Bootstrap Risk Assessment & Management 5 — Questions and Answers
Question 1: A project's risk breakdown structure (RBS) is most useful for:
- Calculating the total budget for risk responses
- Organizing and categorizing identified risks by source or type (Correct answer)
- Assigning risk owners across the team
- Scheduling when risk reviews should occur
Correct answer: Organizing and categorizing identified risks by source or type
The RBS is a hierarchical framework that groups risks by category (technical, organizational, external, etc.) to ensure comprehensive coverage during identification.
Question 2: In a sensitivity analysis (tornado diagram), the risk variable at the top of the diagram indicates:
- The risk with the highest probability
- The risk with the greatest potential impact on the project objective (Correct answer)
- The first risk to be addressed in the risk register
- The risk with the highest EMV
Correct answer: The risk with the greatest potential impact on the project objective
The tornado diagram sorts variables by their range of impact; the widest bar (top) represents the risk factor with the greatest influence on project outcome.
Question 3: Which scenario best illustrates a 'risk appetite' rather than a 'risk tolerance'?
- Accepting up to $10,000 in cost overruns before escalating
- The organization's strategic preference for pursuing high-reward, high-risk ventures (Correct answer)
- Documenting risks with a probability below 10% on the watchlist only
- Setting a 15% schedule buffer for all projects
Correct answer: The organization's strategic preference for pursuing high-reward, high-risk ventures
Risk appetite is a broad strategic posture toward risk-taking, while risk tolerance defines the specific thresholds of acceptable variation.
Question 4: When two risks have a correlation — meaning one risk occurring increases the likelihood of another — this is called:
- Risk aggregation
- Risk dependency (Correct answer)
- Compound risk
- Tail risk
Correct answer: Risk dependency
Risk dependency (or correlated risks) means the realization of one risk changes the probability or impact profile of another, requiring them to be assessed together.
Question 5: Under ISO 31000, the risk management process begins with which step?
- Risk identification
- Establishing the context (Correct answer)
- Risk evaluation
- Risk treatment
Correct answer: Establishing the context
ISO 31000 mandates establishing the internal and external context (scope, objectives, stakeholders) before any risk identification or analysis begins.
Question 6: A project manager notices a previously low-priority risk has spiked in probability due to a new supplier issue. The correct action is to:
- Leave it on the watchlist until the next scheduled review
- Escalate immediately to the risk owner and re-analyze it (Correct answer)
- Close the risk and open a new issue
- Transfer the risk to the supplier via a contract amendment
Correct answer: Escalate immediately to the risk owner and re-analyze it
A change in risk profile warrants immediate re-analysis and escalation to the risk owner so that updated responses can be planned before impact occurs.
Question 7: Which approach does 'active risk acceptance' require compared to 'passive risk acceptance'?
- Immediately transferring the risk to a third party
- Developing a contingency plan in advance while still accepting the risk (Correct answer)
- Reducing probability through preventive measures
- Removing the risk source from the project plan
Correct answer: Developing a contingency plan in advance while still accepting the risk
Active acceptance acknowledges the risk but prepares a contingency plan ready to execute if the risk materializes, unlike passive acceptance which has no pre-planned response.
Bootstrap Risk Assessment & Management 5
A project's risk breakdown structure (RBS) is most useful for: