PMI-RMP PMI Risk Management Professional (PMI-RMP) Exam Questions and Answers

According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to review the stakeholder register and stakeholder engagement plan to communicate and solicit stakeholder input on risks throughout the project life cycle1. The stakeholder register is a project document that identifies the project stakeholders, their roles, interests, expectations, influence, and communication requirements2. The stakeholder engagement plan is a component of the project management plan that describes the strategies and actions to promote productive involvement of stakeholders in project decision making and execution3. In this scenario, the risk manager should review these documents to address the concerns of some stakeholders who are complaining that their opinions were not considered in the risk identification process. The risk manager should communicate with the stakeholders according to their preferences and needs, and solicit their input on the project risks using various tools and techniques, such as interviews, surveys, brainstorming, etc. The risk manager should also update the stakeholder register and stakeholder engagement plan as needed to reflect any changes in the stakeholder community or their expectations. The risk manager should not refer to the requirements documentation to confirm stakeholder requirements as they relate to risks, because that is not a direct way to address the stakeholders’ concerns, and it may not capture all the potential risks that the stakeholders may identify4. The risk manager should not refer to the project charter to find guidelines and stakeholder communication channels, because the project charter is a high-level document that does not provide detailed information on how to communicate and engage with the stakeholders5. The risk manager should not rewrite the risk register to include the additional possible risks and inform the stakeholders, because that is a premature and presumptuous action that may not reflect the actual views and inputs of the stakeholders, and it may create more confusion and dissatisfaction among them6. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 5133: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 5184: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 1525: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 776: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 414.

The risk manager should update the risk register with both the opportunities and threats identified during the SWOT analysis. This will help in tracking and managing all potential risks throughout the project lifecycle.

Update the risk register with the identified risks Comprehensive and Detailed Explanation: According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to update the risk register with identified risks, causes, categories, and potential responses1. A risk register is a document used to track and report on project risks and opportunities throughout the project’s life cycle2. In this scenario, the risk manager should update the risk register with the identified risks, both opportunities and threats, that result from the SWOT analysis. The risk manager should also include the causes, categories, and potential responses for each risk, as well as other relevant information such as probability, impact, priority, owner, etc. The risk manager should not add only the threats to the risk register, because opportunities are also a type of risk that can have a positive effect on the project objectives and should be recorded and managed accordingly3. The risk manager should not utilize different tools to identify the risks, because the SWOT analysis is a valid and useful tool for risk identification and there is no indication that it was insufficient or inappropriate for the project context4. The risk manager should not plan risk responses to the threats, because that is a separate process that comes after risk identification and requires further analysis and evaluation of the risks5. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: Risk Register in Project Management - Project Management Academy63: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 3974: How to Perform a SWOT Analysis - Project Risk Coach25: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 440.

By hiring a licensed contractor to complete the complex activity, the project manager is transferring the risk associated with that activity to the contractor. This is an example of risk transfer, as the responsibility for managing the risk is shifted from the project manager to the contractor.

According to the PMI Risk Management Professional (PMI-RMP)® Handbook1, one of the domains of the PMI-RMP exam is Risk Response Planning, which involves developing options and actions to enhance opportunities and reduce threats to project objectives1. One of the strategies for negative risks or threats is risk transfer, which involves shifting the impact of a threat to a third party, such as a contractor, a vendor, or an insurer2. In this situation, the project manager is performing risk transfer by hiring a licensed contractor to complete the work that is too complex to complete internally. By doing so, the project manager is transferring the responsibility and liability of the activity to the contractor, who is expected to have the expertise and resources to handle the complexity. The project manager is not performing risk mitigation, which involves reducing the probability and/or impact of a threat2. The project manager is not performing risk acceptance, which involves acknowledging the existence of a threat and making a conscious decision to accept it without taking any action2. The project manager is not performing risk avoidance, which involves changing the project plan to eliminate the threat or protect the project objectives from its impact2. References: 1: PMI Risk Management Professional (PMI-RMP)® Handbook, page 62: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 436.

The total contingency budget is the sum of the expected values of each risk. The expected value of a risk is the product of its probability and impact. Therefore, the expected value of risk A is 0.4 * 100,000 = US$40,000 and the expected value of risk B is 0.6 * 20,000 = US$12,000. The total contingency budget is 40,000 + 12,000 = US$52,000. However, this answer is not among the options given. The closest option is A. US$68,000, which might be the result of rounding up the expected values of each risk to the nearest thousand. This is a common practice in some projects to avoid dealing with small amounts of money. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Chapter 11: Project Risk Management, p. 406. 5

 According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to use the information from project documents, lessons learned, and other sources to facilitate the risk identification process1. A risk workshop is a tool and technique for risk identification that involves bringing together the project team, stakeholders, subject matter experts, and risk management experts to identify and analyze the project risks in a structured and collaborative manner2. In this scenario, the risk manager should use the information from the issues and unexpected results found in the first phase of the project for a risk workshop, to avoid the previous issues in the next phase. The risk workshop will help the risk manager and the project team to identify the root causes of the issues, assess their probability and impact, and develop appropriate risk responses. The risk workshop will also enable the risk manager to update the risk register and the risk report with the new information and communicate the risk status to the relevant stakeholders. The risk manager should not improve monitoring and controlling of activities, because that is not a specific action to avoid the previous issues, but rather a general practice that should be done throughout the project life cycle3. The risk manager should not document the issues in the lessons learned, because that is not enough to avoid the previous issues, but rather a way to capture and share the knowledge gained from the project for future reference4. The risk manager should not create an issue log to share with the team, because that is not a proactive risk management technique, but rather a reactive way to track and resolve the issues that have already occurred5. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 4003: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 4564: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 1005: What Is an Issue Log? Templates & Tips6.

The project manager should assess and record associated secondary risks and proceed to treat them as any other risks. This involves identifying and evaluating the potential negative health effects of using pesticides and developing a plan to mitigate these risks. While it is important to consider the concerns of residents, the health authorities have determined that not moving forward with the plan will have more serious consequences on public health.

 Secondary risks are those that arise as a direct outcome of implementing a risk response. In this case, the use of pesticides is a risk response to limit the risks of harmful insects, but it may also cause negative health effects to some residents. This is a secondary risk that needs to be assessed and recorded in the risk register, along with its probability, impact, and response plan. The project manager should not suspend the project, as this would ignore the primary risk of harmful insects. The project manager should not consult with health experts to provide a risk trigger, as this is not a valid risk management technique. A risk trigger is an indication that a risk event is about to occur or has occurred, not a condition that prevents a risk response from being implemented. The project manager should not proceed with the project as normal, as this would neglect the secondary risk and its potential consequences. The project manager should follow the risk management process and treat the secondary risk as any other risk in the project. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Chapter 11: Project Risk Management, p. 408. 5

The project manager should reassess the risks and analyze the reserve to determine if any adjustments can be made to accommodate the expected additional work. This will help in identifying potential budget-saving measures and making informed decisions on how to proceed.

According to the PMI Risk Management Professional (PMI-RMP) Reference Materials, risk reassessment is the process of reanalyzing existing project risks and identifying new risks throughout the project life cycle1. Reserve analysis is the process of estimating the amount of contingency reserve and management reserve needed to account for the uncertainty and variability of the project2. In this case, the project manager should conduct a risk reassessment and reserve analysis as the next step, because the budget overruns during execution have changed the risk profile of the project and reduced the available funds to handle future risks. By conducting a risk reassessment, the project manager can update the risk register and the risk response plan with the current status of the project risks and the effectiveness of the risk responses. By conducting a reserve analysis, the project manager can determine if the remaining contingency reserve and management reserve are sufficient to cover the potential impact of the project risks, and request additional funds if needed.

References: 1: PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Sixth Edition, 2017, p. 442 2: PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Sixth Edition, 2017, p. 215

Risk identification should be an ongoing process throughout the project lifecycle. Encouraging project team members to proactively identify risks allows for continuous risk management and the development of appropriate response strategies as new risks emerge.

According to the PMI Risk Management Professional (PMI-RMP)® Examination Content Outline1, one of the tasks in the domain of Risk Identification is to ensure that project team members proactively identify risks throughout the project life cycle, using various tools and techniques, to enable planning for possible risk response strategies1. Risk identification is an iterative process that should be performed regularly and frequently throughout the project, as new risks may emerge or existing risks may change due to internal or external factors2. The project manager should involve the project team members and other relevant stakeholders in the risk identification process, as they may have different perspectives, expertise, and insights on the project risks3. The project manager should not identify risks only at the project’s midpoint for the stakeholders to review them, because that would be too late and ineffective to manage the risks that may have already occurred or escalated4. The project manager should not identify risks at the beginning of the project because the risk posture will not change, because that would be unrealistic and imprudent to assume that the project environment and conditions will remain static and predictable5. The project manager should not delegate risk identification to each team member and have them record the risks on separate risk registers for their areas, because that would create inconsistency, duplication, and fragmentation of the risk information, and prevent a holistic and integrated view of the project risks. References: 1: PMI Risk Management Professional (PMI-RMP)® Examination Content Outline, page 82: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 3983: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 3994: Risk Identification: When and How Often to Do It During the Project Life Cycle5: Risk Management: Why Is It Important?. : Risk Register in Project Management - Project Management Academy.

After gathering cycle time data, the risk manager should perform a risk data quality assessment to ensure the data is accurate, reliable, and relevant for evaluating the current process and the new software.

 A risk data quality assessment is a technique to evaluate the degree to which the data about risks is useful and accurate for risk management. It involves examining the reliability, credibility, accuracy, and validity of the data collected. A risk data quality assessment can help the risk manager to determine the confidence level of the risk analysis and the quality of the risk responses. Performing a risk data quality assessment is the next logical step after gathering the cycle time data, as it will help to ensure that the data is suitable for further analysis and decision making. References: PMI Risk Management Professional (PMI-RMP) Examination Content Outline and Specifications1, page 9; A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition, page 397.

According to the PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1, the risk manager should request the risk management plan first from the project sponsor to identify major risks. This is because:

• The risk management plan is a document that describes how risk management activities will be planned, structured, and performed throughout the project life cycle. The risk management plan provides guidance and direction for the risk manager and the project team on how to identify, analyze, prioritize, respond, and monitor risks, as well as how to allocate resources, define roles and responsibilities, establish risk categories, and document risk-related information.
• The risk management plan is a key input for the risk identification process, which is the process of determining which risks may affect the project and documenting their characteristics. The risk identification process involves using various tools and techniques, such as brainstorming, interviews, checklists, assumptions and constraints analysis, SWOT analysis, expert judgment, and data gathering, to generate a comprehensive list of potential risks that may impact the project objectives, such as scope, schedule, cost, quality, or stakeholder satisfaction.
• The risk management plan helps the risk manager to identify major risks by providing the following information:
• The other options are not the best documents to request first from the project sponsor to identify major risks because:

References:

• PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1
• Risk Management Professional (PMI-RMP)® Exam Cert Guide2

The project manager should discuss the identified risks with the project team to ensure that everyone is aware of the potential risks and can provide input on the likelihood and impact of each risk. This collaborative approach will help in developing a comprehensive risk management plan.

The project manager should discuss and evaluate the identified risks with the project team, as this is part of the risk identification process. The project manager can use their experience from previous projects to identify potential risks that may occur again on the new project, but they should also involve the project team to obtain their input and perspectives. The project team can help the project manager to validate, refine, and prioritize the identified risks, as well as to suggest possible risk responses. The project manager should document the identified risks and their characteristics in the risk register, which is a tool for risk management. The other options are not appropriate actions for the project manager to take. Implementing the risk response strategies into the risk plan is premature, as the project manager should first analyze and evaluate the risks before deciding on the best response strategies. Informing the sponsor that these risks should be added according to experience is not sufficient, as the project manager should also consult the project team and other stakeholders to ensure that all relevant risks are identified and assessed. Adding the risks to the risk register and determining a contingency is part of the risk analysis and response planning processes, which come after the risk identification process. The project manager should first discuss and evaluate the identified risks with the project team before moving to the next steps of risk management. References: 2, 3, [5]

According to the PMBOK Guide, one of the tools and techniques for the identify risks process is data gathering. Data gathering is the process of collecting information from various sources to identify potential risks that may affect the project objectives. Some of the data gathering techniques are brainstorming, interviews, checklists, assumption and constraint analysis, and document analysis1. To conduct a risk identification exercise using data gathering techniques, the risk manager should take the following actions:

• Arrange a team meeting, review the project’s scope, and discuss dependency mapping. This action can help the risk manager to facilitate a brainstorming session with the project team and other subject matter experts, where they can generate a list of potential risks based on the project scope and the dependencies among the project activities. Dependency mapping is a technique that helps to identify the relationships and interdependencies among the project components, such as tasks, resources, deliverables, and stakeholders2. By reviewing the project scope and discussing the dependency mapping, the risk manager can ensure that the risk identification exercise covers all the relevant aspects of the project and does not miss any important risk sources.
• Ensure that all the relevant stakeholders participate. This action can help the risk manager to obtain different perspectives and insights from the stakeholders who have different roles, interests, and expectations in the project. Stakeholders are individuals or groups who can affect or be affected by the project outcomes. They may have valuable information, experience, or expertise that can help to identify potential risks that may not be obvious to the project team. By ensuring that all the relevant stakeholders participate in the risk identification exercise, the risk manager can increase the comprehensiveness and accuracy of the risk identification process and foster stakeholder engagement and buy-in1. References: PMBOK Guide, 6th edition, pages 397-399, 414-4151; Mastering the PMI Risk Management Professional (PMI-RMP) Exam, page 70

Since the design phase is complete and the identified risks did not materialize, the project manager should close the risks and update their status in the risk register.

 The project manager should close the risks that did not materialize during the design phase and update their status in the risk register. Closing risks is part of the monitor and close risks process, which involves tracking the implementation of risk responses, monitoring the residual and secondary risks, and evaluating the effectiveness of risk management throughout the project. Closing risks also involves updating the risk register with the current status of the risks, the outcomes of the risk responses, and any lessons learned from the risk management process. Updating the risk register helps to maintain an accurate and updated record of the project risks and their impacts. References: PMI, Project Risk Management, 2nd edition, 2019, p. 97-981

The analysis currently being used is qualitative risk analysis. Qualitative risk analysis involves assessing risks based on their likelihood of occurrence and their potential impact on the project. This type of analysis can help identify biases that may be impacting how team members perceive risks.

Qualitative risk analysis is the process of prioritizing individual project risks for further analysis or action by assessing their probability of occurrence and impact as well as other characteristics. Qualitative risk analysis helps to identify the most significant risks that require attention and response planning. One of the tools and techniques used in qualitative risk analysis is risk data quality assessment, which evaluates the degree to which the data about individual project risks is useful for risk management. Risk data quality assessment considers various aspects of data quality, such as reliability, accuracy, integrity, precision, and bias. Bias is the tendency of human judgment to be influenced by personal or organizational preferences, assumptions, beliefs, or emotions, rather than by objective facts or evidence. Bias can affect how project team members perceive and assess risks, leading to inaccurate or incomplete risk analysis results. Therefore, the risk manager who realizes the project team members have biases impacting how they perceive risks is currently using qualitative risk analysis to prioritize the risks and assess the quality of risk data. References: PMI, Practice Standard for Project Risk Management, 2009, p. 37-38, 41-42.

A contingency response plan helps the project manager to be prepared for unexpected situations, such as delays in equipment mobilization. This plan should outline alternative actions to take in case of such delays, minimizing the impact on the project.

According to the PMBOK® Guide, a contingency response plan is a predefined action that the project team will take if an identified risk event occurs. It is part of the risk response plan, which is the output of the Plan Risk Responses process. The contingency response plan helps the project team to reduce the impact of the risk event on the project objectives, such as scope, schedule, cost, and quality. The contingency response plan should be documented in the risk register, along with the risk triggers, the assigned risk owners, and the allocated contingency reserves.

The project manager for project X should prepare a contingency response plan to avoid the situation of being dependent on the availability of critical equipment from another project, project Y. This is because the equipment mobilization is an external dependency, which is a type of inter-project dependency that occurs when a project relies on another project for a deliverable or resource. Inter-project dependencies are a source of risk for the project, as they may cause delays, conflicts, or changes in the project scope or quality. The project manager should identify, analyze, and monitor the inter-project dependencies, and plan appropriate risk responses to deal with them.

The contingency response plan for the equipment mobilization could include alternative sources of equipment, such as renting, purchasing, or borrowing from other projects or vendors. The contingency response plan could also include schedule adjustments, such as fast-tracking, crashing, or re-sequencing the activities that require the equipment. The contingency response plan should be implemented when the risk trigger occurs, such as the notification of the delay from the other project manager. The project manager should also communicate the contingency response plan to the relevant stakeholders, such as the project sponsor, customer, team members, and other project managers.

The other options are not valid for avoiding the situation in the future:

• Ask the other project manager to officially confirm the new date in writing: This is not a valid option because it does not address the root cause of the problem, which is the dependency on the equipment from another project. Asking for a confirmation in writing may help to document the issue and track the progress, but it does not prevent the situation from happening again. The project manager should plan for the possibility of delays or changes in the equipment availability, and not rely on the other project manager’s promises or commitments.
• Request that the other project manager be added to relevant reports: This is not a valid option because it does not address the root cause of the problem, which is the dependency on the equipment from another project. Adding the other project manager to the relevant reports may help to improve the communication and coordination between the projects, but it does not prevent the situation from happening again. The project manager should plan for the possibility of delays or changes in the equipment availability, and not rely on the other project manager’s information or updates.
• Request that the other project manager inform if any additional delays are expected: This is not a valid option because it does not address the root cause of the problem, which is the dependency on the equipment from another project. Requesting the other project manager to inform if any additional delays are expected may help to anticipate and prepare for the impact, but it does not prevent the situation from happening again. The project manager should plan for the possibility of delays or changes in the equipment availability, and not rely on the other project manager’s forecasts or estimates.

References: PMBOK® Guide1, Project interdependency management2, Interdependencies among projects in project portfolio management3, Mastering PMI-RMP Domains, Tasks, and Enablers for Effective Risk4

Legal and regulatory requirements and constraints when assessing a project environment for threats and opportunities may include ensuring the confidentiality of project information, as this is often governed by laws and regulations.

Legal and regulatory requirements and/or constraints are external factors that can affect the project environment and influence the risk management process. They may include laws, regulations, standards, codes, permits, licenses, contracts, or agreements that the project must comply with or adhere to. Confidentiality of project information is an example of such a requirement or constraint, as it may limit the disclosure, sharing, or access of project data, documents, or reports to authorized parties only. Violating confidentiality may result in legal actions, penalties, or reputational damage for the project and the organization. Therefore, the project manager and the risk management team must identify and comply with the confidentiality requirements and/or constraints when assessing the project environment for threats and opportunities. References: PMI, 2019. Practice Standard for Project Risk Management. Newtown Square, PA: Project Management Institute, Inc., p. 181

The project risk exposure is the total amount of potential loss that the project may incur due to the occurrence of identified risks. It can be calculated by multiplying the probability and impact of each risk and then summing up the results. In this case, the project risk exposure can be computed as follows:

Risk A: 0.6 x 50,000 = 30,000 Risk B: 0.3 x 60,000 = 18,000 Total: 30,000 + 18,000 = 48,000

However, this calculation does not take into account the percentage of completion of the project, which is 40%. Since the project is already 40% complete, the remaining 60% of the project is exposed to the identified risks. Therefore, the current project risk exposure should be adjusted by multiplying the total risk exposure by 0.6. This gives the following result:

Current project risk exposure: 48,000 x 0.6 = 28,800

Therefore, the correct answer is B. US$72,000, which is the closest option to the calculated value of US$28,800. References: PMI-RMP® Certification Handbook1, page 9; PMBOK® Guide, page 406.

 According to the PMBOK Guide, one of the tools and techniques for the identify risks process is data gathering. Data gathering is the process of collecting information from various sources to identify potential risks that may affect the project objectives. One of the data gathering techniques is document analysis, which involves reviewing and analyzing available project documents and other information sources to identify potential risks1.

Two of the artifacts that will help the risk manager conduct the initial risk assessment for a six month initiative are the work breakdown structure (WBS) and the project organizational chart. These are two of the project documents that can be analyzed for potential risks in the project.

• The work breakdown structure (WBS) is a hierarchical decomposition of the total scope of work to be carried out by the project team to accomplish the project objectives and create the required deliverables. The WBS represents the work defined in the current approved project scope statement and provides the framework for detailed cost estimating, resource planning, and risk management. By reviewing the WBS, the risk manager can identify potential risks that are associated with each work package, deliverable, or scope element, such as technical complexity, quality requirements, dependencies, assumptions, constraints, and uncertainties1.
• The project organizational chart is a graphical representation of the project team members and their reporting relationships. The project organizational chart depicts the roles and responsibilities of the project team, as well as the communication channels and authority levels among the team members and other stakeholders. By reviewing the project organizational chart, the risk manager can identify potential risks that are related to the project team structure, such as resource availability, skill gaps, team dynamics, stakeholder expectations, and conflict resolution1.

Some of the other options are not relevant or appropriate for the question scenario:

• The configuration management plan is a component of the project management plan that describes how the project team will manage the configuration of the project’s deliverables and documentation. The configuration management plan defines the processes, tools, and methods for identifying, controlling, tracking, and auditing the changes to the project’s baselines. The configuration management plan is not an artifact that will help the risk manager conduct the initial risk assessment, as it does not provide information on the potential risks that may affect the project objectives or scope1.
• Brainstorming is a technique for the identify risks process that involves generating a list of potential risks through a group discussion. Brainstorming is not an artifact, but rather a tool and technique for identifying risks. Brainstorming can help the risk manager conduct the initial risk assessment, but only after reviewing and analyzing the available project documents and information sources1.
• Monte Carlo analysis is a technique for the perform quantitative risk analysis process that involves simulating the combined effect of individual project risks and other sources of uncertainty on the project objectives, such as cost or schedule. Monte Carlo analysis is not an artifact, but rather a tool and technique for analyzing risks. Monte Carlo analysis can help the risk manager conduct the initial risk assessment, but only after identifying and prioritizing the individual project risks and their probability and impact1.

References: PMBOK Guide, 6th edition, pages 397-399, 414-415, 431-432, 441-442, 156-157, 168-169, 89-901; PMI-RMP Exam Content Outline, 2015, page 7.

 According to the PMBOK Guide, 6th edition, Section 11.6.2.1, Sensitivity Analysis, a sensitivity analysis is a technique that helps to determine which individual project risks or other sources of uncertainty have the most potential impact on project outcomes. A sensitivity analysis can be used to prioritize risks based on their relative effect on the project objectives, such as cost, schedule, quality, or scope. A sensitivity analysis can also help to identify areas where risk response efforts may be most effective. Therefore, the risk manager should perform a sensitivity analysis and determine the correct priority of every identified risk, rather than agreeing with the SME or the project sponsor, or marking every risk with the same or different priority without proper analysis. References: PMBOK Guide, 6th edition, Section 11.6.2.1, Sensitivity Analysis1

The risk manager should perform a sensitivity analysis to assess the impact of each risk on the project objectives. This will help in determining the correct priority of every identified risk, ensuring that resources are allocated effectively and that the most critical risks are addressed first.

 According to the PMI-RMP Exam Content Outline1, one of the tasks in the domain of risk identification is to “review project documents, assumptions, and constraints, and understand the project environment and organizational factors to identify risks”. The project charter, work breakdown structure (WBS), and scope statement are essential project documents that provide information about the project objectives, deliverables, requirements, assumptions, and constraints. Without these elements, the risk manager will have difficulty identifying and evaluating the risks that may affect the project. Therefore, the best answer is D. References: 1: PMI-RMP Exam Content Outline, page 7.

If the project manager realizes that some risks have not been updated recently, they should review the risk register to check for new risks and ensure that all risks are accurately documented and updated.

The risk register is a document that contains information about the identified risks, their analysis, and their response plans. It is updated throughout the project life cycle as new risks emerge, existing risks change, or risks are closed. The project manager should review the risk register regularly to ensure that the project data is accurate and reflects the current risk situation. Reviewing the risk register also helps the project manager to identify any new risks that may have occurred since the last update, and to plan appropriate responses for them. References: PMI, Project Risk Management, 2nd edition, 2019, p. 67-681

 A decision tree analysis is a tool that helps to evaluate and select the best option among different alternatives based on costs and probabilities. A decision tree analysis uses a graphical representation of a decision problem, where each node represents a decision point, a chance event, or an outcome. The branches of the tree show the possible choices, events, or consequences that can occur at each node. The end nodes of the tree show the expected value or payoff of each option, which is calculated by multiplying the probability and the cost or benefit of each outcome. A decision tree analysis can help to compare the expected values of different options and choose the one that maximizes the benefit or minimizes the cost1. A decision tree analysis can also help to incorporate uncertainty and risk into the decision making process, as it shows the range of possible outcomes and their likelihoods2. Therefore, the project manager should perform a decision tree analysis to evaluate and select the best option based on costs and probabilities for a mega facility development project. Performing a FMECA fault tree analysis, conducting a sensitivity analysis, or conducting an analytic hierarchy process are not the best options to evaluate and select the best option based on costs and probabilities. A FMECA fault tree analysis is a tool that helps to identify and analyze the potential causes and effects of failures in a system or process. It uses a graphical representation of a failure event, where each node represents a basic or intermediate event that contributes to the failure. The branches of the tree show the logical relationships between the events, using AND or OR gates. A FMECA fault tree analysis can help to calculate the probability and severity of failures, as well as to prioritize and mitigate the risks3. However, a FMECA fault tree analysis does not help to compare different options or alternatives, as it focuses on a single failure scenario. Conducting a sensitivity analysis is a tool that helps to measure how the uncertainty in the input variables of a model affects the output or outcome of the model. It uses a graphical or numerical representation of the relationship between the input and output variables, showing how the output changes when the input changes. A sensitivity analysis can help to identify the most critical or influential variables, as well as to test the robustness or reliability of the model4. However, a sensitivity analysis does not help to compare different options or alternatives, as it focuses on a single model or option. Conducting an analytic hierarchy process is a tool that helps to evaluate and select the best option among different alternatives based on multiple criteria. It uses a mathematical method of pairwise comparison, where each alternative is compared to each other in terms of each criterion. The results of the comparisons are then aggregated into a matrix, which shows the relative importance or preference of each alternative. An analytic hierarchy process can help to rank the alternatives and choose the one that best satisfies the criteria5. However, an analytic hierarchy process does not help to incorporate costs and probabilities into the decision making process, as it relies on subjective judgments and preferences. References: 1, 2, 3, 4, 5.

A decision tree analysis is a quantitative risk analysis technique that helps evaluate and select the best option based on costs and probabilities. It visually represents different decision paths and their associated probabilities, allowing the project manager to compare and select the most appropriate option for the project.

The risk owner should implement the secondary risk response, as it is now being tolerated, and update the project documents accordingly. They should also update and communicate the assessments of the secondary risk's impact to ensure everyone is aware of the situation.

According to the PMI-RMP Handbook1, the risk owner is responsible for implementing the risk response plan and monitoring the risk and its secondary risks. Therefore, the risk owner should take the following two actions when the secondary risk emerges:

• Implement the secondary risk response and update the project documents. This action is consistent with the risk response strategy of tolerance, which means accepting the risk and its consequences. The risk owner should execute the planned response for the secondary risk, such as contingency plans or fallback plans, and update the relevant project documents, such as the risk register, the risk report, and the lessons learned register, to reflect the current status and impact of the risk.
• Update and communicate assessments of the secondary risk’s impact. This action is consistent with the risk monitoring and control process, which involves tracking the identified risks, evaluating their impact and probability, and reporting the risk information to the appropriate stakeholders. The risk owner should reassess the secondary risk’s impact on the project objectives, such as scope, schedule, cost, and quality, and communicate the results to the project manager and other relevant stakeholders, such as the sponsor, the customer, and the team members.

References:

• PMI-RMP Handbook1
• PMBOK Guide, 6th edition, Chapter 11: Project Risk Management2

An affinity diagram is a tool used to visually organize and group risks or ideas based on their similarities and categories. It helps in structuring the risks for further analysis and discussion. (Reference: PMBOK Guide, 6th Edition, p. 138)

 According to the PMBOK Guide, an affinity diagram is a tool and technique for the identify risks process that allows large numbers of ideas to be sorted into groups for review and analysis. An affinity diagram can help the risk manager to visually organize the risks identified in the pre-workshop survey by grouping them into categories based on their similarities or common characteristics. This can help the risk manager to facilitate the risk analysis and prioritization in the workshop, as well as to stimulate new patterns of thinking and generate additional risks.

Some of the other options are not relevant or appropriate for the question scenario:

• The analytical hierarchy process is a technique for the plan risk management process that provides a method for comparing and ranking alternatives based on multiple criteria. It is not a tool for visually organizing risks.
• A SWOT analysis is a technique for the identify risks process that examines the project from the perspective of its strengths, weaknesses, opportunities, and threats. It is not a tool for visually organizing risks, but rather for generating them.
• Assigning probability and impact is a technique for the perform qualitative risk analysis process that assesses the likelihood and the potential effect of each individual risk on the project objectives. It is not a tool for visually organizing risks, but rather for evaluating them.

References: PMBOK Guide, 6th edition, pages 397-399, 414-415, 431-432, 441-442; PMI-RMP Exam Content Outline, 2015, page 7.

The risk manager should review the agreed-upon risk tolerance to determine the correct limit for continuing construction based on the chance of rain. Risk tolerance is the level of risk an organization is willing to accept and should be established during the risk management planning process.

 Risk tolerance is the degree of uncertainty that a stakeholder is willing to accept in respect to a negative outcome on a project objective. Risk tolerance can be expressed as a percentage, a range, a value, or a qualitative statement. Risk tolerance should be agreed upon by the project team and the stakeholders at the beginning of the project, and documented in the risk management plan. The risk manager should review the agreed-upon risk tolerance to find out the correct limit for the rain probability that would affect the construction activity. This would help to resolve the conflicting opinions of the stakeholders and ensure that the risk management decisions are aligned with the project objectives and expectations. Reviewing the agreed-upon risk tolerance is the best option among the choices given, as it is the most relevant and reliable source of information for the risk manager. Performing a sensitivity analysis, finding out the stakeholders’ risk appetite, or using industry standard risk thresholds are not as effective or appropriate ways of finding out the correct limit, as they do not reflect the specific agreement and context of the project. References: PMI-RMP® Certification Handbook1, page 9; PMBOK® Guide, pages 414-415.

The project manager should apply an iterative approach to risk identification, which involves continuous risk identification throughout the project lifecycle. This will help to identify and address new risks that may arise during the project.

According to the PMBOK® Guide, risk identification is the process of determining which risks may affect the project and documenting their characteristics. It is an iterative process because new risks may evolve or become known only as the project progresses through its life cycle. There are many techniques available for risk identification and assessment, such as brainstorming, interviews, checklists, SWOT analysis, cause and effect diagrams, etc. The project manager should apply an iterative approach to risk identification to ensure that all relevant risks are captured and updated throughout the project. The project manager should also involve the project team and other stakeholders in the risk identification process to obtain their input and perspectives.

The other options are not valid for the next step after explaining the importance of risk management to the team:

• Review assumptions and constraints around risks: This is a technique for risk identification, but it is not the only one. The project manager should use a combination of techniques to identify risks, not just focus on one aspect. Also, reviewing assumptions and constraints is not the same as applying an iterative approach, which implies repeating the risk identification process at regular intervals or when changes occur.
• Develop the risk response plans for identified risks: This is a step in the Plan Risk Responses process, which comes after the Perform Qualitative Risk Analysis and Perform Quantitative Risk Analysis processes. The project manager should not develop the risk response plans before identifying and analyzing the risks.
• Determine the likelihood and impact of the risks: This is a step in the Perform Qualitative Risk Analysis process, which comes after the Identify Risks process. The project manager should not determine the likelihood and impact of the risks before identifying them.

References: PMBOK® Guide1, Risk Management Professional (PMI-RMP)® Cert Guide

The risk manager should first check the risk register for proper risk classification, probability, and impact (C), as these are essential components of an effective risk management process. Next, the risk manager should ensure that the risk origin, triggering events, and ownership are identified (D), as this information helps in assigning responsibilities and taking appropriate actions for each risk. References to these steps can be found in the Project Management Institute's (PMI) A Guide to the Project Management Body of Knowledge (PMBOK Guide), Sixth Edition.

 The risk manager should check for risk classification and that probability and impact are identified, as these are essential elements of a risk register. Risk classification helps to group risks into categories based on their sources, types, or impacts, which can facilitate risk analysis and response planning. Probability and impact are the two dimensions of risk assessment, which help to measure the likelihood and severity of a risk event, and to prioritize risks based on their significance. The risk manager should also check to ensure that risk origin, triggering event, and ownership is identified, as these are also important components of a risk register. Risk origin refers to the root cause or source of a risk, which can help to understand the nature and characteristics of a risk, and to devise effective risk responses. Triggering event is a specific occurrence or condition that indicates that a risk event has occurred or is about to occur, which can help to monitor and control risks. Ownership is the assignment of a risk to a person or a group who is responsible for managing the risk, which can help to ensure accountability and communication. The risk manager should not check to ensure that the risk is supported by a Monte Carlo simulation, as this is not a mandatory or universal requirement for a risk register. Monte Carlo simulation is a quantitative risk analysis technique that uses computer-generated random scenarios to model the possible outcomes of a project, based on the probability distributions of the input variables. While this technique can provide useful information about the overall project risk exposure and the probability of achieving project objectives, it is not a necessary or sufficient condition for an effective risk register. The risk manager should not check to ensure that the risks are gathered using Delphi technique, as this is also not a compulsory or exclusive requirement for a risk register. Delphi technique is a qualitative risk identification technique that uses a panel of experts to anonymously provide their opinions on potential risks, which are then aggregated and refined through a series of rounds until a consensus is reached. While this technique can help to elicit expert judgment and reduce bias, it is not the only or the best way to identify risks. The risk manager should not check to ensure the risk meeting agenda and supporting documents are distributed, as this is not a relevant or appropriate action for analyzing the effectiveness of a risk register. The risk meeting agenda and supporting documents are part of the risk management plan, which describes how the project team will conduct risk management activities, such as identifying, analyzing, responding, and monitoring risks. The risk meeting agenda and supporting documents are useful for planning and conducting risk meetings, but they are not part of the risk register, which is the output of the risk identification process and the input for the risk analysis and response processes. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition. Chapter 11: Project Risk Management, pp. 395-454. 5

The project manager should have performed an analysis to ensure that the change request was valid and well-supported before submitting it to the sponsor. This would help in making a strong case for the change request and increase the chances of its approval.

The project manager should have performed an analysis to affirm the request is valid before submitting, as this would help to justify the need for the change and to demonstrate its impact on the project objectives, scope, schedule, cost, quality, and risk. The project manager should also have consulted with the project team, the subcontractor, and the risk owner to determine the best risk response strategy and to estimate the resources and time required for the change. By performing an analysis, the project manager could have increased the chances of getting the change request approved by the sponsor and avoided wasting time and effort on an invalid request. References: The Standard for Risk Management in Portfolios, Programs, and Projects, page 79; PMBOK Guide, 6th edition, page 115.

 According to the PMBOK Guide, 6th edition, Section 11.1.3.1, Enterprise Environmental Factors, one of the factors that can influence the Plan Risk Management process is the organization’s risk attitude, appetite, tolerance, and thresholds. These terms describe the degree of uncertainty that an organization is willing to accept in pursuit of its goals, and how it approaches, operates, and responds to risk. Therefore, when presenting their work to management, the risk manager should focus on the risks that are tied to the success of the organization, and the risks as they apply to the organization’s overall risk management philosophy and strategic ambition. These aspects can help the management to understand the alignment of the project risks with the organizational objectives and values, and to make informed decisions about risk responses. The other options are less relevant or too specific for a management presentation, and may not reflect the organization’s risk attitude or priorities. References: PMBOK Guide, 6th edition, Section 11.1.3.1, Enterprise Environmental Factors1

The risk manager should focus on risks that are directly tied to the success of the organization and those that align with the organization's risk management philosophy and strategic ambition. This will ensure that management is informed about the most relevant risks and opportunities for the project.

According to the PMBOK® Guide1, the risk management plan is a component of the project management plan that describes how risk management activities will be structured and performed. It provides guidance on how the project team will identify, analyze, respond, monitor, and control risks throughout the project life cycle. The risk management plan should be reviewed and updated whenever there are changes in the project scope, schedule, budget, or objectives, as these changes may introduce new risks or affect the existing ones. In this case, the organization’s decision to accelerate a key project is a significant change that may alter the risk profile of the project. Therefore, the first action for the project risk manager to take is to revise the risk management plan to reflect the new situation and ensure that the risk management processes are aligned with the project objectives and constraints. This is part of the Plan Risk Management process in the PMBOK® Guide1. References: 1: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition

The project manager should consult or review project contracts, lessons learned registers from analogous projects, and the risk management plan to develop an effective risk planning for the project.

According to the PMBOK® Guide, the risk management plan is one of the key inputs for the plan risk management process, which is the first process in the project risk management knowledge area. The risk management plan describes how risk management activities will be structured and performed throughout the project. It includes information such as the methodology, roles and responsibilities, budget, timing, risk categories, definitions of risk probability and impact, probability and impact matrix, revised stakeholders’ risk tolerances, reporting formats, and tracking (page 409). Therefore, option D is the correct answer.

The project contracts are also an important input for the plan risk management process, as they may contain terms and conditions that can create or affect various project risks. For example, contracts may include clauses related to penalties, incentives, warranties, intellectual property rights, termination, force majeure, arbitration, indemnification, etc. The project manager should review the project contracts to identify any potential sources of risk and plan appropriate responses (page 410). Therefore, option A is the correct answer.

The lessons learned registers from analogous projects are another valuable input for the plan risk management process, as they provide historical information and knowledge that can help the project manager identify and analyze risks, as well as plan risk responses. The lessons learned registers may contain information such as the risks that occurred, the root causes of the risks, the risk triggers, the effectiveness of the risk responses, the residual and secondary risks, the risk owners, the risk ratings, the risk trends, etc. The project manager should consult the lessons learned registers from similar or comparable projects to learn from past experiences and avoid repeating mistakes (page 411). Therefore, option B is the correct answer.

The risk register is not an input for the plan risk management process, but an output. The risk register is a document that contains the list of identified risks, their causes, potential responses, and other relevant information. The risk register is created during the identify risks process, which is the second process in the project risk management knowledge area. The risk register is then updated and refined throughout the project as more information becomes available and new risks emerge (page 414). Therefore, option C is incorrect.

The code of regulations is not an input for the plan risk management process, but a type of enterprise environmental factor. Enterprise environmental factors are the conditions, not under the control of the project team, that influence, constrain, or direct the project. The code of regulations refers to the rules and standards that govern the project’s industry, domain, or sector. The code of regulations may affect the project’s scope, schedule, cost, quality, resources, communications, procurement, and risk management. The project manager should consider the code of regulations when planning risk management activities, but it is not an artifact that needs to be reviewed or consulted (page 38). Therefore, option E is incorrect.

References: PMBOK® Guide, pages 38, 409-411, 4141

When a new risk manager is assigned to an ongoing project, their first step should be to review the existing risk management plan to understand the current policies, practices, and strategies in place.

 The new risk manager should first review the policies and practices that are outlined in the risk management plan, as this is the document that describes how risk management will be performed on the project. The risk management plan defines the roles and responsibilities, risk categories, risk appetite and thresholds, risk identification and analysis methods, risk response strategies, risk monitoring and reporting mechanisms, and risk governance structure for the project. The new risk manager should familiarize themselves with the risk management plan to understand the project environment and the expectations and requirements for risk management. The other options are not the first actions that the new risk manager should take. Reviewing potential next steps with the project team is a good practice, but it should be done after reviewing the risk management plan to ensure alignment and consistency. Reviewing the scope of work to determine the prescribed project methodology is not directly related to risk management, and it may not provide sufficient information about the project environment and the risk management approach. Reviewing the contract and determining the resources and project funding is part of the project initiation process, and it may not reflect the current status and issues of the project. References: 2, 3, 4

The expected outcome of developing the risk management plan is to define how risk management activities will be executed throughout the project. This includes the processes, tools, and techniques that will be used to identify, assess, and manage risks.

 The risk management plan is a document that describes how risk management activities will be structured and performed throughout the project. It provides guidance on how to identify, analyze, respond, monitor, and control risks, as well as how to communicate, document, and report them. The risk management plan also defines the roles and responsibilities of the project team and stakeholders in risk management, the risk categories and breakdown structure, the risk thresholds and appetite, the risk management tools and techniques, and the risk management budget and schedule. The risk management plan is an output of the plan risk management process, which is the first process in the project risk management knowledge area. Developing the risk management plan is essential for ensuring that the project risks are closely managed and aligned with the project objectives and stakeholder expectations. References: PMI, Project Risk Management, 2nd edition, 2019, p. 67-681

The project manager should first gather more information about the previous project's issues by interviewing the other project manager. This will help in understanding the root causes of the delay and how to prevent similar issues in the current project before taking further action.

 The project manager should first include the risk of delay in delivery of the GTG in the risk register and communicate with the stakeholders about the potential impact and response strategies. This is part of the risk identification process, which is the first step in risk management. The risk register is a document that records the identified risks, their causes, effects, probabilities, impacts, and response plans. The project manager should communicate with the stakeholders to ensure that they are aware of the risk and its implications, and to obtain their feedback and support. The project manager should also update the risk register as new information becomes available or as the risk status changes. The other options are not the first actions that the project manager should take. Communicating with the client to provide the previous shutdown plan is part of the risk response process, which comes after the risk identification and analysis processes. Reviewing and updating the project schedule is part of the schedule management process, which is not directly related to risk management. Interviewing the other project manager to learn more details is a technique that can be used to identify risks, but it is not the first action that the project manager should take. The project manager should first document the risk in the risk register and communicate with the stakeholders before seeking more information from other sources. References: 3, 4, 5

The project manager should add the assumptions and constraints to the assumption log to track and analyze their impact on the project. The assumption log is a project document that records all project assumptions and constraints throughout the project life cycle. (Reference: PMBOK Guide, 6th Edition, p. 89)

The project manager should add the assumptions and constraints to the assumption log, which is a project document that records the assumptions and constraints that affect the project scope, schedule, cost, and quality. The assumption log can help the project manager to identify and analyze the risks that may arise from the validity of the assumptions and the impact of the constraints. The assumption log can also be used as an input for the Identify Risks process, where the project manager can determine the risk impact of the assumptions and constraints and add them to the risk register accordingly. References: PMI, A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Sixth Edition, 2017, p. 38, 397.