5.5. Plan and Manage Risk
💡 First Principle: Risk management is a continuous cycle — identify, analyze, respond, monitor — not a single risk-register document created at kickoff and revisited only when something goes wrong; the enablers explicitly include maintaining and communicating risk status throughout.
Enablers: identify risks, analyze risks, monitor and control risks, develop a risk management plan, maintain a risk register (e.g., poor IT security as an example risk), execute a risk management plan (e.g., risk response for security and managing sustainability risks), and communicate the status of risk impact on the project.
Notice the ECO's own examples explicitly name IT-security risk and sustainability risk — reinforcing that risk management now formally spans beyond classic schedule/cost/scope risk into security and environmental risk categories, consistent with Business Environment's broadened 2026 scope.
The risk cycle, and where each exam question sits on it
Almost every risk question on the exam is really asking which step of this cycle the scenario is standing on. Getting the step right usually determines the answer before you have even read the options.
A team that responds before analyzing, analyzes before identifying, or escalates before assessing has skipped a step, and the option describing the skipped step is usually the key.
Risk is one member of a family, and the exam separates them
PMBOK 8 elevates Risk to a performance domain, and with it the vocabulary for the different kinds of not-knowing a project faces. These are tested as distinct terms:
| Term | What it means | Signal in a scenario |
|---|---|---|
| Risk | An identifiable future event with an assessable probability and impact | "There is a chance the vendor slips" |
| Volatility | Rapid, frequent, unpredictable change in the environment | "Customer preferences shift month to month" |
| Complexity | Many interconnected parts whose interactions are hard to predict | "Changing one module keeps breaking three others" |
| Ambiguity | Lack of clarity about goals, options, or how to read the information | "Nobody agrees what 'done' means here" |
| Issue | Something that has already happened and needs resolving now | "The vendor missed the date this morning" |
⚠️ Exam Trap: A risk that has occurred is not a bigger risk — it becomes an issue, moves to the issue log, and calls for resolution rather than further risk analysis. Equally, a trigger is the early-warning condition that says a risk is about to occur; noticing a trigger means executing the planned response, not re-opening the analysis.
Identifying risks
Identification is deliberately broad and repeated, not a single kickoff workshop. The exam expects you to recognize the common sources and techniques: brainstorming and interviews with the team and stakeholders, checklists drawn from organizational process assets, prompts from enterprise environmental factors such as regulation or market conditions, lessons learned from prior projects, assumption and constraint analysis, and the pre-mortem — imagining the project has already failed and working backwards to why, which surfaces risks that optimism suppresses.
A risk breakdown structure (RBS) organizes identified risks hierarchically by category (technical, external, organizational, project management) the way a WBS organizes deliverables. Its value on the exam is coverage: categories with nothing in them are usually the tell that a whole class of risk has gone unexamined.
Every risk in the register gets a named risk owner — a specific person accountable for watching it and executing its response. "The project manager owns all risks" is a wrong-answer pattern.
Analyzing risks: qualitative first, quantitative only if it earns its place
Qualitative analysis rates every identified risk on probability and impact, usually through a probability and impact matrix, and multiplies the two ratings into a risk score used to rank the register. It is fast, subjective, and performed on essentially every project.
Quantitative analysis numerically models what the prioritized risks add up to across the project. It is optional, resource-intensive, and runs only on the shortlist qualitative analysis produced:
- Monte Carlo simulation runs the schedule or cost model thousands of times, drawing from each activity's estimated range, and returns a probability distribution — "an 85% confidence of finishing on or before 14 March" rather than a single date.
- Expected monetary value (EMV) multiplies probability by impact in currency. A 30% chance of a $50,000 rework carries an EMV of −$15,000. EMV is what populates the branches of a decision tree when choosing between options that carry different risks.
- Sensitivity analysis asks which single variable moves the outcome most while the others are held steady, and displays the answer as a tornado diagram whose bars are sorted longest-first.
⚠️ Exam Trap: Numbers do not make an analysis quantitative. A probability and impact matrix scored 1 to 5 is still qualitative — a 4 records a judgement, not a measurement. The dividing line is whether outcomes are being modeled, not whether digits appear.
Responding to risk
PMI gives five strategies for threats and five mirrored strategies for opportunities. The exam tests whether you can pick the one that matches the authority and the economics of the situation.
| Threats | Opportunities | The move |
|---|---|---|
| Escalate | Escalate | Outside the project's authority — hand it to whoever can act |
| Avoid | Exploit | Eliminate the uncertainty: remove the threat, or make the upside certain |
| Transfer | Share | Move ownership to a third party better placed to carry it |
| Mitigate | Enhance | Shift the odds: lower a threat's probability or impact, raise an opportunity's |
| Accept | Accept | Take the outcome on deliberately, with or without a contingency plan |
Acceptance has two forms and the distinction is tested. Active acceptance establishes a contingency plan and usually a contingency reserve, to be triggered if the risk occurs. Passive acceptance simply documents the risk and deals with it if it happens. A scenario where a threat cannot be avoided, transferred, or mitigated, and the team writes a contingency plan, is describing active acceptance.
Two consequences of responding are themselves examinable. A secondary risk is a new risk created by a response — hiring a subcontractor to transfer a delivery threat introduces a vendor-quality risk. A residual risk is what remains after the response has been executed. Both belong in the register. And a response has to be worth its cost: spending $80,000 to mitigate a risk with an EMV of $15,000 fails a cost-benefit test no matter how thorough it looks.
Reserves
| Covers | Sits | Released by | |
|---|---|---|---|
| Contingency reserve | Identified risks, already in the register | Inside the cost baseline | The project manager |
| Management reserve | Unknown risks nobody anticipated | Outside the cost baseline, inside the project budget | Management or the sponsor, via a change request |
⚠️ Exam Trap: A project manager unilaterally spending management reserve is almost always the wrong answer — moving money that sits outside the cost baseline changes the baseline, which needs approval above the project manager.
Monitoring, and the artifacts that carry risk
Risk review is a recurring cadence proportional to the project's volatility and remaining duration, not a fixed number of checkpoints. Reassessment happens at regular reviews, at phase gates, and whenever a significant change lands. A risk audit examines whether the risk process itself is working, as distinct from reviewing individual risks.
Two artifacts get confused. The risk register holds individual risks with their analysis, owners and responses — the working document. The risk report summarizes overall project risk exposure and the sources of that exposure, and is what goes to sponsors and steering groups.
Risk in adaptive and hybrid delivery
Adaptive delivery does not drop risk management; it distributes it. Short iterations are themselves a risk-reduction device, because they cap how much can go wrong before feedback arrives. A risk-adjusted backlog orders work by value and risk, so high-severity risks get addressed in early iterations rather than discovered late — when an item carries a known risk, the team commonly sequences it forward or runs a spike to reduce uncertainty before committing. Retrospectives and daily standups surface emerging risks continuously, which is why an adaptive team may hold no separate risk meeting and still be managing risk properly.
In a hybrid setting, tailoring is the tested judgment: a formal register and quantitative analysis for the predictive, heavily governed portions, and backlog-based risk handling for the adaptive portions, rather than forcing one mechanism across both.
⚠️ Exam Trap: Limiting risk-response thinking to schedule and cost impacts only. The 2026 ECO explicitly expects security and sustainability risk categories to be part of your risk register and response planning, not treated as someone else's domain.
Reflection Question: Does your current risk register include security and sustainability risk categories, or only classic schedule/cost/scope risks? What would adding them change about your top risk priorities?
