Free Practice Questions for PMI PMI-RMP Exam

The project manager should apply an iterative approach to risk identification, which involves continuous risk identification throughout the project lifecycle. This will help to identify and address new risks that may arise during the project.

According to the PMBOK® Guide, risk identification is the process of determining which risks may affect the project and documenting their characteristics. It is an iterative process because new risks may evolve or become known only as the project progresses through its life cycle. There are many techniques available for risk identification and assessment, such as brainstorming, interviews, checklists, SWOT analysis, cause and effect diagrams, etc. The project manager should apply an iterative approach to risk identification to ensure that all relevant risks are captured and updated throughout the project. The project manager should also involve the project team and other stakeholders in the risk identification process to obtain their input and perspectives.

The other options are not valid for the next step after explaining the importance of risk management to the team:

Review assumptions and constraints around risks: This is a technique for risk identification, but it is not the only one. The project manager should use a combination of techniques to identify risks, not just focus on one aspect. Also, reviewing assumptions and constraints is not the same as applying an iterative approach, which implies repeating the risk identification process at regular intervals or when changes occur.

Develop the risk response plans for identified risks: This is a step in the Plan Risk Responses process, which comes after the Perform Qualitative Risk Analysis and Perform Quantitative Risk Analysis processes. The project manager should not develop the risk response plans before identifying and analyzing the risks.

Determine the likelihood and impact of the risks: This is a step in the Perform Qualitative Risk Analysis process, which comes after the Identify Risks process. The project manager should not determine the likelihood and impact of the risks before identifying them.

PMBOK® Guide1, Risk Management Professional (PMI-RMP)® Cert Guide

Contingency plans are predefined actions that the project team will take if an identified risk event occurs. They are designed to reduce the impact or probability of the risk, or to restore the project to its original objectives. Contingency plans are part of the risk response planning process, and they should be documented in the risk register. In this case, the risk manager should execute the contingency plans to deal with the delays caused by the weather, as they cannot be avoided or mitigated. Performing time recovery actions, executing prevention plans, or performing change management are not appropriate responses for this risk, as they are either reactive, proactive, or corrective measures that do not address the risk directly. References: = PMBOK Guide, 6th edition, page 443; The Standard for Risk Management in Portfolios, Programs, and Projects, page 75.

Lessons learned from previous projects are critical for effective risk identification because they provide insights into what risks materialized, how they were managed, and what could have been improved. According to the PMBOK® Guide:

“Lessons learned from previous projects are organizational process assets that should be reviewed during risk identification to avoid repeating past mistakes and to leverage successful risk responses.”

— PMBOK® Guide, 6th Edition, Section 11.2.2.1 (Organizational Process Assets)

These assets enable proactive identification and management of similar risks in the new project.

Including both internal and external stakeholders ensures diverse perspectives and comprehensive risk identification. PMBOK® Guide states:

" Stakeholder participation, including both internal and external stakeholders, is essential during risk identification to ensure a broad and complete identification of risks. "

— PMBOK® Guide, 6th Edition, Section 11.2

The risk manager should establish and communicate common risk thresholds, definitions, scoring criteria, and escalation rules.

Risk terms such as “critical,” “high,” “moderate,” “low,” and “acceptable” must have consistent meanings across the project. Without agreed definitions, stakeholders may interpret the same risk differently, leading to inconsistent prioritization, ineffective escalation, delayed decisions, and confusion in risk reporting.

Common risk definitions should be documented in the risk management plan or equivalent governance documentation. They may include:

• Defined probability ranges.

• Cost-impact thresholds.

• Schedule-impact thresholds.

• Quality, safety, security, compliance, and reputational criteria.

• Probability-and-impact scoring rules.

• Overall risk-rating categories.

• Risk appetite and risk threshold information.

• Escalation criteria.

• Required response time frames.

• Authority levels for accepting risks.

Option A is incorrect because allowing every department to use its own interpretation would continue the inconsistency. Departments may provide specialized information, but consolidated project reporting requires common criteria.

Option B is incorrect because a risk should not be converted into an issue merely because stakeholders disagree about its rating. A risk is an uncertain event or condition, while an issue is a condition or event that has already occurred.

Option C is correct because common thresholds and definitions create a shared risk language and align stakeholder understanding.

Option D is incorrect because increasing the frequency or detail of reports does not resolve inconsistent risk definitions. More information based on unclear criteria may create additional confusion.

The risk manager should advise the project manager to hire additional developers as soon as project metrics indicate that the risk of delay is materializing. This approach ensures that the response is timely and directly tied to the project’s actual performance, allowing for better resource management and minimizing unnecessary costs. This aligns with PMI ' s risk management principles, which advocate for the timely execution of risk responses based on objective data and metrics​.

The probability-impact matrix is a standard tool for qualitative risk analysis, as recommended by PMI:

" A probability and impact matrix is used to prioritize identified risks for further analysis or action by combining their probability of occurrence and impact on project objectives. "

— PMBOK® Guide, 6th Edition, Section 11.3

This ensures the most critical risks are prioritized for response planning.

 The risk matrix heat map is a graphical tool that displays the probability and impact of risks in a project. The horizontal axis represents the probability of occurrence, and the vertical axis represents the impact rating. The colors indicate the level of risk exposure, from green (low) to red (high). The risk in question is located in the upper right quadrant of the matrix, which means it has a high impact rating. The probability of occurrence can be estimated by looking at the scale on the horizontal axis. The risk is slightly to the left of the 50% mark, which means it has a probability of occurrence of about 40%. Therefore, the correct statement that describes the risk is B. The risk has a probability of 40% of occurrence and a high impact rating. References: PMI, The Standard for Risk Management in Portfolios, Programs, and Projects, 2019, p. 104-105.

The correct answer is D. Update the project stakeholders and seek their input on the resulting secondary risk.

This question describes a secondary risk , which is a new risk that arises as a direct result of implementing a risk response. The original equipment-failure risk was successfully mitigated, but the use of alternative machinery introduced another issue. In standard risk management practice, once a secondary risk is identified, it must be documented, assessed, communicated, and managed through the normal risk process. Because this new risk can affect project objectives and may require additional response planning, relevant stakeholders should be informed and involved in determining the best course of action.

Option D is the best answer because secondary risks should not be ignored or delayed unnecessarily. Stakeholder input is important to evaluate the impact of the new issue, determine acceptable response options, and align decisions with project priorities and risk thresholds.

Why the other options are incorrect:

A. Assign a risk owner and develop the risk mitigations at the next scheduled risk meeting. Assigning an owner and planning mitigation are valid activities, but waiting until the next scheduled meeting may delay needed action. The question asks what the risk manager should do now after identifying the secondary risk. Immediate stakeholder communication is more appropriate.

B. Continue with the project as the risk identified is inconsequential. The scenario does not support the conclusion that the secondary risk is insignificant. Assuming it is inconsequential without analysis would be poor risk practice.

C. Assign risk responsibility to the project manager to determine how to proceed. Risk responsibility should be assigned to the most appropriate owner, not automatically to the project manager. Also, the correct first step is broader communication and engagement around the newly emerged secondary risk.

Best-practice reasoning:

Secondary risks are a recognized output of risk response actions. They should be captured and processed like any other identified risk. Transparent stakeholder communication is especially important when a response action creates new uncertainty.

Reference-aligned basis:

This answer is consistent with standard risk management guidance that emphasizes:

risk responses can generate secondary risks,

newly identified risks should be communicated and assessed,

stakeholders should be engaged when new risks emerge from implemented responses.

Identifying and analyzing assumptions is crucial in risk management because assumptions often hide potential risks. PMBOK® Guide states:

" During risk identification, it is important to identify and document assumptions and assess their validity... Assumptions may prove to be incorrect, resulting in project risk. "

— PMBOK® Guide, 6th Edition, Section 11.2

This proactive analysis helps uncover hidden risks and plan for contingencies.