PMP Risk Management Questions: Responses, EMV, Agile Risk, and 3 Practice Scenarios

Risk management is one of the highest-yield study areas on the 2026 PMP exam. Its tasks sit in the Process domain (41% of the exam), but risk thinking bleeds into People and Business Environment questions too — and into the case section that opens the exam. Master a small toolkit — the register, the response strategies, expected monetary value, and agile practices — and an outsized slice of the exam becomes routine.

The risk register: the exam's favorite artifact

Expect at least one question that hinges on knowing what the risk register is for: it records identified risks, their owners, qualitative ratings (probability and impact), planned responses, and status. Its neighbor, the issue log, is for things that have already happened — when a risk materializes, it becomes an issue, and the exam loves testing that transition. "The team has identified a potential problem" is risk territory; "the problem occurred yesterday" means you are managing an issue and executing the planned response.

The five threat responses (plus opportunities)

For threats, know five strategies and — more importantly — how to recognize each in a story:

• Avoid — change the plan so the threat cannot occur (drop the risky feature, use a proven technology instead).
• Transfer — shift the impact to a third party (insurance, warranties, fixed-price contracts). The risk still exists; someone else pays.
• Mitigate — reduce probability or impact (prototyping, extra testing, adding a second supplier).
• Accept — take no proactive action (passive) or set aside a contingency reserve (active).
• Escalate — the threat is outside the project's scope or authority; hand it to the program, portfolio, or organizational level, with the PM tracking it.

Opportunities mirror these: exploit, share, enhance, accept, escalate. Identification questions ("which strategy is this?") are among the fastest points on the exam if you have drilled the verbs.

EMV: the one risk formula you must own

Expected monetary value = probability × impact. Threats carry negative impacts, opportunities positive; sum the EMVs of branches to value a decision path. A risk with a 25% probability of costing $60,000 has an EMV of –$15,000. Exam items usually ask you to compare total exposure before and after a proposed response — exactly the structure of Scenario 2 below. For the other quantitative topics, see our EVM formulas guide.

Risk in agile and hybrid contexts

With the exam roughly 60% agile and hybrid, expect risk questions without a formal register in sight:

• Spikes — timeboxed experiments to burn down technical uncertainty
• Backlog ordering — pulling risky work earlier so it fails fast and cheap
• Short iterations and reviews — frequent feedback as a built-in risk control
• Risk burndown charts — visualizing exposure shrinking (or not) over iterations

The tell in agile risk questions: the credited answer usually uses the process (order the backlog, run a spike, raise it at the review) rather than adding predictive ceremony. More on this split in agile vs. predictive on the 2026 exam.

Scenario 1: name the response

A project depends on a single supplier for a custom component. The team is concerned the supplier's financial instability could delay delivery, so the project manager qualifies a second supplier who can provide the component at short notice, at a modest additional cost. Which risk response strategy is this?

A. Avoid B. Transfer C. Mitigate D. Accept

Correct answer: C.

• A would eliminate the threat entirely — for example, redesigning the product so the custom component is not needed. The threat still exists here.
• B would move the impact to a third party, such as penalty clauses or insurance. Qualifying a backup does not shift ownership of the consequence.
• C fits: the second supplier reduces the impact of the primary supplier failing. Reducing probability or impact at some cost is the definition of mitigation.
• D would mean taking no proactive action or merely reserving contingency; the team acted proactively.

Scenario 2: do the EMV math

A risk has a 30% probability of causing a $40,000 loss. A proposed response costing $3,000 would reduce the probability to 10%. Based on expected monetary value, what is the net change in the project's total risk cost if the response is implemented?

A. Total exposure increases by $3,000 B. Total exposure decreases by $8,000 C. Total exposure decreases by $5,000 D. Total exposure decreases by $12,000

Correct answer: C.

Work it in three steps. Before: EMV = 0.30 × $40,000 = $12,000. After: residual EMV = 0.10 × $40,000 = $4,000, plus the $3,000 response cost = $7,000 total. Net change: $12,000 − $7,000 = $5,000 decrease.

• A counts only the money spent on the response and ignores the EMV reduction it buys.
• B captures the EMV reduction ($12,000 − $4,000) but forgets to subtract the $3,000 the response costs.
• C compares total cost before against total cost after (residual EMV plus response cost) — the full, correct comparison.
• D assumes the threat is completely eliminated at zero cost; mitigation leaves residual risk and is never free.

Scenario 3: beyond the project's authority

During risk identification, the team determines that a pending corporate decision to consolidate data centers could invalidate the project's deployment architecture. The decision is being made at the portfolio level. What should the project manager do?

A. Add contingency reserve to cover a possible redesign. B. Escalate the risk to the portfolio level and record it in the risk register with the PM monitoring it. C. Pause architecture work until the corporate decision is announced. D. Mitigate the risk by designing an architecture that works in both scenarios.

Correct answer: B.

• A treats a strategic threat as a project-level budget problem; reserves cannot manage a decision the project does not own.
• B is textbook escalation: the threat's cause and resolution sit above the project, so ownership moves up while the project tracks it.
• C is unilateral withdrawal that could burn schedule indefinitely over a decision with no announced date.
• D sounds prudent but may double architecture cost for a risk that sits squarely outside project authority.

Turn misses into mastery

Risk items are pattern-dense, which makes them ideal for spaced repetition. ExamElephant's retest engine resurfaces every risk question you miss at 3 days and again at 7 days until you have mastered it. Start with the free 75-question tier; paid passes for the full domain-tagged bank are coming soon (join the waitlist). Risk consistently ranks among the trickier areas in our hardest topics analysis.

FAQ