Assess and manage risks
Assess and manage risks
What you will learn
- Explain the purpose of the risk register and its core contents.
- Name the threat response strategies (avoid, mitigate, transfer, accept, escalate) and their opportunity counterparts (exploit, enhance, share, accept).
- Distinguish contingency reserve from management reserve by who controls the decision to use it.
- Trace the risk management process sequence from identification through ongoing monitoring.
A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives. A common mistake is assuming every risk is negative (a threat) — but PMI classifies a positive risk (an opportunity) as a risk too, with its own parallel response strategies, not just "ignore it because it's good".
Risk response strategies
| Avoid / Exploit | Avoid: change the plan to eliminate the threat entirely. Exploit: make sure the opportunity actually happens instead of leaving it to chance. |
|---|---|
| Mitigate / Enhance | Mitigate: reduce a threat's probability or impact without eliminating it entirely. Enhance: increase an opportunity's probability or impact. |
| Transfer / Share | Transfer: shift a threat's impact to a third party (insurance, a contract). Share: bring in a third party better positioned to capture the opportunity. |
| Accept | Accept (passive or active), taking no proactive action, or setting a contingency reserve for active acceptance. Appropriate when the response would cost more than the risk's own impact. |
| Escalate | Escalating the risk to a party outside the project manager's or the project's own authority, when its impact falls outside what the project can handle. |
Contingency reserve vs. management reserve
| Contingency Reserve | Management Reserve | |
|---|---|---|
| Covers | Known, previously identified risks (known-unknowns) | Unforeseen work entirely outside the project's known scope (unknown-unknowns) |
| Part of the cost baseline? | Yes — it sits inside the approved cost baseline | No — separate from it, added to form the total project budget |
| Who authorizes its use | The project manager | Senior management / the sponsor, usually outside the project manager's direct authority |
The risk management process sequence
Identify risks
List threats and opportunities and log them in the risk register.
Qualitative analysis
Rank risks by probability and impact to set priority.
Quantitative analysis (optional)
Numerically estimate impact on large or highly complex projects.
Plan responses
Choose a response strategy for each priority risk and assign it an owner.
Ongoing monitoring
Track existing risks and identify new ones throughout the project life cycle.
What matters on the exam
- A question about a positive risk (opportunity) expects exploit/enhance/share/accept — not avoid or mitigate.
- "Who authorizes it" is usually the deciding clue between contingency reserve (project manager) and management reserve (senior management).
- The risk register is a living document updated throughout the project, not written once at the start.
Not every risk is negative
A common confusion: assuming "risk management" only means avoiding harm. Half of PMI's four response strategies target positive opportunities (exploit, enhance, share) using the exact same logic as their negative counterparts. A question describing an "opportunity" and asking for the best response, where you pick "avoid" because you automatically link the word "risk" to something negative, is a recurring trap.
Quick check
Answer in your head first, then reveal.
What is the difference between contingency and management reserve in terms of who decides to use them?Reveal the answer
The project manager authorizes contingency reserve; senior management/the sponsor authorizes management reserve.
What is the appropriate response strategy for an opportunity you want to guarantee happens?Reveal the answer
Exploit.
Is management reserve part of the approved cost baseline?Reveal the answer
No, it is separate and added to form the total project budget.
When is "accept" the most fitting response?Reveal the answer
When any proactive response would cost more than the risk's own expected impact.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.