Skip to content
Baseline BinderGet the app

Pocket binder

PMP practice questions on iPhone and Android.

Get the appPractice free on this site
2.3.3

Domain 3 of 3 · Business Environment · task

Risks, issues and impediments on the PMP® exam

Risk management for the PMP turns on tense: a risk might happen, an issue already has. Recognizing the moment one becomes the other is written into the exam outline itself, and most of this topic follows from getting that moment right.

Exam
PMP
Domain
Business Env.
Domain weight
26%
Packages
17
Updated
Oct 13, 2026

01The tense test

Take an outdoor product launch planned for June. Rain in the long-range forecast is a risk: it sits in the risk register with a probability, an impact, an owner and a planned response, perhaps a tent on hold. Rain on launch morning is no longer a risk. The planned response runs, and the register records that the risk occurred.

If it rains and nobody planned for it, the problem goes to the issue log with an owner and a target date, and the team works around it. A workaround is improvised by definition, so the register deserves a second look too: something was missed when risks were identified.

Impediments are the agile relatives of issues, anything that slows the team down. The servant leader removes them, or finds the person who can.

Two Business Environment tasks sit here, one on removing impediments and managing issues and one on planning and managing risk. Our even split of PMI®'s 26% domain weight (as of October 2026) puts them near 6.5% of the exam.

02Where it gets recorded, and who moves

Risk register, issue log and impediments compared

SituationWhere it goesWho acts first
A threat that may happenRisk register, with probability, impact and a responseThe risk owner
An opportunity that may happenRisk register as well; responses aim to make it more likelyThe risk owner
A planned-for risk occursRisk register updated while the planned response runsThe risk owner
An unplanned problem appearsIssue log, with an owner and a target dateThe project manager, who assigns it
Something blocks the teamThe impediment list or boardThe servant leader or scrum master
Any of these goes past your authorityEscalated along the governance pathThe forum the threshold names

03When a risk turns into an issue

  1. Confirm it has occurred

    Compare the trigger written in the register with what is actually happening.

  2. Run the planned response

    The risk owner carries it out. Contingency reserve set aside for that risk can be drawn, as explained under budget, reserves and earned value.

  3. Log what is new

    Effects the response did not cover become issues with owners. Responses can also create secondary risks, which get entries of their own.

  4. Report the status

    Risk and issue status reach stakeholders on the cadence the communication plan sets.

04Sort the risks from the issues

Registers, triggers, escalations and one funding decision with a risk table: the set covers both tasks in this topic.

Work packages 17

  1. WP 01In a matrix organization an impediment owner lacks authority to resolve the issue. What protocol should be followed to reassign ownership?

    Debrief answer to open the notes

    1. ARemoving the item from the log loses the record, and escalating without reassigning still leaves no capable owner.
    2. BNoting the lack of authority documents the problem but leaves the impediment stuck.
    3. CCorrect: ownership moves to the role that can actually resolve it, and preserving the history keeps accountability traceable.
    4. DTeam ownership diffuses accountability, so no one is clearly responsible for resolution.
  2. WP 02Risk register shows two quality risks with regulatory clauses. Identify which require immediate governance escalation.

    Debrief answer to open the notes

    1. AHandling everything internally ignores the compliance thresholds that require governance involvement.
    2. BLimiting escalation to schedule risks overlooks quality risks with regulatory consequences.
    3. CEscalating every quality risk floods governance and blurs which risks truly need its attention.
    4. DCorrect: escalation follows the defined threshold, so the risk that breaches the compliance limit with high probability goes to governance now.
  3. WP 03The buyer elects to accept residual regulatory risk on a cloud contract. What documentation and monitoring are required?

    Debrief answer to open the notes

    1. ASupplier self-certification documents the supplier's view, not the buyer's decision to accept the risk.
    2. BCorrect: accepting a residual risk needs documented approval from those with authority, plus ongoing reviews in case the risk changes.
    3. CA one-time register update with no follow-up leaves an accepted risk unmonitored.
    4. DAn annual report without leadership endorsement provides neither authorization nor timely monitoring.
  4. WP 04Open issues are rising and threaten SLA compliance across modules. Which sequence forms the most effective 7-day stabilization plan?

    Debrief answer to open the notes

    1. APublishing a plan before triage means it is not based on what actually matters most.
    2. BCorrect: triage by severity comes first, then SLA breaches are escalated, and a short stabilization plan targets the most critical issues.
    3. CEscalating every issue before triage overwhelms the steering committee with items the team could handle.
    4. DWaiting until all items close before communicating leaves stakeholders uninformed while SLAs are at risk.
  5. WP 05A stakeholder-driven scope change is approved. Which response introduces unacceptable secondary risks requiring escalation?

    Debrief answer to open the notes

    1. AAccepting the risk with updated logs is a recognized response and does not introduce new hazards.
    2. BTrading scope elsewhere through formal change control is a governed response and stays within policy.
    3. CTransferring testing to a qualified vendor under updated terms shifts the risk without lowering quality controls.
    4. DCorrect: skipping peer review to save time creates a new quality risk, a secondary risk serious enough to escalate.
  6. WP 06During QA a safety risk is discovered that could cause imminent harm to users. The issue exceeds normal escalation thresholds. What is the most appropriate action?

    Debrief answer to open the notes

    1. ACorrect: imminent harm to users exceeds normal thresholds, so the risk goes straight to the sponsor and is documented without delay.
    2. BWithholding a safety risk from the sponsor violates transparency and leaves the decision-maker uninformed.
    3. CLocal containment is reasonable for routine issues, but imminent harm beyond threshold calls for immediate escalation.
    4. DWaiting for a scheduled review leaves users exposed to a known hazard.
  7. WP 07Julia is a project manager for a construction project and is managing risks concerning site safety. She implements mitigation strategies after identifying safety issues and various outcomes arise. The project director asks Julia for details on the current safety risks. What is Julia's best course of action?

    Debrief answer to open the notes

    1. AWaiting until the end of the project withholds current risk information from someone who needs it now.
    2. BSaying the measures are sufficient without updated data is an assurance, not a status report.
    3. CRedirecting the director to someone else avoids the project manager's own responsibility for risk reporting.
    4. DCorrect: the risk register and report reflect the current state after responses, so the project manager updates them and then reports.
  8. WP 08You manage a complex project with limited resources. Multiple blockers occur simultaneously across different streams. Which action should you take FIRST to resolve these impediments?

    Debrief answer to open the notes

    1. AClearing easy items first builds momentum but can leave the most damaging blocker in place.
    2. BSeniority of the requester does not determine business impact.
    3. CCorrect: blockers on the critical path delay delivery directly, so removing them first protects the most value.
    4. DVoting on impact to daily work does not reflect impact on delivery or the critical path.
  9. WP 09A high-probability, high-impact adoption risk has been identified in a regulated environment. Which response strategy best balances mitigation with compliance requirements?

    Debrief answer to open the notes

    1. AAn internal adoption risk cannot be handed to a vendor, since the organization still owns the adoption outcome.
    2. BTraining alone is too narrow for a high-probability, high-impact risk in a regulated setting.
    3. CAccepting a high-probability, high-impact risk and checking it quarterly leaves the exposure unmanaged.
    4. DCorrect: a named owner, clear triggers, and links to change control make the risk actively managed and leave a compliance trail.
  10. WP 10A risk trigger states "vendor may miss delivery." Rewrite it into an observable, measurable trigger that enables lead-indicator monitoring.

    Debrief answer to open the notes

    1. ACorrect: it sets an observable threshold, a deadline, an owner, and a response time, turning a vague concern into a leading indicator.
    2. BWaiting for the vendor to report delays makes the trigger lagging and leaves the response undefined.
    3. C"Appears to be declining" is subjective and gives no threshold to act on.
    4. DA monthly percentage is measurable but has no threshold or action, so it monitors rather than triggers.
  11. WP 11Impediment log data shows recurring patterns. What end-to-end design best translates analytics into continuous improvement?

    Debrief answer to open the notes

    1. ACorrect: KPIs make the patterns visible, the dashboard keeps them in view, and corrective actions in the backlog turn insight into improvement.
    2. BDeleting old entries discards the trend data needed to find root causes.
    3. CData without owners or follow-up never becomes action.
    4. DKeeping the data private and out of the backlog means improvements are never planned or done.
  12. WP 12A new risk requires a threshold matrix entry. Which elements must be included?

    Debrief answer to open the notes

    1. ACorrect: a threshold entry must say what fires it, who owns it, who is told, how fast to respond, and what the impact and options are.
    2. BA description and reserve amount omit the trigger and owner, so no one knows when to act or who acts.
    3. CTrigger and probability alone lack an owner, response time, and recipients.
    4. DAn owner and budget estimate leave out the trigger that tells anyone when to act.
  13. WP 13A vendor informs the project manager that a critical hardware delivery will be delayed by three months. The project manager has exhausted all local mitigation strategies and must escalate the issue. How should the project manager approach the project sponsor?

    Debrief answer to open the notes

    1. AAsking the sponsor to call the vendor delegates upward instead of presenting a decision to make.
    2. BCorrect: escalation should bring the impact, the options already analyzed, and a recommendation, so the sponsor can decide quickly.
    3. CPausing the project is a major decision the project manager cannot simply announce.
    4. DBrainstorming with the sponsor shows the analysis was not done before escalating.
  14. WP 14A critical supplier reports a parts delay that will miss a milestone in 48 hours. The team has attempted local workarounds without success. What immediate sequence balances rapid remediation with governance?

    Debrief answer to open the notes

    1. ACorrect: recording what was tried and escalating to procurement and the PMO with evidence moves the issue quickly through the right channels.
    2. BGoing straight to the sponsor bypasses procurement and the PMO, who are better placed to act first.
    3. CContract termination is a drastic remedy for one delay and is not the immediate next step.
    4. DWaiting for the next meeting with 48 hours left guarantees the milestone is missed.
  15. WP 15A Monte Carlo schedule simulation shows two high-impact risks with a documented correlation of 0.65. The team reruns the model assuming independence. What is the most accurate effect on the reported P90 finish date?

    Debrief answer to open the notes

    1. AIgnoring a positive correlation narrows the spread, so the P90 moves earlier, not later.
    2. BCorrect: positively correlated risks tend to occur together and widen the tail; assuming independence understates that tail, so P90 looks earlier than it should.
    3. CCorrelation affects the whole distribution, and its effect is often largest in the tails such as P90.
    4. DCorrelation changes how risks combine, so ignoring it does change the reported percentiles.
  16. WP 16Multiple constraints block a sprint. How should impediment actions be prioritized?

    Debrief answer to open the notes

    1. ACorrect: triage by impact and urgency so the most damaging blockers go first, resolve what the team can, and escalate only items that need governance authority.
    2. BDeferring items beyond the team's control lets external blockers keep stalling the sprint.
    3. CEscalating everything first overloads management and abandons team-level problem solving.
    4. DDumping blockers into the backlog without review treats impediments like features and delays their removal.
  17. WP 17Given the risk register, which responses should be funded under a $180k budget limit?

    Exhibit for WP 17

    RiskProbabilityImpactResponse CostEMV
    Poor code quality0.4$400k$90k$160k
    Supplier delay0.3$300k$120k$90k
    Scope creep0.25$200k$40k$50k

    Debrief answer to open the notes

    1. ACorrect: fund responses that cost less than their EMV: code quality ($90k vs $160k) and scope creep ($40k vs $50k), $130k total within $180k.
    2. BSupplier delay costs $120k to address a $90k EMV, so its response costs more than the risk.
    3. CCode quality alone leaves scope creep untreated even though its $40k response is below its $50k EMV and still fits.
    4. DSupplier delay's $120k response exceeds its $90k EMV, and $210k exceeds the $180k limit.

Open a row to answer. Keys: 1–4 or A–D answer, N opens the next row.

05Keeping the register alive

Threat responses are avoid, transfer, mitigate and accept; opportunity responses are exploit, share, enhance and accept; escalate applies to either when the risk belongs above the project. Choosing between them is the subject of risk response strategies.

To rank risks in money, multiply probability by impact: a 15% chance of an $80,000 penalty carries an expected monetary value of minus $12,000. How that number feeds decision trees and reserve sizing is on expected monetary value.

The 2026 outline names security and sustainability risks among those that need responses (PMI Examination Content Outline, paraphrased). When a risk closes or occurs, what the team learned belongs in the organization's process assets, which is the work of continuous improvement and organizational change.