PMI-RMP Risk Strategy And Planning — 25 Questions

Question 1

Which TWO inputs are required to properly tailor a risk management methodology?

Accepted Answer

Organizational Process Assets (OPAs).. Option A, Organizational Process Assets (OPAs), is correct because OPAs supply the organization's existing risk policies, templates, procedures, historical risk registers, lessons-learned databases, and risk tolerances that a risk management methodology must align with and reuse. Option B, project context including complexity and risk profile, is correct because tailoring depends on factors such as project size, uncertainty, stakeholder diversity, and the specific risk exposure, which determine how much formality, detail, and which techniques the methodology needs. Options C, D, and E are not inputs to risk methodology tailoring: a lunch schedule, a social media account, and an office location do not affect the risk processes, tools, or documentation depth required, so they are irrelevant to properly tailoring the methodology.

Answer

The project team's lunch schedule.

Answer

The project's social media account.

Answer

The office location.

Question 2

Which TWO actions should a project manager take when a project stakeholder has a risk appetite that conflicts with the organization's?

Accepted Answer

Facilitate a negotiation between the stakeholder and the board.. Option A is correct because when a stakeholder's risk appetite conflicts with the organization's, the project manager should facilitate a negotiation between the stakeholder and the board to reconcile the differing risk tolerances and reach an agreed-upon risk stance for the project. Option B is correct because the enterprise risk management (ERM) policy defines the organization's approved risk appetite and tolerance levels, so consulting it identifies the correct stance the project must align with. Options C, D, and E are incorrect: doing nothing (C) leaves the conflict unresolved and the project exposed, ignoring organizational policy (D) violates governance and compliance requirements, and changing the project scope (E) is not a valid response to a risk-appetite conflict and would require formal change control.

Answer

Do nothing and hope the stakeholder changes their mind.

Answer

Ignore the organizational policy.

Answer

Change the project scope.

Question 3

Which THREE activities are part of the 'Plan Risk Management' process?

Accepted Answer

Assigning roles and responsibilities for risk.. Option A is correct because Plan Risk Management produces the Risk Management Plan, which explicitly documents risk roles and responsibilities such as the risk owner, risk manager, and risk action owners. Option C is correct because this process defines the risk methodology, including the approaches, tools, and data sources that will be used to identify, analyze, and respond to risks. Option E is correct because the primary output of Plan Risk Management is the Risk Management Plan document itself, which captures methodology, roles, budgeting, timing, risk categories, and stakeholder risk appetite. Option B is not part of this process because executing the project work belongs to the Direct and Manage Project Work process in the Executing Process Group. Option D is not part of this process because closing the project occurs in the Closing Process Group via the Close Project or Phase process.

Answer

Executing the project work.

Answer

Closing the project.

Question 4

A PMO is standardizing risk management across multiple projects. They want to ensure that risk appetite is consistent across the organization. What is the most effective approach?

Accepted Answer

Publish an Enterprise Risk Management (ERM) policy that defines standard risk tolerance levels.. An Enterprise Risk Management (ERM) policy defines the organization's risk appetite, tolerance levels, and standard risk processes, ensuring consistency across all projects and aligning with strategic objectives. Publishing such a policy is the most effective way to standardize risk appetite across multiple projects and the organization as a whole.

Answer

Only allow senior management to identify risks.

Answer

Mandate the use of a single, complex quantitative software tool.

Answer

Require all project managers to define their own risk appetite.

Question 5

Your organization is transitioning to a hybrid methodology. During risk management planning, you must select an approach that accommodates both Agile delivery and Waterfall governance. Which strategy is most effective?

Accepted Answer

Tailor the Risk Management Plan to include iterative risk review sessions during sprint planning.. In a hybrid methodology, the Risk Management Plan must be tailored to integrate both Agile and Waterfall practices. Including iterative risk review sessions during sprint planning accommodates Agile's adaptive nature while maintaining governance through the overall plan. This approach ensures risks are continuously identified and addressed in short cycles.

Answer

Use a central Risk Register managed exclusively by the PMO.

Answer

Adopt a purely Waterfall risk register for all work packages.

Answer

Eliminate the Risk Management Plan to reduce bureaucratic overhead.

Question 6

Your project is highly sensitive to regulatory changes. How should you incorporate this into your risk strategy planning?

Accepted Answer

Establish a regulatory risk watch list and define trigger conditions.. For a project highly sensitive to regulatory changes, the risk management plan should include a structured mechanism to monitor the external regulatory environment continuously. A regulatory risk watch list with defined trigger conditions operationalizes this by identifying specific regulations, assigning owners, and specifying the thresholds or events that would activate a risk response — turning an ambiguous 'regulatory uncertainty' into a manageable, trackable risk. This aligns with PMI's emphasis on proactive risk identification and the 'Monitor Risks' process, where triggers are the early-warning signals that prompt contingency plan execution.

Answer

Outsource all regulatory compliance tasks to a third party.

Answer

Increase the reserve budget based on expert judgment.

Answer

Ignore the risk until a specific regulation is passed.

Question 7

When establishing the risk management methodology, which document should be used to provide the framework and authority for risk activities?

Accepted Answer

Risk Management Plan. The Risk Management Plan is the document produced during the Plan Risk Management process that defines the risk management methodology, including the approach, tools, techniques, roles, responsibilities, budgeting, timing, and reporting formats for risk activities. It provides both the framework and the formal authority for how risk management will be conducted on the project. The Project Charter authorizes the project itself but does not detail risk methodology.

Answer

Issue Log

Answer

Stakeholder Register

Answer

Project Charter

Question 8

A project manager is developing the Risk Management Plan for a complex infrastructure project. The stakeholders have expressed concerns about potential financial volatility. Which action should the project manager take to align the plan with organizational expectations?

Accepted Answer

Define the project's risk appetite and tolerance levels with key stakeholders.. The Risk Management Plan must reflect how much risk the organization is willing to accept before risk responses can be planned. Defining risk appetite (the degree of uncertainty an entity is willing to accept) and risk tolerance (the acceptable variation around objectives) with key stakeholders directly aligns the plan with organizational expectations, especially regarding financial volatility. This is a core input to Plan Risk Management per the PMBOK Guide.

Answer

Assign a risk owner to every potential financial risk identified.

Answer

Immediately perform a qualitative risk analysis on all identified risks.

Answer

Update the project scope to remove high-risk components.

Question 9

During a project kickoff meeting, a senior stakeholder states they are 'very risk-averse' regarding project timelines but 'open to innovation' regarding technical solutions. How should the risk management plan reflect this?

Accepted Answer

Create separate risk tolerance thresholds for schedule-related risks and technical risks.. The stakeholder has expressed two distinct risk attitudes: low tolerance for schedule risk and high tolerance for technical risk. PMI-RMP best practice recognizes that risk tolerance is not monolithic — it varies by risk category, stakeholder, and objective. Creating separate thresholds for schedule and technical risks accurately captures this differentiated appetite and allows appropriate response strategies for each category.

Answer

Escalate all technical risks to the project sponsor immediately.

Answer

Ignore the stakeholder's comment as it is subjective.

Answer

Set a single, conservative risk tolerance threshold for all risk categories.

Question 10

You are auditing a project's risk management methodology. You notice that risk identification happens only at the start of the project. What should you recommend to align with standard PMI-RMP best practices?

Accepted Answer

Integrate risk identification into each project stage gate or iteration review.. PMI-RMP best practice treats risk identification as an iterative, ongoing process conducted throughout the project lifecycle, not a one-time activity. Integrating identification into stage gates or iteration reviews ensures new risks emerging from changing conditions are captured and existing risks are re-evaluated. This aligns with the 'Identify Risks' process being repeated in every phase and with progressive elaboration.

Answer

Request additional funding for a dedicated risk consultant.

Answer

Create a separate document for residual risks only.

Answer

Use a quantitative risk analysis tool to automate identification.

Question 11

A project manager is facing pushback from a functional manager who refuses to allocate resources to risk response activities. What is the most appropriate risk strategy planning response?

Accepted Answer

Escalate the issue to the project board for a decision on resource prioritization.. When a functional manager refuses to allocate resources for risk responses, the issue exceeds the project manager's authority because it involves cross-functional resource prioritization. Escalating to the project board (or sponsor/steering committee) is the appropriate risk strategy response, as escalation is a recognized PMI risk response strategy for risks outside the project manager's control. The board can make an organizational-level decision on resource trade-offs.

Answer

Remove the identified risks from the risk register.

Answer

Accept all risks without mitigation.

Answer

Lower the probability rating of the risks associated with those resources.

Question 12

A project team is conducting a risk planning workshop. A team member suggests that all risks identified should be mitigated. What is the most appropriate response from the project manager?

Accepted Answer

Explain that risk responses are selected based on the cost-benefit analysis and risk appetite.. Risk responses are not automatically applied to every risk; they are selected through cost-benefit analysis and must align with the organization's risk appetite and tolerance. Some risks may be accepted, some avoided, some transferred, and some mitigated — the choice depends on whether the response's cost is justified by the reduction in exposure. The project manager should explain this decision framework rather than agree to mitigate everything.

Answer

Transfer all identified risks to a third-party vendor.

Answer

Ignore the comment and document only the risks the manager likes.

Answer

Agree with the team member to ensure project safety.

Question 13

During a project's mid-lifecycle review, you discover that the original risk management strategy is no longer effective due to a change in the market environment. What is the best course of action?

Accepted Answer

Formally review and update the Risk Management Plan to reflect current realities.. When the market environment changes and the original risk management strategy is no longer effective, the project manager must formally review and update the Risk Management Plan to reflect current realities. Risk management is iterative, and the plan is a living document that must be revised when assumptions, constraints, or external conditions change. This ensures responses remain relevant and resources are allocated appropriately.

Answer

Continue using the current plan to maintain consistency.

Answer

Ask stakeholders to sign off on the original plan again.

Answer

Switch to a quantitative-only approach immediately.

Question 14

Which component of the risk management plan details the frequency and level of detail for risk reports?

Accepted Answer

Risk Reporting Requirements. The Risk Reporting Requirements section of the risk management plan defines the format, frequency, audience, and level of detail for risk reports — exactly what the question asks. It specifies who receives which reports (e.g., weekly risk dashboard for the PMO, monthly summary for the steering committee) and the granularity of data (e.g., top-10 risks vs. full register). This is a planning artifact that ensures stakeholders get timely, decision-useful risk information without over- or under-reporting.

Answer

Risk Breakdown Structure

Answer

Risk Response Matrix

Answer

Probability and Impact Matrix

Question 15

A project manager is creating a risk strategy for an international project. They realize that risk tolerance varies significantly between the parent office and the local project site. How should they resolve this?

Accepted Answer

Document both sets of tolerances and define a process for handling conflicts.. When risk tolerances differ between the parent office and the local project site, the PM must not unilaterally choose one over the other. Documenting both sets of tolerances and defining a conflict-resolution process preserves transparency, respects organizational and local realities, and gives the team a repeatable way to decide which threshold applies to a given risk. This aligns with PMI-RMP guidance on documenting risk appetite/tolerance in the risk management plan and establishing escalation paths.

Answer

Use the local site's tolerance only.

Answer

Ignore the local site's preferences.

Answer

Ask for a new policy from the corporate board.

Question 16

What is the primary purpose of defining 'Risk Roles and Responsibilities' in the Risk Management Plan?

Accepted Answer

To clarify who has the authority to approve risk responses and risk reserve usage.. Defining Risk Roles and Responsibilities in the Risk Management Plan clarifies who is accountable for identifying, analyzing, responding to, and monitoring risks, and specifically who has the authority to approve risk responses and use contingency reserves. This ensures clear decision-making and avoids delays or conflicts during risk events.

Answer

To identify who gets paid more for risk management tasks.

Answer

To assign blame if the project fails.

Answer

To reduce the number of stakeholders involved in the project.

Question 17

Your organization uses a 'Risk Management Information System' (RMIS). During planning, you are configuring the system to track risk data. Which parameter is critical to define to ensure meaningful risk reporting?

Accepted Answer

Standardized probability and impact scoring scales.. A Risk Management Information System (RMIS) aggregates risk data across projects and portfolios, and meaningful reporting requires that all inputs use consistent, standardized probability and impact scoring scales. Without a common scale (e.g., 1–5 for probability, 1–5 for impact with defined monetary or schedule thresholds), risk scores from different projects cannot be compared, aggregated, or trended — the RMIS would produce apples-to-oranges data. Defining these scales is a foundational configuration step in the risk management plan and a prerequisite for quantitative and qualitative analysis.

Answer

The exact date of the project's completion.

Answer

The project manager's salary.

Answer

A list of all possible project vendors.

Question 18

When planning for risk management, which stakeholder is usually the final authority on risk appetite for the project?

Accepted Answer

The project sponsor.. The project sponsor is the executive who funds the project and owns the business case, so they are the final authority on the project's risk appetite — the amount of risk the organization is willing to accept in pursuit of the project's objectives. The project manager and team apply that appetite but do not set it.

Answer

The project manager.

Answer

Project team members.

Answer

The external auditor.

Question 19

A project is utilizing a 'Risk-Adjusted Schedule'. What does this imply about the project's risk planning?

Accepted Answer

The schedule accounts for identified risks via time buffers or logic changes.. A Risk-Adjusted Schedule is a project schedule that has been deliberately modified to reflect the impact of identified risks and agreed-upon risk responses. This is typically achieved by adding time buffers (such as contingency reserves or feeding buffers) or by altering the logical sequence of activities (e.g., adding lag, changing dependencies, or re-sequencing work) to reduce the probability or impact of risk events. In PMI's risk management framework, this schedule is an output of the Plan Risk Responses process and is used to establish a realistic baseline that accounts for uncertainty rather than assuming a risk-free environment.

Answer

The schedule was created by a software tool without human input.

Answer

The schedule has no risks involved.

Answer

The schedule is fixed and cannot be changed.

Question 20

In the context of the Risk Management Plan, what is a 'Risk Threshold'?

Accepted Answer

A value that triggers a specific risk response or escalation path.. A Risk Threshold is a predefined value or level of risk exposure (e.g., cost, schedule, or quality impact) that, when reached or exceeded, triggers a specific risk response or escalation to a higher authority. It is documented in the Risk Management Plan and helps determine when a risk is no longer acceptable and requires action. For example, a threshold might state that any risk with a potential cost overrun greater than $50,000 must be escalated to the project sponsor. Thus, it acts as a decision trigger, not a date, budget total, or register limit.

Answer

The start date of the risk assessment phase.

Answer

The total budget allocated to the project.

Answer

The maximum number of risks allowed in the register.