PMI RMP - Risk Response

What is the purpose of mitigating negative risks as a part of the risk response process?

• To transfer the probability of a risk happening to a third party to reduce the impact.

• To reduce the probability of a risk happening and/or reduce the severity of the impact.

• To accept the probability of a risk happening to reduce the severity of the impact.

• To increase the probability of a risk happening, but reduce the severity of the impact.

Answer explanation

B. To reduce the probability of a risk happening and/or reduce the severity of the impact.

The purpose of mitigating a negative risk is to reduce the probability of the risk and reduce the potential impact. For example, if our negative risk is "delayed supply of X", we would like to reduce the probability that supply X would indeed be delayed. Furthermore, we would like to reduce the potential impact in case supply X is indeed delayed (mitigating potential timeline delays, cost increases due to engaging with different suppliers, etc). Accepting or transferring risk are not mitigation strategies. Risk acceptance is a risk response strategy whereby the project team decides to acknowledge the risk and not take any action unless the risk occurs. Risk transfer is a risk response strategy whereby the project team shifts the impact of a threat to a third party, together with ownership of the response. Increasing the probability of a risk happening does not necessarily reduce the severity of the impact and is not a mitigation strategy.

The risk manager organizes a stakeholder meeting to obtain an agreement on project risk response strategies. The risk manager must leave the meeting and will be out of the office for the next week. The risk manager reminds the team that at the conclusion of this meeting, risk response strategies should be which of the following?

• Scheduled, budgeted, and easy to understand.

• Cost-effective and validated by Monte Carlo analysis.

• Iterative, scaled to the project, and implemented.

• Timely, cost-effective, agreed upon, and accepted.

Answer explanation

D. Timely, cost-effective, agreed upon, and accepted.

At the conclusion of the meeting, the risk response strategies should be timely, cost-effective, agreed upon, and accepted. This means that the risk response strategies should be implemented in a timely manner, be cost-effective in meeting the challenge, be realistic within the project context, be agreed upon by all parties involved, and be owned by a responsible person. It is important to ensure that the risk response strategies are appropriate for the significance of the risk and that they are selected based on structured decision-making techniques. 

The other possible answers are inadequate or incomplete.

While some aspects of the other options may be helpful in some cases, they are not sufficient on their own to represent the definitive output of the meeting. Risk response strategies are not typically scheduled as there is no sure way to predict when or if they will be necessary. 

The project manager has documented a new risk and its impact. If not resolved immediately, the risk will jeopardize the success of the project. The resources necessary to address the risk are currently working on another critical project.
What should the project manager do?

• Seek to negotiate a solution with the functional manager and project sponsor.

• Outsource third-party resources necessary to address the risk to project success.

• Adjust the project schedule based on the highest three-point estimate of the impact.

• Meet with the project sponsor to request more resources and a delay in the schedule.

Answer explanation

A. Seek to negotiate a solution with the functional manager and project sponsor.

The question notes the necessary resources are working on another project, indicating that it is a shared resource in either a functional or matrix-type organization where the functional manager is the person who is able to reschedule, reassign, or replace resources. Negotiating a solution with the functional manager and project sponsor would be the case in this type of organizational structure.

The other options are incorrect.
Outsourcing the resources necessary to address the risk may be a potential outcome, however not until the discussion is held with the functional manager and project sponsor.
Modifying the project schedule has no relevance to the question and the issue at hand.
Meeting with the project sponsor to request additional resources and schedule delay may be a potential outcome, however not until the discussion is held with the functional manager and project sponsor.

While preparing for a project review meeting with leadership, the project team analyzes and checks its scope activities and discovers missing requirements. The project risk manager decides to hire a subcontractor to fulfill these newly discovered requirements. What risk strategy did the project risk manager use?

• Avoid

• Transfer

• Accept

• Mitigate

Answer explanation

B. Transfer

In risk management, transfer involves shifting the impact of a threat to a third party, along with ownership of the response. By hiring a subcontractor, the project team is transferring the risk of not being able to fulfill the requirements to the subcontractor. It's important for project teams to carefully consider and choose the appropriate risk response strategy for each identified risk. A risk strategy is based on the risk attitude and appetite of the organization. These determine the risk threshold and are a key element of the risk strategy. 

The other options are incorrect. 

Avoidance is when the project team acts to eliminate the threat or protect the project from its impact. 

Acceptance is when the threat is acknowledged but no action is taken unless the risk occurs.

Mitigation is intended to reduce the probability and/or impact of the risk.

Which of the following is an effective channel for risk mitigation assistance, project risk visibility, and risk escalation support?

• Project steering committee

• Project management office (PMO)

• Change control board (CCB)

• Board of directors

Answer explanation

B. Project management office (PMO)

The PMO is a management structure that standardizes the project‐related governance processes and facilitates the sharing of resources, methodologies, tools, and techniques. 

The change control board (CBB) and board of directors may become involved after consulting the PMO, but this would not be the most effective channel in this instance. The project steering committee has a clear view of its own project, however, the PMO has a broad and powerful understanding of the organization's project portfolio.

A telecommunications company is planning to implement a new service network but is concerned about the risk of failure. The company decides to test a prototype before conducting full implementation on the entire network. What type of risk response strategy did the company choose?

• Transfer

• Mitigate

• 1. Avoid

• Accept

Answer explanation

B. Mitigate

They chose to mitigate the risk by testing the new network prototype before conducting full implementation on the entire network. This is a common risk management strategy used to reduce the impact or likelihood of a risk. By testing the prototype, the mobile operator can identify and address any potential issues or problems before implementing the new network on a larger scale.

The other options are incorrect.

Risk transference involves shifting ownership of the risk to a third party to manage, which in this case the mobile operator did not do. 

Risk avoidance is a risk response strategy that involves eliminating the threat, which is not the case in this scenario.

Risk acceptance acknowledges the existence of the risk, but no proactive action is taken. In this case, however, the mobile operator selected to test a prototype, making the accept strategy not applicable.

During the development phase of a construction project, key stakeholders approved a project budget. The risk management team identified risks and appropriate risk responses. However, during project execution, an unexpected local health emergency halted and delayed work on the project. This event type was not identified as a risk or listed in the risk register. The team decides that this issue must be mitigated, which would incur additional costs. 

How should the risk manager address this unforeseen budgetary overrun?

• Use the management reserve to cover the cost.

• Identify potential ways to exploit the risk.

• Use the contingency reserve to cover the cost.

• Develop cost and performance baselines.

Answer explanation

A. Use the management reserve to cover the cost.

Since the health emergency was unforeseen, the management reserve would be the appropriate resource to cover the cost or mitigation. A management reserve is the amount of the project budget or project schedule held outside of the performance measurement baseline for management control purposes that is reserved for unforeseen work that is within the project scope.

Risk exploitation addressed opportunities, not threats. Risk exploitation is a response strategy whereby the project team acts to ensure that an opportunity occurs. Further, the question states that the issue must be mitigated, so the risk response has already been determined.  

A contingency reserve is the time or money allocated in the schedule or cost baseline for known risks with active response strategies. This option is incorrect because the risk was not known.

The cost baseline is the approved version of the time-phased project budget, excluding any management reserves, which can be changed only through formal change control procedures and is used as a basis for comparison to actual results.

Some of the project's materials have been ordered from overseas. The supplier notifies the project team that the materials will not reach the site on time due to a customs clearance delay that will affect the critical path.

What should the project manager do first?

• Ask the logistics team to arrange an expedited clearance.

• Revisit the risk register and implement the respective risk response.

• Identify the root cause of the delay and add it to the bid documents.

• Ensure the suppliers cover any additional costs due to the delay.

Answer explanation

B. Revisit the risk register and implement the respective risk response

The project manager should first revisit the risk register since corrective action has been identified at the beginning of the project. Information in a risk register can include the person responsible for managing the risk, probability, impact, risk score, planned risk responses, and other information used to get a high-level understanding of individual risks.
The other options are incorrect because the project manager should first review the risk register to determine the appropriate course of action.
Asking the logistics team to arrange expedited clearance is incorrect because it may not be possible and customs regulations are controlled by regional or governmental bodies. 
Identifying the root cause of the issue is incorrect because the basic cause is known in this case. This option is also incorrect because bid documents are used to request proposals from prospective suppliers and the supplier has already been chosen.
It may not be possible to ensure that the suppliers cover additional costs, agreements like that are typically determined when entering a contract with a supplier.

A project manager learned that the project deliverables will not meet the quality requirements unless a change is made to a component. After issuing a formal change request, the project manager emailed details of the change to all stakeholders. Most stakeholders received the information promptly and were fully aware of the change. However, the project manager found out that some stakeholders did not receive the email or did not read it.

What could the project manager have done to prevent this?

• Reviewed the communications management plan.

• Developed a detailed work performance report.

• Met with the project sponsor to discuss communication.

• Questioned the stakeholders about technological literacy.

Answer explanation

A. Reviewed the communications management plan.

A communications management plan is a component of the project, program, or portfolio management plan that describes how, when, and by whom information about the project will be administered and disseminated. Communication is the most important factor in engaging with stakeholders effectively. Project success is dependent on effective communication and the communication medium used influences the effectiveness of communication. Before deciding to send emails to all stakeholders, the risk manager should have first reviewed the communications management plan to confirm that email communication is effective for all stakeholders. Typically, preferred communication methods vary from stakeholder to stakeholder, based on a multitude of factors. 

The other options are incorrect because they do not preemptively address the core issue. In this case, some stakeholders had no problems with the emails. For others, email was clearly not the most effective way to communicate. The risk manager could have avoided the confusion by reviewing the communications management plan and disseminating the information in the stakeholders' preferred medium.

Two companies merge. The executive leadership team for the newly formed company hires a project risk manager to integrate both companies' technology platforms into a single global platform. Since the success of this integration project is critical for the new company, the project risk manager determines that risk management is vital. What are the primary factors of the risk response planning process that the team should consider?

• People, planning, and analysis

• People, planning, and avoidance

• Planning, acceptance, and analysis

• People, mitigation, and analysis

Answer explanation

A. People, planning, and analysis

The risk response planning process includes factors such as people, planning, and analysis. In risk management, the risk response planning process involves developing options and actions to enhance opportunities and reduce threats to project objectives. The factors included in this process are:

• People: Identifying and assigning roles and responsibilities for risk management activities, including risk response planning.

• Planning: Developing a plan for responding to identified risks, including defining risk response strategies, actions, and triggers.

• Analysis: Analyzing the identified risks to determine the appropriate response strategies and actions.

The other options are incorrect.

Avoidance, mitigation, and acceptance are risk response strategies, not the primary factors of the risk response planning process. Every project is different, and it's important for project teams to carefully consider and choose the appropriate risk response strategy for each identified risk to ensure the success of the project. Avoidance involves taking action to eliminate the threat or protect the project from its impact, while acceptance involves acknowledging the risk and not taking any action unless the risk occurs. While selecting a strategy is paramount, no one response strategy is used for every project.