Courseiva

CCNA Risk Monitoring And Reporting Questions

41 questions · Risk Monitoring And Reporting · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Which report type is best suited for providing senior management with a high-level view of current risk status versus the risk appetite threshold?

A.Individual Risk Response Plan
B.Project Schedule Variance Report
C.Risk Heat Map
D.Risk Register Detail Report
AnswerC

A risk heat map plots risks by probability and impact, giving senior management a consolidated visual against appetite thresholds. This satisfies the high-level status-versus-appetite constraint, unlike detailed registers or mitigation plans that obscure the aggregate exposure picture.

Why this answer

A risk heat map visually plots probability against impact and highlights which risks exceed the organization's risk appetite thresholds. Senior management can quickly see the overall risk posture and where intervention is needed. This makes it the best high-level reporting tool for comparing current risk status to appetite.

Exam trap

PMI-RMP often tests report selection by audience, tempting candidates to choose detailed registers or response plans when executives need a visual, threshold-oriented view.

How to eliminate wrong answers

Option A is wrong because an Individual Risk Response Plan is a detailed, per-risk document, not a high-level portfolio view. Option B is wrong because a Project Schedule Variance Report tracks schedule performance, not risk status versus appetite. Option D is wrong because a Risk Register Detail Report is a granular list of risks and responses, too detailed for executive-level appetite comparison.

Practice this question →
2
MCQmedium

During project execution, you find that the 'Risk Response Owner' is not reporting updates. How should this be addressed within the project governance framework?

A.Update the risk yourself and hide the lack of participation
B.Escalate the accountability issue to the project sponsor
C.Assign a new owner without informing the original owner
D.Remove the risk from the register
AnswerB

Escalating to the project sponsor satisfies the governance constraint because the sponsor owns project-level accountability when a designated owner fails to perform. The risk response owner's silence is a performance and authority gap the project manager cannot resolve alone; the sponsor can enforce accountability, reassign ownership, or direct corrective action.

Why this answer

In project governance, the Risk Response Owner is accountable for executing and reporting on risk responses. If they fail to report, the issue is an accountability gap that should be escalated to the project sponsor, who has the authority to enforce governance and address performance issues. This maintains transparency and ensures the risk management process remains effective.

Exam trap

PMI-RMP often tests governance and accountability, and the trap is choosing to 'fix' the issue quietly or reassign without escalation, which violates transparency and proper authority.

How to eliminate wrong answers

Option A is wrong because updating the risk yourself and hiding the lack of participation violates transparency and integrity, and it does not address the root cause of non-reporting. Option C is wrong because assigning a new owner without informing the original owner bypasses proper change control and can cause confusion or conflict. Option D is wrong because removing the risk from the register is not justified; the risk still exists and must be managed, and removal would falsify the risk profile.

Practice this question →
3
MCQeasy

A risk audit has just been completed. What is the most critical activity to perform with the findings?

A.Update the risk management plan and register
B.Discard the report to avoid negative visibility
C.Request a project budget increase immediately
D.Send the report to external regulatory bodies
E.Delete the risks identified during the audit
AnswerA

Audit findings only create value once fed back into the risk management plan and risk register, updating response strategies, owners and reassessed exposures. This closes the audit loop and satisfies the stem's requirement to act on findings, ensuring risk processes reflect current effectiveness rather than remaining static documentation.

Why this answer

A risk audit evaluates the effectiveness of risk management processes and identifies areas for improvement. The most critical follow-up is to update the risk management plan and risk register with findings, ensuring that lessons learned are incorporated and that risk responses are adjusted. This closes the loop on the audit and supports continuous improvement.

Exam trap

PMI-RMP often tests the misconception that audit findings should be immediately escalated for budget or regulatory action, but the primary step is to update the risk management plan and register to reflect the findings and improve future risk handling.

How to eliminate wrong answers

Option B is wrong because discarding the report hides valuable information and violates transparency and governance; it also prevents corrective action. Option C is wrong because immediately requesting a budget increase is premature; the audit findings should first be analyzed to determine if additional funds are needed. Option D is wrong because sending the report to external regulatory bodies is not a standard step unless required by compliance; it could breach confidentiality.

Option E is wrong because deleting risks identified during the audit is destructive and ignores the purpose of the audit, which is to improve risk management.

Practice this question →
4
MCQhard

During a risk review, a stakeholder asks why a risk's impact has not changed despite a completed mitigation plan. What is the most likely cause?

A.The project manager forgot to save the update
B.The mitigation addressed probability, not impact
C.The risk is a secondary risk
D.The risk register is corrupted
AnswerB

Mitigation plans often reduce likelihood without altering the severity of consequences. If the response lowered probability only, the impact rating stays unchanged, explaining why the stakeholder sees no movement in the impact value despite completed mitigation work.

Why this answer

Risk responses target either the probability of a risk occurring or its impact if it does occur — and sometimes both. If a mitigation plan was completed but the impact score in the risk register is unchanged, the most likely explanation is that the response was designed to reduce probability only, leaving the potential impact untouched. This is a normal and valid outcome of certain response strategies.

Exam trap

PMI-RMP often tests the misconception that any completed mitigation must reduce both probability and impact, when in fact responses are frequently designed to address only one dimension — candidates who assume uniform reduction pick administrative or structural explanations instead.

How to eliminate wrong answers

Option A is wrong because a forgotten save is an administrative error, not a risk management explanation — the question asks for the most likely cause from a risk management perspective. Option C is wrong because a secondary risk is a new risk arising from a response, which would appear as a separate entry in the register, not explain why an existing risk's impact is unchanged. Option D is wrong because a corrupted risk register is a data integrity failure, not a plausible explanation for a specific risk's unchanged impact score.

Practice this question →
5
MCQhard

You are performing a periodic risk reassessment. A key risk has shifted from 'Low' to 'High' probability. What is the next immediate step in the reporting workflow?

A.Update the Probability and Impact Matrix and trigger a stakeholder notification
B.Schedule an immediate Steering Committee meeting
C.Close the risk and add it to the Issues Log
D.Immediately activate the contingency reserve
AnswerA

Re-scoring the risk in the Probability and Impact Matrix formally records the Low-to-High shift, and notifying stakeholders ensures the changed exposure is communicated before further response planning. Reporting workflow demands the register and matrix reflect current ratings first.

Why this answer

When a risk's probability shifts from Low to High, the immediate step is to update the Probability and Impact Matrix to reflect the new risk rating and trigger a stakeholder notification as per the communication plan. This ensures the risk is re-prioritized and stakeholders are aware of the increased exposure. The matrix update is foundational for subsequent response planning.

Exam trap

PMI-RMP often tests the confusion between responding to a risk that has occurred versus one whose probability has increased, where candidates may jump to activating reserves or escalating instead of updating the risk matrix and notifying stakeholders.

How to eliminate wrong answers

Option B is wrong because scheduling an immediate Steering Committee meeting may be premature; the first step is to update the risk documentation and notify stakeholders according to the plan, not escalate immediately. Option C is wrong because closing the risk and adding it to the Issues Log is incorrect; the risk has not occurred, only its probability increased, so it remains a risk. Option D is wrong because immediately activating the contingency reserve is premature; contingency reserves are used when risks occur or when approved responses require funding, not merely when probability increases.

Practice this question →
6
Multi-Selecthard

Which THREE actions are part of a 'Risk Audit' process?

Select 3 answers
A.Validating the documentation of the Risk Register
B.Evaluating the effectiveness of risk responses
C.Assigning new risks to owners
D.Updating the project budget for all contingencies
E.Verifying that the risk management process is followed
AnswersA, B, E

A risk audit examines whether the risk register is complete, current and correctly documented, so validating that documentation is a core action. It confirms risks, responses and owners are recorded accurately, satisfying the audit's purpose of assessing the risk management process itself.

Why this answer

A 'Risk Audit' is a tool/technique of the Control Risks process that examines the risk management process itself and its outputs. Option A is correct because the audit validates the documentation of the Risk Register, confirming that risks, responses, and status information are accurately and completely recorded. Option B is correct because the audit evaluates the effectiveness of implemented risk responses, determining whether they are actually reducing threats or exploiting opportunities as intended.

Option E is correct because the audit verifies that the risk management process is being followed according to the risk management plan, including the agreed policies, procedures, and roles. Option C does not belong because assigning new risks to owners is part of risk identification/qualitative analysis and ongoing risk management, not the audit itself. Option D does not belong because updating the project budget for all contingencies is a cost/funding activity, not an audit action.

Exam trap

PMI-RMP often tests the confusion between risk audit and other risk processes like risk reassessment or contingency planning. Candidates might select actions that are part of risk response planning rather than audit.

Practice this question →
7
MCQmedium

You are using a Risk Register template. Which field is most useful for tracking the 'Risk Reassessment' frequency?

A.Risk Owner
B.Risk ID
C.Next Review Date
D.Contingency Budget
AnswerC

The Next Review Date field records when each risk must be reassessed, letting the risk manager schedule and track reassessment frequency directly. Other register fields, such as owner, probability or response strategy, describe the risk itself rather than when it should next be reviewed.

Why this answer

The 'Next Review Date' field in a Risk Register is specifically designed to track when a risk should be reassessed, aligning with the 'Risk Reassessment' frequency defined in the Risk Management Plan. It ensures that risks are reviewed at planned intervals, enabling timely updates to probability, impact, and response strategies. This field directly supports the Control Risks process by scheduling regular reviews.

Exam trap

PMI-RMP often tests the distinction between fields that track risk status versus those that schedule activities; candidates may confuse 'Risk Owner' with review responsibilities, but the specific field for reassessment frequency is 'Next Review Date'.

How to eliminate wrong answers

Option A is wrong because the Risk Owner is responsible for managing the risk but does not indicate when reassessment should occur. Option B is wrong because the Risk ID is a unique identifier for tracking and referencing, not for scheduling reviews. Option D is wrong because the Contingency Budget tracks funds reserved for risk responses, not the timing of reassessments.

Practice this question →
8
Multi-Selecteasy

Which TWO items should you check to verify if a risk is being monitored appropriately?

Select 2 answers
A.The 'Last Updated' date in the Risk Register
B.The weather forecast at the office location
C.The number of hours the team works
D.The color of the project binder
E.The agreed-upon frequency in the Risk Management Plan
AnswersA, E

The 'Last Updated' date in the Risk Register shows when the risk was last reviewed or modified. A stale date indicates monitoring has lapsed, giving an objective, evidence-based check against the required review cadence for verifying appropriate risk monitoring.

Why this answer

Option A, the 'Last Updated' date in the Risk Register, is correct because the Risk Register is the living document where each identified risk's status, owner, and response actions are recorded, so a recent update timestamp confirms the risk is actively being tracked rather than left stale. Option E, the agreed-upon frequency in the Risk Management Plan, is correct because the Risk Management Plan defines the cadence (e.g., weekly, monthly, or at each phase gate) at which risks must be reviewed and reassessed, so comparing actual review activity against that frequency verifies monitoring is happening as scheduled. The remaining options are irrelevant to risk monitoring: the weather forecast (B) is an environmental factor, not a risk-tracking artifact; team work hours (C) measure effort, not risk review; and the color of the project binder (D) is purely cosmetic and has no bearing on risk management.

Exam trap

PMI-RMP often tests the difference between monitoring frequency and other risk register fields; candidates might focus on risk owner or status, but the key indicators of monitoring are the last update date and the planned frequency.

Practice this question →
9
Multi-Selecthard

Which THREE factors are primary triggers for conducting an unscheduled 'Risk Reassessment'?

Select 3 answers
A.Completion of a major project milestone
B.Change in the administrative assistant of the team
C.A major change in project scope
D.Daily routine status meetings
E.Evidence that a current mitigation plan is failing
AnswersA, C, E

Completing a major milestone materially changes the project's risk profile, since assumptions and dependencies tied to that phase are resolved or replaced. This satisfies the unscheduled trigger criterion by introducing new information that warrants reassessing the risk register outside the regular cycle.

Why this answer

Option A is correct because completing a major project milestone is a recognized trigger for unscheduled risk reassessment: milestones often invalidate prior assumptions, expose new risks, and change the risk profile, so the risk register must be re-examined. Option C is correct because a major change in project scope alters deliverables, assumptions, constraints, and the probability/impact of existing risks, which mandates an out-of-cycle reassessment rather than waiting for the next scheduled review. Option E is correct because evidence that a current mitigation plan is failing means the risk response is no longer effective, requiring immediate reassessment to re-analyze the risk, adjust response strategies, and identify secondary or residual risks.

Option B does not belong because a change of administrative assistant is a routine staffing matter that does not materially alter project risk exposure. Option D does not belong because daily routine status meetings are a regular monitoring and communication activity, not a trigger for an unscheduled risk reassessment.

Exam trap

PMI-RMP often tests the confusion between routine monitoring activities and triggers for unscheduled reassessment, where candidates may select routine events like daily meetings instead of significant change events.

Practice this question →
10
MCQeasy

What is the purpose of 'Risk Reassessment' sessions held throughout the project?

A.To ensure compliance with the procurement plan
B.To identify new risks and retire old ones
C.To change the project manager
D.To increase the contingency budget
AnswerB

Risk reassessment explicitly reviews the register to surface newly emerged threats and opportunities while closing risks that are no longer relevant, satisfying the stem's requirement for ongoing sessions across the project lifecycle. This differs from one-off identification or qualitative analysis, which do not retire obsolete entries.

Why this answer

Risk Reassessment is the process of re-evaluating existing risks, closing risks that are no longer relevant, and identifying new risks that have emerged as the project progresses. Its core purpose is to keep the risk register current and accurate by retiring obsolete risks and capturing new ones, ensuring the risk response plan reflects the actual project environment. This is distinct from other monitoring activities like risk audits or variance analysis.

Exam trap

PMI-RMP often tests the boundary between Risk Reassessment and other Monitor Risks techniques (risk audits, variance analysis) — the trap is choosing an option that describes a different process or an unrelated project action.

How to eliminate wrong answers

Option A is wrong because procurement compliance is addressed through procurement audits and contract administration, not risk reassessment sessions. Option C is wrong because changing the project manager is an HR/organizational action unrelated to the risk management process. Option D is wrong because increasing the contingency budget is a possible output of risk response planning or reserve analysis, not the purpose of reassessment — reassessment may inform such a decision but is not defined by it.

Practice this question →
11
MCQhard

If a risk's 'Risk Proximity' is approaching, what does this indicate for reporting?

A.The risk should be moved to the watchlist
B.The mitigation plan failed
C.The risk requires immediate and frequent monitoring
D.The risk is no longer relevant
AnswerC

Risk proximity measures how soon a risk is expected to occur. As it approaches, the risk moves closer to materialising, so it demands immediate attention and frequent monitoring to enable timely response actions before it impacts objectives.

Why this answer

Risk proximity measures how soon a risk is expected to occur relative to the current point in the project. When proximity is approaching, the risk is moving from a future possibility into the near-term window, which means it must be actively tracked with immediate and frequent monitoring so the team can trigger the response plan before impact. This is a reporting signal that urgency has increased, not that the risk has changed category or been resolved.

Exam trap

PMI-RMP often tests the confusion between proximity (when a risk will occur) and status (whether a risk is active, closed, or on the watchlist), causing candidates to pick the watchlist option for a risk that is actually escalating in urgency.

How to eliminate wrong answers

Option A is wrong because the watchlist is for low-priority risks that are monitored passively, whereas an approaching risk demands active, frequent attention. Option B is wrong because proximity is a timing attribute of the risk itself and says nothing about whether a mitigation plan succeeded or failed. Option D is wrong because an approaching risk is becoming more relevant, not less — it is moving toward occurrence, not out of scope.

Practice this question →
12
MCQmedium

You notice that the 'Residual Risk' is higher than the 'Inherent Risk' after mitigation. What does this suggest?

A.The risk is now fully accepted
B.The mitigation was highly successful
C.The mitigation strategy may have introduced secondary risks
D.The project is complete
AnswerC

Residual risk is what remains after mitigation, so it should fall below inherent risk. A higher residual figure indicates the mitigation introduced new exposures — secondary risks — that outweigh the original threat, meaning the response increased overall risk rather than reducing it.

Why this answer

Residual risk is the risk remaining after mitigation, while inherent risk is the risk before mitigation. If residual risk is higher than inherent risk, it suggests that the mitigation strategy may have introduced secondary risks or that the mitigation was ineffective and actually increased the overall risk exposure. This is a red flag indicating the need to reassess the response strategy.

Exam trap

PMI-RMP often tests the relationship between inherent and residual risk; candidates might assume residual is always lower, but the exam may present a scenario where it is higher to test understanding of secondary risks.

How to eliminate wrong answers

Option A is wrong because full acceptance would not increase residual risk above inherent risk; acceptance means acknowledging the risk without action, so residual equals inherent. Option B is wrong because successful mitigation would reduce residual risk below inherent risk. Option D is wrong because project completion is irrelevant to the comparison of residual and inherent risk.

Practice this question →
13
MCQhard

You are presenting a risk report. The sponsor points out that a specific risk was closed, but the cost impact was never updated. What is the correct way to handle this during reporting?

A.Suggest the sponsor look at the Issues Log instead
B.Blame the Risk Owner for the missing data
C.Argue that cost updates are not required for closed risks
D.Update the record with actuals and apologize for the reporting gap
AnswerD

Closing a risk without recording its realised cost leaves the risk register inaccurate, so the record must be updated with actual figures before the report is finalised. Acknowledging the reporting gap maintains transparency with the sponsor and preserves data integrity.

Why this answer

When a risk is closed, the risk register must reflect the actual outcome, including any realized cost impact, so that the historical record and lessons-learned data are accurate. The correct action is to update the record with actuals and acknowledge the reporting gap, since the risk report must present current, accurate information to the sponsor. This aligns with PMI's emphasis on transparency, accuracy, and continuous improvement in risk reporting.

Exam trap

PMI-RMP often tests the misconception that once a risk is closed, no further updates are needed, when in fact closure requires recording actual outcomes and cost impacts for accuracy and lessons learned.

How to eliminate wrong answers

Option A is wrong because the Issues Log tracks problems that have already occurred, not closed risks with cost data that still needs updating. Option B is wrong because blaming the Risk Owner is unprofessional and does not fix the data gap; accountability for reporting accuracy lies with the risk manager. Option C is wrong because closed risks still require cost actuals to be recorded for historical accuracy, lessons learned, and reserve reconciliation.

Practice this question →
14
Multi-Selectmedium

Which TWO of the following are essential components of a formal 'Risk Report' provided to project stakeholders?

Select 2 answers
A.Personal performance reviews of risk owners
B.Full list of all individual risk task assignments
C.Summary of top risks by impact
D.Trend of aggregate risk exposure
E.Detailed log of every risk register edit
AnswersC, D

Ranking top risks by impact gives stakeholders the prioritised view needed to allocate contingency reserves and attention. It satisfies the report's purpose of communicating which exposures most threaten project objectives, enabling informed escalation and response decisions rather than exhaustive risk listing.

Why this answer

Option C is correct because a formal Risk Report must give stakeholders a concise, prioritized view of the most significant threats, typically summarizing the top risks ranked by impact (and often probability) so decision-makers can focus on what matters most. Option D is correct because the report should also communicate how the overall risk exposure is changing over time, i.e., the trend of aggregate risk exposure, which shows whether the project's risk profile is improving or worsening across reporting periods. Options A and B are incorrect because personal performance reviews of risk owners and full lists of individual risk task assignments are operational/HR-level details, not stakeholder-facing risk reporting content.

Option E is incorrect because a detailed log of every risk register edit is raw audit-level data; the Risk Report summarizes and interprets risk information rather than reproducing every register change.

Exam trap

PMI-RMP often tests the distinction between the Risk Register (detailed, operational) and the Risk Report (summarized, stakeholder-facing), so the trap is selecting detailed register-level items as report components.

Practice this question →
15
MCQmedium

You are configuring a risk dashboard in a PMIS. Stakeholders need to see the 'Risk Burn-down' trend. Which data point must be tracked consistently to enable this report?

A.Aggregate risk exposure value
B.Owner assignment frequency
C.Total number of risks identified
D.Number of risk responses completed
AnswerA

A risk burn-down chart plots remaining aggregate risk exposure over time, so the exposure value must be calculated and recorded consistently at each reporting interval. Tracking this single data point satisfies the stakeholder requirement to display the trend of diminishing overall risk exposure.

Why this answer

The Risk Burn-down trend tracks the aggregate risk exposure value over time, showing how the total risk exposure decreases as risks are mitigated or closed. This requires consistent tracking of the aggregate exposure value, typically calculated as the sum of probability times impact for all open risks. Without this data point, the burn-down chart cannot be generated.

Exam trap

PMI-RMP often tests the difference between counting risks and measuring risk exposure; candidates might think the number of risks or responses completed is sufficient, but the burn-down specifically requires the aggregate exposure value to show the trend of risk reduction.

How to eliminate wrong answers

Option B is wrong because owner assignment frequency does not reflect risk exposure reduction; it is an administrative metric. Option C is wrong because the total number of risks identified does not account for the severity or exposure of those risks; a project could have many low-impact risks. Option D is wrong because the number of risk responses completed indicates progress but does not directly measure the remaining risk exposure, as responses may not fully eliminate risks.

Practice this question →
16
MCQhard

When reporting to an external regulatory agency, how should you present 'Risk Exposure'?

A.Omit any risks that have been mitigated
B.Only report risks with a low probability
C.Present a summary of risk exposure and mitigation efficacy
D.Present the full Risk Register with all sensitive data
AnswerC

External regulators need assurance that exposure is understood and controlled, so reporting a summary of risk exposure alongside mitigation efficacy demonstrates governance. This satisfies the stem's requirement for how risk exposure should be presented to a regulatory agency.

Why this answer

When reporting risk exposure to an external regulatory agency, you should present a summary of risk exposure and mitigation efficacy (Option C). This provides the agency with an accurate, aggregated view of the organization's risk posture and the effectiveness of controls, which is what regulators need to assess compliance and safety. It also respects confidentiality by not exposing raw internal risk data that could contain sensitive commercial or personal information.

Exam trap

PMI-RMP often tests the tension between transparency and confidentiality in external reporting, tempting candidates to either over-disclose (full register) or under-disclose (omit mitigated risks) instead of choosing a balanced summary.

How to eliminate wrong answers

Option A is wrong because omitting mitigated risks misrepresents the organization's true risk exposure — regulators need to know about all material risks, including those that have been mitigated, to assess residual risk. Option B is wrong because reporting only low-probability risks is a selective disclosure that hides high-probability or high-impact risks, which is both misleading and potentially a regulatory violation. Option D is wrong because presenting the full risk register with all sensitive data violates confidentiality and data-protection principles; external reports should be sanitized and aggregated, not raw internal documents.

Practice this question →
17
Multi-Selectmedium

Which TWO factors should be reviewed when deciding whether to 'Retire' a risk from the register?

Select 2 answers
A.The risk owner has resigned
B.The risk event has passed without occurring
C.The risk event is no longer possible
D.The project is over budget
E.The team decided the risk was too boring
AnswersB, C

A risk whose window has elapsed without materialising is closed because the exposure period ended, not because likelihood changed. This satisfies the retirement criterion by removing risks that can no longer affect the project, distinguishing them from those still pending future triggers.

Why this answer

Option B is correct because if the risk event's window has passed without the event occurring, the risk no longer has any future exposure and can legitimately be retired from the register. Option C is correct because if the risk event has become impossible — for example, the underlying asset, technology, or condition that created it no longer exists — there is no residual probability or impact to manage, so retirement is appropriate. Option A is not a valid reason, since a risk owner resigning only requires reassigning ownership, not closing the risk.

Option D is irrelevant, because being over budget does not eliminate the probability or impact of a risk. Option E is not a valid factor, as subjective disinterest does not change the risk's actual exposure.

Exam trap

PMI-RMP often tests the misconception that risks can be retired for administrative or subjective reasons, when retirement requires objective evidence that the risk is no longer possible or has passed.

Practice this question →
18
Multi-Selecteasy

Which TWO pieces of information are critical to include when logging a new risk in the register?

Select 2 answers
A.The office location of the project team
B.A clear description of the risk event
C.The historical performance of the company
D.The assigned risk owner
E.The salary of the risk owner
AnswersB, D

A clear description of the risk event captures the cause-and-effect statement of what could happen and how it would affect objectives. Without this, the register entry cannot be assessed, prioritised or responded to, making it the foundational field for every logged risk.

Why this answer

Option B is correct because a risk register entry must contain a clear, specific description of the risk event, including its cause and potential impact, so the risk can be understood, assessed, and managed consistently. Option D is correct because every logged risk needs an assigned risk owner who is accountable for monitoring the risk and executing the agreed response actions. Option A is not required, since the physical office location of the project team has no bearing on identifying, analyzing, or responding to a risk.

Option C is not required, as the company's historical performance is background context rather than a core field of a risk register entry. Option E is not required, because the risk owner's salary is irrelevant to documenting and managing the risk.

Exam trap

PMI-RMP often tests which fields are essential versus incidental in a risk register — the trap is selecting plausible-sounding organizational or historical details that are not required for logging an individual risk.

Practice this question →
19
MCQhard

You are assessing the effectiveness of a risk mitigation strategy. Which metric best indicates if the mitigation is working?

A.Number of audit findings related to risk
B.The change in residual risk exposure
C.Total number of risks managed
D.The frequency of steering committee meetings
AnswerB

Residual risk exposure measures the risk remaining after mitigation, so a reduction in that value directly demonstrates the mitigation's effectiveness. Comparing pre- and post-mitigation exposure isolates the treatment's impact, unlike activity or cost metrics that do not reflect actual risk reduction.

Why this answer

The purpose of risk mitigation is to reduce the probability and/or impact of a risk, which is measured by the change in residual risk exposure — the risk that remains after the response is applied. If residual exposure drops relative to the pre-mitigation assessment, the mitigation is working. This metric directly ties the response action to its intended effect on the risk profile, making it the most valid indicator of effectiveness.

Exam trap

PMI-RMP often tests the difference between activity/volume metrics and outcome metrics — the trap is selecting a metric that sounds risk-related (audit findings, number of risks) but does not actually measure whether mitigation reduced exposure.

How to eliminate wrong answers

Option A is wrong because audit findings measure compliance and control gaps, not whether a specific mitigation reduced a specific risk's exposure — a project can have zero findings yet still carry high residual risk. Option C is wrong because the total number of risks managed is a volume metric that says nothing about whether any individual mitigation lowered exposure; managing more risks could even mean the project is riskier. Option D is wrong because steering committee meeting frequency is a governance cadence metric and has no causal relationship to mitigation effectiveness.

Practice this question →
20
Multi-Selecthard

Which THREE elements are essential when documenting a 'Risk Trigger' in the register?

Select 3 answers
A.The phone number of the sponsor
B.The data source used to verify the trigger
C.The associated response plan to be activated
D.The specific trigger condition
E.The font style of the register entry
AnswersB, C, D

A trigger's data source identifies where the observable condition is monitored, enabling the project team to detect when the risk event is imminent. Recording it makes the trigger actionable rather than a vague statement, satisfying the register's requirement for a verifiable, traceable detection mechanism.

Why this answer

Option D is correct because a risk trigger must state the specific, observable condition or event (e.g., a threshold value or milestone) that signals the risk is about to occur or has occurred. Option B is correct because documenting the data source used to verify the trigger identifies where and how the condition is monitored (e.g., a specific report, metric, or system), making the trigger actionable and auditable. Option C is correct because linking the associated response plan to be activated ensures that when the trigger fires, the predefined contingency or mitigation steps are immediately known and executable.

Option A is not essential because a sponsor's phone number is contact information, not part of the trigger definition itself. Option E is not essential because font style is a formatting preference and has no bearing on risk identification or response.

Exam trap

PMI-RMP often tests the misconception that any information about a risk can serve as a trigger, when in fact a trigger must have a specific condition, a verifiable data source, and a linked response plan.

Practice this question →
21
Multi-Selectmedium

Which TWO features in a modern PMIS are best suited for automated 'Risk Monitoring'?

Select 2 answers
A.Dynamic dashboard updates based on register changes
B.Manual typing of risk descriptions
C.Automatic deletion of risks after 30 days
D.Automated email notifications for upcoming trigger dates
E.Manual spreadsheet export to PDF
AnswersA, D

Dynamic dashboard updates satisfy the automated monitoring constraint by recalculating risk exposure whenever register fields change, such as probability, impact or status. This removes manual reporting lag, surfacing threshold breaches and emerging high-severity risks in near real time, so the risk manager can trigger responses promptly.

Why this answer

Option A is correct because a PMIS dashboard that dynamically refreshes from the risk register gives real-time visibility into risk status, exposure, and trends, which is the essence of automated risk monitoring. Option D is correct because automated email notifications tied to trigger dates or thresholds proactively alert stakeholders when a risk is approaching or has breached its trigger, enabling timely response without manual tracking. Option B is not a monitoring feature; manually typing risk descriptions is data entry, not automation.

Option C is wrong because automatically deleting risks after 30 days would destroy risk history and violate the need for continuous tracking. Option E is not automated monitoring; manually exporting a spreadsheet to PDF is a static, one-off reporting action.

Exam trap

PMI-RMP often tests whether candidates can distinguish genuine automation (dynamic dashboards, trigger-based alerts) from manual activities (typing, exporting) and from destructive behaviors (auto-deletion) — the trap is picking options that sound like 'features' but are not monitoring capabilities.

Practice this question →
22
MCQhard

When reporting risk data to a global team, what is the biggest challenge for the project manager regarding risk data quality?

A.Software language compatibility
B.Subjectivity in risk assessment across different regions
C.Email communication delays
D.Time zone differences for reporting meetings
AnswerB

Risk assessments rely on probability and impact estimates that vary by culture, experience, and local data, so different regions score identical risks inconsistently. This subjectivity undermines comparability across the global register, making aggregation and prioritisation unreliable — the central data-quality challenge when reporting to a distributed team.

Why this answer

Subjectivity in risk assessment across different regions is the biggest challenge because risk perception, cultural norms, and risk tolerance vary globally, leading to inconsistent probability and impact ratings. This directly affects the quality and comparability of risk data. Other challenges like software compatibility or time zones are logistical and can be mitigated with tools, but subjectivity undermines data integrity.

Exam trap

PMI-RMP often tests the difference between logistical challenges and data quality issues; candidates might pick time zone differences as a major challenge, but the exam emphasizes that data quality is about accuracy and consistency, not convenience.

How to eliminate wrong answers

Option A is wrong because software language compatibility is a technical issue that can be resolved with translation or standardized tools, not a fundamental data quality challenge. Option C is wrong because email communication delays are a logistical inconvenience, not a core data quality issue. Option D is wrong because time zone differences affect scheduling but do not inherently compromise the quality of risk data.

Practice this question →
23
MCQeasy

When a 'Risk Trigger' occurs, what must be updated in the PMIS immediately?

A.The Project Scope Statement
B.The Stakeholder Register
C.The Resource Plan
D.The Risk Status and the Issue Log
AnswerD

A triggered risk becomes an issue, so its status must move to realised or closed in the risk register, and the resulting problem must be logged in the issue log for tracking and ownership. Updating both keeps the PMIS reflecting actual exposure and assigns accountability for resolution.

Why this answer

When a risk trigger occurs, the risk is transitioning from potential to actual or imminent, so the risk status must be updated immediately in the PMIS and the issue log must be updated if the risk has materialized into an issue. This ensures the project team and stakeholders have current information for response activation. The PMIS is the central repository for both risk and issue data, so these two updates are the immediate priority.

Exam trap

PMI-RMP often tests the confusion between risk status updates and issue log updates, where candidates may overlook that a triggered risk may become an issue and require both records to be updated.

How to eliminate wrong answers

Option A is wrong because the Project Scope Statement defines the project boundaries and is not updated merely because a risk trigger occurred; scope changes require formal change control. Option B is wrong because the Stakeholder Register is updated when stakeholder information changes, not when a risk trigger fires. Option C is wrong because the Resource Plan is updated through resource management processes, not as a direct response to a risk trigger.

Practice this question →
24
Multi-Selecthard

You are managing risks on a software development project. During a risk audit, you discover that a risk response plan for a high-priority risk was implemented, but the risk has not been monitored since. The risk owner claims that the response was successful and no further action is needed. You need to ensure that the risk is properly monitored going forward. Which TWO actions should you take? (Choose two.)

Select 2 answers
A.Schedule a risk review meeting with the risk owner and key stakeholders to reassess the risk.
B.Update the risk register to reflect the current status of the risk and its response.
C.Document the audit finding and recommend a corrective action plan to the project sponsor.
D.Reassign the risk to a different owner to ensure fresh oversight.
E.Close the risk since the response was successful and no further action is needed.
AnswersA, B

A risk review meeting brings together the risk owner and stakeholders to reassess the risk's probability, impact, and the effectiveness of the response. This collaborative approach ensures that all perspectives are considered and that the risk is properly monitored going forward. It also reinforces the importance of ongoing monitoring and provides an opportunity to update the risk response plan if needed. This action directly addresses the lack of monitoring and ensures accountability.

Why this answer

To ensure proper monitoring, the risk register must be updated with the current status, and a risk review meeting should be conducted to reassess the risk with the owner and stakeholders. These actions close the monitoring gap and reinforce accountability. Reassigning the owner or closing the risk without evidence is premature, and documenting the finding alone does not directly monitor the risk.

Exam trap

The trap here is thinking that a successful response means the risk can be closed without further monitoring, when in fact risks must be continuously monitored until they are no longer relevant.

Practice this question →
25
MCQmedium

You are monitoring risks and notice that a 'Secondary Risk' has appeared. What should you do first?

A.Add it to the Risk Register and assess its impact
B.Immediately initiate the contingency reserve
C.Ignore it if it is small
D.Call the sponsor to discuss the project failure
AnswerA

A secondary risk arises directly from implementing a risk response, so it must be captured and evaluated like any other risk. Adding it to the risk register and assessing its impact satisfies the stem's requirement to act first before planning further responses.

Why this answer

When a secondary risk appears, the first action is to add it to the Risk Register and assess its impact (Option A). A secondary risk is a new risk that arises as a direct result of implementing a risk response — for example, mitigating a schedule risk by adding resources may create a cost risk. Because it is a newly identified risk, it must be formally captured and analyzed before any response can be planned or contingency reserves tapped.

Exam trap

PMI-RMP often tests the distinction between secondary risks (new risks created by a response) and residual risks (remaining risks after a response), tempting candidates to skip assessment or immediately escalate.

How to eliminate wrong answers

Option B is wrong because initiating the contingency reserve before assessing the secondary risk's probability and impact is premature — you cannot know whether the reserve is needed or how much to use until the risk is analyzed. Option C is wrong because ignoring a secondary risk, even a small one, violates the risk-management process; small risks can escalate or interact with other risks to produce significant exposure. Option D is wrong because calling the sponsor to discuss project failure is an alarmist overreaction; a secondary risk is a normal occurrence in risk management, not a sign of project failure.

Practice this question →
26
MCQeasy

Which document should you reference to understand the formal reporting requirements for project risks?

A.The Risk Management Plan
B.The Communications Management Plan
C.The Project Charter
D.The Scope Statement
AnswerA

The Risk Management Plan defines how risk activities are structured and governed, including reporting formats, cadence, audiences and escalation paths. It directly satisfies the stem's requirement for formal reporting requirements, unlike the risk register, which records individual risks, or the communications management plan, which covers general project communication.

Why this answer

The Risk Management Plan is the document that defines how risk management activities will be structured and performed, including formal reporting requirements such as report format, frequency, audience, and escalation paths. It is the authoritative source for risk reporting procedures. Referencing it ensures compliance with the project's agreed risk communication framework.

Exam trap

PMI-RMP often tests the distinction between the Risk Management Plan (how risk is managed and reported) and the Communications Management Plan (how general project information is communicated), so candidates must not conflate the two.

How to eliminate wrong answers

Option B is wrong because the Communications Management Plan covers general project communications (status reports, meeting cadences) but does not specifically define risk reporting requirements. Option C is wrong because the Project Charter authorizes the project and names the PM but does not detail risk reporting procedures. Option D is wrong because the Scope Statement defines what is in and out of scope, not how risks are reported.

Practice this question →
27
MCQmedium

A project manager is using a 'Monte Carlo' simulation for risk monitoring. What is the main purpose of updating this simulation during the project?

A.To reflect current actuals and improve accuracy of future forecasts
B.To make the project look better to stakeholders
C.To keep the simulation software updated
D.To replace the need for qualitative risk assessments
AnswerA

Monte Carlo outputs are probability distributions built from estimated ranges. Updating the model with actual cost, duration and risk data replaces stale assumptions, narrowing variance and producing forecasts that reflect the project's real performance rather than its original baseline estimates.

Why this answer

Updating a Monte Carlo simulation with current actuals (e.g., actual durations, costs, and risk occurrences) refines the probability distributions and improves the accuracy of future forecasts. This is a core Monitor Risks activity that keeps the quantitative risk analysis relevant as the project progresses. The simulation is not a one-time exercise but a living model.

Exam trap

PMI-RMP often tests the misconception that Monte Carlo simulation is a one-time planning tool, when it is actually an iterative monitoring tool that must be refreshed with actuals to remain valid.

How to eliminate wrong answers

Option B is wrong because using the simulation to make the project look better is unethical and violates the integrity principle; simulations must reflect reality. Option C is wrong because keeping software updated is an IT maintenance task, not the purpose of updating the simulation model. Option D is wrong because Monte Carlo simulation complements, not replaces, qualitative risk assessments — both are used together in the risk management process.

Practice this question →
28
MCQeasy

You are setting up a regular risk review meeting. Who is the most important attendee to invite?

A.The Risk Owner for the specific risks being reviewed
B.The entire project team
C.All project stakeholders
D.The external auditor
AnswerA

The Risk Owner is accountable for managing and responding to the specific risks under review, so their attendance satisfies the stem's need for the most important participant. They provide current status, own mitigation actions, and can commit resources during the meeting, which no other attendee can do for those particular risks.

Why this answer

A risk review meeting exists to assess the status of identified risks and their response plans. The person accountable for executing those responses is the Risk Owner, so they are the most critical attendee — without them, the meeting cannot meaningfully update risk status or adjust mitigation actions.

Exam trap

PMI-RMP often tests the distinction between accountability (Risk Owner) and broad participation (team, stakeholders), so options that invite 'everyone' are classic distractors.

How to eliminate wrong answers

Option B is wrong because inviting the entire project team dilutes focus and is impractical for a recurring review; the team is engaged when their specific risks are discussed. Option C is wrong because 'all stakeholders' is over-broad — many stakeholders have no ownership of specific risks and would add noise. Option D is wrong because an external auditor provides independent assurance, not risk ownership, and is not a routine participant in operational risk reviews.

Practice this question →
29
MCQhard

You are managing a project with a 'high' risk profile. Stakeholders request a report that shows the 'Residual Risk' vs 'Target Risk' levels. What does this indicate?

A.The gap shows the extent of required further mitigation
B.The project is over budget
C.The project is ahead of schedule
D.The project risk is fully mitigated
AnswerA

Residual risk is what remains after existing responses, while target risk is the exposure stakeholders are willing to accept. The gap between them quantifies how much additional mitigation is still needed to reach that tolerance, directly satisfying the high-risk profile's demand for further treatment.

Why this answer

Residual risk is the risk that remains after planned responses have been applied, while target risk is the acceptable level the organization is willing to tolerate. The gap between them quantifies how much additional mitigation is still required to bring exposure down to the target threshold. Reporting this gap gives stakeholders a clear, actionable view of remaining work on the risk profile.

Exam trap

PMI-RMP often tests the misconception that residual risk equals zero after mitigation — candidates forget that residual risk is what remains and the gap to target drives further action.

How to eliminate wrong answers

Option B is wrong because budget variance is measured through cost performance metrics (CPI, EAC), not through a residual-vs-target risk comparison. Option C is wrong because schedule performance is tracked via schedule variance or SPI, which is unrelated to the residual/target risk gap. Option D is wrong because if risk were fully mitigated, residual risk would equal or fall below target risk, eliminating the gap — the presence of a gap specifically indicates mitigation is incomplete.

Practice this question →
30
MCQeasy

Which section of the 'Risk Register' is most important for monitoring the status of a specific risk?

A.Risk ID
B.Risk Description
C.Owner
D.Risk Status
AnswerD

Risk Status records whether each identified risk is active, closed, or occurred, directly satisfying the stem's monitoring requirement. Unlike static identification fields, it tracks live progression through the risk lifecycle, enabling the risk manager to confirm current standing at any review point.

Why this answer

The Risk Status section of the Risk Register is specifically designed to track the current state of a risk, such as whether it is active, closed, or occurred. It provides the most direct information for monitoring a specific risk's status. Other sections like Risk ID, Description, and Owner are important for identification and assignment but do not indicate current status.

Exam trap

PMI-RMP often tests the confusion between risk identification elements (ID, description) and risk monitoring elements (status) — candidates may pick 'Owner' thinking it indicates accountability, but status is the key for monitoring.

How to eliminate wrong answers

Option A is wrong because Risk ID is merely a unique identifier for the risk, not an indicator of its status. Option B is wrong because Risk Description provides details about the risk but does not track its current state. Option C is wrong because the Owner is the person responsible for managing the risk, not the status itself.

Practice this question →
31
Multi-Selectmedium

Which THREE criteria are commonly used to prioritize risks for reporting in a dashboard?

Select 3 answers
A.The name of the software used for tracking
B.The birth date of the risk owner
C.Probability of occurrence
D.Impact on project objectives
E.Urgency of the risk event
AnswersC, D, E

Probability of occurrence is a core prioritisation axis, letting the dashboard rank risks by likelihood so the team addresses the most probable threats first. It satisfies the stem's requirement for a common reporting criterion alongside impact and urgency.

Why this answer

Option C (Probability of occurrence) is correct because risk prioritization typically begins with assessing how likely a risk is to happen, often expressed as a likelihood rating or percentage, so that more probable risks receive higher reporting priority. Option D (Impact on project objectives) is correct because the severity of consequences on scope, schedule, cost, or quality determines how damaging a risk would be, and high-impact risks warrant prominent dashboard visibility. Option E (Urgency of the risk event) is correct because the time frame in which a risk must be addressed affects prioritization; near-term risks require immediate attention and are ranked higher than those with longer horizons.

Option A (The name of the software used for tracking) is not a prioritization criterion because the tracking tool is merely an administrative detail and does not reflect risk severity or likelihood. Option B (The birth date of the risk owner) is irrelevant personal information and has no bearing on how a risk should be ranked for reporting.

Exam trap

PMI-RMP often tests whether candidates confuse administrative or irrelevant data (like software name or owner birth date) with genuine risk prioritization criteria, so always focus on probability, impact, and urgency.

Practice this question →
32
MCQmedium

When a risk response is found to be ineffective during an audit, what is the next step?

A.Close the risk to avoid future audits
B.Revise the risk response plan and update the register
C.Assign a different owner to the same ineffective plan
D.Continue with the plan until the project ends
AnswerB

An ineffective response means the residual risk exceeds tolerance, so the risk register entry and response plan must be revised to reflect the new approach and re-assessed. Updating the register maintains the audit trail the audit demands.

Why this answer

When an audit reveals that a risk response is ineffective, the correct action is to revise the risk response plan and update the risk register to reflect the new approach, reassessed probability/impact, and revised ownership. This closes the loop on the Plan-Do-Check-Act cycle for risk management. Simply changing the owner or continuing an ineffective plan leaves the risk unaddressed.

Exam trap

PMI-RMP often tests whether candidates understand that ineffective responses require plan revision rather than cosmetic changes like swapping owners, and candidates frequently pick the owner-change option because it looks like corrective action.

How to eliminate wrong answers

Option A is wrong because closing a risk to avoid audits is a governance violation and does not eliminate the underlying exposure — it just hides it. Option C is wrong because assigning a different owner to the same ineffective plan does not change the plan's inadequacy; the response itself must be redesigned. Option D is wrong because continuing an ineffective plan until project end guarantees the risk will materialize unmitigated and wastes resources.

Practice this question →
33
MCQeasy

You are a risk manager on a construction project. The project sponsor requests a report on the top five risks by exposure. You have calculated the risk exposure for each risk as the product of probability and impact. Which document should you consult to obtain the most current probability and impact values for each risk?

A.Risk register
B.Lessons learned register
C.Issue log
D.Risk management plan
AnswerA

The risk register is the primary document that contains detailed information about each identified risk, including its probability, impact, risk score, and response plan. It is regularly updated throughout the project lifecycle, so it holds the most current values. To report on top risks by exposure, you must consult the risk register for the latest probability and impact assessments. This ensures that the report reflects the current risk landscape and supports informed decision-making.

Why this answer

The risk register is the centralized repository for all risk-related information, including current probability and impact assessments. It is updated throughout the project, making it the authoritative source for calculating risk exposure. Other documents like the risk management plan, issue log, and lessons learned register serve different purposes and do not contain the real-time risk data needed for this report.

Exam trap

The trap here is confusing the risk management plan with the risk register; the plan describes the process, while the register contains the actual risk data.

Practice this question →
34
MCQeasy

During a risk audit, you identify that a previously closed risk has manifested. What is the most appropriate action to ensure accurate project risk status?

A.Archive the risk to maintain the dashboard clarity
B.Create a new risk entry in the Risk Register
C.Update the Lessons Learned repository only
D.Re-open the existing risk and update the response plan
AnswerD

A closed risk that has actually occurred must return to the register as active, because the risk status is no longer valid. Re-opening it preserves the original identification, owner and history, and lets the response plan be revised to reflect the realised threat.

Why this answer

When a previously closed risk manifests, the most appropriate action is to re-open the existing risk and update its response plan. This maintains the integrity of the risk register, ensures the risk is actively managed again, and allows the team to apply the planned response or adjust it based on current conditions. It also preserves the historical link between the original risk and its realization.

Exam trap

The trap is thinking that a closed risk should remain closed or be replaced by a new entry; candidates may choose to create a new risk to avoid re-opening, but that loses traceability and violates proper risk management practice.

How to eliminate wrong answers

Option A is wrong because archiving the risk would hide a real issue and prevent proper management, compromising project risk status. Option B is wrong because creating a new risk entry duplicates the risk and loses the history and context of the original entry, leading to confusion and potential double-counting. Option C is wrong because updating lessons learned alone does not address the active risk; it is a retrospective action, not a real-time response.

Practice this question →
35
MCQeasy

When monitoring risk triggers, what is the primary purpose of a 'Risk Trigger' threshold field in your project management software?

A.To automate the closure of the risk entry
B.To define the escalation path for the project manager
C.To provide an objective indicator that a risk is about to occur
D.To notify the finance department of budget changes
AnswerC

The threshold field stores a measurable value, such as a cost variance or schedule slip, that signals the risk is materialising. Crossing it gives an objective, pre-agreed cue to activate the response plan rather than relying on subjective judgement.

Why this answer

The primary purpose of a risk trigger threshold field is to provide an objective, measurable indicator that a risk is about to occur, enabling timely activation of the response plan. It sets a specific value or condition that, when met, signals the need for action. This supports proactive risk management rather than reactive firefighting.

Exam trap

PMI-RMP often tests the misconception that a trigger threshold is for escalation or closure, when its core purpose is to provide an objective indicator of impending risk occurrence.

How to eliminate wrong answers

Option A is wrong because a trigger threshold does not automate risk closure; closure is a deliberate decision based on risk status, not a threshold breach. Option B is wrong because the escalation path is defined separately in the risk management plan or communication plan, not by the trigger threshold field. Option D is wrong because notifying the finance department of budget changes is a communication action, not the purpose of a trigger threshold; the threshold is about risk occurrence, not budget updates.

Practice this question →
36
Multi-Selecteasy

Which TWO stakeholders are most likely to request a detailed 'Risk Report'?

Select 2 answers
A.The office receptionist
B.The local newspaper reporter
C.The project sponsor
D.The project manager
E.The catering service staff
AnswersC, D

The project sponsor requires the Risk Report to oversee overall risk exposure, approve contingency reserves, and make informed decisions about the project's viability. This satisfies the stem's demand for detailed risk information, as sponsors need comprehensive visibility into threats and opportunities to fulfil their governance and funding responsibilities.

Why this answer

The project sponsor (C) is a correct answer because sponsors are accountable for the project's business case and overall success, so they need the Risk Report to understand exposure, potential impacts on budget/schedule/scope, and whether risks threaten expected benefits. The project manager (D) is also correct because they own day-to-day risk management: they use the Risk Report to track identified risks, probability/impact ratings, risk owners, response plans, and status, and to drive mitigation and escalation decisions. The office receptionist (A), local newspaper reporter (B), and catering service staff (E) are not typical project stakeholders with a legitimate need for detailed risk information; they have no role in risk ownership, governance, or decision-making, and sharing such a report with them would be inappropriate and potentially a confidentiality concern.

Exam trap

PMI-RMP often tests the confusion between the Risk Report and the Risk Register, and candidates must remember that the Risk Report is a broader communication artifact for senior stakeholders, not a tactical list of risks.

Practice this question →
37
MCQmedium

You are reviewing a 'Risk Burndown' chart and see that it is flat. What does this mean?

A.The project is completed
B.No risk mitigation or closure has occurred
C.The risk management process is highly effective
D.Risks are being identified faster than they are being closed
AnswerB

A flat risk burndown means the cumulative risk exposure is unchanged over time. Mitigation and closure actions reduce that exposure and would slope the line downward, so a flat line indicates no such risk reduction work has occurred.

Why this answer

A Risk Burndown chart plots cumulative risk exposure (typically probability × impact) against time across the project lifecycle. A flat line means the total risk exposure is not decreasing, which indicates that no risk responses have been executed, no risks have been closed, and no new mitigation value has been realized. In other words, the project team is not actively reducing the risk profile over time.

Exam trap

PMI-RMP often tests the interpretation of graphical risk tools, and candidates confuse a flat burndown with 'no new risks' or 'stable risk,' when it actually means no net reduction in risk exposure has occurred.

How to eliminate wrong answers

Option A is wrong because project completion would be represented by the burndown line reaching zero (or the baseline), not remaining flat. Option C is wrong because effective risk management would show a downward-sloping burndown as risks are mitigated and closed, not a flat line. Option D is wrong because risks being identified faster than closed would produce a rising or upward-trending line, not a flat one.

Practice this question →
38
MCQeasy

What is the primary function of a 'Risk Dashboard' compared to a 'Risk Register'?

A.Dashboards provide full historical logs of all changes
B.Dashboards replace the need for the Risk Register
C.Dashboards offer visual summaries and trends for executive review
D.Dashboards store raw data for quantitative analysis
AnswerC

A risk dashboard aggregates register data into visual summaries, heat maps and trend lines, giving executives a fast portfolio-level view. The register itself remains the detailed, item-level record; the dashboard's distinct function is condensed visual reporting for leadership review and decision-making.

Why this answer

A Risk Dashboard provides visual summaries and trends, such as heat maps, burn-down charts, and key risk indicators, tailored for executive review and decision-making. In contrast, the Risk Register is a detailed repository of individual risks. The dashboard aggregates and visualizes data to highlight patterns and overall risk exposure, enabling quick comprehension.

Exam trap

The trap is confusing the purpose of a dashboard with that of a register; candidates might think dashboards store data or replace the register, but the exam emphasizes that dashboards are for visualization and summarization, not data storage.

How to eliminate wrong answers

Option A is wrong because full historical logs are typically maintained in the Risk Register or a separate audit trail, not in a dashboard. Option B is wrong because dashboards complement, not replace, the Risk Register; the register remains the source of detailed risk data. Option D is wrong because raw data storage and quantitative analysis are functions of the Risk Register or specialized risk analysis tools, not the dashboard's primary purpose.

Practice this question →
39
MCQmedium

You are identifying a trend where multiple risks in a specific category (e.g., 'Supply Chain') are occurring. What report should you generate?

A.Budget Variance Report
B.Individual Risk Audit Report
C.Project Schedule Baseline
D.Risk Category Trend Report
AnswerD

Grouping risks by category and plotting occurrence frequency over time exposes the concentration the stem describes, letting you see which category is trending upward. A Risk Category Trend Report aggregates this data specifically, unlike a register or heat map that shows only current exposure.

Why this answer

A Risk Category Trend Report aggregates risk data by category (e.g., Supply Chain, Technical, External) to reveal patterns, such as a rising frequency of risks in one area. This report helps the PM identify systemic issues and prioritize response efforts. It is the appropriate artifact when multiple risks in a specific category are occurring.

Exam trap

PMI-RMP often tests the difference between a Risk Report (comprehensive snapshot) and a Risk Category Trend Report (pattern analysis by category), so candidates must match the tool to the specific analytical need.

How to eliminate wrong answers

Option A is wrong because a Budget Variance Report tracks cost performance against the baseline, not risk category patterns. Option B is wrong because an Individual Risk Audit Report examines a single risk's response effectiveness, not trends across a category. Option C is wrong because the Project Schedule Baseline is a time-related reference, not a risk analysis tool.

Practice this question →
40
Multi-Selecthard

Which THREE items should be included in a 'Risk Audit' report to project governance?

Select 3 answers
A.The cost of the audit consultant
B.Summary of audit findings
C.The internal team's lunch schedule
D.Status of the risk management process compliance
E.Recommendations for process improvement
AnswersB, D, E

A risk audit report must communicate what the audit discovered, so a summary of findings gives governance the observed strengths, gaps and non-compliance in risk practise. This satisfies the stem directly, since findings are the substantive output that justifies the audit and informs subsequent decisions.

Why this answer

A Risk Audit report to project governance must communicate what was found, so option B (Summary of audit findings) is correct because governance needs a concise account of the audit's observations, evidence, and conclusions to make informed oversight decisions. Option D (Status of the risk management process compliance) is correct because the audit's core purpose is to verify that the risk management process adheres to the defined policy, standards, and procedures, and governance must know the degree of compliance. Option E (Recommendations for process improvement) is correct because an effective audit does not merely report deficiencies but proposes corrective or enhancing actions so governance can authorize remediation and improve the risk process.

Option A (The cost of the audit consultant) is not included because consultant fees are a procurement or budget matter, not a substantive risk audit finding for governance. Option C (The internal team's lunch schedule) is irrelevant administrative trivia with no bearing on risk management or governance oversight.

Exam trap

PMI-RMP often tests the distinction between process-level audit outputs and project-level administrative details, so candidates who grab any 'reasonable-sounding' report item (like audit cost) instead of the three governance-relevant process findings lose the question.

Practice this question →
41
MCQmedium

Which tool in your PMIS allows you to track the 'Risk Response' implementation status across multiple work streams?

A.Individual Risk Response Plan
B.Project Charter
C.Risk Impact Analysis Matrix
D.Risk Register Status Report
AnswerD

The risk register status report consolidates each identified risk with its response owner, actions and implementation progress, giving a single cross-work-stream view of response status. Other PMIS artefacts track individual risks or schedules but do not aggregate response implementation across work streams.

Why this answer

The Risk Register Status Report (Option D) is the PMIS tool designed to track the implementation status of risk responses across multiple work streams. It aggregates data from the risk register — such as response owner, due date, completion percentage, and effectiveness — into a report that gives a portfolio or program-level view. This enables risk managers to monitor whether responses are being executed as planned and to identify work streams that are falling behind.

Exam trap

PMI-RMP often tests the confusion between documents that define or prioritize risks (charter, impact matrix, individual response plan) and the report that tracks implementation status across work streams.

How to eliminate wrong answers

Option A is wrong because an Individual Risk Response Plan documents the response for a single risk; it does not provide cross-work-stream tracking or status aggregation. Option B is wrong because the Project Charter is a high-level authorization document that defines the project's purpose and boundaries — it does not track risk response implementation. Option C is wrong because a Risk Impact Analysis Matrix (similar to a probability-impact matrix) is used to prioritize risks, not to track the status of response implementation across work streams.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Risk Monitoring And Reporting questions.

Start 20-question session