Risk questions trip up even well-prepared candidates because there's rarely one "textbook" answer. Here's a repeatable framework for choosing the response PMI actually wants.
Why Risk Questions Feel Harder Than They Should
Risk management questions on the PMP exam rarely ask you to define a term. Instead, they drop you into a scenario — a vendor is late, a technical assumption just failed, a stakeholder raised a new concern — and ask what you should do next. The trap is that two or three of the answer choices usually sound reasonable. PMI is testing whether you know which risk response strategy fits the situation, not just whether you've memorized the five strategy names.
The Five PMI Risk Response Strategies
- Avoid — change the plan so the risk can no longer occur at all (e.g. remove a risky deliverable from scope).
- Mitigate — reduce the probability or impact of the risk, without eliminating it entirely.
- Transfer — shift the financial impact to a third party (insurance, warranties, fixed-price contracts).
- Accept — acknowledge the risk and do nothing proactive, usually because the cost of a response exceeds the risk's impact. Can be active (setting aside contingency reserve) or passive (no action at all).
- Escalate — hand the risk to someone outside the project (e.g. a program or portfolio level) because it's beyond the project manager's authority to manage.
If a risk is outside your authority to control, "escalate" is almost always the better answer than trying to manage it yourself — PMI penalizes project managers who overreach their authority just as much as those who under-react.
A 3-Step Framework for Scenario Questions
When a risk scenario appears, work through these in order:
- Is this a known risk or a new one? If it's already in the risk register, check what response was planned — the answer may simply be "execute the existing response plan," not invent a new one.
- Is it within your authority? If resolving it requires budget, scope, or organizational authority you don't have as the PM, escalate — don't quietly try to absorb it.
- What's the proportional response? Match the strategy's cost and effort to the risk's actual impact. A high-probability, high-impact risk usually calls for mitigate or avoid; a low-impact risk is often best accepted.
Don't Forget Secondary and Residual Risk
A response to one risk can create a new one. If you transfer a risk via a fixed-price contract, you introduce a new risk: vendor quality or delivery risk. These are called secondary risks. Whatever risk remains after a response has been applied is a residual risk — both should be logged and monitored, not ignored just because you "handled" the original risk.