By El Mehdi Bouchti, PMP, PMI-ACP · Updated
- 180 questions, 240 minutes, July 2026 domain weights
- Free: 180-question pool · Premium: full 2,000+ question bank
- AI debrief after every exam
PMP Risk Management: Study Guide & Exam Tips
Risk management on the PMP exam covers planning risk management, identifying risks, performing qualitative and quantitative analysis, planning risk responses, implementing responses, and monitoring risks. You need to know the sequence and the main outputs (e.g. risk register, risk report). Risks are uncertain events that can have positive or negative effects on objectives. You identify them (with the team and others), analyze them (qualitative first, probability and impact, then quantitative if needed), and plan responses: avoid, mitigate, transfer, or accept for threats; exploit, enhance, share, or accept for opportunities. As the project runs you implement responses and monitor for new risks and triggers. Common exam traps include mixing up “avoid” and “mitigate” (avoid = eliminate the cause; mitigate = reduce impact or probability) and forgetting that opportunities have response strategies too. Another trap is doing quantitative analysis before qualitative, you typically prioritize with qualitative first. Also watch for questions where the best “next” step is to update the risk register or communicate with stakeholders before taking action. Practice risk questions in the Process domain on PMP Exam Lab. Focus on “what is the PM doing?” and “what should happen next?” to reinforce the flow of risk management.
Risk management in one paragraph
Risk management is the set of processes that identify, analyze, and respond to uncertainty before it becomes an issue. On the exam, the flow is always the same: plan how you will manage risk, identify risks and log them, prioritize them with qualitative analysis, model the important ones quantitatively when numbers are needed, plan and implement responses, and keep monitoring for new risks and triggered conditions. A risk is an uncertain future event; an issue has already happened. Risk can be a threat (negative) or an opportunity (positive), and the exam tests both response families.
The six risk processes and what the exam asks about each
The exam rarely asks you to recite a process name. It describes a situation and expects you to recognize which process is happening or what comes next.
| Process | What it produces | What the exam asks |
|---|---|---|
| Plan Risk Management | Risk management plan (definitions, appetite, roles) | Which document defines probability/impact scales? |
| Identify Risks | Risk register entries, risk report | What should the PM do with a newly surfaced risk? (log it) |
| Qualitative analysis | Priority scores, a shortlist | Which risks to analyze next; probability and impact scales |
| Quantitative analysis | Numeric estimates (EMV, Monte Carlo) | Contingency reserve sizing; when numbers justify decisions |
| Plan risk responses | Chosen strategies, owners, triggers | Which strategy fits this scenario? |
| Implement and monitor | Executed responses, updated register | What to do when a trigger occurs or a new risk appears |
Threat and opportunity responses, side by side
Most risk questions are response-selection questions: given a scenario, which strategy is the project manager applying? Learn the pairs in one table.
| Threat | Opportunity | What it does |
|---|---|---|
| Avoid | Exploit | Eliminates the threat / ensures the opportunity happens |
| Mitigate | Enhance | Reduces probability or impact / increases them |
| Transfer | Share | Shifts ownership to a third party (insurance, contracts) / partners to share upside |
| Accept | Accept | No proactive action; active acceptance adds a contingency plan |
Recognition cues: insurance and fixed-price contracts signal transfer (threat) or share (opportunity). Changing the plan so the risk no longer exists is avoid. Adding testing, prototypes, or redundancy is mitigate. Doing nothing (documented) is accept.
Expected monetary value (EMV) and decision trees
EMV is the one risk formula the exam reliably tests: EMV = probability × impact, summed across branches. A decision tree compares the EMV of options to pick the best path.
Worked example: a project faces a 20% chance of a $100,000 supplier failure. Mitigation (a second supplier) costs $15,000 and cuts the probability to 5%.
- Do nothing: EMV of the threat = 0.20 × $100,000 = $20,000 exposure.
- Mitigate: EMV = 0.05 × $100,000 + $15,000 cost = $5,000 + $15,000 = $20,000 total exposure.
- The options tie on pure EMV ($20,000 each), so the exam answer usually turns on a secondary consideration: mitigation reduces variance and protects the schedule, which tips the decision.
On decision-tree questions, compute each branch's EMV (including costs), then choose the branch with the best (highest for gains, lowest for losses) value. Common trap: forgetting to subtract the cost of the response, or mixing positive and negative signs.
Secondary risks, residual risks, and the other vocabulary
- Residual risk: what remains after you have implemented a response. You accept it knowingly.
- Secondary risk: a new risk created by the response itself (the backup supplier becomes a single point of failure).
- Contingency plan: the predefined action executed when a risk trigger occurs (active acceptance).
- Fallback plan: used when the contingency plan proves ineffective.
- Workaround: an unplanned response to a risk that was not prepared for in advance.
- Risk owner: the person who watches the trigger and executes the response; every identified risk should have one.
- Risk appetite and risk threshold: how much uncertainty the organization tolerates before a response is required.
The exam loves the secondary-risk distinction: a question describes a response, then asks what the project manager must now consider. The answer is the new risk the response introduced.
Common traps
- Using quantitative analysis when qualitative is enough; qualitative comes first and narrows the field.
- Confusing avoid (eliminate the cause) with mitigate (reduce probability or impact).
- Forgetting that opportunities have response strategies too: exploit, enhance, share, accept.
- Treating an issue (already happened) as a risk (uncertain); issues go to issue logs, not the risk register.
- Skipping the update step: any new risk, trigger, or response changes the risk register, and that update is often the correct exam answer.
- Choosing escalation to the sponsor when the project manager can handle the risk within their authority.
Tips for practice
Memorize the response table and the EMV formula, then drill scenario selection:
- For "what should the PM do first?" questions: identify or analyze before acting, and log in the register before escalating.
- For calculation questions: write down probability × impact before looking at the options, so distractor arithmetic does not seduce you.
- Practice with timed mixed sets, not just risk-only sets; the exam interleaves risk with schedule, procurement, and cost scenarios.
Practice risk questions in the Process domain on PMP Exam Lab, and review every miss against the table above to see which recognition cue you missed.
Practice Risk Management questions with answers in our public collection. All topics are free to practice on one page, with no signup.
Frequently asked questions
- What goes in the risk register?
- The risk register typically includes identified risks, potential responses, risk owners, and other details. It is updated throughout risk management, identification adds risks, analysis adds priority and details, and response planning adds response strategies.
- When do you use quantitative risk analysis?
- Quantitative analysis (e.g. Monte Carlo, expected monetary value) is used when you need numerical outputs, e.g. contingency reserves or prioritization of risks by impact on project objectives. It often follows qualitative analysis, which narrows the set of risks to analyze in depth.
- What’s the difference between avoid and mitigate?
- Avoid: eliminate the risk or its cause (e.g. change the approach so the risk no longer applies). Mitigate: reduce the probability and/or impact of the risk (e.g. add quality checks). Both are threat response strategies.
- What are the risk response strategies for threats and opportunities?
- For threats: avoid, mitigate, transfer, or accept. For opportunities: exploit, enhance, share, or accept. Avoid eliminates the cause; mitigate reduces probability or impact; transfer shifts impact to a third party. Exploit ensures the opportunity happens; enhance increases probability or impact; share involves a third party. Accept means no proactive action.
- What is the difference between qualitative and quantitative risk analysis?
- Qualitative analysis prioritizes risks using probability and impact (e.g. high/medium/low) and a probability-impact matrix. It is fast and often done first. Quantitative analysis uses numerical techniques (e.g. EMV, Monte Carlo) to model effects on objectives and estimate contingency reserves. Quantitative is used when you need numeric outputs and typically follows qualitative.
- How many risk management questions are on the PMP exam?
- PMI does not publish topic-specific counts. Risk decisions appear within the Process domain and can also be embedded in cross-domain scenarios. Prepare to identify, analyze, respond to, and monitor uncertainty rather than relying on an unofficial question estimate.
Ready to practice? Start free PMP practice or explore our PMP exam simulator and pricing.
PMP Exam Lab is an independent exam preparation platform and is not affiliated with, endorsed by, or connected to PMI.
PMP Exam Lab does not guarantee exam success or certification.