Free PMI-RMP Exam Flashcards

An uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives. Risk includes both threats (downside) and opportunities (upside).

A threat is a risk with a negative effect on objectives; an opportunity is a risk with a positive effect. PMI manages both — each has its own set of five response strategies.

An individual risk is a single uncertain event affecting one or more objectives. Overall project risk is the cumulative effect of all uncertainty on the project as a whole, including its exposure to variation.

The degree of uncertainty an organization is willing to accept in anticipation of a reward. It is a high-level, strategic attitude — broader than tolerance or threshold.

Tolerance is the range of acceptable variation around an objective. A threshold is a specific measurable trigger point that, once crossed, forces action. Tolerance is a band; threshold is a line.

Defines HOW risk will be managed: methodology, roles, budgeting, timing, risk categories, probability/impact definitions, and reporting formats. It does NOT list the actual risks.

The Risk Register records individual risks (description, owner, response, status). The Risk Report summarizes sources of overall project risk and the big-picture exposure. Register = detail; Report = summary.

A hierarchical, categorized list of potential risk sources used to organize identification (e.g., technical, management, commercial, external). It groups risks by source, not by work package like the WBS.

The risk owner is accountable for monitoring a risk and ensuring its response works. A risk action owner carries out a specific assigned response action. Owner oversees; action owner executes.

Stakeholders supply risk information, hold differing risk attitudes, and own or are affected by responses. Engaging them aligns risk thresholds, surfaces hidden risks, and secures buy-in for response actions.

Risk attitude is shaped by risk appetite, tolerance, threshold, and individual perception. Differing attitudes among stakeholders must be reconciled so the project applies consistent risk criteria.

Targeted, timely risk communication keeps stakeholders informed of exposure and response status, manages expectations, and prevents surprises. The Risk Report is the primary vehicle for overall-risk communication.

An anonymous, iterative expert-survey method used to build consensus and identify risks while avoiding groupthink and dominant-personality bias. Responses are aggregated and fed back across rounds.

Examines Strengths, Weaknesses, Opportunities, and Threats. Strengths/opportunities surface upside risks; weaknesses/threats surface downside risks. It deliberately captures both threats and opportunities.

A root-cause technique that traces an effect back to contributing causes grouped by category. Used to find the underlying drivers of risks rather than just symptoms.

Tests the validity of project assumptions and explores constraints to surface risks. Invalid or unstable assumptions and tight constraints are common sources of threats.

Predetermined category lists (e.g., PESTLE, TECOP, RBS, VUCA) used to stimulate risk identification so that whole categories of risk are not overlooked.

An indicator or symptom showing that a risk is about to occur or has occurred, prompting the response. Triggers are identified early and monitored throughout the project.

Prioritizes individual risks by subjectively assessing probability and impact (often via a probability-impact matrix). It is fast and ranks risks; it does NOT produce numeric cost/schedule outcomes.

A grid that multiplies probability rating by impact rating to score and rank each risk into priority zones (e.g., red/yellow/green). It is the core qualitative prioritization tool.

Probability × Impact, using the rating scales defined in the risk management plan. Higher scores get prioritized for detailed analysis or response; it is relative, not a dollar figure.

Risks can also be assessed by urgency, proximity, manageability, detectability, connectivity, dormancy, and strategic impact. These help refine prioritization beyond probability and impact alone.

Grouping risks by source (RBS), affected area (WBS), root cause, or project phase to reveal concentrations of exposure and target responses more efficiently.

Numerically analyzes the combined effect of risks on overall project objectives (cost/schedule), producing ranges and probabilities. It is optional, resource-intensive, and follows qualitative analysis.

Runs thousands of iterations with random sampling from input distributions to model overall cost/schedule outcomes. Produces an S-curve showing the probability of meeting any given target.

Identifies which individual risks or variables have the greatest impact on the project outcome. The tornado diagram ranks them with the most influential bar at the top.

Uses optimistic (O), most likely (M), and pessimistic (P) values to model uncertainty. Triangular mean = (O+M+P)/3; Beta/PERT mean = (O+4M+P)/6, weighting the most likely value.

EMV = Probability × Impact (in currency). Threats are negative, opportunities positive. Summed across a branch, EMV gives the weighted-average value used to compare decision options.

A risk with 20% probability and a $50,000 loss has an EMV of −$10,000 (0.20 × −50,000). A 30% chance of a $40,000 gain has an EMV of +$12,000. Net EMV here = +$2,000.

A diagram that evaluates choices under uncertainty by computing EMV down each branch (cost of decision plus probability-weighted outcomes). You select the path with the most favorable EMV.

Contingency reserve covers KNOWN risks (identified, with responses) and is controlled by the project manager within the cost baseline. Management reserve covers UNKNOWN risks, sits outside the baseline, and needs management approval to use.

Typically from the EMV of known risks or from quantitative analysis (e.g., Monte Carlo at a chosen confidence level). It funds planned contingency/fallback responses, not unforeseen events.

Cost baseline = work estimates + contingency reserve. Total budget = cost baseline + management reserve. Management reserve is in the budget but NOT the baseline, so consuming it changes the baseline.

Escalate, Avoid, Transfer, Mitigate, Accept. Avoid eliminates the cause; Transfer shifts impact to a third party; Mitigate reduces probability/impact; Accept takes no proactive action.

Escalate, Exploit, Share, Enhance, Accept. Exploit makes the opportunity certain; Share allocates it to a partner best able to capture it; Enhance increases probability/impact; Accept takes it if it arises.

Used for threats OR opportunities outside the project's authority/scope. Ownership is handed to program/portfolio level; the risk is then removed from the project's active register and monitored elsewhere.

Transfer moves a THREAT's impact (and ownership of response) to a third party, usually for a premium (insurance, warranties, contracts). Share allocates an OPPORTUNITY to a partner better able to capture it (partnerships, joint ventures).

Mitigate reduces the probability and/or impact of a THREAT. Enhance increases the probability and/or impact of an OPPORTUNITY. They are mirror-image proactive strategies.

Active acceptance establishes a contingency reserve (time, money, resources) to handle the risk if it occurs. Passive acceptance takes no action beyond documenting and periodically reviewing the risk.

A secondary risk is a NEW risk created by implementing a response. A residual risk is the LEFTOVER risk that remains after the response is applied. New from the fix vs. what's still left.

A contingency plan (Plan A) executes when a risk's trigger fires. A fallback plan (Plan B) is held in reserve for when the contingency plan fails or the risk exceeds tolerance.

An unplanned response to an UNIDENTIFIED risk (or a residual risk) that has already occurred. Unlike a contingency plan, it is not prepared in advance — it is improvised during execution.

A risk audit evaluates the EFFECTIVENESS of the risk management process and responses. A risk review reassesses existing risks, closes outdated ones, and identifies new risks. Audit = process; review = the risks themselves.

Compares the amount of contingency/management reserve remaining against the amount of risk remaining, to confirm reserves are still adequate as the project progresses.

A recurring activity that identifies new risks, reassesses current ones, and closes risks that are obsolete. It keeps the risk register current as project conditions change.

A risk is closed when it can no longer occur or its response is fully complete (it occurred and was handled, or the window passed). Closed risks are archived with notes for lessons learned.

Reviews cost/schedule performance trends (e.g., earned value variances) to forecast emerging risk exposure. Worsening trends can signal that overall project risk is increasing.

A KRI is a metric tracked over time to signal changing risk exposure (leading indicator). A trigger is the specific point that signals a particular risk is occurring. KRIs trend; triggers fire.

Captured throughout and at closure, lessons document what risks occurred, how effective responses were, and what to repeat or avoid. They feed organizational process assets for future projects.

Predictive projects emphasize up-front quantitative analysis and reserves. Agile/hybrid handles risk iteratively — backlog reprioritization, short feedback loops, and frequent reassessment reduce exposure as work proceeds.