PMI-RMP Flashcards — Free PMI Risk Management Professional (PMI-RMP) (PMI-RMP) Study Cards

Publish an Enterprise Risk Management (ERM) policy that defines standard risk tolerance levels.

An Enterprise Risk Management (ERM) policy defines the organization's risk appetite, tolerance levels, and standard risk processes, ensuring consistency across all projects and aligning with strategic objectives. Publishing such a policy is the most effective way to standardize risk appetite across multiple projects and the organization as a whole.

Communicate that identifying risks is a positive contribution to project success and not a sign of failure.

The root cause of hiding risks is usually fear of blame, so the first step is to reframe risk identification as a positive contribution to project success rather than an admission of failure. This addresses the cultural barrier directly and aligns with PMI's emphasis on creating a safe, transparent risk culture. Only after trust is established do mandates or incentives become effective.

Update the risk management plan and register

A risk audit evaluates the effectiveness of risk management processes and identifies areas for improvement. The most critical follow-up is to update the risk management plan and risk register with findings, ensuring that lessons learned are incorporated and that risk responses are adjusted. This closes the loop on the audit and supports continuous improvement.

Implement the Delphi Technique

The Delphi Technique is a structured, anonymous, iterative expert-elicitation method in which a facilitator collects input from experts individually and circulates summarized responses across rounds until consensus emerges. Because contributions are anonymous and written, a dominant senior stakeholder cannot steer or anchor the group, which directly neutralizes the bias described. It is the PMI-recommended tool for reducing the effects of personal influence and groupthink during risk identification.

You determine the optimal path by selecting the branch with the best EMV at each decision node.

Folding back a decision tree involves calculating the EMV at each chance node and then selecting the decision branch with the best EMV at each decision node. This process works backward from the end nodes to the start, determining the optimal path.

Risk response planning

Risk response planning is part of the Plan Risk Responses process, which occurs after risk identification is complete — it is not an identification technique. Identification techniques generate the list of risks, while response planning determines what to do about them. SWOT analysis, brainstorming, and checklist analysis are all standard identification tools listed in PMBOK.

Update the Risk Breakdown Structure to reflect the program's strategic objectives and use it to guide risk identification and reporting.

Strategic alignment is achieved when the risk taxonomy mirrors the program's objectives, making traceability explicit. The Risk Breakdown Structure, when tailored to strategic goals, becomes the mechanism that guides identification, assessment, and reporting so every risk can be linked to a business outcome. Simulation, escalation, and quantitative modeling address different problems and do not create the missing strategic linkage.

The risk description and its potential impact

When a risk is first identified and added to the risk register, the foundational entries are a clear description of the risk event and its potential impact on project objectives. Without these, the risk cannot be analyzed, prioritized, or assigned. Other elements like cost of mitigation, risk score, and owner are populated later during qualitative/quantitative analysis and response planning. Thus, the description and impact are the most critical initial elements.

Revise the risk response plan and update the register

When an audit reveals that a risk response is ineffective, the correct action is to revise the risk response plan and update the risk register to reflect the new approach, reassessed probability/impact, and revised ownership. This closes the loop on the Plan-Do-Check-Act cycle for risk management. Simply changing the owner or continuing an ineffective plan leaves the risk unaddressed.

Facilitate a structured assessment session using established qualitative or quantitative criteria.

When stakeholders disagree on risk severity, the best resolution is to facilitate a structured assessment session using established qualitative or quantitative criteria (e.g., probability-impact matrix, risk scoring rubrics). This ensures objectivity, transparency, and repeatability, aligning with PMI's emphasis on data-driven risk analysis.

Discuss with the risk owner the reasons for the delay and provide any necessary support.

When a risk owner is not acting, the project manager should first engage the owner directly to understand the delay and offer support, because the owner may lack resources, authority, or clarity. This collaborative approach aligns with PMI's emphasis on servant leadership and stakeholder engagement. Escalation or reassignment should only follow if the discussion fails to resolve the issue.

Escalate the risk to the project board or project sponsor

When the cost contingency is exhausted but the risk remains, the project manager no longer has authority to absorb it within the project budget, so the risk must be escalated to the project board or sponsor. Escalation is the correct risk-process step when the risk exceeds the project manager's tolerance or available reserves. This aligns with PMI's risk escalation and reserve analysis principles.

Risk Management Plan

The Risk Management Plan is the document produced during the Plan Risk Management process that defines the risk management methodology, including the approach, tools, techniques, roles, responsibilities, budgeting, timing, and reporting formats for risk activities. It provides both the framework and the formal authority for how risk management will be conducted on the project. The Project Charter authorizes the project itself but does not detail risk methodology.

Adjusting the risk management process to fit the project's complexity and needs.

Tailoring in risk management refers to adjusting the risk management processes, tools, and techniques to fit the specific project's size, complexity, industry, and organizational context. It ensures the risk approach is proportionate and relevant rather than applying a one-size-fits-all methodology.

The schedule accounts for identified risks via time buffers or logic changes.

A Risk-Adjusted Schedule is a project schedule that has been deliberately modified to reflect the impact of identified risks and agreed-upon risk responses. This is typically achieved by adding time buffers (such as contingency reserves or feeding buffers) or by altering the logical sequence of activities (e.g., adding lag, changing dependencies, or re-sequencing work) to reduce the probability or impact of risk events. In PMI's risk management framework, this schedule is an output of the Plan Risk Responses process and is used to establish a realistic baseline that accounts for uncertainty rather than assuming a risk-free environment.

The Communications Management Plan.

The Communications Management Plan is the PMBOK document that defines how project information—including risk management activities, risk status reports, and risk escalation paths—will be distributed to stakeholders. It specifies who receives what information, in what format, at what frequency, and through which channel. Since the question asks specifically about how risk management activities will be communicated, this plan is the correct governing document.

No risk mitigation or closure has occurred

A Risk Burndown chart plots cumulative risk exposure (typically probability × impact) against time across the project lifecycle. A flat line means the total risk exposure is not decreasing, which indicates that no risk responses have been executed, no risks have been closed, and no new mitigation value has been realized. In other words, the project team is not actively reducing the risk profile over time.

It accounts for the variability of multiple tasks simultaneously.

Monte Carlo simulation accounts for the variability of multiple tasks simultaneously by sampling from probability distributions for each task and running thousands of iterations. This produces a range of possible project completion dates with associated probabilities, unlike static analysis which uses single-point estimates. The key advantage is capturing the combined effect of uncertainty across the entire schedule.

Model the occurrence of specific, mutually exclusive project outcomes.

A probabilistic branch in schedule logic allows the model to represent alternative paths that depend on uncertain events, enabling simulation of mutually exclusive outcomes. In risk analysis tools like @RISK or Primavera Risk Analysis, this means the schedule can branch into different scenarios (e.g., a design is approved or rejected), and the simulation randomly selects a branch based on assigned probabilities. This models the occurrence of specific project outcomes, providing a more realistic distribution of completion dates.

Facilitate a meeting to discuss the risk, the stakeholder's proposal, and the organization's risk appetite.

When a stakeholder proposes a risk response outside the organization's risk appetite, the best approach is to facilitate a meeting to discuss the risk, the proposal, and the risk appetite. This collaborative approach allows all parties to understand the constraints and work toward a mutually acceptable solution. It respects the stakeholder's input while ensuring alignment with organizational risk tolerance.

Risk Heat Map

A risk heat map visually plots probability against impact and highlights which risks exceed the organization's risk appetite thresholds. Senior management can quickly see the overall risk posture and where intervention is needed. This makes it the best high-level reporting tool for comparing current risk status to appetite.

Cause-and-Effect Diagram

A Cause-and-Effect Diagram (also known as a Fishbone or Ishikawa diagram) is used to visualize the relationships between a problem or effect and its potential causes. When multiple risks appear related, this tool helps identify root causes and show how they interconnect, making it ideal for understanding relationships between risks.

To provide regular updates on the status and mitigation progress of the assigned risk.

A risk owner is the person accountable for monitoring an assigned risk and driving its response actions. Their core responsibility is to track the risk's status, execute or coordinate the agreed response, and report progress and changes to the project manager. This is a monitoring-and-controls role, not a financial, blame, or all-tasks role.