the rule that any risk scoring 15 or higher on the probability-impact matrix must have a documented response plan and a named owner. This is an example of a:
Risk trigger
Management reserve
Risk appetite statement
Risk threshold
Answer: d. A threshold is the specific, measurable level of exposure at which action becomes required. Appetite is the general willingness to take risk; a trigger is the warning sign that a particular risk is about to occur. A numeric cut-off that forces a defined action is a threshold.
4. Which risk identification technique gathers input from experts anonymously over multiple rounds to prevent one dominant voice from steering the group?
Brainstorming
Delphi technique
Checklist analysis
SWOT analysis
Answer: b. The Delphi technique uses anonymous, iterative rounds with a facilitator consolidating responses, which removes personality and rank effects. Brainstorming is face-to-face and specifically vulnerable to the loud-senior-person problem the question describes.
5. Which statement best distinguishes the risk register from the risk report?
The register is used only in agile projects; the report only in predictive
They are the same document under two names
The register summarizes overall project risk exposure; the report lists individual risks
The register lists individual risks with owners and responses; the report summarizes overall project risk and trends
Answer: d. The risk register is the row-by-row record of individual risks: description, cause, score, response, owner, trigger, status. The risk report rolls that up into information about OVERALL project risk exposure, key drivers, and trends for sponsors and funders. Reversing them is the classic trap.
6. Qualitative risk analysis is BEST described as:
A quick, subjective ranking of individual risks by probability and impact
A simulation producing a confidence level for the finish date
A technique used only when quantitative analysis is unavailable
A numeric model of the combined effect of all risks on the project's overall objectives
Answer: a. Qualitative analysis rates and ranks individual risks quickly and subjectively so the team knows where to spend attention. The numeric modeling of combined effects on overall objectives (including simulations that produce confidence levels) is quantitative analysis, which is optional and typically reserved for large or complex projects.
7. A GCHS quantitative analysis identifies three risks on a rehab: a 20% chance of a $30,000 permit-delay cost, a 30% chance of a $10,000 material price spike, and a 15% chance of an $8,000 gain from an early-finish incentive. What is the net expected monetary value of the three risks combined?
-$9,000
-$10,200
-$7,800
-$4,800
Answer: c. EMV is probability times impact, threats negative and opportunities positive: permit delay = -0.20 x $30,000 = -$6,000; material spike = -0.30 x $10,000 = -$3,000; early-finish incentive = +0.15 x $8,000 = +$1,200. Summed: -$6,000 - $3,000 + $1,200 = -$7,800, the net EMV. Treating the incentive as a cost instead of a gain gives the wrong distractor of -$10,200.
8. A supplier offers GCHS a bulk discount if the order is placed this week. The project manager assigns the most capable buyer and pre-approves the paperwork so the discount is captured with certainty. Which opportunity strategy is this?
Accept
Exploit
Enhance
Share
Answer: b. Exploit removes uncertainty entirely so a positive risk is guaranteed to happen, which matches assigning the best resource to lock in the discount. Enhance would only raise the probability or impact, not guarantee it.
9. Which statement about management reserve is correct?
It sits inside the cost baseline, and the project manager may draw on it without any approval
It is calculated using EMV on the identified risk register
It funds known risks that have already been analyzed and scored
It covers unknown risks, sits outside the cost baseline, and needs management approval
Answer: d. Management reserve covers unknown-unknowns, sits outside the cost baseline in the total project budget, and needs management approval to release. Contingency reserve is the one calculated from known, analyzed risks and sits inside the baseline, usually for the PM to use under the rules in the plan.
10. The National Hurricane Center posts a tropical depression forming in the Gulf. For GCHS's hurricane-season flooding risk, this notice is best described as a:
Risk threshold
Risk response
Risk trigger
Secondary risk
Answer: c. A risk trigger is the early warning sign that a risk is about to become real, and a tropical depression forming is exactly that signal for a flooding risk. It is not a threshold, which is the numeric line that forces a required action.
11. GCHS transfers framing work to a fixed-price subcontractor to avoid a cost overrun. The new possibility that this subcontractor could go out of business mid-job is a:
Secondary risk
Contingency reserve item
Management reserve item
Residual risk
Answer: a. A secondary risk is a brand-new risk created by the response itself, exactly like the subcontractor-failure exposure created by transferring the work. A residual risk is what remains of the original risk after the response, not a new one caused by it.
12. An agile GCHS Portal team wants to test an uncertain vendor integration before committing to it. Where should that work live?
Written into the business case for the sponsor to review at the next gate
As a spike on the product backlog, ordered alongside feature work
Only noted in the risk register with no scheduled work
Discussed in a separate risk-only meeting outside the sprint
Answer: b. A risk-adjusted backlog puts response actions such as a timeboxed spike directly on the backlog as real, prioritized work, which is how agile teams make sure risk work actually gets done. Leaving it only in the register with no scheduled work means it competes with nothing and rarely happens.
13. An AI tool scans GCHS's historical project data and flags a supplier delivery risk the team had not considered. What is the correct way to use this output?
Disregard it because AI cannot assess construction risk
Let it replace the team's qualitative risk analysis session
Treat it as an input to analysis, validate the data, and keep a human accountable for the response
Add it to the risk register automatically with no review
Answer: c. AI-driven risk analytics is treated as an input the PM validates for data quality and bias, with a human still accountable for the response. Automatically accepting it or letting it replace team analysis ignores that AI output is a starting point, not a decision.
14. A pending HUD rule change could eliminate a category of allowable rehab costs, a risk entirely outside the project's authority to change or absorb. What is the correct risk response?
Escalate the risk to the program or portfolio level
Transfer the risk to the framing subcontractor
Actively accept the risk and fund it from contingency reserve
Mitigate it by quietly reducing scope on the current task order
Answer: a. A pending regulatory change of this kind sits outside the project's scope and the PM's authority, which is exactly when escalation is the textbook-correct response. Mitigating or absorbing it quietly is the wrong answer PMI tests for when a risk genuinely cannot be owned at the project level.
Glossary
Risk appetite
The general, high-level willingness of an organization to take on uncertainty in pursuit of reward.
Risk tolerance
The amount of variation around an objective that an organization can absorb.
Risk threshold
The specific, measurable level of risk exposure that triggers a required action.
Risk trigger
An early warning sign or condition indicating that a risk is about to occur.
Expected monetary value (EMV)
Probability multiplied by impact, expressed as a negative number for threats and a positive number for opportunities.
Secondary risk
A new risk created directly by a risk response.
Residual risk
The exposure that remains after a risk response has been applied.
Management reserve
Time and money set aside for unknown risks, held outside the cost baseline and released only with management approval.