PMI-RMP Risk Monitoring And Reporting — 25 Questions

Question 1

Which THREE types of risks should always be included on a 'Watchlist' for regular monitoring?

Accepted Answer

Accepted risks that do not require active mitigation. The three correct answers are C, D, and E. Accepted risks that do not require active mitigation (C) still belong on a watchlist because acceptance is a conscious decision that must be periodically revisited in case the risk's probability, impact, or the organization's tolerance changes. Risks that are currently deferred (D) are not eliminated; they are postponed, so they must be monitored to ensure the deferral remains valid and that they do not escalate into active issues. Low-priority risks (E) are also watchlist candidates because their low rating may change over time as project conditions evolve, and they could become higher-priority threats if left unmonitored. Options A and B do not belong: risks that have already been resolved (A) are closed and no longer require monitoring, and critical path risks (B) are typically actively managed through mitigation or contingency plans rather than merely watched.

Answer

Risks that have already been resolved

Answer

Critical path risks

Question 2

You are the risk manager on a large infrastructure program. During the monthly risk review, the program manager asks for the current overall risk exposure. You have updated the probability and impact values for all active risks in the risk register, but you have not yet recalculated the contingency reserve. What should you do FIRST to provide an accurate risk exposure figure?

Accepted Answer

Recalculate the contingency reserve using the updated probability and impact values for all active risks.. The contingency reserve is derived from the expected monetary value of risks. When probability and impact values change, the reserve must be recalculated to reflect the updated risk exposure. This ensures that the program has sufficient funds to cover potential risk impacts. Providing an accurate risk exposure figure requires an up-to-date reserve, making recalculation the essential first step before any further analysis or reporting.

Answer

Review the risk register to ensure all risks have been assigned an owner and that response plans are in place.

Answer

Report the updated probability and impact values to the program manager and ask for guidance on how to proceed.

Answer

Perform a Monte Carlo simulation using the updated probability and impact data to determine the range of possible outcomes.

Question 3

A risk audit has just been completed. What is the most critical activity to perform with the findings?

Accepted Answer

Update the risk management plan and register. A risk audit evaluates the effectiveness of risk management processes and identifies areas for improvement. The most critical follow-up is to update the risk management plan and risk register with findings, ensuring that lessons learned are incorporated and that risk responses are adjusted. This closes the loop on the audit and supports continuous improvement.

Answer

Discard the report to avoid negative visibility

Answer

Request a project budget increase immediately

Answer

Send the report to external regulatory bodies

Answer

Delete the risks identified during the audit

Question 4

During project execution, you find that the 'Risk Response Owner' is not reporting updates. How should this be addressed within the project governance framework?

Accepted Answer

Escalate the accountability issue to the project sponsor. In project governance, the Risk Response Owner is accountable for executing and reporting on risk responses. If they fail to report, the issue is an accountability gap that should be escalated to the project sponsor, who has the authority to enforce governance and address performance issues. This maintains transparency and ensures the risk management process remains effective.

Answer

Update the risk yourself and hide the lack of participation

Answer

Assign a new owner without informing the original owner

Answer

Remove the risk from the register

Question 5

You are performing a periodic risk reassessment. A key risk has shifted from 'Low' to 'High' probability. What is the next immediate step in the reporting workflow?

Accepted Answer

Update the Probability and Impact Matrix and trigger a stakeholder notification. When a risk's probability shifts from Low to High, the immediate step is to update the Probability and Impact Matrix to reflect the new risk rating and trigger a stakeholder notification as per the communication plan. This ensures the risk is re-prioritized and stakeholders are aware of the increased exposure. The matrix update is foundational for subsequent response planning.

Answer

Schedule an immediate Steering Committee meeting

Answer

Close the risk and add it to the Issues Log

Answer

Immediately activate the contingency reserve

Question 6

You are configuring a risk dashboard in a PMIS. Stakeholders need to see the 'Risk Burn-down' trend. Which data point must be tracked consistently to enable this report?

Accepted Answer

Aggregate risk exposure value. The Risk Burn-down trend tracks the aggregate risk exposure value over time, showing how the total risk exposure decreases as risks are mitigated or closed. This requires consistent tracking of the aggregate exposure value, typically calculated as the sum of probability times impact for all open risks. Without this data point, the burn-down chart cannot be generated.

Answer

Owner assignment frequency

Answer

Total number of risks identified

Answer

Number of risk responses completed

Question 7

When monitoring risk triggers, what is the primary purpose of a 'Risk Trigger' threshold field in your project management software?

Accepted Answer

To provide an objective indicator that a risk is about to occur. The primary purpose of a risk trigger threshold field is to provide an objective, measurable indicator that a risk is about to occur, enabling timely activation of the response plan. It sets a specific value or condition that, when met, signals the need for action. This supports proactive risk management rather than reactive firefighting.

Answer

To automate the closure of the risk entry

Answer

To define the escalation path for the project manager

Answer

To notify the finance department of budget changes

Question 8

During a risk audit, you identify that a previously closed risk has manifested. What is the most appropriate action to ensure accurate project risk status?

Accepted Answer

Re-open the existing risk and update the response plan. When a previously closed risk manifests, the most appropriate action is to re-open the existing risk and update its response plan. This maintains the integrity of the risk register, ensures the risk is actively managed again, and allows the team to apply the planned response or adjust it based on current conditions. It also preserves the historical link between the original risk and its realization.

Answer

Archive the risk to maintain the dashboard clarity

Answer

Create a new risk entry in the Risk Register

Answer

Update the Lessons Learned repository only

Question 9

You are assessing the effectiveness of a risk mitigation strategy. Which metric best indicates if the mitigation is working?

Accepted Answer

The change in residual risk exposure. The purpose of risk mitigation is to reduce the probability and/or impact of a risk, which is measured by the change in residual risk exposure — the risk that remains after the response is applied. If residual exposure drops relative to the pre-mitigation assessment, the mitigation is working. This metric directly ties the response action to its intended effect on the risk profile, making it the most valid indicator of effectiveness.

Answer

Number of audit findings related to risk

Answer

Total number of risks managed

Answer

The frequency of steering committee meetings

Question 10

Which report type is best suited for providing senior management with a high-level view of current risk status versus the risk appetite threshold?

Accepted Answer

Risk Heat Map. A risk heat map visually plots probability against impact and highlights which risks exceed the organization's risk appetite thresholds. Senior management can quickly see the overall risk posture and where intervention is needed. This makes it the best high-level reporting tool for comparing current risk status to appetite.

Answer

Individual Risk Response Plan

Answer

Project Schedule Variance Report

Answer

Risk Register Detail Report

Question 11

What is the primary function of a 'Risk Dashboard' compared to a 'Risk Register'?

Accepted Answer

Dashboards offer visual summaries and trends for executive review. A Risk Dashboard provides visual summaries and trends, such as heat maps, burn-down charts, and key risk indicators, tailored for executive review and decision-making. In contrast, the Risk Register is a detailed repository of individual risks. The dashboard aggregates and visualizes data to highlight patterns and overall risk exposure, enabling quick comprehension.

Answer

Dashboards provide full historical logs of all changes

Answer

Dashboards replace the need for the Risk Register

Answer

Dashboards store raw data for quantitative analysis

Question 12

During a risk review, a stakeholder asks why a risk's impact has not changed despite a completed mitigation plan. What is the most likely cause?

Accepted Answer

The mitigation addressed probability, not impact. Risk responses target either the probability of a risk occurring or its impact if it does occur — and sometimes both. If a mitigation plan was completed but the impact score in the risk register is unchanged, the most likely explanation is that the response was designed to reduce probability only, leaving the potential impact untouched. This is a normal and valid outcome of certain response strategies.

Answer

The project manager forgot to save the update

Answer

The risk is a secondary risk

Answer

The risk register is corrupted

Question 13

You are using a Risk Register template. Which field is most useful for tracking the 'Risk Reassessment' frequency?

Accepted Answer

Next Review Date. The 'Next Review Date' field in a Risk Register is specifically designed to track when a risk should be reassessed, aligning with the 'Risk Reassessment' frequency defined in the Risk Management Plan. It ensures that risks are reviewed at planned intervals, enabling timely updates to probability, impact, and response strategies. This field directly supports the Control Risks process by scheduling regular reviews.

Answer

Risk Owner

Answer

Risk ID

Answer

Contingency Budget

Question 14

You notice that the 'Residual Risk' is higher than the 'Inherent Risk' after mitigation. What does this suggest?

Accepted Answer

The mitigation strategy may have introduced secondary risks. Residual risk is the risk remaining after mitigation, while inherent risk is the risk before mitigation. If residual risk is higher than inherent risk, it suggests that the mitigation strategy may have introduced secondary risks or that the mitigation was ineffective and actually increased the overall risk exposure. This is a red flag indicating the need to reassess the response strategy.

Answer

The risk is now fully accepted

Answer

The mitigation was highly successful

Answer

The project is complete

Question 15

Which document should you reference to understand the formal reporting requirements for project risks?

Accepted Answer

The Risk Management Plan. The Risk Management Plan is the document that defines how risk management activities will be structured and performed, including formal reporting requirements such as report format, frequency, audience, and escalation paths. It is the authoritative source for risk reporting procedures. Referencing it ensures compliance with the project's agreed risk communication framework.

Answer

The Communications Management Plan

Answer

The Project Charter

Answer

The Scope Statement

Question 16

You are monitoring risks and notice that a 'Secondary Risk' has appeared. What should you do first?

Accepted Answer

Add it to the Risk Register and assess its impact. When a secondary risk appears, the first action is to add it to the Risk Register and assess its impact (Option A). A secondary risk is a new risk that arises as a direct result of implementing a risk response — for example, mitigating a schedule risk by adding resources may create a cost risk. Because it is a newly identified risk, it must be formally captured and analyzed before any response can be planned or contingency reserves tapped.

Answer

Immediately initiate the contingency reserve

Answer

Ignore it if it is small

Answer

Call the sponsor to discuss the project failure

Question 17

When reporting risk data to a global team, what is the biggest challenge for the project manager regarding risk data quality?

Accepted Answer

Subjectivity in risk assessment across different regions. Subjectivity in risk assessment across different regions is the biggest challenge because risk perception, cultural norms, and risk tolerance vary globally, leading to inconsistent probability and impact ratings. This directly affects the quality and comparability of risk data. Other challenges like software compatibility or time zones are logistical and can be mitigated with tools, but subjectivity undermines data integrity.

Answer

Software language compatibility

Answer

Email communication delays

Answer

Time zone differences for reporting meetings

Question 18

You are presenting a risk report. The sponsor points out that a specific risk was closed, but the cost impact was never updated. What is the correct way to handle this during reporting?

Accepted Answer

Update the record with actuals and apologize for the reporting gap. When a risk is closed, the risk register must reflect the actual outcome, including any realized cost impact, so that the historical record and lessons-learned data are accurate. The correct action is to update the record with actuals and acknowledge the reporting gap, since the risk report must present current, accurate information to the sponsor. This aligns with PMI's emphasis on transparency, accuracy, and continuous improvement in risk reporting.

Answer

Suggest the sponsor look at the Issues Log instead

Answer

Blame the Risk Owner for the missing data

Answer

Argue that cost updates are not required for closed risks

Question 19

You are setting up a regular risk review meeting. Who is the most important attendee to invite?

Accepted Answer

The Risk Owner for the specific risks being reviewed. A risk review meeting exists to assess the status of identified risks and their response plans. The person accountable for executing those responses is the Risk Owner, so they are the most critical attendee — without them, the meeting cannot meaningfully update risk status or adjust mitigation actions.

Answer

The entire project team

Answer

All project stakeholders

Answer

The external auditor

Question 20

A project manager is using a 'Monte Carlo' simulation for risk monitoring. What is the main purpose of updating this simulation during the project?

Accepted Answer

To reflect current actuals and improve accuracy of future forecasts. Updating a Monte Carlo simulation with current actuals (e.g., actual durations, costs, and risk occurrences) refines the probability distributions and improves the accuracy of future forecasts. This is a core Monitor Risks activity that keeps the quantitative risk analysis relevant as the project progresses. The simulation is not a one-time exercise but a living model.

Answer

To make the project look better to stakeholders

Answer

To keep the simulation software updated

Answer

To replace the need for qualitative risk assessments