PMI Risk Management Professional

A risk process works when people agree how it runs. You set methods, roles, scales and thresholds, decide how risks will be reported and funded, and write the plan that the team follows.

• Risk management plan contents
• Roles and responsibilities
• Risk categories and the risk breakdown structure
• Probability and impact scales
• Reporting formats and review frequency
• Risk budgets and reserves

You build A risk management plan with scales, roles and a risk breakdown structure.

You cannot manage a risk you have not found. You use workshops, interviews, checklists and analysis to surface risks from every source, and challenge the assumptions behind the plan.

• Brainstorming and facilitated workshops
• Interviews and the Delphi technique
• Checklists and lessons from past projects
• SWOT, assumption and constraint analysis
• Root cause and diagramming techniques
• Documentation review and expert judgment

You build A long list of risks from three techniques applied to one project.

A poorly worded risk cannot be analyzed or owned. You describe each risk by cause, event and effect, assign owners, and keep a register that stays useful as the project changes.

• Cause, event and effect statements
• Risk owners and their authority
• Risk triggers and warning signs
• Linking risks to objectives and the work breakdown structure
• Register structure and tools
• Reviewing and improving risk statements

You build A risk register of well-formed statements, each with an owner and a trigger.

Most risks are ranked, not modeled. You score probability and impact, add urgency and proximity, assess data quality, and present the results so that the team knows where to look first.

• Probability and impact assessment
• Probability-impact matrices and heat maps
• Urgency, proximity and detectability
• Assessing the quality of risk data
• Risk categorization and grouping
• Reporting results to decision makers

You build A scored risk list and a heat map for one project.

Numbers help when the decisions are large. You turn risks into money and time, use expected value, decision trees, sensitivity analysis and simulation, and interpret results that carry uncertainty.

• When quantitative analysis is worth doing
• Three-point estimates and distributions
• Expected monetary value and decision trees
• Sensitivity analysis and tornado diagrams
• Monte Carlo simulation for cost and schedule
• Interpreting confidence levels and reserves

You build A Monte Carlo analysis of a schedule or budget with a written interpretation.

Analysis is only useful if it changes what the team does. You choose among avoid, transfer, mitigate and accept for threats, and exploit, share and enhance for opportunities, and plan responses that people can carry out.

• Response strategies for threats
• Response strategies for opportunities
• Escalating risks beyond the project
• Contingent responses and fallback plans
• Secondary and residual risks
• Choosing a response by cost and benefit

You build A response plan with named owners for the leading risks on a project.

Reserves turn risk analysis into a budget and a schedule that can absorb surprises. You size contingency from the analysis, separate it from management reserve, and release it only by clear rules.

• Contingency and management reserve
• Sizing reserves from analysis
• Schedule and cost contingency
• Rules for drawing down reserves
• Reporting reserve use
• Reserves in contracts and agile funding

You build A reserve calculation with draw-down rules for one project.

Risks change as the work moves. You review risks on a rhythm, check that responses work, track triggers and trends, audit the process, and report in a way that prompts decisions.

• Risk reviews and reassessment
• Tracking triggers, trends and variances
• Checking whether responses work
• Risk audits
• Risk reporting and dashboards
• Updating the plan and the reserves

You build A monthly risk report with trends and recommended decisions.

A risk is not finished until someone says so. You close risks on clear criteria, handle the residual ones that remain, and record lessons so that the next project starts smarter.

• Criteria for closing a risk
• Handling residual risks at handover
• Closing out the risk register
• Capturing lessons and feeding the risk library
• Transferring risk to operations
• Reviewing the risk process itself

You build A risk closeout report with lessons learned.

Project risk does not stay inside the project. You see how risks add up in programs and portfolios, how enterprise risk frameworks relate, and how to communicate upward.

• Aggregating risk across projects
• Program and portfolio risk views
• Enterprise risk management and its link to projects
• Risk governance and escalation
• Contract and supplier risk
• Communicating risk to executives

You build A risk escalation framework linking project, program and enterprise levels.

One project holds the whole course. You build the plan, find and analyze risks, plan responses and reserves, monitor through simulated events, and close with a report.

• Setting up the risk approach
• Identifying and analyzing the risks
• Planning responses and reserves
• Monitoring through simulated events
• Closing and reporting

You build A complete risk file for a realistic project, from plan to closeout report.