Plan, Identify, and Analyze Risks

Introduction

This lesson covers the first half of task 5 of the Business Environment domain in the July 2026 PMP Examination Content Outline: planning risk management, identifying risks, keeping the risk register, and analyzing risks qualitatively and quantitatively. Business Environment carries 26% of the exam. The July 2026 outline also lists enablers such as poor IT security in the risk register, so you should be ready to see cybersecurity and sustainability risks in scenarios.

The exam tests situations such as: a new project manager must decide how much risk effort fits a project; a workshop produced a list of fears and you must turn it into a usable register; two risks must be ranked; a decision depends on expected monetary value. After this lesson you will be able to build a risk management approach, write well-formed risks, score them, and calculate simple quantitative results. The second lesson of this chapter covers responses, monitoring, and communication.

Learning objectives

• Explain what the risk management plan contains and how it is tailored.
• Identify risks with several techniques and write them as cause, event, and effect.
• Build and maintain a risk register, including security and sustainability risks.
• Score risks with a probability and impact matrix and rank them.
• Distinguish individual risks from overall project risk.
• Calculate expected monetary value, use decision trees, and explain simulation.
• Explain risk appetite, tolerance, and threshold.

1. What a risk is

A risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more objectives. Negative risks are threats; positive risks are opportunities. Two levels exist: individual risks, specific events, and overall project risk, the combined effect of all uncertainty on the project outcome, including variability and ambiguity.

Related terms:

2. The risk management plan

The plan describes how risk management will be done. It is developed early, with the sponsor and key stakeholders, and tailored to the size, complexity, and importance of the project. It usually contains:

• Strategy and approach: the method and sources of data.
• Roles and responsibilities: who identifies, owns, analyzes, and approves.
• Funding and time: budget for risk work and the contingency reserve policy.
• Timing and frequency: when risk reviews take place, for example each iteration or monthly.
• Risk categories: often a risk breakdown structure (technical, external, organizational, project management, security, sustainability).
• Stakeholder risk appetite and thresholds.
• Definitions of probability and impact scales for each objective.
• Probability and impact matrix.
• Reporting formats and how risk information is tracked.

In agile projects, risk handling is built into the rhythm: backlog items carry risk and value, risky items are scheduled early, spikes reduce uncertainty, and the team reviews risks at planning, in the daily meeting, and at reviews. In hybrid projects the plan sets the governance for the predictive part and the team routines for the agile part.

Tailoring

A small internal project with a two-month duration does not need quantitative simulation. A high-value infrastructure project does. Tailor the effort to the value at stake, the novelty of the work, the contract type, and the regulatory context.

3. Identifying risks

Identification is continuous; it starts at project initiation and repeats at each phase, iteration, and major change. Involve the team, subject experts, customers, and other stakeholders.

Techniques

Writing a good risk statement

A risk written as "the vendor" or "bad requirements" cannot be analyzed. Use the structure: Because of [cause], [uncertain event] may occur, which would lead to [effect on objectives].

Example: "Because the payment vendor has changed its API twice in 12 months, it may change it again before go-live, which would force rework of about 3 weeks and a delay of the launch."

Security and sustainability risks

The July 2026 outline names poor IT security as an example of an item in the risk register. Consider:

• Security: unauthorized access to project data, an unpatched component, a supplier with weak controls, a data leak during migration.
• Sustainability: energy-intensive infrastructure that fails an environmental target, a supplier outside responsible sourcing rules, disposal obligations at end of life.
• Compliance and external: new regulation, geopolitical event, market change.
• Opportunities: a reusable component might reduce effort, a new tool might speed up work.

The risk register

The register is created during identification and grows with analysis. Its minimum content:

Keep it alive. A register that is not reviewed is just a document.

4. Qualitative risk analysis

Qualitative analysis prioritizes individual risks quickly by assessing probability, impact, and other characteristics, with no need for complex data.

Steps:

1. Assess the quality of the data. Are the estimates based on facts or on guesses? Biased or uncertain data should be noted.
2. Assess probability and impact against the scales in the plan, for each objective (cost, schedule, scope, quality).
3. Assess other attributes: urgency (how soon a response is needed), proximity (when the risk could occur), dormancy (time between occurrence and discovery), manageability, controllability, detectability, connectivity to other risks, strategic impact, and propinquity (how much stakeholders perceive it as important).
4. Place the risk in the probability and impact matrix and rank it.
5. Categorize by source or area to detect concentrations.

Example scales:

A score is often probability times impact. A risk with probability 4 and impact 4 scores 16 and requires attention; probability 1 and impact 2 scores 2 and is watched. Thresholds for the colour bands (low, medium, high) come from the risk appetite of the stakeholders.

Opportunities are scored with the same method, using positive impacts.

Other tools

• Probability and impact matrix: a grid with colour zones.
• Risk data quality assessment.
• Risk categorization using the risk breakdown structure.
• Hierarchical charts such as bubble charts (probability, impact, and detectability or proximity).
• Risk urgency assessment to decide which risks need an immediate response even when their score is moderate.

Worked example: ranking three risks

Scenario. A logistics platform project has a budget of 2,000,000 and 12 months. Three risks are submitted:

• R1: A key data scientist may leave (probability 30%, cost impact 100,000, schedule impact 6 weeks).
• R2: The warehouse scanner firmware may be incompatible with the new API (probability 60%, cost impact 40,000, schedule impact 2 weeks, but it would be discovered only at integration testing in month 9).
• R3: A new data protection regulation may require encryption of stored data (probability 20%, cost impact 250,000, schedule impact 8 weeks).

The matrix uses the scales above.

Step 1: convert to levels. R1: probability 2 (30% sits on the border of low and medium; the team agrees on 2), cost impact 3 (5%), schedule impact 4 (6 weeks) so impact 4. R2: probability 4, cost 2, schedule 2, so impact 2. R3: probability 2, cost impact 5 (12.5%), schedule 4 (8 weeks, in the high band), so impact 5.

Step 2: compute scores. R1: 2 x 4 = 8. R2: 4 x 2 = 8. R3: 2 x 5 = 10.

Step 3: consider other attributes. R2 has high dormancy and low detectability: it will not show until month 9, when it is expensive. This raises its urgency; a test with a scanner sample now is cheap. R3 has a longer horizon but a large impact, so a response plan should be prepared. R1 is probable at certain moments, such as after a bonus cycle.

Step 4: rank. By score: R3, then R1 and R2 tied. With urgency and detectability, R2 is moved up, so the order of attention is R3 (plan the response, since the impact is large), R2 (act now: a cheap early test), R1 (mitigate with knowledge sharing).

Why not rank only by score? A number hides attributes such as proximity and detectability. A low-score risk that can be eliminated now for little money should be handled before it becomes expensive.

5. Quantitative risk analysis

Quantitative analysis provides numerical estimates of the combined effect of risks on objectives. It is used for large or complex projects, where data exists, and where the decision justifies the effort. It is not always needed.

Expected monetary value (EMV)

EMV = probability x impact (in money). Threats are negative, opportunities positive. EMV of several independent risks can be summed to estimate the reserve.

Example: a 25% chance of a 80,000 rework has EMV = 0.25 x (-80,000) = -20,000. A 40% chance of a 30,000 saving has EMV = +12,000.

Decision tree analysis

A decision tree compares choices with uncertain outcomes by calculating the EMV of each branch.

Worked example. A project must choose between building a component internally or buying one.

• Build: cost 120,000. A 30% chance that complexity causes a 50,000 overrun; 70% no overrun.
• Buy: cost 150,000. A 10% chance that the integration costs an extra 20,000.

EMV (cost) of build = 120,000 + 0.30 x 50,000 = 135,000. EMV of buy = 150,000 + 0.10 x 20,000 = 152,000.

Decision: on expected cost, build is cheaper by 17,000. But also consider other factors: the schedule, the risk appetite (the worst case for build is 170,000 against 170,000 for buy), the loss of in-house capacity, and the quality of data used. A risk-averse sponsor might still choose buy to get certainty on schedule. The EMV supports the decision; it does not make it alone.

Why the other options are weaker: choosing the option with the lowest base price (build) without calculating the risk-adjusted value hides the trade-off, and choosing buy only because the worst cases match ignores the probability.

Sensitivity analysis and the tornado diagram

Sensitivity analysis shows which uncertain inputs have the greatest effect on a result. A tornado diagram ranks them by influence: bars are ordered from the largest to the smallest effect. It tells you where to concentrate the response effort.

Simulation (Monte Carlo)

A model of the project (cost or schedule) is run thousands of times with values drawn from probability distributions for each uncertain element. The output is a distribution of outcomes, for example a cumulative probability curve. It answers questions such as: "What is the probability of finishing before 30 September?" or "How much contingency gives 80% confidence?". Quality of inputs is essential; wrong inputs give a precise but false answer.

Contingency reserve

The results are used to set the contingency reserve for identified risks, held in the cost baseline, and to decide the buffers in the schedule. Management reserve is separate: it covers unidentified risks and is outside the baseline, released through change control.

6. Common pitfalls and exam tips

Common pitfalls

• Treating the risk register as a one-time deliverable.
• Writing risks without a cause and effect, so no response can be designed.
• Listing issues (already happened) as risks.
• Using only quantitative analysis when data are poor, or never using it when the stakes are high.
• Ignoring opportunities.
• Failing to name an owner for each risk.
• Mixing contingency and management reserves.
• Giving false precision to guessed probabilities.

Exam tips

• Exam tip: The risk management plan comes first, and it is tailored; the register is built from identification.
• Exam tip: Qualitative analysis comes before quantitative analysis, and quantitative analysis is applied to the highest-priority risks.
• Exam tip: Positive risks (opportunities) are part of risk management.
• Exam tip: Expected monetary value multiplies probability by impact; for decision trees, choose the branch with the best EMV unless the scenario says otherwise.
• Exam tip: When the team cannot agree because of dominant voices, use the Delphi technique or anonymous input.
• Exam tip: In agile projects, risk-driven prioritization means placing risky and valuable items early in the backlog.

Mini case study

Case. You lead a project to migrate a hospital's patient scheduling system to a cloud platform, with a budget of 1,500,000 and 10 months. The steering committee has a low risk appetite for patient data exposure and a moderate one for schedule. The initial workshop produced a list: "security", "the vendor", "people may resist", "cost", and "weather". The team of 12 has never used the new platform. The migration weekend must not exceed 8 hours of downtime. You also learn that a 30% chance exists that the cloud vendor's regional data centre certification will not be renewed on time, which would require a 90,000 move to another region and 3 weeks of delay.

Question. How should you structure risk management for this project?

Solution (commented).

1. Plan: draft a risk management plan with the sponsor: roles, a monthly review plus a review at each phase gate, categories (security, technical, organizational, external, compliance), scales, and the thresholds that reflect the low appetite for data exposure (a high impact for any exposure of patient data). Define the contingency reserve policy.
2. Identify properly: rewrite the vague list into cause, event, effect statements, for example "Because the team has no experience with the platform's access policies, a misconfigured permission may expose patient records, leading to a breach, regulatory fines, and a stop of the migration". Use interviews with the clinical staff, a checklist from earlier migrations, an assumption analysis ("the weekend window is enough"), and prompt lists for security and compliance. Remove "weather" unless a link with the project exists.
3. Record in the register with owners, triggers (failed access audit, certification renewal notice not received by month 4), and categories.
4. Qualitative analysis: score probability and impact, add urgency and proximity. The data exposure risk has a moderate probability but an extreme impact for this sponsor, so it ranks first. The weekend downtime risk has high impact too.
5. Quantitative analysis: the certification risk has EMV = 0.30 x 90,000 = 27,000 plus 3 weeks of schedule effect. Add it to the contingency reserve calculation. A simulation of the schedule may be justified for the migration weekend, given its importance.
6. Plan the next steps: assign owners, prepare responses (covered in the next lesson), and schedule reviews.
7. Do not limit the register to the word "security", skip the plan, or compute exact probabilities from unsupported guesses.

Key terms

• Risk: an uncertain event or condition that may affect objectives.
• Risk management plan: the description of how risk management will be done.
• Risk register: the record of identified risks, analysis, owners, and responses.
• Risk breakdown structure: a hierarchy of risk sources.
• Probability and impact matrix: a grid used to rate and rank risks.
• Risk appetite, tolerance, threshold: the willingness, acceptable variation, and level of concern about uncertainty.
• Trigger: a warning sign that a risk may occur.
• Expected monetary value (EMV): probability multiplied by monetary impact.
• Decision tree: a diagram comparing options with uncertain outcomes.
• Monte Carlo simulation: repeated modelling to produce a distribution of outcomes.
• Contingency reserve: budget or time for identified risks.
• Management reserve: budget for unidentified risks, released through change control.

Summary checklist

• I tailor a risk management plan with roles, scales, thresholds, and review rhythm.
• I use several techniques to identify risks and opportunities, including security and sustainability.
• I write risks as cause, event, and effect, and keep a living register with owners and triggers.
• I score risks with a matrix and consider urgency, proximity, and detectability.
• I use quantitative methods (EMV, decision trees, sensitivity, simulation) when the data and stakes justify them.
• I distinguish contingency and management reserves.
• I include opportunities as well as threats.
• I adapt the approach in agile and hybrid projects.

Official sources

• PMI, PMP Examination Content Outline (July 2026): https://www.pmi.org/-/media/pmi/documents/public/pdf/certifications/new-pmp-examination-content-outline-2026.pdf (opens in a new tab)
• PMI, About the new PMP exam: https://www.pmi.org/certifications/project-management-pmp/new-exam (opens in a new tab)
• PMI, Project Management Professional (PMP): https://www.pmi.org/certifications/project-management-pmp (opens in a new tab)
• PMI, Standards: https://www.pmi.org/standards (opens in a new tab)