Guide §2.7 · PRINTED PP. 92–102
Risk Performance Domain
The Risk domain builds project resilience by repeatedly identifying, analyzing, responding to, and monitoring uncertainty. A risk is an uncertain event or condition with a positive or negative effect; an issue already exists. The domain addresses individual threats and opportunities, overall project risk, risk appetite and thresholds, exposure, ambiguity, emergent risk, and the capacity to absorb disruption and recover. Risk management is therefore both preventive and adaptive: it prepares specific responses to known risks while developing reserves, continuity awareness, and flexible structures for what cannot be predicted.
Understand the chapter
The Risk domain builds project resilience by repeatedly identifying, analyzing, responding to, and monitoring uncertainty. A risk is an uncertain event or condition with a positive or negative effect; an issue already exists. The domain addresses individual threats and opportunities, overall project risk, risk appetite and thresholds, exposure, ambiguity, emergent risk, and the capacity to absorb disruption and recover. Risk management is therefore both preventive and adaptive: it prepares specific responses to known risks while developing reserves, continuity awareness, and flexible structures for what cannot be predicted.
Learning objectives
- Distinguish risks from issues, assumptions, constraints, ambiguity, uncertainty, and known facts.
- Describe risks in cause-event-consequence form and identify both threats and opportunities iteratively.
- Explain individual risk versus overall project risk, appetite, threshold, exposure, and resilience.
- Perform qualitative analysis using probability, impact, urgency, timing, manageability, proximity, interrelationships, and agreed prioritization rules.
- Use quantitative analysis such as simulation, sensitivity, decision trees, and expected monetary value when the decision warrants numerical treatment.
- Select and implement threat, opportunity, contingent, and overall-risk strategies with owners, actions, triggers, resources, reserves, and residual or secondary risks.
- Monitor response execution, new and changing risks, reserve sufficiency, process effectiveness, and alignment with continuity or emergency plans.
Key concepts
Threat and opportunity
Uncertain events with possible adverse or beneficial effects.
Issue
A condition that has already occurred and needs present action.
Risk response
A planned action, owner, and trigger to alter exposure or exploit an opportunity.
Deeper understanding
Why it matters
The event's status changes its management route: an occurred risk is now an issue, while residual uncertainty still needs monitoring.
Decision questions
- Is the item an uncertain future event, a present issue, or a whole-project exposure?
- Have new risks appeared, and does their combined effect exceed the agreed tolerance?
- Was the agreed response executed, and did it reduce exposure or merely consume reserve?
Teach it back
- Distinguish risks from issues, assumptions, constraints, ambiguity, uncertainty, and known facts.
- Describe risks in cause-event-consequence form and identify both threats and opportunities iteratively.
- Explain individual risk versus overall project risk, appetite, threshold, exposure, and resilience.
Signals to notice
- The event's status changes its management route: an occurred risk is now an issue, while residual uncertainty still needs monitoring.
- Positive opportunities deserve owners and tracking, not only negative threats and contingency budgets.
- Resilience addresses disruptions that no risk register could comprehensively enumerate.
Section-by-section reading
Use the printed page references to read each section in the official publication, then explain the idea in your own words.
Key concepts: threats, opportunities, issues, overall risk, and resilience
A risk is uncertain and can help or harm objectives; an issue is a condition that has already occurred and needs attention now. The guide suggests describing risks through cause, event, and consequence, and distinguishes individual risks from uncertainty affecting the project as a whole. Risk appetite is willingness to accept uncertainty for reward; thresholds express tolerable variation, while exposure aggregates potential effects at a point in time. Responses may address threats or opportunities, and an intolerably high overall exposure can justify cancelling a project. Resilience is the capacity to absorb disruption and recover, including from events that could not be specifically predicted. A risk register alone does not create that capacity.
Understand this item
Why it matters: Different uncertainty states demand different action: future possibilities need risk responses, present conditions need issue handling, and aggregate exposure may require a governance decision about the entire project.
Decision to make: Classify each concern, describe uncertain risks through cause-event-consequence, compare exposure with thresholds, pursue opportunities as well as threats, and build recovery capacity for surprises.
Do not confuse it with: A risk is uncertain, an issue has occurred, overall risk reflects combined project exposure, and resilience is the ability to absorb disruption and recover rather than merely list it.
Teach it back: Use a flood example to distinguish a possible event, a current issue, overall exposure, and a resilience measure.
Apply it: Possible flooding is a risk, a flooded access road is an issue, and keeping an alternate route ready adds resilience.
Check yourself: Is the item an uncertain future event, a present issue, or a whole-project exposure?
Plan risk management, identify risks, and analyze exposure
Risk management planning starts early and defines how the project will conduct risk activities. Identification seeks both threats and opportunities and repeats as information changes; concerns that have already become issues should not be mistaken for hypothetical risks. Qualitative analysis evaluates individual risks through probability and impact and may also consider timing, manageability, connections, or common causes. Quantitative analysis numerically examines combined effects when the project's context warrants it; it is not mandatory for every project. The analysis should distinguish individual events from aggregate exposure and make assumptions explicit. Repeating identification and analysis is essential because neither the original register nor an early numerical model can capture every emerging condition.
Understand this item
Why it matters: Early assumptions age quickly, so repeated identification and analysis are needed to reveal emerging threats, opportunities, and changes in combined exposure.
Decision to make: Define scales, thresholds, cadence, and responsibilities; identify both positive and negative uncertainty; use qualitative prioritization and add quantitative analysis only when stakes and context justify it.
Do not confuse it with: Qualitative analysis prioritizes individual risks using relative judgments, while quantitative analysis models numerical combined effects; neither makes a one-time register complete.
Teach it back: Explain when a probability-impact review is sufficient and when combined cost or schedule simulation would improve a real decision.
Apply it: At each construction phase, review flood threats and a potential accelerated permit opportunity, then analyze combined delay exposure if warranted.
Check yourself: Have new risks appeared, and does their combined effect exceed the agreed tolerance?
Plan, implement, and monitor risk responses
Planning responses selects and agrees actions for individual risks and overall exposure. Threat strategies may include avoiding, mitigating, transferring, accepting, or escalating; opportunities can be exploited, enhanced, shared, accepted, or escalated. A response may require resources, reserves, and schedule activities, so documenting it without funding or an owner is weak control. Implementation checks that agreed actions actually happen. Monitoring tracks known risks, discovers and analyzes new ones, plans new responses, and evaluates whether prior actions worked. Assign owners so responsibility continues as the project changes. A reserve is not an alternative to prevention; the guide's check results also look for proactive steps that reduce reliance on contingency.
Understand this item
Why it matters: A response written in a register changes nothing unless it has authority, resources, timing, an owner, and evidence that it reduced exposure.
Decision to make: Choose a strategy suited to threat, opportunity, or overall exposure; fund and schedule the action; define ownership and triggers; then verify execution and reassess residual and secondary risk.
Do not confuse it with: Planning selects an action, implementation performs it, and monitoring tests effectiveness and detects change; a reserve funds consequences but does not replace prevention.
Teach it back: For a seasonal flood threat, state the response, owner, funding, trigger or due date, readiness test, and evidence that exposure fell.
Apply it: A contractor books temporary flood barriers, names the site lead as owner, funds the rental, and tests readiness before the rainy season.
Check yourself: Was the agreed response executed, and did it reduce exposure or merely consume reserve?
Tailoring: scale, thresholds, strategic importance, and disruption planning
Tailor the depth of risk management to project size and complexity, urgency, external regulation, and the organization's appetite and thresholds. Strategic importance can raise both the opportunity to pursue and the consequences of failure. The guide calls for a holistic view across domains and for resilience planning where disruption could be severe, including scenarios connected to business continuity or emergency response. Analytical techniques can be adapted to available information; extensive quantitative modeling is not automatically justified for a small effort. Agile work may review risks at the start of each sprint and with stakeholders at iteration end. Tailoring changes frequency and technique, not the need to distinguish threats, opportunities, and actionable response ownership.
Understand this item
Why it matters: Risk effort should match decision stakes: too little leaves serious exposure unmanaged, while excessive modeling consumes time without improving a small, reversible decision.
Decision to make: Scale cadence, documentation, analysis, and disruption scenarios to complexity, urgency, regulation, strategic importance, appetite, and thresholds while retaining clear ownership.
Do not confuse it with: A small iterative pilot may review privacy risks each cycle, whereas a regulated infrastructure project may need formal thresholds, quantitative models, and continuity scenarios.
Teach it back: Explain why tailoring can simplify techniques but cannot eliminate the distinction between risks, issues, opportunities, and accountable responses.
Apply it: A short app pilot reviews emerging privacy risks each iteration, while a regulated dam upgrade uses documented thresholds and disruption scenarios.
Check yourself: Is the effort spent on analysis proportional to exposure and decision stakes?
Interactions with stakeholders, scope, schedule, and finance
Stakeholders provide information about uncertainty, help assess impacts, and may help execute responses. Scope, schedule, and finance define objectives that threats and opportunities can affect, while responses themselves may alter work, dates, costs, and resource needs. Effective risk management therefore cannot consist of a separate register periodically updated by one specialist. A design simplification might reduce schedule exposure but create quality or acceptance risk; extra contingency funding may protect a milestone but reduce available investment elsewhere. Governance should see the aggregate trade-off, especially when a threshold is crossed. Communication also matters because different stakeholders may perceive and tolerate the same exposure differently.
Understand this item
Why it matters: Risks and their responses alter objectives, dates, costs, resources, and acceptance, so isolated register maintenance hides the trade-offs governance must see.
Decision to make: For each major risk and proposed response, identify affected objectives and stakeholders, test cross-domain consequences, and escalate when aggregate exposure exceeds authority or tolerance.
Do not confuse it with: A response can reduce one exposure while creating another—for example, a second supplier may protect schedule but increase compatibility, cost, or acceptance risk.
Teach it back: Trace how a supplier-failure response would change scope, schedule, finance, quality, and stakeholder expectations before approval.
Apply it: A supplier failure risk leads to a second-source option; the team assesses compatibility, procurement cost, lead time, and user acceptance.
Check yourself: Which objective and stakeholder would be affected by both the risk and its proposed response?
Check results: response readiness, reserves, and realized opportunities
The guide's checks ask whether the team considers technical, social, political, market, and economic context; has a well-understood process to identify, assess, document, and respond; and aligns actions with budget, schedule, and performance constraints. Look for reserves that are available and used appropriately, delivery performance within agreed thresholds, and mechanisms that identify and track realized opportunities. Risk owners, response execution, and evidence of recovery matter more than a long list of hypothetical events. A low reserve draw may reflect effective prevention, but it should not be celebrated without checking whether exposure was truly reduced. Reassess resilience and remaining uncertainty after a disruption rather than assuming a completed response closes the subject.
Understand this item
Why it matters: Risk performance is demonstrated by readiness, timely action, recovery, appropriate reserve use, and captured opportunities—not by the length of the risk list.
Decision to make: Check owners, triggers, funded actions, threshold performance, reserve decisions, opportunity tracking, recovery evidence, and the current residual-risk view after events or responses.
Do not confuse it with: Low reserve use may show successful prevention or inadequate response; it is meaningful only when paired with evidence that exposure and delivery consequences were controlled.
Teach it back: After a storm, identify the measures that would show whether the planned response worked and what uncertainty still remains.
Apply it: After a storm, compare response activation time, reserve use, revised milestone forecast, and whether the alternate supplier remained viable.
Check yourself: Can the team demonstrate an effective response and a current view of residual risk?
Apply it to a project
Coastal solar farm A solar project faces permit uncertainty, seasonal storms, foreign-exchange exposure, a possible tax-credit extension, and community concern about construction traffic. Plan Risk Management defines categories, five-level probability and impact scales, cost and schedule thresholds, review cadence, owners, escalation, and quantitative-analysis criteria. Identify Risks uses permit documents, weather data, supplier interviews, community sessions, assumptions, and AI-assisted document review. Each item is written as cause, uncertain event, and consequence; current permit deficiencies are logged as issues, not risks. Qualitative analysis elevates storm logistics and permit delay. Quantitative simulation estimates the chance of meeting the commercial-operation date, while a decision tree compares early equipment purchase against waiting for permit certainty. The tax-credit extension is analyzed as an opportunity. Plan Risk Responses assigns permit workshops, storm-season resequencing, currency hedging review, a triggered logistics contingency, and advocacy partnership for the opportunity. Costs, owners, dates, and reserves are inserted into finance and schedule plans. Monitor Risks checks triggers and response effectiveness each month. After a new regulation appears, the team identifies a new compliance risk, updates overall exposure, and escalates because the forecast exceeds the sponsor's threshold. Risk practice becomes operational only when uncertainty is translated into decisions, funded actions, triggers, accountable owners, and changing forecasts.
What to watch for
- Misconception: All risk is negative. Correction: PMBOK 8 treats threats and opportunities as uncertain effects; objectives improve when opportunities are identified and acted on.
- Misconception: A problem that has already happened belongs in the risk register only. Correction: It is an issue requiring current action, though it should remain linked to any originating risk and lessons.
- Misconception: Risk identification is a one-time workshop. Correction: Initial identification is incomplete by definition; reviews must continue as scope, stakeholders, data, and the environment change.
- Misconception: High probability automatically means highest priority. Correction: Priority also depends on impact, urgency, proximity, manageability, interrelationships, thresholds, and the objective affected.
- Misconception: A response written in the register has been managed. Correction: Implementation requires an owner, resources, dates, triggers, plan integration, monitoring, and evaluation of residual and secondary risks.
- Misconception: Contingency reserve covers every surprise. Correction: Contingency addresses identified risks. Management reserve and resilience or continuity planning address unforeseen and disruptive conditions under separate authority.
- Misconception: A risk score is objective truth. Correction: Scores depend on scales, evidence, and judgment. Use them for consistent prioritization, then examine uncertainty, bias, and decision consequences.
Test your reasoning
A supplier has already missed a contractual delivery date. Is this a risk or an issue?
Show answer and reasoning
Issue, because the condition has occurred The future consequences may create additional risks, but the missed date itself is a present condition requiring issue management.
Which process combines qualitative and, when required, quantitative analysis?
Show answer and reasoning
Perform Risk Analysis It prioritizes individual risks qualitatively and may numerically analyze their combined effect on overall objectives.
A 30% chance of a $100,000 loss has what EMV?
Show answer and reasoning
-$30,000 EMV = 0.30 x -$100,000 = -$30,000. It is a probability-weighted decision input, not a prediction that exactly $30,000 will be lost.
What is the best response to an opportunity the team wants to make certain?
Show answer and reasoning
Exploit Exploit acts to ensure the opportunity occurs. Enhance increases probability or impact; share allocates ownership to a capable party; accept takes no proactive action beyond monitoring.
What shows that risk management is integrated rather than administrative?
Show answer and reasoning
Response work, reserves, dates, contracts, assignments, and forecasts are incorporated into project plans and monitored A populated register is not execution. Integration changes the actual schedule, budget, resource, procurement, stakeholder, and governance system.
Study companion only; the official guide is available from PMI.