8.6 Risk Management Process

Project Management Professional PMP

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Introduction & Fundamentals

1.1 About the PMP Exam 1.2 What is a Project? 1.3 Project, Program & Portfolio Management 1.4 The Project Manager Role 1.5 PMBOK 7 Principles Overview 1.6 Performance Domains Overview 1.7 What Changed in the July 2026 PMP Exam

2 Chapter 2: People Domain Part 1

2.1 Managing Conflict 2.2 Leading a Team 2.3 Supporting Team Performance 2.4 Empowering Team Members 2.5 Training & Development 2.6 Building a Team 2.7 Removing Impediments

3 Chapter 3: People Domain Part 2

3.1 Negotiating Project Agreements 3.2 Collaborating with Stakeholders 3.3 Building Shared Understanding 3.4 Engaging Virtual Teams 3.5 Defining Team Ground Rules 3.6 Mentoring Stakeholders 3.7 Emotional Intelligence

4 Chapter 4: Process Domain - Planning

4.1 Determining Project Methodology 4.2 Integrating Project Planning 4.3 Planning & Managing Scope 4.4 Planning & Managing Schedule 4.5 Planning & Managing Budget 4.6 Planning & Managing Quality 4.7 Planning & Managing Resources 4.8 Planning & Managing Procurement

5 Chapter 5: Process Domain - Execution & Control

5.1 Executing with Urgency for Value 5.2 Managing Communications 5.3 Assessing & Managing Risks 5.4 Engaging Stakeholders 5.5 Managing Project Changes 5.6 Establishing Project Governance 5.7 Managing Project Issues 5.8 Managing Project Artifacts 5.9 Knowledge Transfer & Closure

6 Chapter 6: Business Environment Domain

6.1 Planning & Managing Compliance 6.2 Evaluating & Delivering Benefits 6.3 External Environment Changes 6.4 Supporting Organizational Change

7 Chapter 7: Agile & Hybrid Approaches

7.1 Agile Mindset & Values 7.2 Scrum Framework 7.3 Kanban & Lean 7.4 Extreme Programming (XP) 7.5 Hybrid Project Management 7.6 Agile Planning & Estimation 7.7 Agile Metrics & Tools

8 Chapter 8: Predictive (Waterfall) Approaches

8.1 Predictive Lifecycle 8.2 Scope Management 8.3 Schedule Management 8.4 Cost Management 8.5 Quality Management 8.6 Risk Management Process 8.7 Procurement & Contracts 8.8 Change Control

8.6 Risk Management Process

Key Takeaways Explain This Topic AI

The Risk Register is the central repository for all identified risks, including descriptions, categories, causes, probability, impact, and response plans

Probability-Impact Matrix is a qualitative tool that rates risks on likelihood and severity to prioritize response planning

EMV (Expected Monetary Value) = Probability x Impact calculates the weighted average outcome considering uncertainty

Decision Trees graphically represent decision points and chance events to calculate EMV for different options

Risk responses for threats include Escalate, Avoid, Transfer, Mitigate, and Accept; for opportunities: Exploit, Share, Enhance, and Accept

Last updated: October 2026

Risk management is the systematic process of identifying, analyzing, and responding to project risks. In predictive projects, risks are identified early and managed proactively throughout the project lifecycle.

Risk Management Processes

• Process Purpose Key Output
• Plan Risk Management Define how risk will be managed Risk Management Plan
• Identify Risks Determine which risks may affect the project Risk Register
• Perform Qualitative Risk Analysis Prioritize risks based on probability and impact Updated Risk Register
• Perform Quantitative Risk Analysis Numerically analyze effect on objectives Quantified risk exposure
• Plan Risk Responses Develop options and actions to address risks Response strategies
• Implement Risk Responses Execute agreed-upon response plans Updated Risk Register
• Monitor Risks Track risks and evaluate response effectiveness Work Performance Information
• Understanding Project Risk
• Risk Definition

A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives.

• Risk Type Definition Example
• Threat Negative risk Key team member may resign
• Opportunity Positive risk New technology may reduce costs
• Risk Components
• Uncertainty — May or may not occur
• Probability — Likelihood of occurrence
• Impact — Effect on objectives if it occurs
• Risk Register

The Risk Register is the central repository for all risk-related information:

Risk Register Contents

• Field Description
• Risk ID Unique identifier
• Risk Description Clear statement of uncertainty and impact
• Category Technical, external, organizational, PM
• Probability Likelihood of occurrence (0-100%)
• Impact Effect on objectives if risk occurs
• Risk Score Probability x Impact
• Risk Owner Person responsible for monitoring and response
• Response Strategy Chosen approach to address the risk
• Contingency Plan Actions if risk occurs
• Triggers Warning signs that risk is about to occur
• Status Active, closed, occurred
• Qualitative Risk Analysis

Qualitative Risk Analysis prioritizes risks for further action based on their probability and impact.

Probability-Impact Matrix

The Probability-Impact Matrix is the primary tool for qualitative risk analysis:

• Probability Very Low Impact Low Impact Moderate Impact High Impact Very High Impact
• Very High (0.9) 0.09 0.18 0.36 0.54 0.72
• High (0.7) 0.07 0.14 0.28 0.42 0.56
• Medium (0.5) 0.05 0.10 0.20 0.30 0.40
• Low (0.3) 0.03 0.06 0.12 0.18 0.24
• Very Low (0.1) 0.01 0.02 0.04 0.06 0.08
• Risk Prioritization

• Risk Level Score Range Action
• High (Red) > 0.40 Immediate attention, detailed response plan
• Medium (Yellow) 0.15-0.40 Monitor closely, develop contingency
• Low (Green) < 0.15 Monitor periodically
• Quantitative Risk Analysis

Quantitative Risk Analysis numerically analyzes the effect of identified risks on overall project objectives.

Expected Monetary Value (EMV)

EMV calculates the average outcome when the future includes scenarios that may or may not happen:

• EMV = Probability x Impact
• EMV Example

• Risk Probability Impact EMV
• Server failure 30% -$50,000 -$15,000
• Early delivery bonus 40% +$20,000 +$8,000
• Regulatory fine 10% -$100,000 -$10,000
• Total Project EMV -$17,000
• Decision Tree Analysis

Decision Trees graphically represent decisions and chance events:

Decision Tree Components

• Symbol Meaning
• Square Decision node (choice to be made)
• Circle Chance node (uncertain event)
• Triangle End point (outcome)
• Decision Tree Example

A company must decide whether to build a new factory ($5M) or upgrade existing ($2M):

Build New Factory ($5M investment):

• High demand (60%): Profit $10M → EMV = 0.6 x $10M = $6M
• Low demand (40%): Profit $3M → EMV = 0.4 x $3M = $1.2M
• Total EMV = $6M + $1.2M - $5M = $2.2M

Upgrade Existing ($2M investment):

• High demand (60%): Profit $5M → EMV = 0.6 x $5M = $3M
• Low demand (40%): Profit $2M → EMV = 0.4 x $2M = $0.8M
• Total EMV = $3M + $0.8M - $2M = $1.8M
• Decision: Build New Factory (higher EMV of $2.2M vs. $1.8M)
• Monte Carlo Simulation

Monte Carlo Simulation uses computer modeling to run thousands of scenarios:

• How It Works
• Define probability distributions for uncertain variables
• Randomly sample from each distribution
• Calculate project outcome
• Repeat thousands of times
• Analyze probability distribution of results
• Interpreting Results

• Confidence Level Meaning
• P50 50% probability of achieving this outcome or better
• P80 80% probability of achieving this outcome or better
• P90 90% probability of achieving this outcome or better
• Example Output
• "There is an 80% probability (P80) that the project will complete within 18 months and cost less than $2.5M."
• Risk Response Strategies
• Strategies for Threats (Negative Risks)

• Strategy Description Example
• Escalate Risk is outside project scope, escalate to appropriate level Organization-wide risks to sponsor
• Avoid Eliminate the threat by eliminating the cause Change scope to remove risky work
• Transfer Shift impact to a third party Purchase insurance, fixed-price contract
• Mitigate Reduce probability and/or impact Add redundancy, prototype, train team
• Accept Acknowledge risk without proactive action Document risk, monitor for changes
• Strategies for Opportunities (Positive Risks)

• Strategy Description Example
• Exploit Ensure the opportunity is realized Assign best resources to capture opportunity
• Share Allocate to third party best able to capture Joint venture, partnership
• Enhance Increase probability and/or impact Invest in R&D to maximize benefit
• Accept Take advantage if it occurs, but no proactive action Document, be ready to capitalize
• Contingency Reserves

Contingency Reserves address "known unknowns" — identified risks:

Calculation Methods

• Method Formula Use
• Percentage of Budget Budget x 10-15% Quick estimate
• EMV Summation Sum of all risk EMVs Quantitative approach
• Expected Value of Project From Monte Carlo simulation Most accurate
• Reserve Types

• Reserve For Controlled By
• Contingency Reserve Known unknowns (identified risks) Project Manager
• Management Reserve Unknown unknowns Management/Sponsor
• Key Takeaways
• The Risk Register is the central repository for all risk information
• Probability-Impact Matrix prioritizes risks based on likelihood and severity
• EMV = Probability x Impact calculates weighted average outcomes
• Decision Trees help choose between alternatives under uncertainty
• Monte Carlo Simulation provides probability distributions for project outcomes
• Threat responses : Escalate, Avoid, Transfer, Mitigate, Accept
• Opportunity responses : Exploit, Share, Enhance, Accept

Loading diagram... Risk Management Process Flow